Astra Linux – Vulnerability in gst-plugins-good1.0

GStreamer is a library for constructing graphs of media-handling components. A OOB-read vulnerability has been identified in the gstavisubtitleparsegab2chunk function within gstavisubtitle.c. This function reads the namelength value directly from the input file without properly checking it. As a...

Astra Linux – Vulnerability in Git

Git is a fast, scalable, distributed revision control system with an unusually rich command set. It offers both high-level operations and full access to its internal workings. When reading a config value, Git removes any trailing carriage return and line feed CRLF characters. When writing a confi...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: spi: spi-mt65xx: Fixed NULL pointer access in the interrupt handler. The TX buffer in spitransfer can be a NULL pointer. As a result, the interrupt handler may write to invalid memory, causing crashes. Add a check for trans-txbuf...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nfsd: never defer requests during idmap lookup During the decoding of v4 request compound arguments, certain operations e.g., SETATTR can trigger idmap lookup upcalls. When the responses to these upcalls are delayed beyond the...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ocfs2: Added bounds checking to ocfs2checkdirentry. This adds sanity checks for ocfs2direntry to ensure that all members of ocfs2direntry do not go beyond the valid memory region...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: fs/ntfs3: Use variable length arrays instead of fixed-size ones. The issue with the “smatch warning” should be fixed: Error in ntfssetlabel: builtinmemcpy’s ‘uni-name’ is too small 20 vs 256...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Input: cyapa – add missing input core locking to suspend/resume functions. Lock the “grabinput” mutex during suspend/resume functions, just as it is done in other input drivers. This fixes the following warning during system...

Astra Linux – Vulnerability in node-minimatch

Minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and earlier are vulnerable to Regular Expression Denial of Service ReDoS when a glob pattern contains many consecutive wildcards followed by a literal character that does not...

Astra Linux – Vulnerability in gstreamer1.0, gst-plugins-good1.0

GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemuxparsetheoraextension within qtdemux.c. The vulnerability occurs due to an underflow of the gint size variable, which causes size to hold a large unintended...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-17 and 6.9.13-42, the NewXMLTree method contained a bug that could lead to a crash due to an out-of-write-bound situation involving a single zero byte. Versions 7.1.2-17 and...

Astra Linux – Vulnerability in cups

OpenPrinting CUPS is an open-source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a client that connected to cupsd but sent very slow messages—for example, only one byte per second—could delay cupsd as a whole, rendering it unusable for other clients...

Astra Linux – Vulnerability in Firefox

Memory safety bugs exist in Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151, and Thunderbird 151. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability...

Astra Linux – Vulnerability in Redis

Redis is an open-source, in-memory database that persists data on disk. When parsing an incoming Redis Standard Protocol RESP request, Redis allocates memory according to values specified by the user, which determine the number of elements in the multi-bulk header and the size of each element in...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: macb: properly unregistered fixed-rate clocks The additional resources allocated through clkregisterfixedrate need to be released using clkunregisterfixedrate, otherwise they will be lost...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: soc: ti: pm33xx: The refcount leak in am33xxpmprobe has been fixed. wkupm3ipcget takes a reference count, which should be released by wkupm3ipcput. Add the necessary refcount release in the error-prone paths...

Astra Linux – Vulnerability in Firefox

JIT compilation errors in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 151.0.3...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-5.10

In the Linux kernel, the following vulnerabilities have been resolved: crypto: safexcel – Cleanup of ring IRQ workqueues on load failure A failure to load the safexcel driver results in the following warning upon boot, because the IRQ affinity has not been properly cleaned up. Ensure that we...

Astra Linux – Vulnerability in Redis

Redis is an open-source, in-memory database that persists data on disk. The redis-cli command-line tool and the redis-sentinel service may be vulnerable to integer overflow when parsing specially crafted large multi-bulk network replies. This issue arises due to a vulnerability in the hiredis...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: SUNRPC: Fixed a suspicious RCU usage warning I received the following warning while running cthon on an Ontap server running pNFS: 57.202521 ============================= 57.202522 WARNING: Suspicious RCU usage 57.202523...

Astra Linux – Vulnerability in Ruby2.5, JRuby

A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby, up to 3.2.1. The Time parser improperly handles invalid URLs that contain specific characters. This causes an increase in execution time when parsing strings into Time objects. The fixed versions are 0.1.1 and 0.2.2...