Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fixed a use-after-free in iscsitdecconnusagecount. In iscsitdecconnusagecount, the function calls complete while holding the conn-connusagelock. As soon as complete is invoked, the waiter such as...

Astra Linux – Vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.22.0, the sdlPointerNew function freed memory upon failure. However, the pointerfree function would call sdlPointerFree, which further freed the memory, leading to a Universal Address Forgery UAF vulnerability. Th...

Astra Linux – Vulnerability in Firefox and Thunderbird

Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: hwrng: core – Use RCU and workstruct to fix race conditions Currently, the hwrngfill function is not cleared until the hwrngfillfn thread exits. Since hwrngunregister reads hwrngfill outside of the rngmutex lock, a concurrent...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: sched/deadline: Only the freecpus field is set for online runqueues. Commit 16b269436b72 “sched/deadline: Modified cpudl::freecpus to reflect rd-online“” introduced the cpudlset/clearfreecpu functions, allowing the...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrumrouter: Fix neighbor use-after-free We sometimes encounter situations where a use-after-free occurs when dereferencing a neighbor pointer. The issue seems to arise because the driver stores a pointer to the neighbo...

Astra Linux – Vulnerability in grub2

A vulnerability related to operations after freeing memory has been discovered in GRUB’s gettext module. This flaw arises from a programming error where the gettext command remains registered in memory even after its associated module is unloaded. An attacker can exploit this condition by invokin...

Astra Linux – Vulnerability in xwayland, xorg-server

A flaw was discovered in the X.Org X server. This “use-after-free” vulnerability occurs in the XSYNC fence triggering logic, specifically within the miSyncTriggerFence function. An attacker with access to the X11 server can exploit this vulnerability without any user interaction, resulting in a...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: In the net: gro subsystem, do not merge the zcopy state. The skbgroreceive function currently copies fragments between the source skb and the GRO. This process does not check the zerocopy status, especially the SKBFLMANAGEDFRAGRE...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ksmbd: ipc: Fix for use-after-free in ipcmsgsendrequest The ipcmsgsendrequest function waits for a generic netlink reply using an ipcmsgtableentry on the stack. The generic netlink handler handlegenericevent/handleresponse fil...

Astra Linux – Vulnerability in Squid

Squid is a caching proxy for the Web. Prior to version 7.5, due to heap use-after-free issues, Squid was vulnerable to Denial of Service attacks when handling ICP traffic. This vulnerability allowed a remote attacker to carry out a reliable and repeatable Denial of Service attack on the Squid...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: AppArmor: Fixed a race condition related to the dereference of rawdata objects. There is a race condition that leads to a “use-after-free” situation: Since the rawdata inodes are not counted for their references, an attacker can...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: mptcp: fixed a race condition in mptcpschedulework syzbot reported a use-after-free in mptcpschedulework 1 The issue arises from mptcpschedulework scheduling a task, then checking the refcount of sk-skrefcnt if the task was...

Astra Linux – Vulnerability in Chromium

The use of “after free” in PDFs in Google Chrome before version 146.0.7680.178 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted PDF file. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Using “after free” in Dawn in Google Chrome before version 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: smb: client: fixed potential UAF and double-free errors in smb2openfile Set @erriov and @errbuftype to zero before retrying SMB2open, to prevent UAF bugs if @data != NULL; otherwise, a double-free error will occur...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, there was a heap use-after-free vulnerability in ImageMagick’s MSL decoder, which allowed attackers to access freed memory by creating an MSL file. This...

Astra Linux – Vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, xfSetWindowMinMaxInfo dereferenced a freed xfAppWindow pointer because xfrailgetwindow in xfrailserverminmaxinfo returned an unprotected pointer from the railWindows hash table. This could allow the main...

Astra Linux – Vulnerability in Firefox and Thunderbird

Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...

Astra Linux – Vulnerability in Firefox and Thunderbird

Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...