Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: ISO: Fixed a issue where user input was not validated using setsockopt. The length of user input was checked before data was copied...

Astra Linux – Vulnerability in ffmpeg

A denial-of-service vulnerability exists in FFmpeg 4.2 due to a memory leak in the configinput function in the afacrossover.c file...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in the Input in Google Chrome before version 149.0.7827.103 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Golang-Google-GRPC

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have a vulnerability caused by improper input validation of the HTTP/2 :path pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the :path did not start with a leading slash...

Astra Linux – Vulnerability in binutils

There is a flaw in the bfdpefscanstartaddress function of bfd/pef.c in binutils, which could allow an attacker who can submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability. This flaw affects binutils...

Astra Linux – Vulnerability in imagemagick

In the functions CatromWeights, MeshInterpolate, InterpolatePixelChannel, InterpolatePixelChannels, and InterpolatePixelInfo, which are all part of /MagickCore/pixel.c, there were multiple unconstrained pixel offset calculations that were used with the floor function. These calculations resulted ...

Astra Linux – Vulnerability in binutils

There is a flaw in binutils /opcodes/tic4x-dis.c. An attacker who can submit a crafted input file for processing by binutils could cause the use of uninitialized memory. The greatest threat is to the availability of the application, with a lower threat to data confidentiality. This flaw affects...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: usb: net: sierra: check for no status endpoint The driver checks whether it has three endpoints, as well as endpoints for bulk input and output. However, it does not check whether the third endpoint is an interrupt input. This...

Astra Linux – Vulnerability in imagemagick

A vulnerability was discovered in ImageMagick, causing a value of type ‘unsigned char’ to fall outside the representable value range when crafted or untrusted input is processed in the coders/psd.c file. This results in a negative impact on the availability of the application or other problems...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: Input: iforce – wakes up after clearing the IFORCEXMITRUNNING flag. syzbot reports a hung task at inputunregisterdevice, with iforceclose waiting in waiteventinterruptible, while dev-mutex is held. This is blocking...

Astra Linux – Vulnerability in busybox

An out-of-bounds heap read in Busybox’s unlzma applet leads to information leakage and denial of service when LZMA-compressed input is decompressed. This can be triggered by any applet/format that…...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: Added check for filling the poll mod list. In cases where improtocols has a value of 1 and tmprotocols has a value of 0, this combination successfully passes the check. This condition is specified as “!improtocols &&...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: RFCOMM: No fix to ensure that user input is validated before setting the setsockopt function. The syzbot reported that the rfcommsocksetsockoptold function copies data without checking the length of the user input...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerabilities have been resolved: ext4: Fixed a bug in ext4escacheextent when ext4splitextentat failed. We encountered the issue when running fsstress with an IO fault: 130747.323114 Kernel BUG at fs/ext4/extentsstatus.c:762! 130747.323117 Internal error: Oops...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: dm: fixed a NULL pointer race issue when completing IO operations. The dmiodecpending function calls endioacct first, and then decreases the number of pending DMA operations. However, if a task swaps the DM table at the same...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input downloads in Google Chrome before version 95.0.4638.54 allowed a remote attacker to bypass navigation restrictions through a malicious file...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: xfrm: fixed the race condition in ipRtbug for icmpRouteLookup reverse path icmpRouteLookup performs multiple route lookups to find a suitable route for sending ICMP error messages, with special handling for XFRM IPsec policies. T...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: xtensa: simdisk: added input size checking in procwritesimdisk A malicious user could potentially enter an arbitrarily bad value into memdupusernul, which might cause the kernel to crash. This follows the same pattern as the patc...

Astra Linux – Vulnerability in vorbis-tools

A buffer underflow vulnerability has been identified in the ogg123 utility from the vorbis-tools 1.4.3 package, within the remotethread function in remote.c. This vulnerability occurs during the remote control functionality, when processing malformed input, resulting in a stack buffer underflow...

Astra Linux – Vulnerability in Lasso

There is a denial-of-service vulnerability in the lassoproviderverifysamlsignature functionality of Entr’ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a denial-of-service attack. An attacker can send a malformed SAML response to exploit this vulnerability...