Astra Linux – vulnerability in libssh

A flaw was found in libssh. The API function sshgethexa is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI Generic Security Service Application Program Interface authentication if the server’s logging verbosity is se...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: add bounds checks in nvmettcpbuildpduiovec nvmettcpbuildpduiovec may exceed cmd-req.sg when a PDU length or offset exceeds sgcnt; it then uses incorrect values for sg-length/offset, resulting in a GPF or KASAN in...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: can: kvaserusb: leaf: Fix potential infinite loop in command parsers The kvaserusbleafwaitcmd and kvaserusbleafreadbulkcallback functions contain logic for handling zero-length commands. These commands are used to align data to t...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: libceph: define and enforce CEPHMAXKEYLEN When decoding the key, verify that the key material fits into a fixed-size buffer in processauthdone and generally has a reasonable length. The new CEPHMAXKEYLEN check replaces the existi...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187rxcb rtl8187rxcb calculates the rx descriptor header address by subtracting its size from the skb tail pointer. However, it does not validate whether the received...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: net: nfc: nci: Fix parameter validation for packet data Since commit 9c328f54741b “net: nfc: nci: Add parameter validation for packet data”, communication with nci NFC chips no longer works. The mentioned commit attempts to fix...

Astra Linux – vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, an unvalidated authlength field read from the network triggered a WINPRASSERT failure in rtsreadauthverifiernochecks, causing any FreeRDP client connecting via a malicious RDP Gateway to crash with SIGABRT...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: EFI/CPER: Do not exceed the ARM processor CPER record buffer There is a logic within GHES/CPER to detect whether the sectionlength is too small; however, it fails to detect if it is too large. Currently, if the firmware receives ...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in handleauthdone Perform an explicit bounds check on payloadlen to avoid a possible out-of-bounds access in the callout. idryomov: changelog...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: tracing: ring-buffer: Fix to check event length before using Check the event length before adding it for accessing the next index in rbreaddatabuffer. Since this function is used for validating possibly broken ring buffers, the...

Astra Linux – vulnerability in libsoup3

A request smuggling vulnerability exists in libsoup’s HTTP/1 header parsing logic. The soupmessageheadersappendcommon function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker...

Astra Linux – vulnerability in capstone

Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and earlier, Skipdata length is not bounded; therefore, a user-supplied skipdata callback may cause csdisasm/csdisasmiter memcpy to write more than 24 bytes into csinsn.bytes, resulting in a heap buffer overflow during the disassembly...

Astra Linux – vulnerability in python3.11

When reading an HTTP response from a server, if no read amount is specified, the default behavior is to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially leading to an Out-of-Memory OOM condition or other types of...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative datalen in ibumadwrite ibumadwrite computes datalen from a user-controlled count and the MAD header sizes. When the user-provided MAD header size does not match the expected RMPP header length, datalen...

Astra Linux – vulnerability in Erlang

The “Inconsistent Interpretation of HTTP Requests” ‘HTTP Request Smuggling’ vulnerability in Erlang OTP’s inets httpd module allows HTTP Request Smuggling. This vulnerability is associated with the program file lib/inets/src/httpserver/httpdrequest.erl and the program routine...

Astra Linux – vulnerability in gst-plugins-ugly1.0

GStreamer ASF Demuxer Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability enables remote attackers to execute arbitrary code on affected installations of GStreamer. Exploitation requires interaction with this library; however, the attack vectors may vary depending o...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: can: gsusb: gsusbreceivebulkcallback: check actuallength before accessing data The URB received in gsusbreceivebulkcallback contains a struct gshostframe. The length of the data after the header depends on the gshostframe hf::fla...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: can: gsusb: gsusbreceivebulkcallback: check actuallength before accessing header The driver expects to receive a struct gshostframe in gsusbreceivebulkcallback. Use structgroup to describe the header of the struct gshostframe and...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: EFI/CPER: do not dump the entire memory region The current logic in cperprintfwerr does not check whether the error record length is sufficient to accommodate the offset. In a bad firmware, if the offset exceeds the actual record...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: spi: fsl-cpm: Check length parity before switching to 16 bit mode The commit fc96ec826bce “spi: fsl-cpm: Use 16 bit mode for large transfers with even size” failed to ensure that the size is truly even before switching to 16-bit...