libxml: use-after-free in xmlXIncludeAddNode

A flaw was found in libxml2 where improper handling of memory allocation failures in libxml2 can lead to crashes, memory leaks, or inconsistent states. While an attacker cannot directly control allocation failures, they may trigger denial-of-service conditions under extreme system stress...

Astra Linux – Vulnerability in Firefox, Thunderbird

Assuming a controlled failed memory allocation, an attacker could cause a use-after-free, resulting in a potentially exploitable crash. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Firefox ESR 115.19, Thunderbird 134, and Thunderbird 128.6...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: media: atomisp: Added a check for a failure in memory allocation for rgbydata. In iacss3astatisticsallocate, there is no check on the allocation result of the rgbydata memory. If rgbydata is not successfully allocated, it may...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Nilfs2: Fixed potential deadlocks caused by newly created symlinks. Syzbot reported that the pagesymlink function, called by nilfssymlink, triggers memory reclamation involving the filesystem layer. This can lead to circular lock...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: btrfs: fixed an issue where an uninitialized pointer was freed during the readalloconename function. The readalloconename function does not initialize the name field of the passed fscryptstr structure if kmalloc fails to allocate...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: dma: Fixed the call order in dmamfreecoherent. dmamfreecoherent frees a DMA allocation, making the freed vaddr available for reuse. Then, it calls devresDestroy to remove and free the data structure used to track the DMA...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fixed the missing error check for xastore. xastore may fail. It returns xaerr-EINVAL if the entry cannot be stored in an XArray, or xaerr-ENOMEM if memory allocation fails. Therefore, a check for errors in xastore is...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Input: uinput – rejects requests with an unreasonable number of slots When using uinput, the syzkaller may attempt to set up a device with a very large number of slots, leading to a memory allocation failure in inputmtinitslots...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/cs8409: Fixed possible NULL dereferencing. If sndhdagenaddkctl fails to allocate memory and returns NULL, then a NULL pointer dereferencing will occur in the next line. Since the dolphinfixups function is a hdafixup...

Astra Linux – Vulnerability in libstb

STBVorbis is a single-file library licensed under MIT, designed for processing OGG Vorbis files. A properly crafted file may cause a memory allocation failure in the startdecoder function. In such cases, the function returns early; f-commentlist is set to NULL, but f-commentlistlength is not rese...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Added a check for memory allocation. allocpbl can return an error when memory allocation fails. The driver does not check the status of memory allocation in some instances...

kernel: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof

In the Linux kernel, the following vulnerability has been resolved: mm: fix NULL pointer dereference in allocpagesbulknoprof We triggered a NULL pointer dereference for ac.preferredzoneref-zone in allocpagesbulknoprof when the task is migrated between cpusets. When cpuset is enabled, in...

Important: Red Hat Security Advisory: kernel-rt security update

An update for kernel-rt is now available for Red Hat Enterprise Linux 9.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...

Azure Linux 3.0 Security Update: libxml2 (CVE-2023-45322)

The version of libxml2 installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-45322 advisory. - libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. Th...

GNU Binutils 安全漏洞

GNU Binutils GNU Binary Utilities is a set of programming language utility programs developed by the American GNU community. The programs are primarily designed to work with target files in a variety of formats, and provide connectors, assemblers, and other tools for target files and archives. A...

Azure Linux 3.0 Security Update: kernel (CVE-2024-23851)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-23851 advisory. - copyparams in drivers/md/dm-ioctl.c in the Linux kernel through 6.7.1 can attempt to allocate more than INTM...

Azure Linux 3.0 Security Update: kernel (CVE-2024-25739)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-25739 advisory. - createemptylvol in drivers/mtd/ubi/vtbl.c in the Linux kernel through 6.7.4 can attempt to allocate zero...

Azure Linux 3.0 Security Update: kernel (CVE-2024-46746)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-46746 advisory. - In the Linux kernel, the following vulnerability has been resolved: HID: amdsfh: free driverdata after...

Azure Linux 3.0 Security Update: kernel (CVE-2024-49954)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-49954 advisory. - In the Linux kernel, the following vulnerability has been resolved: staticcall: Replace pointless WARNON in...

Azure Linux 3.0 Security Update: kernel (CVE-2024-42082)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-42082 advisory. - In the Linux kernel, the following vulnerability has been resolved: xdp: Remove WARN from xdpregmemmodel...