Astra Linux – Vulnerability in symfony

Symfony is a PHP framework for web and console applications, along with a set of reusable PHP components. The ability to enumerate users was possible without requiring relevant permissions, as the handling differed depending on whether the user existed or not when trying to use the “switch users”...

Astra Linux – Vulnerability in Netty

HttpObjectDecoder.java in Netty before 4.1.44 allowed an HTTP header that lacked a colon. This could be interpreted as a separate header with incorrect syntax, or it could be interpreted as an “invalid fold”...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: KVM: PPC: Fixed the issue with the vcpuload leak in kvmarchvcpuioctl. The vcpuput function is not called if the user copy fails. This can lead to problems such as corruption of the preempt notifier and system crashes...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: MIPS: Loongson64: DTS: Actually fixed the PCIe port nodes for ls7a. Fixed the dtc warnings: arch/mips/boot/dts/loongson/ls7a-pch.dtsi:68.16-416.5: Warning interruptprovider: /bus@10000000/pci@1a000000: 'interrupt-cells' found,...

Astra Linux – Vulnerability in xorg-server

In the X.Org X Server versions 20.11 through 21.1.16, when a client application uses easystroke for mouse gestures, the main thread modifies various data structures used by the input thread without acquiring a lock, which is known as a race condition. Specifically, the AttachDevice function in...

Astra Linux – Vulnerability in exiv2

In Exiv2, from version 0.27.1 onwards, a malicious HTTP server can cause a denial of service crash due to a NULL pointer dereference by returning a crafted response that lacks a space character...

Astra Linux – Vulnerability in Chromium

Missing authorization in BFCache in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, a missing check in the MNG encoder allowed the possibility of reading more images than the list limit allowed, resulting in excessive resource usage. This issue...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Before versions 7.1.2-15 and 6.9.13-40, when a PCD file did not contain a valid Sync marker, the DecodeImage function would get stuck in an infinite loop while searching for the Sync marker. This caused...

Astra Linux – Vulnerability in Chromium

Missing authorization in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leverage social engineering to obtain sensitive information through UI interaction. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Missing authorization in the FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leverage social engineering to bypass system access restrictions through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Missing authorization in the Sensor component of Google Chrome prior to version 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to obtain sensitive information through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Missing authorization in the FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process and utilized social engineering to obtain sensitive information through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Missing authorization in Contacts in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and utilized social engineering to potentially obtain sensitive information through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net: Missing check for virtio Two missing checks in virtionethdrtoskb allowed syzbot to crash kernels again. 1. After the skbsegment function, the buffer may become non-linear nrfrags != 0. However, since the SKBTXSHAREDFRAG...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: s390/qeth: Check CAPNETADMIN for private ioctls. Gate the SIOCQETHADPSETSNMPCONTROL, SIOCQETHGETCARDTYPE, and SIOCQETHQUERYOAT ioctl commands with the CAPNETADMIN capability check, to ensure that unprivileged users cannot invo...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Thermal: int340x: Added a NULL check for adev. Not all devices have an ACPI companion fwnode; therefore, adev may be NULL. This is similar to the change made in commit cd2fd6eab480 “platform/x86: int3472: Check for adev == NULL”....

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: For the clk subsystem, in the qcom module, there is a issue where gcc-sm6350 uses parentmap for two clocks that actually doesn’t exist. If a clkrcg2 has a parent, it should also have the parentmap property defined. Otherwise, a...

Astra Linux – Vulnerability in Linux 5.10

In the dplinksettingswrite function in the file drivers/gpu/drm/amd/display/amdgpudm/amdgpudmdebugfs.c in the Linux kernel, up to version 5.14.14, there is a vulnerability that allows for a heap-based buffer overflow by an attacker. This vulnerability arises because the attacker can write a strin...

Astra Linux – Vulnerability in Chromium

Missing authorization in the Browser of Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions through a crafted HTML page. Chromium security severity: Medium...