Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: net/sched: actife: avoided possible NULL derefrence tcfifeencode must ensure that ifeencode does not return NULL. syzbot reported: Oops: general protection fault, likely for a non-canonical address 0xdffffc0000000000: 0000 1 S...

Astra Linux – Vulnerability in qtbase-opensource-src

A issue was discovered in Qt before version 5.15.14, in versions 6.x before 6.2.9, and in versions 6.3.x through 6.5.x before 6.5.1. Qt Network incorrectly parses the strict-transport-security HSTS header, allowing unencrypted connections to be established, even when such connections are explicit...

Astra Linux – Vulnerability in docker.io

Moby is an open-source container framework developed by Docker Inc. It is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component dockerd, which is developed as moby/moby, is commonly referred to as Docker. Swarm Mode, which is...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: netsched: hfsc: Fixed a potential UAF in hfscdequeue. Similarly to the previous patch, we also need to properly protect hfscdequeue. However, for this issue, we do not have a reliable way to reproduce the problem...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: nfsd: never defer requests during idmap lookup During the decoding of v4 request compound arguments, certain operations e.g., SETATTR can trigger idmap lookup upcalls. When the responses to these upcalls are delayed beyond the...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: 2D. The supported versions affected by this vulnerability include Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK:...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: Security. The supported versions affected by this vulnerability are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9,...

Astra Linux – Vulnerability in Chromium

A heap buffer overflow in ANGLE in Google Chrome prior to version 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption through malicious network traffic. Chromium security severity: High...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Oracle Java SE and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: Libraries. The supported versions affected include Oracle Java SE: 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. This easily exploitable vulnerability allows an...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Wifi: wilc1000: Prevent use-after-free in wilcnetdevcleanup when cleaning up all interfaces. wilcnetdevcleanup currently triggers a KASAN warning. This can be observed during the interface registration process, or by simply...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: NFSD: fixed a hang issue in nfsd4shutdowncallback. If nfs4client is in the courtesy state, there is no point in sending the callback. This causes nfsd4shutdowncallback to hang, as clcbinflight is not set to 0. This hang lasts...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: nbd: The function genlunregisterfamily is called first in nbdcleanup. Otherwise, there may be a race between the removal of the module and the handling of the netlink command, which can lead to an oops as shown below: BUG: Kernel...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Fixed a crash in the cmaneteventworkhandler function. The struct rdmacmid structure has a member “struct workstruct network”, which is reused to queue cmaneteventworkhandler functions onto the cmawq queue. The crash1 ca...

Astra Linux – Vulnerability in Chromium

Using “after free” in Chromoting within Google Chrome on Linux before version 149.0.7827.53 allowed a remote attacker to execute arbitrary code through malicious network traffic. Chromium security severity: Low...

Astra Linux – Vulnerability in Mariadb 10.3

Vulnerability in the MySQL Client product of Oracle MySQL component: Client: mysqldump. The supported versions affected are 8.0.0–8.0.41, 8.4.0–8.4.4, and 9.0.0–9.2.0. This vulnerability is difficult to exploit; it allows low-privilege attackers with network access via multiple protocols to...

Astra Linux – Vulnerability in Chromium

The use of after-free in the Network component of Google Chrome before version 149.0.7827.53 allowed a remote attacker to execute arbitrary code through a crafted HTML page. Chromium security severity: Critical...

Astra Linux – Vulnerability in Chromium

Using after-free in Proxy in Google Chrome before version 149.0.7827.103 allowed a remote attacker to execute arbitrary code through malicious network traffic. Chromium security severity: Critical...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in the Network section of Google Chrome before version 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to leak cross-origin data through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in the Network section of Google Chrome before version 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Incorrect authorization in the Network of Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy through a crafted HTML page. Chromium security severity: Medium...