Astra Linux – Vulnerability in librsvg

A directory traversal vulnerability exists in the URL decoder of librsvg before version 2.56.3. This vulnerability could be exploited by local or remote attackers to access files located in the local filesystem, outside of the expected area. This was demonstrated with the URL...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Input: mms114 – fixed the touch indexing for MMS134S and MMS136. The MMS134S and MMS136 touch controllers have an event size of 6 bytes, rather than 8 bytes. When mms114readreg reads the touch data packet from the device into the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: Unlock immaprwsem before releasing after-split folios. foliosplit continues to dereference the mapping after the split: shmemunchargemapping-host and remappage occur while the folios are still frozen/locked...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Before versions 7.1.2-15 and 6.9.13-40, the MSL interpreter would crash when processing an invalid element, causing it to use an image after it had been freed. Versions 7.1.2-15 and 6.9.13-40 include a...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetpipapo: do not free live element Pablo reported a crash when processing large batches of elements with a back-to-back add/remove pattern. Quoting Pablo: addelem"00000000" timeout 100 ms ... addelem"0000000X"...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: do not skip expired elements during walking. There is an asymmetry between the commit/abort phase and the preparation phase if the following conditions are met: 1. “set” is a verdict map “1.2.3.4 : jump foo” ...

Astra Linux – Vulnerability in curl

There is a path traversal vulnerability in the 8.0.0 SFTP implementation of curl. This vulnerability causes the tilde character to be incorrectly replaced when used as a prefix in the first path element. Additionally, the tilde is intended to be used as the first element to indicate a path relati...

Astra Linux – Vulnerability in Qemu

A flaw was discovered in the vhost-vsock device of QEMU. In the event of an error, an invalid element was not detached from the virtqueue before freeing its memory, resulting in memory leakage and other unexpected issues. This issue affects QEMU versions up to 6.2.0...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: RISCV: Process: Fix kernel information leakage The s12 element of the threadstruct may contain random kernel memory contents, which could potentially be leaked to the user space. This is a security flaw. To address this issue,...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Wifi: cfg80211 – Fix for buffer overflow in elem comparison. For vendor elements, the code assumes that 5 octets are present without checking them. Since the element itself has already been checked for compatibility, we only need...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: BPF: Fixed a memory leak in the LRU and LRUPERCPU hash maps The LRU and LRUPERCPU maps allocate a new element during updates, before locking the target hash table bucket. Immediately afterwards, the maps attempt to lock the bucke...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Wifi: wl1251 – Validating packet IDs before indexing TXframes The wl1251txpacketcb function uses the firmware completion ID directly to index the fixed 16-element wl-txframes array. The ID is a raw u8 value from the completion...

Astra Linux – Vulnerability in Firefox

A website could have obscured the fullscreen notification by using an option element, introducing a delay through a costly computational process. This could have caused confusion among users and potentially led to spoofing attacks. This vulnerability affects Firefox versions earlier than 115...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: hwmon: In the line asusatk0110, it is necessary to check the packagecount before accessing elements. The atkecpresent function iterates through the packages in the management group returned by the GGRP ACPI method. For each...

Astra Linux – Vulnerability in RustC

In the standard library of Rust before version 1.52.0, a double-free error can occur in the Vec::fromiter function if the process of freeing the element causes a panic...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetpipapoavx2: Do not return a non-matching entry when it expires. A new test case fails unexpectedly when avx2 matching functions are used. The test first loads a randomly generated pipapo set with the key “ipv4...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: dm integrity: Memory corruption occurs when tagsize is less than digestsize. It is possible to configure dm-integrity in such a way that the tagsize parameter is smaller than the actual digestsize. In this case, a portion of the...

Astra Linux – Vulnerability in Firefox and Thunderbird

When interacting with the file picker dialog of an HTML input element using the webkitdirectory setting, a use-after-free vulnerability may occur, leading to memory corruption and potentially exploitable crashes. This vulnerability affects Firefox versions less than 94, Thunderbird versions less...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a malicious MSL script could trigger a heap-use-after-free vulnerability. The operation element handler replaced and freed the image while the parser continued...

Astra Linux – Vulnerability in Linux

A issue was discovered in the Linux kernel versions 3.2 through 5.10.16, as used by Xen. Grant mapping operations often occur during batch hypercalls, where multiple operations are performed in a single hypercall. The success or failure of each operation is reported to the backend driver, and the...