Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-5.10

A vulnerability was identified in the Linux Kernel versions up to 4.19.316/5.4.278/5.10.220/5.15.161. This affects the tcpgetsockopt/tcpsetsockopt functions of the TCP Handler component. Such manipulation leads to a race condition. This attack involves a high level of complexity. The vulnerabilit...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/9p: A potential socket leak has been fixed in p9socketopen. Both p9fdcreatetcp and p9fdcreateunix will call p9socketopen. If the creation of p9transfd fails, both p9fdcreatetcp and p9fdcreateunix will return an error directly...

Astra Linux – Vulnerability in Cpio

Debian’s cpio package contains a path traversal vulnerability. This issue was introduced by reverting the CVE-2015-1197 patches, which caused a regression in the --no-absolute-filenames option. Upstream has since provided a proper fix for this issue...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Add a wrapper around the mlx5etxreporterdumpsq function to extract the SQ value from the struct mlx5etxtimeoutctx structure and set it as the dump callback for the TX-timeout-recovery flow. The mlx5etxreporterdumpsq...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: net/smc: A NULL pointer dereferencing issue was addressed in smcpnetfindib. The devname function was called with dev.parent as an argument, but without performing a NULL-check before using it. This issue was resolved by checking...

Astra Linux – Vulnerability in Linux 5.10

A vulnerability has been discovered in the Linux kernel. It has been rated as problematic. The affected component is the sessfreebuffer function in the fs/cifs/sess.c file of the CIFS Handler module. This vulnerability can lead to double-free operations. It is recommended that patches be applied ...

Astra Linux – Vulnerability in SQLite3

A vulnerability was discovered in SQLite SQLite3 version 3.43.0 and is classified as critical. This issue affects the sessionReadRecord function in the file ext/session/sqlite3session.c of the make alltest component. The vulnerability results in a heap-based buffer overflow. It is recommended to...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

A vulnerability has been discovered in the Linux kernel. It has been classified as problematic. The affected function is nilfsnew inode in the file fs/nilfs2/inode.c of the BPF component. This vulnerability allows for manipulation after the memory allocation function free is called. The attack ca...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

A use-after-free flaw was discovered in the Linux kernel’s core dump subsystem. This flaw allows a local user to crash the system. Only if patch 390031c94211 “coredump: Use the vma snapshot in fillfilesnote” is not applied yet, then the kernel may be affected...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Validating the payload size in the IPC response When installing malicious ksmbd-tools, ksmbd.mountd may return an invalid IPC response to the ksmbd kernel server. ksmbd should validate the payload size of the IPC response...

Astra Linux – Vulnerability in Linux 5.15

A vulnerability, classified as problematic, has been identified in the Linux kernel. This issue affects the functions unixsockdestructor/unixreleasesock in the file net/unix/afunix.c of the BPF component. The manipulation leading to this issue results in a memory leak. It is recommended that a...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-5.10

A vulnerability has been identified in the Linux kernel and is classified as problematic. This vulnerability affects the function inet6streamops/inet6dgramops of the IPv6 Handler component. The vulnerability causes a race condition. It is recommended that a patch be applied to address this issue...

Astra Linux – Vulnerability in Linux 5.15

A vulnerability has been identified in the Linux kernel and is classified as problematic. This vulnerability affects the function l2caprecvacldata in the file net/bluetooth/l2capcore.c of the Bluetooth component. The vulnerability causes a memory leak. It is recommended that a patch be applied to...

Astra Linux – Vulnerability in freerdp2

FreeRDP is a free implementation of the Remote Desktop Protocol. Clients based on FreeRDP prior to version 3.5.1 are vulnerable to a possible NULL access and may crash. Version 3.5.1 contains a patch for this issue. There are no known workarounds available...

Astra Linux – Vulnerability in Squid

Squid is a web proxy cache. Starting from version 3.5.27 and before version 6.8, Squid may be vulnerable to a Denial of Service attack against the HTTP Chunked decoder due to an uncontrolled recursion bug. This issue allows a remote attacker to cause a Denial of Service when sending a crafted,...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

A vulnerability has been discovered in the Linux kernel. It has been identified as a problem. The component affected by this vulnerability is the “ipv6renewoptions” function within the IPv6 handler. This vulnerability causes a memory leak. The attack can be launched remotely. It is recommended th...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Fixed an issue in verifying allowptrleaks. After we changed the capabilities of our networking-bpf program from capsysadmin to capnetadmin+capbpf, our networking-bpf program failed to start. This was because it failed the bp...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/msm/mdp5: The return error code in mdp5piperelease occurs when a deadlock is detected. mdp5getglobalstate runs the risk of encountering an -EDEADLK error when acquiring the modeset lock. Currently, mdp5piperelease does not...

Astra Linux – Vulnerability in gpac

A vulnerability was discovered in GPAC version 2.4. It has been rated as problematic. The affected function is gfdashdownloadinitsegment in the file src/mediatools/dashclient.c. Manipulating the baseiniturl argument leads to a null pointer dereference. This attack can be launched remotely. The...

Astra Linux – Vulnerability in PHP 8.1, PHP 7.3

The opensslprivatedecrypt function in PHP, when using PKCS1 padding OPENSSLPKCS1PADDING, which is the default, is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/13817...