Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fixed a NULL pointer dereference in pnfsmarkmatchinglsegsreturn. The commit de144ff4234f fixes the issue by changing pnfsreturnlayout to call pnfsmarkmatchinglsegsreturn, with NULL passed as the argument to the...

Astra Linux – Vulnerability in libmysofa

Incorrect handling of input data in the loudness function of the libmysofa library in versions 0.5 to 1.1 can lead to heap buffer overflows and access to unallocated memory blocks...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

The “Use After Free” vulnerability in the Linux kernel allows for the execution of code in a local environment on Linux, x86, and ARM bluetooth modules. This vulnerability is associated with program files located at https://gitee.com/anolis/cloud-kernel/blob/devel-5.10/net/bluetooth/afbluetooth.C...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: smb3: Fixed temporary data corruption in the collapse range. The “collapse range” does not discard the affected cached regions; therefore, there is a risk of temporarily corrupting the file data. This fix corresponds to bug xfste...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: mshv: Fixed the check for overlap in memory regions. The current check was incorrect; it only checks whether the beginning or end of a region is within an existing region. This does not take into account cases where the user spac...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: XArray: Fixed the issue with xascreaterange when a multi-index entry is present. If there is already an entry present that is of order = XACHUNKSHIFT when we call xascreaterange, xascreaterange will misinterpret that entry as a...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

In the Linux kernel, the following vulnerabilities have been resolved: arm64: mm: fixed the sanity check for VA-range Both createmappingnoalloc and updatemappingprot perform sanity checks on their ‘virt’ parameter. However, the check itself doesn’t make much sense. The condition used today seems ...

Astra Linux – Vulnerability in Vim

Use of out-of-range pointer offset in the GitHub repository vim/vim before version 8.2...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/buddy: Fixed the error handling code for allocrange. A few users have reported display corruption when booting the machine into KDE Plasma or playing games. We have identified a problem where, whenever allocrange failed to fi...

Astra Linux – Vulnerability in Tomcat9

In some unusual configurations of multipart uploads, an Integer Overflow vulnerability in Apache Tomcat can lead to a Denial-of-Service attack by bypassing size limits. This issue affects Apache Tomcat versions from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, and from 9.0.0.M1 throu...

Astra Linux – Vulnerability in node-semver

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service ReDoS via the function new Range, when untrusted user data is provided as a range...

Astra Linux – Vulnerability in imagemagick

A vulnerability was discovered in ImageMagick, causing a value that is outside the representable range for the type ‘unsigned char’ at coders/psd.c, when crafted or untrusted input is processed. This results in a negative impact on the availability of the application or other problems related to...

Astra Linux – Vulnerability in Vim

Use of out-of-range pointer offset in the GitHub repository vim/vim before version 8.2.4418...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ext4: The block range must be validated before being used in ext4mbclearbb. The block range to be freed is validated in ext4freeblocks, using ext4 inodeblockvalid, and then it is passed to ext4mbclearbb. However, in some cases on...

Astra Linux – Vulnerability in libproxy

In url.cpp within libproxy versions 0.4.x to 0.4.15, it is possible for a remote HTTP server to trigger uncontrolled recursion by sending a response that consists of an infinite stream without a newline character. This leads to a stack exhaustion issue...

Astra Linux – Vulnerability in Tomcat9

A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protections provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: In mm/hugetlb, do not call vmaaddreservation when ENOMEM occurs. sysbot reported a segmentation fault 1 in unmaphugepagerange. This occurs because vmaneedsreservation may return -ENOMEM if allocatefileregionEntries fails to...

Astra Linux - уязвимость в u-boot

In Das U-Boot versions 2016.11-rc1 through 2019.07-rc4, an underflow can cause memcpy to overwrite a very large amount of data including the entire stack, while reading a crafted ext4 filesystem...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: smb3: Fixed temporary data corruption during the insert range operation. The insert range does not discard the affected cached data; therefore, there is a risk of temporarily corrupting file data. Some minor optimizations were...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: mm/gup: fixed guppudrange for dax For dax pud, pudhuge returns true on x86. Therefore, the function works as long as hugetlb is configured. However, dax does not depend on hugetlb. Commit 414fd080d125 “mm/gup: fixed guppmdrang...