Astra Linux – Vulnerability in libsoup2.4

A flaw was discovered in libsoup, where the soupmultipartnewfrommessage function is vulnerable to an out-of-bounds read. This flaw allows a malicious HTTP client to induce the libsoup server to read data beyond its intended range...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mfd: pcf50633-adc: Fixed a potential memory leak in pcf50633adcasyncread. The variable req is allocated in pcf50633adcasyncread, but adcenqueuerequest might fail to insert the req into the queue. We need to check the return value...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, when performing a polynomial distortion, an excessive read of 24 bytes could occur when specifying certain arguments. This issue has been fixed in versions...

Astra Linux – Vulnerability in Linux, Linux 5.10

The vmwgfx driver contains a local privilege escalation vulnerability that allows unprivileged users to gain access to files opened by other processes on the system through a dangling ‘file’ pointer...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

In the Linux kernel up to version 6.3.1, a use-after-free issue in Netfilter’s nftables module arises when processing batch requests. This allows unprivileged local users to obtain root privileges. The issue occurs due to improper handling of anonymous sets...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ipv4: iptunnel: Fixed a suspicious RCU usage warning in iptunnelfind The per-netns IP tunnel hash table is protected by the RTNL mutex, and iptunnelfind is only called from the control path where the mutex is acquired. Added a...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: zsmalloc: Fixed races between asynchronous zspage free operations and page migration. The asynchronous zspage free worker attempts to lock the entire page list of a zspage without protecting against page migration. Since pages...

Astra Linux – Vulnerability in ntfs-3g

A properly crafted NTFS image can lead to a out-of-bounds read in ntfsielookup in NTFS-3G before version 2021.8.22...

Astra Linux – Vulnerability in Chromium

The vulnerability in VideoCapture in Google Chrome prior to version 149.0.7827.115 allowed a remote attacker who had compromised the GPU process to obtain potentially sensitive information from process memory through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.20.1, a heap-buffer overflow occurred during drive reads when a server-controlled read length was used to read file data into an IRP output stream buffer without a hard upper limit. This allowed an oversized read ...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: bpf: Fixed the overloading of the meaning of MEMUNINIT Lonial reported an issue with the BPF verifier, where the checkmemsizereg function contains the following code: c if !tnumisconstreg-varoff / For unprivileged variable...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mmc: core: Avoid using the bitfield RMW for control flags related to claims/retunes. Move the control flags related to claims and retunes out of the bitfield to avoid unrelated side effects of RMW in asynchronous contexts. The...

Astra Linux – Vulnerability in exiv2

Exiv2 is a C++ library and command-line utility for reading, writing, deleting, and modifying image metadata in formats such as Exif, IPTC, XMP, and ICC. A buffer overflow vulnerability has been discovered in Exiv2 versions v0.27.3 and earlier. This vulnerability occurs when Exiv2 is used to writ...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: parisc: Revised the gateway LWS calls to probe user read access rights. We use load and stbys,e instructions to trigger memory reference interruptions without writing to memory. Due to the way read access support is implemented,...

Astra Linux – Vulnerability in binutils

There is a flaw in the binutils within bfd/pef.c. An attacker who can submit a crafted PEF file for parsing by objdump could cause a heap buffer overflow, leading to out-of-bounds reads, which could result in a disruption to the application’s functionality. This flaw affects binutils versions pri...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: scsi: sg: Allow waiting for commands to complete on removed devices When an SCSI device is removed while still in active use, currently, sg will immediately return -ENODEV whenever an attempt is made to wait for active commands...

Astra Linux – Vulnerability in Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fs/aio: Check IOCBAIORW before the conversion of struct aiokiocb. The first argument of kiocbset Cancelfn may point to a struct kiocb that is not embedded within struct aiokiocb. With the current code, depending on the compiler,...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: net: bridge: Fixed the issue of null pointer dereference in the vlan tunnel destination. This patch addresses a null pointer dereference issue caused by lockless access in the tunnel egress path. When deleting a vlan tunnel, the...

Astra Linux – Vulnerability in Apache2

Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in apstrcmpmatch, especially when an extremely large input buffer is used. Although no code distributed with the server can be forced to make such a call, third-party modules or Lua scripts that us...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ntfs3: Boundary checks for the buffer were added to rununpack. rununpack checks runbuf runlast at the beginning of the while loop. However, it then reads sizesize and offsetsize bytes via rununpacks64, without verifying that thes...