Astra Linux – Vulnerability in Parsec

The vulnerability of the pdpl-file utility in the PARSEC security subsystem is related to improper memory release after its use. Exploiting this vulnerability allows an attacker to cause a service failure...

Astra Linux – Vulnerability in grub2

A flaw was discovered in grub2, where its configuration file, known as grub.cfg, is created with the wrong permission set, allowing non-privileged users to read its contents. This represents a minor confidentiality issue, as those users could potentially access any encrypted passwords contained i...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: In the “block” section, there’s a issue where rq and qos structures are released without the disk being handled first. The blkcginitqueue function may add these structures to the request queue. Previously, the blkcleanupqueue...

Astra Linux – Vulnerability in Firefox and Thunderbird

Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: macsec: Fixed a use-after-free issue during the sending of the offloading packet. KASAN reports the following UAF. The metadatadst, which is used to store the SCI value for macsec offloading, is already freed by metadatadstfre...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ipv6: Release the next-hop information upon device removal The CI is experiencing some non-periodic hangs during device removal in the pmtu.sh self-test: unregisternetdevice: Waiting for vethA-R1 to become available. Usage cou...

Astra Linux – Vulnerability in Composer

Composer is a dependency manager for PHP. On the 2.x branch, prior to versions 2.2.24 and 2.7.7, the status, reinstall, and remove commands, when used with packages installed from sources via Git that contain specially crafted branch names in the repository, could allow for the execution of...

Astra Linux – Vulnerability in Thunderbird, Firefox

An inconsistent comparator in xslt/txNodeSorter could have led to potentially exploitable out-of-bounds access. This issue only affected versions 122 and later. This vulnerability was fixed in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: iommu/sprd: The DMA buffer should be released to avoid memory leaks. When attaching to a domain, the driver allocates a DMA buffer, which is used to store the address mapping table. This buffer must be released when the IOMMU...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: seccomp: Move copyseccomp to the no-failure path. Our syzbot instance reported memory leaks in doseccomp, similar to the reports 1. This indicates that we are failing to properly free the struct seccompfilter and some objects...

Astra Linux – Vulnerability in Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Watchdog: cpu5wdt.c – Fixed a use-after-free bug caused by cpu5wdttrigger. When the cpu5wdt module is being removed, the original code uses deltimer to deactivate the timer. If the timer handler is still running, deltimer may not...

Astra Linux – Vulnerability in Firefox and Thunderbird

Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10...

Astra Linux – Vulnerability in Firefox and Thunderbird

Incorrect boundary conditions in the Libraries component of NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10...

Astra Linux – Vulnerability in Firefox, Thunderbird

Memory safety bugs exist in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18, and Thunderbird 128.5. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Scsi: sg: Fix slab-use-after-free issue in sgrelease A use-after-free bug was fixed in sgrelease, detected by syzbot with KASAN: Bug: KASAN: Slab-use-after-free in lockrelease+0x151/0xa30 kernel/locking/lockdep.c:5838...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fixed the buffer release/clearing order in the deferred receive path. A use-after-free condition was addressed by correcting the buffer release sequence in the deferred receive path. The code first released the RQ...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: caif: A memory leak has been fixed in cfctrllinkuprequest. When linktype is unknown, or kzalloc fails in cfctrllinkuprequest, pkt is not released. Add a release process to the error handling logic...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ksmbd: A possible reference count leak in smb2open has been fixed. The reference count of ACLs will cause a leak when memory allocation fails. This issue has been addressed by adding the missing posixaclrelease function...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: EDAC/mc: Fixed the error path ordering in edacmcalloc. When the mci-pvtinfo allocation in edacmcalloc fails, the error path will call putdevice, which will ultimately call the device’s release function. However, the initializatio...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: btrfs: Ensure that the correct amount of memory is released during direct IO write operations. Running generic/406 causes the following warning in btrfsdestroy inode: this indicates that there are still outstanding extents...