Astra Linux – Vulnerability in Chromium

Server-side request forgery in Omnibox in Google Chrome on Android prior to version 153.0.8010.52 allowed a remote attacker to leverage social engineering to bypass system access restrictions through crafted network traffic. Chromium security severity: Medium...

Astra Linux – vulnerability in netty

Netty is an open-source, asynchronous event-driven network application framework designed for rapidly developing high-performance protocol servers and clients. In Netty io.netty:netty-codec-http2 prior to version 4.1.60.Final, there is a vulnerability that allows request smuggling. If a...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gfx3d: add parent to parent request map After commit d228ece36345 “clk: divider: remove roundrate in favor of determinerate”, determining the GFX3D clock rate caused a crash, as the passed parent map does not provide t...

Astra Linux – Vulnerability in Chromium

Cross-site request forgery in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to leverage social engineering to bypass web origin policy through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – vulnerability in Tomcat9

A vulnerability related to improper input validation exists in Apache Tomcat versions from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81, and from 8.5.0 through 8.5.93. These versions fail to properly parse HTTP trailer headers. A specially crafted...

Astra Linux – vulnerability in linux-5.15

In the Linux kernel, the following vulnerability has been resolved: s390/ism: fix concurrency management in ismcmd The s390x ISM device data sheet clearly states that only one request-response sequence is allowed per ISM function at any given time. Unfortunately, as of today, the s390/ism driver ...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: frndis: Refactor bind path to use free After a bind/unbind cycle, the rndis-notifyreq remains stale. If a subsequent bind fails, the unified error label attempts to free this stale request, resulting in a NULL pointe...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: Input: pegasus-notetaker - fix potential out-of-bounds access In the pegasusnotetaker driver, the pegasusprobe function allocates the URB transfer buffer using the wMaxPacketSize value from the endpoint descriptor. An attacker ca...

Astra Linux – vulnerability in linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: can: etases58x: allow partial RX URB allocation to succeed When es58xallocrxurbs fails to allocate the requested number of URBs but manages to allocate some, it returns an error code. This causes es58xopen to return early, skippi...

Astra Linux – Vulnerability in python-tornado

Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the provided “reason” phrase is used unescaped in HTTP headers where it could be used for header injection or in HTML on the default error page where it could be used for XSS attacks. This...

Astra Linux – Vulnerability in xwayland, xorg-server

A flaw was discovered in the X.Org X server. This vulnerability, an out-of-bounds read, affects the handling of XKB X Keyboard Extension modifier maps. An attacker with access to the X11 server can exploit this by sending a malformed request, causing the server to read beyond its intended memory...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix URB leak in pvr2sendrequestex When pvr2sendrequestex successfully submits a write URB, it fails to submit the read URB e.g., returns -ENOMEM. As a result, pvr2sendrequestex returns immediately, without waiting...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: A missing key size check in L2CAPLECONNREQ has been fixed. A check for the encryption key size is added upon receiving the L2CAPLECONNREQ. This is required by L2CAP/LE/CFC/BV-15-C, which expects...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: can: esdusb: esdusbreadbulkcallback: fixed the URB memory leak. The memory leak was fixed in a similar manner to the issue in commit 7352e1d5932a “can: gsusb: gsusbreceivebulkcallback: fixed the URB memory leak”. In esdusbopen, t...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix for accepting multiple L2CAPECREDCONNREQ Currently, the code attempts to accept requests regardless of their command identifier; this can result in multiple requests being marked as pending FLAGDEFERSETUP. A...

Astra Linux – Vulnerability in HAPProxy

HAProxy in versions up to 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the drl field of the fcgiconn structure. This vulnerability allows for incorrect parsing of buffer data as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, t...

Astra Linux – vulnerability in linux, linux-5.10, linux-5.15, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: can: j1939: enhanced error handling for tightly received RTS messages in xtprxrtssessionnew This patch improves error handling in cases where RTS Request to Send messages arrive closely together. It replaces the less...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: tcp/dccp: Do not use timerpending in reqskqueueunlink. Martin KaFai Lau reported a use-after-free in reqsktimerhandler. We are encountering a use-after-free related to a bpf program attached to tracetcpretransmitsynack. The...

Astra Linux – Vulnerability in symfony

Symfony/http-foundation is a module for the Symphony PHP framework that defines an object-oriented layer for handling HTTP requests. The Request class does not parse URIs containing special characters in the same way that browsers do. As a result, attackers can trick validators that rely on the...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: i2c: npcm: disable interrupt enable bit before devmrequestirq The customer reports that there is a soft lockup issue related to the i2c driver. Upon inspection, it was found that the i2c module was performing a TX transfer;...