Astra Linux – Vulnerability in emacs

A vulnerability was discovered in GNU Emacs through version 28.2. The htmlfontify.el script has a command injection vulnerability. In the hfy-istext-command function, the parameter file and parameter srcdir parameters come from external inputs, and these parameters are not escaped properly. If a...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: hcisync: Fixed UAFs related to advertising data. The hcifindadvinstance function returns a advinfo pointer that is only valid while hdev-lock is held. In the advertising command-sync path, instance lookups are...

Astra Linux – Vulnerability in Ruby-Rack

Rack is a modular Ruby web server interface. In versions 3.0.0.beta1 through 3.1.21, and from 3.2.0 through 3.2.6, Rack::Multipart::Parserhandlemimehead parsed quoted multipart parameters such as Content-Disposition: form-data; name="..." using repeated Stringindex searches combined with...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: perf/core: Fixed an issue where the perfoutputbegin parameter is incorrectly invoked in perfeventbpfoutput. syzkaller reports a issue with a stack-out-of-bounds condition. The call trace is as follows: dumpstack+0x9c/0xd3,...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: rcuscale: Move rcuscalewriter’s scheduletimeoutuninterruptible function to idle. The rcuscale.holdoff module parameter can be used to delay the start of rcuscalewriter’s kthread. However, the hung-task timeout will trigger when t...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fixed the type of the second parameter in the odneditdpmtable callback. With Clang’s kernel control flow integrity kCFI, CONFIGCFICLANG, indirect call targets are validated against the expected function pointer...

Astra Linux – Vulnerability in Node.js

If the Node.js HTTPS API was used incorrectly, and “undefined” was passed as the “rejectUnauthorized” parameter, no error would be returned, and connections to servers with expired certificates would be accepted...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: hinic: fixed a memory leak when reading the function table. When the input parameter idx matches the expected case option in hinicdbggetfunctable, the readdata variable is not released properly. This issue has been addressed...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: In the ofmodalias function, we can pass the str and len parameters. This could lead to a kernel oops in vsnprintf, as the function only allows passing a NULL pointer when the length is also 0. Additionally, we need to filter out...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-5.10

In the Linux kernel, the following vulnerability has been resolved: Wifi: iwlwifi: pcie: Fixed an integer overflow in the iwlwritetouserbuf function. An integer overflow occurs in the iwlwritetouserbuf function, which is called by the iwldbgfsmonitordataread function. The function is as follows: ...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Netwerk: Ethernet: mvpp2main: A possible OOB write issue has been fixed in mvpp2ethtoolgetrxnfc. The rules parameter is allocated in ethtoolgetrxnfc, and its size is determined by rulecnt from the user space. Therefore, rulecnt...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: btrfs: The reloc control parameter is not set if the transaction commit fails in preparetorelocate. In btrfsrelocateblockgroup, the rc parameter is allocated. Then, btrfsrelocateblockgroup calls relocateblockgroup, which calls...

Astra Linux – Vulnerability in mapserver

MapServer is a system for developing web-based GIS applications. From version 6.4.0 to before version 8.6.3, msSLDParseUserStyle always called SLDApplyRuleValuespsRule, psLayer, 1 for any that contained . It assumed that msSLDParseRule had added a class. When the rule had no symbolizer a...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: gpio: amd8111: Fixed the issue with the reference count leak of PCI devices The function foreachpcidev is implemented through pcigetdevice. The comment accompanying pcigetdevice states that it will increase the reference count...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: flowtable: fixed and simplified the handling of IP6IP6 tunnels. Fixed the nfflowip6tunnelproto function to use pskbmaypull instead of skbheaderpointer, to ensure that the outer IPv6 header is within the skb headroom...

Astra Linux – Vulnerability in Qemu

QEMU prior to version 8.2.0 has an integer underflow issue, which can lead to a buffer overflow. This occurs due to a TI command, where a transfer length that is not a DMA transfer is processed, and the actual transfer length is shorter than the length of the available FIFO data. This issue arise...

Astra Linux – Vulnerability in Zabbix

The endpoint /zabbix.php?action=export.valuemaps is vulnerable to a Cross-Site Scripting attack due to the backurl parameter. This vulnerability arises from the reflection of user-provided data without proper HTML escaping or output encoding. As a result, a JavaScript payload may be injected into...

Astra Linux – Vulnerability in libjettison-java

It was discovered that Jettison before version 1.5.2 contained a stack overflow vulnerability through the map parameter. This vulnerability allows attackers to cause a Denial of Service DoS attack by using a specially crafted string...

Astra Linux - Vulnerability in libxml2

parser.c in libxml2 prior to version 2.9.5 does not prevent infinite recursion in parameter entities...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Audit: Improved robustness of audit queue handling If the audit daemon becomes stuck in a stopped state, the kauditdthread function in the kernel might get blocked while attempting to send audit records to the audit daemon in the...