Astra Linux – Vulnerability in Mariadb 10.3

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. The supported versions affected are 8.0.40 and earlier, 8.4.3 and earlier, and 9.1.0 and earlier. This easily exploitable vulnerability allows a high-privilege attacker with network access via multiple protocols to...

Astra Linux – Vulnerability in Apache2

A out-of-bounds read vulnerability exists in the Apache HTTP Server with modheaders and modmime, involving multiple response languages. This issue affects the Apache HTTP Server version 2.4.0 through 2.4.67...

Astra Linux – Vulnerability in Apache2

Some modproxy configurations on the Apache HTTP Server versions 2.4.0 through 2.4.55 allow for an HTTP Request Smuggling attack. These configurations are affected when modproxy is enabled along with some form of RewriteRule or ProxyPassMatch, where a non-specific pattern matches a portion of the...

Astra Linux – Vulnerability in golang-go.crypto

The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server under certain circumstances involving AddHostKey...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerabilities have been resolved: smb: client: fix double-free of TCPServerInfo::hostname When shutting down the server in cifsputtcpsession, the cifsd thread might reconnect to multiple DFS targets before realizing that it should exit the loop. As a result,...

Astra Linux – Vulnerability in python-urllib3

urllib3 is a user-friendly HTTP client library for Python. Prior to version 2.5.0, it was possible to disable redirections for all requests by instantiating a PoolManager and specifying retries in a way that disables redirections. By default, requests and botocore users are not affected. An...

Astra Linux – Vulnerability in Apache2

In certain proxy configurations, a denial-of-service attack against Apache HTTP Server versions 2.4.26 through 2.4.63 can occur when untrusted clients trigger an assertion in modproxyhttp2. The configurations affected include reverse proxies configured for HTTP/2 backends, where ProxyPreserveHost...

Astra Linux – Vulnerability in Apache2

Apache HTTP Server versions 2.4.0 to 2.4.46: A specially crafted Cookie header handled by modsession can lead to a NULL pointer derefrence error and system crash, potentially causing a Denial Of Service attack...

Astra Linux – Vulnerability in Apache2

Apache HTTP Server versions 2.4.39 to 2.4.46: unexpected matching behavior with "MergeSlashes OFF"...

Astra Linux – Vulnerability in Apache2

Inconsistent interpretation of HTTP requests: The “HTTP Request Smuggling” vulnerability in modproxyajp of the Apache HTTP Server allows an attacker to secretly send requests to the AJP server to which the server forwards requests. This issue affects the Apache HTTP Server version 2.4.54 and...

Astra Linux – Vulnerability in Apache2

A carefully crafted request body can cause a buffer overflow in the modlua multipart parser r:parsebody called from Lua scripts. The Apache httpd team is not aware of an exploit for this vulnerability, but it might be possible to create one. This issue affects Apache HTTP Server 2.4.51 and earlie...

Astra Linux – Vulnerability in xorg-server

A vulnerability was discovered in X.Org. This security flaw arises because the handler for the XIPassiveUngrab request accesses out-of-bounds memory when invoked with a high keycode or button code. This issue can lead to local privileges escalation on systems where the X server is running with...

Astra Linux – Vulnerability in xorg-server, xwayland

A heap-based buffer overflow vulnerability was discovered in the X.org server’s ProcXIGetSelectedEvents function. This issue occurs when length values that are swapped in bytes are used in replies. This can potentially lead to memory leakage and segmentation faults, especially when triggered by a...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Validating the payload size in the IPC response When installing malicious ksmbd-tools, ksmbd.mountd may return an invalid IPC response to the ksmbd kernel server. ksmbd should validate the payload size of the IPC response...

Astra Linux – Vulnerability in yajl

There is a memory leak in yajl 2.1.0 when using the yajltreeparse function. This can lead to out-of-memory issues on the server and cause crashes...

Astra Linux – Vulnerability in xwayland, xorg-server

A flaw was identified in the X.Org X server’s X Keyboard Xkb extension. Improper bounds checking in the XkbSetCompatMap function can lead to an unsigned short overflow. If an attacker sends specially crafted input data, the value calculation may overflow, resulting in memory corruption or a syste...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: NFSD: Fixed a use-after-free issue on the source server during inter-server copying. The use-after-free occurred when the laundromat attempted to free an expired cpntfstate entry from the s2scpstateids list after inter-server...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Fuse: Fixed a livelock issue in synchronous file put operations performed by fuseblk workers. I observed a hang when running the generic/323 test against a fuseblk server. This test creates a file, initiates multiple AIO writes t...

Astra Linux – Vulnerability in Zabbix

A specially crafted string can cause a buffer overflow in the JSON parser library, resulting in a crash of the Zabbix Server or Zabbix Proxy...

Astra Linux – Vulnerability in Samba

All versions of Samba prior to 4.15.5 are vulnerable to a malicious client that can use a server symlink to determine whether a file or directory exists in a part of the server file system that is not exported under the share definition. This attack can only succeed if SMB1 with unix extensions i...