Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: usb: host: xhci: Fixed a potential memory leak in xhciallocstreaminfo The xhciallocstreaminfo function allocates a stream context array for streaminfo-streamctxarray using xhciallocstreamctx. When an error occurs, the...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: SCTP: Use callrcu to free endpoints This patch delays the endpoint freeing process by calling callrcu, in order to address another use-after-free issue in sctpsockdump: BUG: KASAN: Use-after-free in lockacquire+0x36d9/0x4c20...

Astra Linux – Vulnerability in Poppler

A issue was discovered in Poppler 0.71.0. There is a potentially fatal abort in Object.h; this will lead to a denial of service, as EmbFile::save2 in FileSpec.cc lacks a stream check before saving an embedded file...

Astra Linux – Vulnerability in FLAC

In streamencoder.c, there is a potential out-of-bounds write due to a missing bounds check. This could lead to exposure of local information without requiring additional execution privileges. User interaction is not required for exploitation. Product: Android Versions: Android-11 Android ID:...

Astra Linux – Vulnerability in Redis

Redis is an in-memory database that persists data on disk. A specially crafted XAUTOCLAIM command on a stream key in a specific state may lead to a heap overflow, and potentially remote code execution. This issue affects versions on the 7.x branch prior to 7.0.4. The patch is released in version...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mptcp: handle large GSO sizes After the committed code below, TCP sockets and MPTCP subflows can generate egress packets that are larger than 64K. This exceeds the maximum DSS data size; the packet length is misrepresented over t...

Astra Linux – Vulnerability in Firefox and Thunderbird

Freeing arbitrary nsIInputStream's on a thread other than the one in which they were created could lead to a use-after-free, potentially causing a crash. This vulnerability affects Firefox ESR 102.5, Thunderbird 102.5, and Firefox 107...

Astra Linux – Vulnerability in libxstream-java

XStream is a Java library for serializing objects to XML and back again. Before version 1.4.16, XStream had a vulnerability that could allow a remote attacker with sufficient rights to execute commands on the host by manipulating the processed input stream. However, no users are affected as long ...

Astra Linux – Vulnerability in libxstream-java

XStream is software used for serializing Java objects into XML and back again. A vulnerability exists in XStream versions prior to 1.4.17, which may allow a remote attacker with sufficient rights to execute commands on the host by manipulating the input stream being processed. However, users who...

Astra Linux – Vulnerability in libxstream-java

XStream is a simple library for serializing objects to XML and back again. In affected versions, this vulnerability may allow a remote attacker with sufficient rights to execute commands on the host by manipulating the input stream being processed. No users are affected as long as they follow...

Astra Linux – Vulnerability in libxstream-java

XStream is a simple library for serializing objects to XML and back again. In affected versions, this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. No users are affected if they follow the recommendation...

Astra Linux – Vulnerability in libxstream-java

XStream is a simple library for serializing objects to XML and back again. In affected versions, this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. No users are affected if they follow the recommendation...

Astra Linux – Vulnerability in ffmpeg

A null pointer dereferencing issue was discovered in ‘FFmpeg’ within the decodemainheader function of the libavformat/nutdec.c file. The flaw occurs because the function does not check the return value of avformatnewstream, leading to a null pointer dereferencing error, which can cause the...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: nvme-tcp: fixed UAF Use-after-Free issues when detecting digest errors. We should also exit the iowork loop when setting rdenabled to true, so that we do not attempt to read data from the socket when the TCP stream is already...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: SCTP: Fixed a memory leak in sctpstreamoutqmigrate. When sctpstreamoutqmigrate is called to release resources related to streamouts, the memory pointed to by priohead in the streamout context is not released properly. The details...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Fixed a possible null-ptr-deref issue when assigning a stream. While AudioDSP drivers assign streams that are exclusively of HOST or LINK type, nothing prevents a user from attempting to assign a COUPLED stream. The...

Astra Linux – Vulnerability in Tomcat9

A vulnerability exists in Apache Tomcat related to uncontrolled resource consumption, caused by an allocation leak in the HTTP/2 backlog tracking when a stream is reset. This issue affects Apache Tomcat: versions from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, and from 9.0.39...

Astra Linux – Vulnerability in Redis

Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user could use scripting commands to inject arbitrary information into the response stream for a given client, potentially corrupting or returning tampered data to other users on the same...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: SCTP: The comparison of MACs has been fixed to require constant-time operations. To prevent timing attacks, MACs need to be compared in constant-time. Use the appropriate helper function for this purpose...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix for use-after-free in the linked stream runtime in sndpcmdrain In the drain loop, the local variable ‘runtime’ is reassigned to the runtime of the linked stream runtime = s-runtime at line 2157. After releasing the...