Astra Linux – Vulnerability in freerdp2

FreeRDP is a free remote desktop protocol library and client. Versions of FreeRDP that are affected may attempt integer additions on too narrow types, resulting in the allocation of a buffer that is too small to hold the written data. A malicious server can trick a FreeRDP-based client into readi...

Astra Linux – Vulnerability in docker.io-app

Moby v25.0.0 – v26.0.2 is vulnerable to NULL Pointer Dereference attacks through the daemon/images/imagehistory.go module...

Astra Linux – Vulnerability in Apache2

Apache HTTP Server 2.4.52 and earlier fail to close inbound connections when errors occur during the discarding of the request body, exposing the server to HTTP Request Smuggling attacks...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: FireWire: OHCI: Masking of bus reset interrupts between ISR and the bottom half In the FireWire OHCI interrupt handler, if a bus reset interrupt occurs, the bus reset interrupts are masked until busresetwork processes and clears...

Astra Linux – Vulnerability in cups

OpenPrinting CUPS is an open-source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, when the AuthType is set to anything other than Basic, if the request contains an Authorization: Basic ... header, the password is not checked. This leads to...

Astra Linux – Vulnerability in libpodofo

A flaw was discovered in PoDoFo 0.9.7. An uncontrolled recursive call within the functions PdfTokenizer::ReadArray, PdfTokenizer::GetNextVariant, and PdfTokenizer::ReadDataType can lead to a stack overflow issue...

Astra Linux – Vulnerability in Python 3.11, Python 3.7

The email module, specifically the “BytesGenerator” class, did not properly quote newlines for email headers when serializing an email message. This issue occurs only when using “LiteralHeader” to write headers that do not follow email folding rules. The new behavior will reject incorrectly folde...

Astra Linux – Vulnerability in Apache2

A memory allocation vulnerability with an excessive size value in Apache HTTP Server’s modhttp leads to a denial of service due to malicious HTTP requests. This issue affects Apache HTTP Server versions 2.4.17 through 2.4.67...

Astra Linux – Vulnerability in Samba

A flaw was discovered in the Samba AD LDAP server. The AD DC database audit logging module can access values of LDAP messages freed by a preceding database module, leading to a use-after-free issue. This issue only occurs when certain privileged attributes are modified, such as userAccountControl...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfttproxy: restrict to prerouting hook TPROXY is only allowed during prerouting, but nfttproxy does not check this. This fix resolves a crash null dereference that occurs when using tproxy from, for example, the output...

Astra Linux – Vulnerability in Apache2

A carefully crafted If: request header can cause a memory read, or a write of a single zero byte, in a pool heap memory location beyond the header value sent. This could cause the process to crash. This issue affects Apache HTTP Server 2.4.54 and earlier...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: nfsd: Under NFSv4.1, fix the issue where double svcxprtput operations on rpccreate cause failures. In error situations, clp-clcbconn.cbxprt should not be referenced as an xprt. Otherwise, both client cleanup and error handling...

Astra Linux – Vulnerability in PackageKit

PackageKit provided detailed error messages to unprivileged callers who were exposed to information about the presence of files and their mimetypes. This information was difficult for those callers to determine on their own...

Astra Linux – Vulnerability in Apache2

Splitting HTTP responses across multiple modules in the Apache HTTP Server allows an attacker who can inject malicious response headers into backend applications to carry out an HTTP desynchronization attack. Users are recommended to upgrade to version 2.4.59, which fixes this issue...

Astra Linux – Vulnerability in freerdp2

FreeRDP is a set of free and open-source remote desktop protocol libraries and clients. In affected versions, an integer overflow in the freerdpbitmapplanarcontext function leads to a heap-buffer overflow. This affects FreeRDP-based clients. FreeRDP-based server implementations and proxies are no...

Astra Linux – Vulnerability in Linux, Linux 5.10

It was discovered that there was a lack of CPU resources in the Linux kernel tracing module functionality in versions prior to 5.14-rc3. This issue occurred due to the way users utilize the trace ring buffer. Only privileged local users with the CAPSYSADMIN capability could exploit this flaw to...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: dm ioctl: A misbehavior occurred when listversions raced with module loading. listversions will first estimate the required space using the dmtargetiteratelistversiongetneeded, &needed call, and then fill the space using the...

Astra Linux – Vulnerability in Apache2

A buffer overwrite vulnerability exists in the Apache HTTP Server, due to poorly crafted regular expressions in the configuration. This issue affects the Apache HTTP Server versions from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, as this version fixes the...

Astra Linux – Vulnerability in Samba

A flaw was discovered in Samba, specifically in the vfsstreamsxattr module. In this module, uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content, which may include sensitive data, resulting in an information...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: A bug related to use after free was fixed due to errors in error path handling in mtkjpegdecdevicerun. In mtkjpegprobe, the variable &jpeg-jobtimeoutwork is bound to mtkjpegjobtimeoutwork. In mtkjpegdecdevicerun,...