Astra Linux - Vulnerability in golang-gogoprotobuf

A issue was discovered in GoGo Protobuf before version 1.3.2. The plugin/unmarshal/unmarshal.go file lacks certain index validations, also known as the “skippy peanut butter” issue...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

A issue was discovered in the Linux kernel before version 6.3.3. There is an out-of-bounds read in the crc16 function in lib/crc16.c when called from fs/ext4/super.c, because ext4groupdesccsum does not properly check an offset. NOTE: This issue is disputed by third parties, as the kernel is not...

Astra Linux – Vulnerability in Erlang

There is a vulnerability in the validation of certificates in the Erlang OTP publickey pubkeyocsp module, which allows forged OCSP responses signed with an expired responder certificate to be accepted as valid. The OCSP response verification in pubkeyocsp:verifyresponse/5 and...

Astra Linux – Vulnerability found in Python 3.11, Python 3.7, and Python 2.7

The ‘zipfile’ module does not check the validity of the offset value specified in the ZIP64 End of Central Directory EOCD Locator record. Instead, the ZIP64 EOCD record is assumed to be the previous record in the ZIP archive. This behavior could be exploited to create ZIP archives that are...

Astra Linux – Vulnerability in linux-astra-modules-6.1, linux-astra-modules-5.10, linux-astra-modules-5.15

The vulnerability of Linux Astra Modules’ kernel modules is related to insufficient validation of input data. Exploiting this vulnerability allows attackers to access confidential data, compromise its integrity, and cause service failures...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: i40e: Fixed the input validation logic for actionmeta. Also, corrected the condition to check for “greater than or equal” to prevent out-of-band dereferencing...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ksmbd: The validation of the request buffer size was added in smb2allocaterspbuf. The response buffer should be allocated in smb2allocaterspbuf before validation of the request. However, fields within the payload as well as the...

Astra Linux - Vulnerability in Golang-1.19

The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With this fix, the HTTP/1 client will now refuse to send requests that contain an invalid Request.Host or Request.URL.Host value...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables – The validation of NFTDATAVALUE during storage to data registers is fully validated. The validation of the register storage for NFTDATAVALUE is conditional. However, the data type is always either NFTDATAVALU...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: nfc: nci: Fixed an uninit-value issue in ncirxwork. syzbot reported the following uninit-value access issue 1. ncirxwork parses received packets from ndev-rxq. It is necessary to validate the header size, payload size, and tot...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: EFI: Fixed a panic in the kdump kernel. Check whether the getnextvariable function is indeed a valid pointer before calling it. In the kdump kernel, this function is set to NULL, which causes a panic during the kexec-ed kernel...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fixed a slab-out-of-bounds issue in smb2allocaterspbuf. If -ProtocolId is set to SMB2 TRANSFORMPROTONUM, the validation of the request size could be skipped. If the request size is smaller than sizeofstruct smb2queryinfore...

Astra Linux – Vulnerability in PHP 8.1, PHP 7.3

In PHP versions starting from 8.1. up to 8.1.32, from 8.2. up to 8.2.28, from 8.3. up to 8.3.19, and from 8.4. up to 8.4.5, when user-supplied headers are sent, insufficient validation of line-end characters may prevent certain headers from being sent or may lead to misinterpretation of certain...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: char: xillybus: Check USB endpoints when probing the device. Ensure that, as the driver probes the device, all endpoints that the driver may attempt to access exist and are of the correct type. All XillyUSB devices must have a Bu...

Astra Linux – Vulnerability in Thunderbird, Firefox

When using Alt-Svc, ALPN failed to properly validate certificates when the original server was redirecting to an insecure site. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: tee: added a overflow check in registershmhelper When special lengths are provided by the user space, registershmhelper may cause an integer overflow when calculating the number of pages covered by a given user space memory regio...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: usb: pegasus: validate USB endpoints The pegasus driver should validate that the device it is probing has the proper number and types of USB endpoints it expects before binding to it. If a malicious device does not have the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: x86/sev: Evicting cache lines during SNP memory validation A vulnerability related to SNP cache coherence requires a cache line eviction mitigation when validating memory after a page state change to private. The specific...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: comedi: pcl812: Fix bit shift out of bounds When checking for a supported IRQ number, the following test is used: c if 1 options1 & board-irqbits However, it-optionsi is an unchecked int value from userspace, so the shift amount...

Astra Linux – Vulnerability in Firefox

Form validation popups may capture escape key presses. Therefore, spamming form validation messages can be used to prevent users from exiting full-screen mode. This vulnerability affects Firefox 128 and Thunderbird 128...