22021 matches found
Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1
In the Linux kernel, the following vulnerability has been resolved: ALSA: Timer – Setting a lower limit on the start tick time Currently, the ALSA timer does not have a lower limit for the start tick time. It allows a very small size, for example, 1 tick with a resolution of 1 ns for the hrtimer...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: The can: hi311x module has corrected the ndochangemtu function to prevent buffer overflows. Sending a PFPACKET allows bypassing the CAN driver’s logic and directly reaching the xmit function of the CAN driver. The only check...
Astra Linux – Vulnerability in Chromium
A heap buffer overflow in UMA in Google Chrome prior to version 111.0.5563.64 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Insufficient data validation in DevTools in Google Chrome prior to 121.0.6167.85 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: AppArmor: Fixed the issue where an unprivileged local user could perform privileged policy management. An unprivileged local user can load, replace, and remove policies by opening the AppArmor interfaces. This can be achieved...
Astra Linux – Vulnerability in binutils
A vulnerability, classified as problematic, was discovered in GNU Binutils up to version 2.43. This vulnerability affects the disassemblebytes function in the file binutils/objdump.c. Manipulation of the buf argument leads to a stack-based buffer overflow. The attack can be initiated remotely. Th...
Astra Linux – Vulnerability in Linux, Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: x86/hyperv: Fixed a NULL dereferencing in sethvtscchangecb if the Hyper-V setup fails. Checked for a valid hvvpindex array before dereferencing hvvpindex when setting Hyper-V’s TSC change callback. If Hyper-V setup fails in...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fixed an out-of-bounds write in kfdeventpageset. The kfdeventpageset function writes KFDSIGNALEVENTLIMIT 8 bytes via memset, without checking the buffer size parameter. This allows unprivileged userspace to trigger an...
Astra Linux – Vulnerability in Linux, Linux 5.10
In several functions of binder.c, there is a possibility of representing the wrong domain to SELinux due to a race condition. This could lead to a local escalation of privileges without the need for additional execution privileges. User interaction is not required for exploitation. Product:...
Astra Linux – Vulnerability in OpenSSL
Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJobj2txt directly, or use any of the OpenSSL subsystems such as OCSP, PKCS7/SMIME, CMS, CMP/CRMF, or TS without a message size limit may...
Astra Linux – Vulnerability in openimageio
There is a vulnerability related to out-of-bounds reading in the way OpenImageIO version v2.3.19.0 processes string fields in TIFF image files. A specially crafted TIFF file can lead to information disclosure. An attacker can provide a malicious file to exploit this vulnerability...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: fbdev: rivafb: fixed a divide error in nv3arb A userspace program can trigger the RIVA NV3 arbitration code by calling the FBIOPUTVSCREENINFO ioctl on /dev/fb. When doing so, the driver recomputes FIFO arbitration parameters in...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: BPF: Fixed a UAF issue in bpftrampolinelinkcgroupshim The root cause of this bug is that when ‘bpflinkput’ reduces the refcount of ‘shimlink-link.link’ to zero, the resource is considered released, but may still be referenced via...
Astra Linux – Vulnerability in Twisted
In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF...
Astra Linux – Vulnerability in Firefox and Thunderbird
Bypass of the same-origin policy in the Networking: JAR component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...
Astra Linux – Vulnerability in libde265
There is an assertion scalinglistpredmatrixiddelta==1' failed at sps.cc:925 in libde265 v1.0.8 when decoding the file. This can allow attackers to cause a Denial of Service DoS by running the application with a crafted file, or potentially causing unspecified other impacts...
Astra Linux – Vulnerability in Chromium
Insufficient validation of untrusted input in the UI of Google Chrome on Linux and ChromeOS before version 148.0.7778.96 allowed a remote attacker who convinced a user to perform certain UI gestures to execute arbitrary code via a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: drm/logicvc: A reference leak of the device node occurred in the logicvcdrmconfigParse function. The logicvcdrmconfigParse function calls ogetchildbyname to find the “layers” node, but fails to release the reference, resulting in...
Astra Linux – Vulnerability in Firefox
The Remote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to connect back locally to the user’s browser to control it. This bug only affected Firefox when WebDriver was enabled, which is not the default configuration.. This vulnerability...
Astra Linux – Vulnerability in Ansible
A flaw was discovered in the way Ansible templating was implemented in versions prior to 2.6.18, 2.7.12, and 2.8.2. This flaw posed a risk of information disclosure due to unintended variable substitutions. By exploiting these unintentional substitutions, the content of any variable could be...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fixed the issue where the timer for starting a call race against the destruction of the call occurred. The rxrpccall structure contains a timer used to handle various timed events related to a call. This timer can be...
Astra Linux – Vulnerability in Apache2
A properly crafted request URI-path can cause modproxy to forward the request to an origin server chosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier...
Astra Linux – Vulnerability in libwebp
A flaw was discovered in libwebp in versions prior to 1.0.1. A heap-based buffer overflow is possible in the function WebPDecodeRGBInto due to an invalid check for buffer size. The greatest threat from this vulnerability is related to data confidentiality and integrity, as well as system...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: BPF: Fixed potential improper pointer dereferencing in bpfsysbpf. The bpfsysbpf helper function allows an eBPF program to load another eBPF program from within the kernel. In this case, the argument union bpfattr pointer along...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fixed memory leakage This patch addresses potential memory leakage and segmentation faults in the gpuvmimportdmabuf function...
Astra Linux – Vulnerability in Wireshark
A NULL pointer exception occurs in the Modbus dissector in Wireshark versions 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17, allowing for denial of service through packet injection or malicious capture files...
Astra Linux – Vulnerability in Chromium
Insufficient policy enforcement in the Popup Blocker component of Google Chrome prior to version 108.0.5359.71 allowed a remote attacker to bypass navigation restrictions through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Linux
A issue was discovered in the Linux kernel through version 5.10.1, as used with Xen up to version 4.14.x. The Linux kernel’s PV block backend expects the kernel thread handler to reset ring-xenblkd to NULL when the thread is stopped. However, the handler may not have enough time to execute if the...
Astra Linux – Vulnerability in Chromium
Before version 88.0.4324.182, using "Use after free" in Downloads in Google Chrome on Windows allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page...
Astra Linux – Vulnerability in Intel Microcode
Incomplete cleanup in specific special register read operations for some IntelR processors may allow an authenticated user to potentially enable information disclosure via local access...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: afs: Fixed lock recursion issue The function afswakeupasynccall can lead to lock recursion. The problem arises when this function is called from AFRXRPC while holding the -notifylock. However, it attempts to acquire a reference t...
Astra Linux – Vulnerability in Linux, Linux 5.10
There is a use-after-free in the Linux kernel’s tcnewtfilter module, which could allow a local attacker to gain privilege escalation. This vulnerability requires unprivileged user namespaces for exploitation. We recommend upgrading to a version after commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b...
Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15
A issue was discovered in the Linux kernel through version 5.16-rc6. The function malidpcrtcreset in the file drivers/gpu/drm/arm/malidpcrtc.c lacks a check on the return value of kzalloc. This could lead to a null pointer dereferencing...
Astra Linux – Vulnerability in Linux
In memzeroexplicit of compiler-clang.h, there is a possible way to bypass defense in depth due to uninitialized data. This could lead to the disclosure of local information without requiring additional execution privileges. User interaction is not required for exploitation. Product: Android...
Astra Linux – Vulnerability in Shadow
A vulnerability was discovered in Shadow 4.5. The newgidmap function part of shadow-utils is setuid, allowing an unprivileged user to be placed in a user namespace where setgroups2 is allowed. This enables an attacker to remove themselves from a supplementary group, potentially granting them acce...
Astra Linux – Vulnerability in grub2
A crafted 16-bit grayscale PNG image may lead to an out-of-bounds write in the heap area. An attacker may exploit this to cause heap data corruption or, ultimately, arbitrary code execution and circumvent secure boot protections. This issue is highly complex to exploit; an attacker needs to perfo...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: RDMA/irdma: Fixed the bug where sleep operations occurred from an invalid context. RoCEv2 QP processing in netdev events caused a kernel split. This issue was fixed by removing the handling of RoCEv2 in...
Astra Linux – Vulnerability in ofono
A flaw was discovered in ofono, an open-source telephony software for Linux. A stack overflow bug was triggered within the decodesubmitreport function during SMS decoding. It is assumed that the attack scenario can be executed from a compromised modem, a malicious base station, or simply through...
Astra Linux – Vulnerability in PHP 7.3
In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23, and 7.4.x below 7.4.11, when AES-CCM mode is used with the opensslencrypt function and a 12-byte IV is provided, only the first 7 bytes of the IV are actually used. This can result in reduced security and incorrect encrypted data...
Astra Linux – Vulnerability in Ruby-Nokogiri
A command injection vulnerability exists in Nokogiri v1.10.3 and earlier. This vulnerability allows commands to be executed in a subprocess via Ruby’s Kernel.open method. Processes become vulnerable only if the undocumented method Nokogiri::CSS::Tokenizerloadfile is called with unsafe user input ...
Astra Linux – Vulnerability in libmysofa
libmysofa is vulnerable to Heap-based Buffer Overflow attacks...
Astra Linux – Vulnerability in Apache2
Apache HTTP Server versions 2.4.41 to 2.4.46 with modproxyhttp can become unstable when processing specially crafted requests that use both Content-Length and Transfer-Encoding headers. This can lead to a denial of service...
Astra Linux – Vulnerability in Chromium
Insecurity-related UI in TabStrip and Navigation in Google Chrome on Android prior to version 89.0.4389.72 allowed a remote attacker to spoof the contents of the Omnibox URL bar through a crafted HTML page...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: tracing/eprobes: Do not allow eprobes to use $stack, or % for regs While working with event probes eprobes, I tried to see what would happen if I attempted to retrieve the instruction pointer %rip knowing that event probes do not...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: fs/ntfs3: Added a null pointer check to attrloadrunsvcn Some metadata files are processed before the MFT. This requires adding a null pointer check for certain corner cases that could lead to NPD when reading these metadata...
Astra Linux – Vulnerability in docker.io
Moby is an open-source container framework developed by Docker Inc., distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component, dockerd, which is developed as moby/moby, is commonly referred to as Docker. Swarm Mode, which is...
Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: spi: sun6i – reduced the DMA RX transfer width to a single byte. Through empirical testing, it has been determined that sometimes RX SPI transfers with DMA enabled may return corrupted data. This issue arises due to the loss of o...
Astra Linux – Vulnerability in Vim
Vim is vulnerable to Use After Free vulnerabilities...
Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15
A use-after-free vulnerability in the Linux kernel’s net/sched:clsRoute component can be exploited to achieve local privilege escalation. When the route4change function is called on an existing filter, the entire tcfresult struct is always copied into the new instance of the filter. This creates ...
Astra Linux – Vulnerability in Intel Microcode
The removal or modification of security-critical code in certain Intel processors may allow an authenticated user to potentially enable information disclosure through local access...