19108 matches found
Astra Linux – Vulnerability in Firefox and Thunderbird
In several cases, browser prompts might have been obscured by pop-ups controlled by content. This could lead to potential user confusion and spoofing attacks. This vulnerability affects Firefox 113, Firefox ESR 102.11, and Thunderbird 102.11...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: idpf: checked for errors when calling registernetdev in init. The current init logic ignores the error code from registernetdev. This could lead to a WARNON message when attempting to unregister the device, if such an attempt...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fixed a race condition that could lead to UAF in sndusbmidifree. The previous commit 0718a78f6a9f “ALSA: usb-audio: Properly terminates the timer upon endpoint deletion” fixed an UAF issue caused by the error...
Astra Linux – Vulnerability in Linux, Linux 5.15
A flaw was discovered in cifs-utils. When attempting to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This issue may result in the disclosure of sensitive data from the host’s Kerberos...
Astra Linux – Vulnerability in Linux
In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: Fix VLAN traffic leaks The PCRMATRIX field was set to all 1’s when VLAN filtering is enabled, but it wasn’t reset when VLAN filtering was disabled. This could lead to traffic leaks: ip link add br0 type bridge...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: drm/vmwgfx: Unmap the surface before resetting it on a plane state Switching to a new plane state requires unreferencing of all held surfaces. In the work required for mob cursors, the mapped surfaces started being cached, but...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Skips the dev-iotlb flush for inaccessible PCIe devices without scalable mode. PCIe endpoints with ATS enabled and passed through to userspace e.g., QEMU, DPDK can cause a system hard lock when their link fails, eithe...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: monaco: Reserve a full Gunyah metadata region. We have observed spurious “Synchronous External Abort” exceptions ESR=0x96000010 and kernel crashes on Monaco-based platforms. These faults are caused by the kernel...
Astra Linux – Vulnerability in linux-astra-modules-5.4
The vulnerability of the initparsecsecid function in the linux-astra-modules kernel module is related to improper memory release after its use. Exploiting this vulnerability allows an attacker to cause service failures...
Astra Linux – Vulnerability in ffmpeg5
Buffer overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allowing a local attacker to execute arbitrary code and cause a denial of service DoS via the afdialoguenhance.c:261:5 in the destereo component...
Astra Linux – Vulnerability in ffmpeg
A denial-of-service vulnerability exists in FFmpeg 4.2 due to a memory leak in avcodecalloccontext3 in options.c...
Astra Linux – Vulnerability in Chromium
Before version 103.0.5060.53, using "use after free" in Interest groups in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption through a crafted HTML page...
Astra Linux – Vulnerability in hdf5
A memory leak in the H5Ochunkdeserialize function within H5Ocache.c, part of the HDF HDF5 library, from version 1.10.3 allows attackers to cause a denial of service due to excessive memory consumption through a specially crafted HDF5 file...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: iouring: Now waits for request completions upon exit. When the ring exits, cleanup is performed, and the final cancelations and waits for completions are handled by ioringexitwork. This function is invoked by kworker, which does...
Astra Linux – Vulnerability in libvncserver
A issue was discovered in LibVNCServer before version 0.9.13. An improperly closed TCP connection causes an infinite loop in the libvncclient/sockets.c file...
Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fixed a potential double-free in fsanycreategroups. When kcalloc is called for ft-g and succeeds, but kvzalloc is called for in and fails, fsanycreategroups will free ft-g. However, its caller, fsanycreatetable, will...
Astra Linux – Vulnerability in Chromium
The use of “after free” in the Guest View of Google Chrome before version 114.0.5735.198 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Type Confusion in V8 in Google Chrome prior to version 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
The use of after-free in the Media component in Google Chrome before version 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in krb5
In kdc/kdcpreauthec.c of the Key Distribution Center KDC in MIT Kerberos 5 also known as krb5, before versions 1.18.4 and 1.19.x, and before version 1.19.2, remote attackers could exploit a vulnerability that led to a NULL pointer dereferencing and a crash of the daemon. This occurs because the...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: drm/i915: fixed a race condition UAF in i915perfaddconfigioctl. Userspace may attempt to race the creation of the oaconfig object with config remove, resulting in a use-after-free if we dereference the object after unlocking the...
Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1
In the Linux kernel, the following vulnerabilities have been resolved: - Do not allow gsosize to be set to GSOBYFRAGS. - A missing check in virtionethdrtoskb allowed syzbot to crash kernels again. Do not allow gsosize to be set to GSOBYFRAGS 0xffff, because this magic value is used by the kernel....
Astra Linux – Vulnerability in Linux 5.10, Linux
A flaw in the boot CPU could be exploited by attacks targeting speculative execution behavior. This flaw is related to the power management options in the Linux kernel’s X86 CPU. It was discovered in the way users resume the CPU from suspend-to-RAM. A local user could utilize this flaw to...
Astra Linux – Vulnerability in libxml2
There is a flaw in libxml2’s xmllint in versions before 2.9.11. An attacker who can submit a crafted file for processing by xmllint could trigger a use-after-free. The most significant impact of this flaw is on confidentiality, integrity, and availability...
Astra Linux – Vulnerability in Linux, Linux 5.10
A flaw in the processing of received ICMP errors such as ICMP fragments and ICMP redirections within the Linux kernel’s functionality was identified. This flaw allows an off-path remote user to quickly scan open UDP ports. This vulnerability enables a remote user to bypass the UDP source port...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM – Fix for a panic occurring on an out-of-bounds guest IRQ. Since the guestIRQ comes from the KVMIRQFD API call, it may trigger a crash in svmupdatepiirte, due to an out-of-bounds access. Crash output: pid: 22218 task:...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: bpf: Support deferring bpflink deallocation to after RCU grace period For some program types, the “bpflink” is passed as a “context” that can be used by those BPF programs to retrieve additional information. For example, for...
Astra Linux – Vulnerability in Thunderbird
Signatures are written to disk before and read during verification. This may lead to a race condition if a malicious local process or user replaces the file. This vulnerability affects Thunderbird 78.10...
Astra Linux – Vulnerability in netcdf
A issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxmldecode, when parsing a crafted XML file, performs incorrect memory handling. This results in an overflow of the heap-based buffer when strchr is called, starting with a pointer after a '\0' character where the processing of th...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: gpio: loongson-64bit: Fixed an incorrect NULL check after devmkcalloc Fixed an incorrect NULL check in loongsongpioinitirqchip. The function checks chip-parent instead of chip-irq.parents...
Astra Linux – Vulnerability in libde265
Libde265 v1.0.4 contains a heap buffer overflow in the putweightedbipred16fallback function, which can be exploited through a specially crafted file...
Astra Linux – Vulnerability in libsdl2
SDL Simple DirectMedia Layer version 2.0.12 has a heap-based buffer over-read issue in the function Blit3or4to3or4inversedrgb in the file video/SDLblitN.c, caused by a malicious .BMP file...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: bnxten: Fixed a possible memory leak in bnxtrdmaauxdeviceinit. If ulp = kzalloc fails, the allocated edev will leak because it is not properly assigned, and the cleanup mechanism will not be able to free it. This issue was fixed ...
Astra Linux – Vulnerability in busybox
There is a stack overflow vulnerability in ash.c:6030 in busybox before version 1.35. In the environment of the Internet of Vehicles, this vulnerability can lead to the execution of arbitrary code from commands...
Astra Linux – Vulnerability in Chromium
Before version 81.0.4044.92, using the "After Free" feature in Google Chrome allowed a remote attacker to execute arbitrary code through a crafted HTML page...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: In video/aperture, it is now possible to match the device in sysfbdisable optionally. In apertureremoveconflictingpcidevices, we currently only call sysfbdisable for VGA-class devices. This leads to the following issue when the...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: Platform/x86: intel-vbtn – Protect the ACPI notify handler from racing with itself Since the commit e2ffcda16290 “ACPI: OSL: Allow Notify handlers to run on all CPUs”, ACPI notify handlers like intel-vbtn’s notifyhandler may run ...
Astra Linux – Vulnerability in sane-backends
A NULL pointer dereferencing in SANE backends before version 1.0.30 allows a malicious device connected to the same local network as the victim to cause a denial of service, GHSL-2020-079...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: ice: Fixed a race condition during the interface enslavement process. The commit 5dbbbd01cbba83 “ice: Avoiding RTNL lock when recreating auxiliary devices” modifies the process of recreating auxiliary devices. As a result, the...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: arm64: acpi: Fixed a possible memory leak related to ffhctxt. A memory leak may occur if the SMCCC version and conduit checks fail, resulting in the return of -EOPNOTSUPP without freeing the allocated memory. The issue was fixed ...
Astra Linux – Vulnerability in Vim
Vim is vulnerable to Heap-based Buffer Overflow attacks...
Astra Linux – Vulnerability in Qemu
A flaw was discovered in the vhost-vsock device of QEMU. In the event of an error, an invalid element was not detached from the virtqueue before freeing its memory, resulting in memory leakage and other unexpected issues. This issue affects QEMU versions up to 6.2.0...
Astra Linux – Vulnerability in Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Wipe copies of clear-key structures in case of failure. Wipe all sensitive data from the stack for all IOCTLs that convert a clear-key into a protected-or-safe-key...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: ext4: Fixed an uninitialized value in ‘ext4evict inode’. Syzbot identified the following issue: ===================================================== BUG: KMSAN: Uninitialized value in ext4evict inode+0xdd/0x26b0,...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: drivers/perf: hisi: Do not migrate perf to the CPU that is going to be torned down. The driver needs to migrate the perf context if the currently used CPU is going to be torned down. By the time the cpuhp::teardown callback is...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: nvmet-fcloop: Check remoteport-portstate before calling done Callback In the nvmefchandlelsrqstwork function, the lsrsp-done callback is set only when remoteport-portstate is FCOBJSTATEONLINE. Otherwise, the nvmefcxmtlsrsp’s LLDD...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: regulator: fp9931: Fixed a runtime reference leak in fp9931hwmonread. In fp9931hwmonread, if regmapread fails, the function returns an error code without calling pmruntimeputautosuspend, resulting in a PM reference leak...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: “Revert ‘media: v4l2-ctrls: show all owned controls in logstatus’”. This change is reflected in commit 9801b5b28c6929139d6fceeee8d739cc67bb2739. This patch introduced a potential deadlock scenario: Wed May 8 10:02:06 2024 Possibl...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: Wifi: ath12k – Fixed issues with dfs-radar and temperature event locking. The ath12k active PDevs are protected by RCU, but the code responsible for handling DFS-radar and temperature events, which calls ath12kmacgetarbypdevid...