22355 matches found
Astra Linux – Vulnerability in htmldoc
Integer overflow in htmldoc 1.9.11 and earlier may allow attackers to execute arbitrary code and cause a denial of service, similar to CVE-2017-9181...
Astra Linux – Vulnerability in Apache2
Apache HTTP Server 2.4.65 and earlier, with Server Side Includes SSI enabled and modcgid but not modcgi, pass the shell-escaped query string to the exec cmd="..." directives. This issue affects Apache HTTP Server versions prior to 2.4.66. Users are recommended to upgrade to version 2.4.66, which...
Astra Linux – Vulnerability in golang-golang-x-text
An attacker can cause a denial of service by creating an Accept-Language header that requires ParseAcceptLanguage to take significant time to process...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix race between quota disable and quota rescan ioctl There is a race between a task that disables quotas and another task that runs the rescan ioctl. This can lead to a use-after-free of qgroup records from the...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: gfs2: Truncates the address space when flipping the GFS2DIFJDATA flag. When truncating an inode’s address space while flipping the GFS2DIFJDATA flag, depending on that flag, the pages in the address space will either use buffer...
Astra Linux – Vulnerability in parsec-cups
The vulnerability of the Parsec Cups protection and marking mechanism is related to the improper release of memory before deleting the last reference. Exploiting this vulnerability could allow an attacker to trigger a service failure...
Astra Linux – Vulnerability in Firefox and Thunderbird
A missing delay in popup notifications could have allowed an attacker to trick a user into granting permissions. This vulnerability affects Firefox 113, Firefox ESR 102.11, and Thunderbird 102.11...
Astra Linux – Vulnerabilities in Firefox, Thunderbird, NSS
After accepting an untrusted certificate, handling an empty PKCS7 sequence as part of the certificate data could have led to a crash. This crash is believed to be exploitable. This vulnerability affects Firefox ESR 91.5, Firefox 96, and Thunderbird 91.5...
Astra Linux – Vulnerability in Firefox
Service workers may reveal the script-based base URL due to dynamic import. This vulnerability affects Firefox versions earlier than 113...
Astra Linux – Vulnerability in Firefox
A maliciously crafted favicon could lead to a memory-out-of-control crash. This vulnerability affects Firefox versions earlier than 113...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fixed by adding FPU protection for dcn30internalvalidatebw Reason A general protection fault was observed when the WebGL Aquarium was run for a longer duration. If the DRM debug logs were enabled and set to 0x1f,...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1
In the Linux kernel, the following vulnerabilities have been resolved: net: Avoid potential underflow in qdiscpktleninit with UFO After committing 7c6d2ecbda83 “net: Be more cautious regarding silly GSO requests from user space”, the virtionethdrtoskb function added sanity checks to detect...
Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: “riscv”: prevents corruption of pt regs for secondary idle threads. The top of the kernel thread stack should be reserved for pt regs. However, this is not the case for the idle threads of the secondary boot harts. Their stacks...
Astra Linux – Vulnerability in Parsec
The vulnerability of the psaud utility within the PARSEC security subsystem is related to improper memory release after its use. Exploiting this vulnerability allows an attacker to cause a service failure...
Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: virtioring: Fixed a data race by marking eventtriggered as “racy” for KCSAN. The syzbot reported a data race when accessing eventTriggered. Here is the simplified stack when the issue occurred:...
Astra Linux – Vulnerability in WebKit2GTK
There was an issue involving “iframe” elements across origins. This issue has been resolved through improved tracking of security origins. This issue is fixed in Safari 18, iOS 18, iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, and watchOS 11. A malicious website may be able to exfiltrate data...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: btrfs: Do not log conflicting inodes if it’s a directory that was moved during the current transaction. We cannot log an conflicting inode if it’s a directory that was moved from one parent directory to another parent directory...
Astra Linux – Vulnerability in Linux 5.10
A flaw was discovered in the pfnswapentrytopage function within the memory management subsystem of the Linux kernel. In this flaw, an attacker with local user privileges may cause a denial-of-service attack due to a BUG statement that references pmdt x...
Astra Linux – Vulnerability in Firefox
Information disclosure in the IP Protection component. This vulnerability was fixed in Firefox 150 and Thunderbird 150...
Astra Linux – Vulnerability in imagemagick
ImageMagick 7.1.0-49 is vulnerable to information disclosure. When it parses a PNG image e.g., for resizing, the resulting image may contain content from an arbitrary file. This occurs if the ImageMagick binary has permissions to read such files...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: comedi: medaq: Fixed the potential overflow of the firmware buffer. The function me2600xilinxdownload loads the firmware requested by requestfirmware. It is possible for this process to overflow the source buffer due to the...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1
In the Linux kernel, the following vulnerabilities have been resolved: ASoC: meson: axg-card: fixed “use-after-free” issue The buffer “card-dailink” is reallocated in “mesoncardreallocatelinks”. Therefore, the initialization of the “pad” pointer should be moved after this function, when the memor...
Astra Linux – Vulnerability in ntfs-3g
NTFS-3G versions prior to 2021.8.22 may experience a heap buffer overflow when a specially crafted NTFS attribute is set up using the function ntfsattrsetupflag. This could allow code execution and an escalation of privileges...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: atm/fore200e: Fixed a possible data race in fore200eopen. Access to the field fore200e-availablecellrate is protected by the ratemtx lock in the error-handling code of fore200eopen to prevent a data race. The field...
Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15
A use-after-free flaw was discovered in r592remove in drivers/memstick/host/r592.c, responsible for media access in the Linux kernel. This flaw allows a local attacker to crash the system upon device disconnection, potentially leading to a kernel information leak...
Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15
In the Linux kernel, the following vulnerability has been resolved: vcscreen: The load of the struct vcdata pointer in vcswrite was reloaded to avoid a Use-After-Free UAF condition. After a call to consoleunlock in vcswrite, the struct vcdata structure can be freed using vcportdestruct. Therefore...
Astra Linux – Vulnerability in Samba
A flaw was discovered in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the...
Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: net: phy: mscc: Fixed a memory leak that occurred when using one-step timestamping. When running one-step sync timestamping, the hardware is configured to insert the TX time into the frame. There is therefore no reason to keep th...
Astra Linux – Vulnerability in linuxptp
A flaw was discovered in the ptp4l program within the linuxptp package. A missing length check during the forwarding of PTP messages between ports allows a remote attacker to cause an information leak, system crash, or potentially remote code execution. The most significant threat posed by this...
Astra Linux – Vulnerability in curl
With the wolfSSL backend, when CA caching is enabled and a CURLOPTSSLCTXFUNCTION callback replaces the trust store, libcurl can silently reinstall the cached store after the callback returns. This results in a certificate trusted by the cached store but rejected by the callback-selected store bei...
Astra Linux – Vulnerability in Wireshark
The Kismet protocol dissector in Wireshark versions 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows for denial of service attacks...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1
In the Linux kernel up to version 6.7.1, there is a use-after-free in cecqueuemsgfh, related to drivers/media/cec/core/cec-adap.c and drivers/media/cec/core/cec-api.c...
Astra Linux – Vulnerability in Samba
A vulnerability related to information leaks was discovered in Samba’s LDAP server. Due to missing access control checks, a authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store...
Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: net: usbnet: Fix WARNING in usbnetstartxmit/usbsubmiturb The syzbot fuzzer identified a problem in the usbnet driver: usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 754 at drivers/usb/core/urb.c:504...
Astra Linux – Vulnerability in Linux 5.10, Linux
In the Linux kernel, the following vulnerability has been resolved: media: coda: A check for kmalloc has been added. Since kmalloc may return a NULL pointer, it is better to check the return value to avoid dereferencing a NULL pointer, just like with the other cases...
Astra Linux – Vulnerability in Ceph
A flaw was discovered in the Red Hat Ceph Storage RGW in versions prior to 14.2.21. When processing a GET request for a swift URL that ends with two slashes, it can cause the rgw component to crash, resulting in a denial of service. The most significant threat to the system is its availability...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: ksmbd: No longer allows guest users on multi-channel connections. This patch returns STATUSNOTSUPPORTED if the binding session is a guest session...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: Fixed the issue where quota root leaks after quota disabling fails. If, during quota disabling, we fail to clean the quota tree or delete the root node from the root tree, we jump to the ‘out’ label without ever...
Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: A NULL pointer dereference has been fixed in tcpmpdsvdm. It is possible that typecregisterpartner returns ERRPTR upon failure. When port-partner is an error, a NULL pointer dereference may occur, as shown below:...
Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Handling cameras with invalid descriptors If the source entity does not contain any pads, do not create a link...
Astra Linux – Vulnerability in f2fs-tools
There is an exploitable code execution vulnerability in the file system checking functionality of fsck.f2fs 1.12.0. A specially crafted f2fs file can exploit a logical flaw and out-of-bounds heap operations, leading to code execution. An attacker can provide a malicious file to trigger this...
Astra Linux – Vulnerability in Linux 5.10, Linux
In the Linux kernel, the following vulnerabilities have been resolved: mmc: rtsxusbsdmmc: Fix the return value check in mmcaddhost. The mmcaddhost function may return an error. If we ignore its return value, the memory allocated by mmcallochost will be leaked, leading to a kernel crash due to the...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: drm: Fixed a potential null-ptr-deref in drmvblankDestroyWorker. The call to drmvblankinit includes drmMaddactionorreset, with drmvblankinitRelease as the action. If drmMaddaction fails, it will directly call...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerabilities have been resolved: Net: Ethernet: mtk-star-emac: fixed spinlock recursion issues during rx/tx polls. Use spinlockirqsave and spinunlockirqrestore instead of spinlock and spinunlock in the mtk-staremac driver to avoid spinlock recursion issues th...
Astra Linux – Vulnerability in Wireshark
A crash in the Sysdig Event dissector in Wireshark versions 3.6.0, 3.4.0 to 3.4.10 allows for denial of service through packet injection or crafted capture files...
Astra Linux – Vulnerability in libraw
Buffer overflow vulnerability in the LibRaw::stretch function in libraw\src\postprocessing\aspectratio.cpp...
Astra Linux – Vulnerability in Linux 5.10, Linux
In the Linux kernel, the following vulnerability has been resolved: clk: qcom: clk-rcg2: Update the logic to calculate the D value for RCG. The display pixel clock has a requirement on certain newer platforms to support M/N as 2/3, and the final D value calculated results in underflow errors. As...
Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: HID: i2c-hid-of: fix NULL dereference on failed power-up Some time ago, the I2C HID implementation was split into an ACPI and OF part. However, the new OF driver never initializes the client pointer, which is dereferenced in case...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: iavf: Error handling in iavfinitmodule has been fixed. The iavfinitmodule no longer destroys the workqueue when pciregisterdriver fails. Instead, call destroyworkqueue when pciregisterdriver fails to prevent resource leaks. This...
Astra Linux – Vulnerability in Firefox and Thunderbird
Memory safety bugs exist in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142, and Thunderbird 142. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability ha...