Astra Linux – Vulnerability in Chromium

Before version 115.0.5790.170, read and write access in WebGL in Google Chrome allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Color in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in Themes in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially serve malicious content to a user via a crafted background URL. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Insufficient data validation in Permission Prompts in Google Chrome prior to 117.0.5938.62 allowed an attacker who convinced a user to install a malicious app to potentially perform a sandbox escape via a malicious file. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Navigation in Google Chrome prior to 113.0.5672.63 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform domain spoofing via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Before version 99.0.4844.51, using Accessibility in Google Chrome allowed a remote attacker who convinced a user to perform certain UI gestures to execute arbitrary read/write operations through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

The use of after-free in MediaStream in Google Chrome before version 116.0.5845.140 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: The userfaultfdapi function has been fixed to return EINVAL as expected. Currently, if we request a feature that is not set in the kernel configuration, we will fail silently and return all available features. However, the manual...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: tee: amdtee: fixed a race condition in amdteeopenSession. There is a potential race condition in amdteeopenSession that may lead to a use-after-free. For example, in amdteeopenSession, after sess-sessmask is set, and before the...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: btrfs: Fixed a deadlock that occurred when cloning inline extents and using qgroups. There are a few exceptional cases where cloning an inline extent requires copying the inline extent data into a page of the destination inode...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

A problem with out-of-bound reading was detected in brcmfmac/cfg80211.c within the drivers/net/wireless/broadcom/brcm80211 directory of the Linux kernel. This issue can occur when the associnfo-reqlen data is larger than the size of the buffer, which is defined as WLEXTRABUFMAX, resulting in a...

Astra Linux – Vulnerability in u-boot

A issue was discovered in Das U-Boot during the period from 2019.07. There is an unbounded memcpy operation with an unvalidated length at nfsreadlinkreply in the “else” block, after calculating the new path length...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: drm/amd/display: fixed integer types and null check locations Reason: Issues fixed: - Comparison with a wider integer type in the loop condition, which could lead to infinite loops. - Dereferencing a pointer before performing ...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: ipmi: Fixed the use of a pointer after it is freed in ipmidestroyuser. The intffree function frees the “intf” pointer, so we cannot dereference it again in the next line...

Astra Linux – Vulnerability in hdf5

The HDF5 library from version 1.14.3 has a heap-based buffer overflow issue in the H5Tconvstructopt function within H5Tconv.c...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fixed a memory leak in initcreditreturn. When dmaalloccoherent fails to allocate dd-crbasei.va, initcreditreturn should deallocate dd-crbase and dd-crbasei that were allocated earlier. Otherwise, those resources will nev...

Astra Linux – Vulnerability in Firefox

If an attacker loads a font using FontFace on a background worker, a use-after-free might occur, resulting in a potentially exploitable crash. This vulnerability affects Firefox versions earlier than 107...

Astra Linux – Vulnerability in Firefox and Thunderbird

After requesting multiple permissions and closing the first permission panel, subsequent permission panels will be displayed in a different position, but still record a click at the default location. This allows users to be tricked into accepting permissions they do not want to grant. This bug on...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: - tty: serial: Fixed a refcount leak issue in uccuart.c In socinfo, offindnodebytype will return a node pointer with the refcount incremented. We should use ofnodeput when it is no longer needed...

Astra Linux – Vulnerability in udisks2

A vulnerability has been discovered in udisks2. This flaw allows an attacker to submit a specially crafted image file/USB, resulting in kernel panic. The greatest threat posed by this vulnerability is to system availability...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: regmap: slimbus: Fix the buscontext pointer in regmap init calls The commit 4e65bda8273c “ASoC: wcd934x: Fix error handling in wcd934xCodecParsedata” revealed the issue in the slimbus regmap. This commit causes audio playback ...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: ipvs: fixed an warning in ipvsappnetcleanup. During the initialization of ipvsappnetinit, if the file ipvsapp cannot be created, the initialization will still succeed by default. Therefore, the ipvsapp file will not be found duri...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: Replace physindev with physinif in nfbridgeinfo. A skb can be added to the neigh-arpqueue while waiting for an arp reply. In this case, the skb’s skb-dev may differ from the neigh-dev of the destination. For...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

A deadlock flaw was discovered in the Linux kernel’s BPF subsystem. This flaw allows a local user to potentially crash the system...

Astra Linux – Vulnerability in openjpeg2

A flaw was discovered in the opj2decompress program within openjpeg2 2.4.0, particularly in its handling of an input directory containing a large number of files. When it fails to allocate a buffer to store the filenames of the input directory, it calls free on an uninitialized pointer, resulting...

Astra Linux – Vulnerability in open-vm-tools

VMware Tools contains a vulnerability related to bypassing the SAML token signature. A malicious actor who has been granted “Guest Operation Privileges” can potentially elevate their privileges if the target virtual machine has been assigned a more privileged “Guest Alias”. source-iocs-preserved...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ntfs: Set a dummy block size to “read bootblock” when mounting. During mounting, sb-sblocksize is used to read the bootblock without being defined or validated. Set a dummy block size before attempting to read the bootblock. The...

Astra Linux – Vulnerability in leptonlib

Leptonica before version 1.80.0 allows a denial-of-service attack application crashes due to an incorrect left shift in the pixConvert2To8 function in pixconv.c...

Astra Linux – Vulnerability in connman

The client.c file in gdhcp within ConnMan, as of version 1.41, can be exploited by network-adjacent attackers who operate a crafted DHCP server. This exploitation can lead to a stack-based buffer overflow and a denial of service attack, resulting in the termination of the connman process...

Astra Linux – Vulnerability in FLAC

A buffer overflow vulnerability exists in the function bitwritergrow in FLAC before version 1.4.0, allowing remote attackers to execute arbitrary code through crafted inputs to the encoder...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: MIPS: Cavium-Octeon: The issue of missing nodeput in octeon2usbclocksstart has been fixed. We should call nodeput for the reference uctlnode returned by ofgetparent, as this will increase the refcount. Otherwise, there will be a...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: HID: amdsfh: Switch to device-managed dmamalloccoherent Using the device-managed version simplifies cleanup in the probe function. This also ensures proper cleanup, which helps to resolve memory errors, page faults, btrfs...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: nvme-multipath: fixed the lockdep warning due to the partition scan operation. The test cases nvme/014, 057, and 058 occasionally fail due to the lockdep warning. As reported in the Closes tag URL, this warning indicates that ...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ksmbd: Fixed a race condition in the RPC handle list access mechanism. The sess-rpchandlelist XArray manages RPC handles within a ksmbd session. Access to this list is intended to be protected by sess-rpclock a rwsemaphore...

Astra Linux – Vulnerability in RustC

In the standard library of Rust before version 1.49.0, VecDeque::makecontiguous has a bug where the same element may be popped more than once under certain conditions. This bug could lead to a use-after-free or double-free situation...

Astra Linux – Vulnerability in dcmtk

DCMTK through version 3.6.6 does not handle memory deallocation properly. The object in the program is freed, but its address is still used in other locations. Sending specific requests to the dcmqrdb program will lead to a double-free. An attacker can use this vulnerability to launch a DoS attac...

Astra Linux – Vulnerability in virglrenderer

A double-free vulnerability exists in the vrendrenderer.c file within virglrenderer up to version 0.8.1. Attackers can exploit this vulnerability to cause a denial of service by triggering texture allocation failures. The reason is that vrendrendererresourceallocatedtexture is not an appropriate...

Astra Linux – Vulnerability in DjVuLibre

DjVuLibre is a GPL implementation of DjVu, a web-centric format for distributing documents and images. Prior to version 3.5.29, the MMRDecoder::scanruns method was vulnerable to an OOB-write vulnerability, as it did not check that the xr pointer remained within the bounds of the allocated buffer...

Astra Linux – Vulnerability in GhostScript

Artifex Ghostscript before version 10.03.0 has a heap-based pointer disclosure observable in a constructed BaseFont name in the function pdfbasefontalloc...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: A memory leak occurred in flow rule handling during the commit path. The abort path released the flow rule object, but the commit path did not. The code has been updated to destroy these objects before...

Astra Linux – Vulnerability in u-boot

A issue was discovered in Das U-Boot during the period from 2019.07. There is an unbounded memcpy operation when parsing a UDP packet, due to an underflow of the netprocessreceivedpacket integer value during the ncinputpacket call...

Astra Linux – Vulnerability in ntfs-3g

A properly crafted NTFS image can lead to out-of-bounds reads in ntfsattrfind and ntfsexternalattrfind in NTFS-3G 2021.8.22...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: media: dvb-usb: dtv5100: A out-of-bounds access occurred in dtv5100i2cmsg. The rlen value is a user-controlled value, but dtv5100i2cmsg does not check the size of the rlen value. Therefore, if the rlen value is set to a value...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: jbd2: Stop waiting for space when jbd2cleanupjournaltail returns an error. In jbd2logwaitforspace, we may call jbd2cleanupjournaltail to reclaim some journal space. However, if an error occurs during the execution of...

Astra Linux – Vulnerability in LibreOffice

The Certificate Validation user interface in LibreOffice may contain potential vulnerabilities. Signed macros are scripts that have been digitally signed by the developer using a cryptographic signature. When a document containing a signed macro is opened, LibreOffice displays a warning before th...

Astra Linux – Vulnerability in Wireshark

Excessive memory consumption in the MS-WSP dissector in Wireshark versions 3.4.0 to 3.4.4, and 3.2.0 to 3.2.12 may allow denial of service through packet injection or crafted capture files...

Astra Linux – Vulnerability in CGal

There are multiple code execution vulnerabilities in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could result in code execution. An attacker can provide malicious input to trigger...

Astra Linux – Vulnerability in Mariadb 10.3

In MariaDB, the getsortbytable function before version 10.6.2 allows an application to crash due to certain uses of the ORDER BY clause...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: dpaa2-ptp: Fixed the refcount leak in dpaa2ptpprobe. This node pointer is returned by offindcompatiblenode, and the refcount is incremented. Calling ofnodeput helps to address the refcount leak issue...

Astra Linux – Vulnerability in gst-plugins-bad1.0

GStreamer AV1 Codec Parsing Heap-based Buffer Overflow: A Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability, but the attack vecto...