Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ext4: a potential memory leak has been fixed in ext4fcrecordregions. Since krealloc may return NULL, in this case, state-fcregions may not be freed by krealloc. However, state-fcregions is already set to NULL. This could lead to ...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: vhost-scsi: Fixed the handling of multiple calls to vhostscsisetendpoint. If vhostscsisetendpoint is called multiple times without a vhostscsiclearendpoint between them, we may encounter several bugs identified by Haoran Zhang...

Astra Linux – Vulnerability in Chromium

Inappropriate implementations of performance APIs in Google Chrome prior to version 89.0.4389.72 allowed a remote attacker to leak cross-origin data through a crafted HTML page...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Ensure that the DAID handling is completed before deleting an NPIV instance. Deleting an NPIV instance requires that all fabric ndlps be released before the resources of the NPIV can be destroyed. Failure to release t...

Astra Linux – Vulnerability in Chromium

A vulnerability was identified in GWP-ASan in Google Chrome prior to version 149.0.7827.53, allowing a local attacker to obtain potentially sensitive information from process memory through a malicious file. Chromium security severity: Medium...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ima: Fixed a potential integer overflow in imaappraisemeasurement. When ima-modsig is enabled, the rc parameter passed to evmverifyxattr may be negative, which could lead to an integer overflow issue...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in HTML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fixed a missing dirty page tracking issue in pte,pmdwrprotect When the hardware page table walker PTW is enabled on LoongArch, the CPU may set PAGEDIRTY directly in the page table entry during a write TLB miss, without...

Astra Linux – Vulnerability in Chromium

Incorrect authorization settings in Google Chrome prior to version 152.0.7977.75 allowed a remote attacker to bypass system access restrictions through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Jackson-Databind

FasterXML Jackson-Databind 2.x versions before 2.9.10.8 mishandle the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/rds: fixed the possible null dereference of cp The cp parameter may be null. Calling cp-cpconn would result in a null dereference. Simon Horman adds: Analysis: cp is a parameter of rdsrdmamap, and it is not reassigned. The...

Astra Linux – Vulnerability in WebKit2GTK

This issue has been resolved through improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6, iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, and watchOS 11.6. Processing maliciously crafted web content may lead to an unexpected Safari crash...

Astra Linux – Vulnerability in Firefox and Thunderbird

When resizing a popup after requesting fullscreen access, the popup does not display the fullscreen notification. This vulnerability affects Firefox 98, Firefox ESR 91.7, and Thunderbird 91.7...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: tty: Fixed an out-of-bound access to vmalloc in imageblit. This issue occurs when a user-space program calls ioctl FBIOPUTVSCREENINFO, passing the fbvarscreeninfo structure containing only the fields xres, yres, and bitsperpixel...

Astra Linux – Vulnerability in xrdp

xrdp is an open-source project that provides a graphical login to remote machines using the Microsoft Remote Desktop Protocol RDP. xrdp versions prior to 0.9.21 contain a “Out of Bound Read” issue in the libxrdpsendtochannel function. There are no known solutions to this problem. Users are advise...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: btrfs: Fix for the iteration of extrefs during log replay. When calling inodeaddref and processing extrefs, if we jump to the next label, the value of victimname.len is undefined. This occurs because victimname.len wasn’t...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Set/clear CR8 write interception when AVIC is deactivated The issue was addressed by explicitly setting/clearing the CR8 write interception when AVIC is deactivated. This fixes a bug where KVM kept the interception...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: swiotlb: Fixed the issue of information leakage due to DMAFROMDEVICE. The problem I’m addressing was discovered during the LTP test covering cve-2018-1000204. A brief description of what happens is as follows: 1 The test case sen...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ARP: RCU protection should be used in arpxmit. arpxmit can be called without RTNL or RCU protection. RCU protection is used to avoid potential Use-after-Allocation UAF vulnerabilities...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: The neighnotify function can be called without RTNL or RCU protection. Use RCU protection to avoid potential Universal Atomic Faults UAF...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: drm/amdgpu: The parameters of bo mapping operations need to be clarified. The parameters of amdgpuvmbomap/replacemap/clearingmappings should be verified in a single common place...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: filelock: Removes locks reliably when a race between fcntl/close operations is detected. When the fcntlsetlk operation races with the close operation, the created lock is removed using dolockfilewait. However, LSMs may allow t...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: mac80211: Fixed a deadlock in the ieee80211stapsdeliverwakeup function. The ieee80211stapsdeliverwakeup function uses sta-pslock to synchronize with the ieee80211txhunicastpsbuf function, which is called from the softirq...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: wilc1000 – Fixed RCU usage in the connect path. With lockdep enabled, calls to the connect function from the cfg802.11 layer lead to the following warning: ============================= WARNING: Suspicious RCU usage...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: x86/fpu: No longer rely on user space for information that could lead to faults in the xsave buffer. Before this change, the expected size of the user space buffer was taken from fxsw-xstatesize. fxsw-xstatesize can be changed fr...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Most: USB – Fix for use-after-free in hdmdisconnect The hdmdisconnect function calls mostderegisterinterface, which ultimately unregisters the MOST interface device using deviceunregisteriface-dev. If this action drops the last...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in sndusbmidius122loutput The sndusbmidius122loutput function selects a count of 2 whenever the transfer speed is slower than high speed. It never relates this count to ep-maxtransfer. The URB buffe...

Astra Linux – Vulnerability in pgpool2

Information disclosure vulnerabilities exist in Pgpool-II versions 4.4.0 to 4.4.1 4.4 series, 4.3.0 to 4.3.4 4.3 series, 4.2.0 to 4.2.11 4.2 series, 4.1.0 to 4.1.14 4.1 series, 4.0.0 to 4.0.21 4.0 series, all versions of the 3.7 series, all versions of the 3.6 series, all versions of the 3.5...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: f2fs: A fix was made to perform a sanity check on the destination blkaddr during recovery. As Wenqing Liu reported in Bugzilla: https://bugzilla.kernel.org/showbug.cgi?id=216456 loop5: A change in capacity was detected, from 0...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix double increment of clientcount in dmachanget The first time dmachanget is called for a channel the channel clientcount is incorrectly incremented twice for public channels, first in balancerefcount, and again prio...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fou: Do not allow the value 0 for FOUATTRIPPROTO. The issue mentioned in the previous patch still exists in fouudprecv. If FOUATTRIPPROTO is set to 0, the buffer skb is neither freed by fouudprecv nor sent through...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: uacce: Ensure safe queue release with state management. Directly calling putqueue carries risks, as it cannot guarantee that the resources of uaccequeue have been fully released beforehand. Therefore, adding a stopqueue...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: clk: microchip: mpfs-ccc: fixed an out-of-bounds access during output registration. UBSAN reported an out-of-bounds access during the registration of the last two outputs. This out-of-bounds access occurs because space is only...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: can: gsusb: gsusbreceivebulkcallback: Check actuallength before accessing the header. The driver expects to receive a struct gshostframe in gsusbreceivebulkcallback. Use structgroup to describe the header of the struct gshostfram...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: “smack”: fixed a bug where an unprivileged task could create labels. If an unprivileged task is allowed to relabel itself "/smack/relabel-self is not empty", it can freely create new labels by writing their names into its own...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: Avoid scheduling the deletion of associations twice. When forcibly shutting down a port via the configfs interface, nvmetportsubsysdroplink first calls nvmetportdelctrls, and then nvmetdisableport. Both functions will...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: nfc: nci: Added parameter validation for packet data. Syzbot reported a bug involving uninitialized values in nciinitreq. This bug was introduced through the commit 5aca7966d2a7 “Merge tag...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: fix resource leaks in vdecmsgqueueinit If any error occurs in vdecmsgqueueinit, we need to set msgqueue-wdmaaddr.size = 0;. Normally, this is done inside the vdecmsgqueuedeinit function. However, if the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: btrfs: Always detect conflicting inodes when logging inode refs After renaming an inode, either through the rename operation or through regular renames in multiple non-atomic steps, if two inodes exist and at least one of them is...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: batman-adv: Avoid OGM aggregation when skbtailroom is insufficient. When the OGM aggregation state is toggled at runtime, an existing forwarded packet may have been allocated only with packetlen bytes, while a later packet can...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: ncsi: Fixed a skb leak in error paths. Early return paths in NCSI RX and AEN handlers fail to release the received skb, resulting in a memory leak. Specifically, ncsiaenhandler returns on invalid AEN packets without releasin...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: iio: gyro: mpu3050: Fixed the incorrect use of the freeirq variable. The handler for the IRQ part of this driver is mpu3050-trig, but during cleanup, freeirq is called with the handler mpu3050. Use the correct IRQ handler when...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: In the media subsystem, for mc and v4l2, the operations REINIT and REQBUFS are now serialized using the reqqueuemutex. The MEDIAREQUESTIOCREINIT operation can run concurrently with VIDIOCREQBUFS0. Paths involving queue teardown m...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ubi: fastmap: Fixed duplicate slab cache names during attachment Since commit 4c39529663b9 “slab: Warns about duplicate cache names when DEBUGVM=y”, duplicate slab cache names can be detected, and a kernel warning is issued. In t...

Astra Linux – Vulnerability in Firefox and Thunderbird

In some cases, video frames may have been leaked between their origins. This vulnerability affects Firefox 132, Firefox ESR 128.4, Firefox ESR 115.17, Thunderbird 128.4, and Thunderbird 132...

Astra Linux – Vulnerability in gnutls28

A flaw was discovered in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certificate data can take excessive time, leading to increased resource consumption. This flaw allows a remote attacker to send a speciall...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: gpio: aggregator: Protect driver attr handlers against module unload Both newdevicestore and deletedevicestore access module global resources e.g., gpioaggregatorlock. To prevent race conditions during module unloading, a...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Wifi: In rtlwifi, memory leaks and invalid access at the probe error path have been fixed. The deinitialization is performed in reverse order when the probe fails. When initswvars fails, rtldeinitcore should not be called. Thi...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: fs/ntfs3: Fixed a general protection fault in runismappedfull. ntfscreate inode: Fixed the deletion of a non-resident attribute...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: bpf: Ensure that the internal and UAPI bpfredirect flags do not overlap. The bpfredirectinfo is shared between the SKB and XDP redirection paths. Both paths use the same numerical flag values in the ri-flags field specifically,...