21941 matches found
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: btrfs: fixed an issue where the extent map was used after free, when adding pages to compressed Bio data structures. In the function addrabiopages, we access the extent map to calculate ‘addsize’. After dropping the reference to...
Astra Linux – Vulnerability in Chromium
Insufficient validation of untrusted inputs in plugins in Google Chrome before version 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data through a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: RDMA: hfi1: Fixed the possibility of a division-by-zero error in findhwthreadmask. The function divides the number of online CPUs by numcoresiblings, and then checks if the result is zero. This may lead to a division-by-zero...
Astra Linux – Vulnerability in Chromium
The “Type Confusion in Tint” vulnerability in Google Chrome before version 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in gdcm
There is an out-of-bounds write vulnerability in the JPEG2000Codec::DecodeByStreamsCommon functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted DICOM file can lead to a heap buffer overflow. An attacker can provide a malicious file to exploit this vulnerability...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: drm/i915: Fixed potential context UAFs. The gemcontextregister function makes the context visible to user space, and a separate thread can trigger the I915GEMCONTEXTDESTROY ioctl command. Therefore, we need to ensure that...
Astra Linux – Vulnerability in libmodbus
A issue was discovered in libmodbus before versions 3.0.7 and 3.1.x, prior to 3.1.5. There is a vulnerability related to the MODBUSFCWRITEMULTIPLEREGISTERS function, also known as VD-1301...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek-gen3: The refcount leak in mtkpcieinitirqdomains has been fixed. The function ofgetchildbyname returns a node pointer whose refcount is incremented. Therefore, we should use ofnodeput on it when we no longer need it...
Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: netlink: Do not hard code the device address length in fdb dumps. syzbot reports that some netdev devices do not have a six-byte address. Replace ETHALEN with dev-addrlen. 1 In cases where dev-addrlen = 4 BUG: KMSAN:...
Astra Linux – Vulnerability in libass
In libass 0.14.0, the call to assoutlineconstruct's outlinestroke function causes a signed integer overflow...
Astra Linux – Vulnerabilities in Linux-6.1, Linux-5.15, Linux-5.10
In the Linux kernel, the following vulnerability has been resolved: gpio: rcar: Use rawspinlock to protect register access The rawspinlock is used to fix spurious messages about invalid context when spinlock debugging is enabled. The lock is only used to serialize register access. 4.239592...
Astra Linux – Vulnerability in Chromium
Integer overflow in Mojo in Google Chrome prior to version 90.0.4430.85 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page...
Astra Linux – Vulnerability in freerdp2
FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The affected versions are vulnerable to a Out-of-Bounds Read vulnerability in the nscrledecompressdata function. This vulnerability occurs because the function processes context-Planes without...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: usb: renesas: Fixed the refcount leak bug In usbhsrza1hardwareinit, the offindnodebyname function will return a node pointer with the refcount incremented. We should use ofnodeput when the node pointer is no longer needed...
Astra Linux – Vulnerability in Firefox and Thunderbird
When a user clicks on an FTP URL containing encoded newline characters %0A and %0D, these newline characters are interpreted as such, allowing arbitrary commands to be sent to the FTP server. This vulnerability affects Firefox ESR 78.10, Thunderbird 78.10, and Firefox 88...
Astra Linux – Vulnerability in hdf5
A issue was discovered in HDF5 through 1.12.0. A NULL pointer dereference exists in the function H5Fgetnrefs located in H5Fquery.c. This allows an attacker to cause a Denial of Service attack...
Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1
In the Linux kernel, the following vulnerability has been resolved: net/dpaa2: Avoid explicit allocation of the cpumask variable on the stack. For the CONFIGCPUMASKOFFSTACK=y kernel, explicit allocation of the cpumask variable on the stack is not recommended, as it may cause a potential stack...
Astra Linux – Vulnerability in Firefox
Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145...
Astra Linux – Vulnerability in Firefox
Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145...
Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: phonet/pep: fixed the use of racyskbqueueempty The receive queues are protected by their respective spin-locks, not the socket lock. This could lead to skbpeek returning NULL or a pointer to a socket buffer that has already been...
Astra Linux – Vulnerability in Firefox and Thunderbird
Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Firefox ESR 115.30, Thunderbird 145, and Thunderbird 140.5...
Astra Linux – Vulnerability in Firefox and Thunderbird
Race condition in the Graphics component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Firefox ESR 115.30, Thunderbird 145, and Thunderbird 140.5...
Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: ksmbd: Fixed a use-after-free issue in Kerberos authentication. The introduction of sess-user = NULL was necessary to fix the dangling pointer created by ksmbdfreeuser. However, it is possible that another thread might be...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fixed a possible NULL pointer dereferencing in sndusbpcmhasfixedrate. The argument of the subs function may be NULL; therefore, do not use it before a NULL check...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: In the mm: memcg subsystem, there is a issue where reclaiming memory stops when a limit update is superseded. The kernfs subsystem serializes file operations only for each open file. This allows separate open files to update the...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: video: fbdev: arkfb: Fixed a divide-by-zero bug in arksetpixclock Since the user can control the arguments of the ioctl function from the user space, there are special cases where a divide-by-zero bug may occur. For example, in:...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: net: enetc: avoid buffer leaks on xdpdoredirect failure Before enetccleanrxringxdp calls xdpdoredirect, each software BD in the RX ring between index origi and i can have one of two refcount values on its page. We are the owner o...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.166 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: can: bcm: added locking for bcmop runtime updates. The CAN broadcast manager CAN BCM can send a sequence of CAN frames via hrtimer. The content and length of the sequence can be changed during runtime, after which the ‘currframe’...
Astra Linux – Vulnerability in Chromium
Chromium: CVE-2021-30624 – Use after free in Autofill...
Astra Linux – Vulnerability in Intel Microcode
Improper finite state machines in the hardware logic of some 4th and 5th generation IntelR XeonR processors may allow an authorized user to potentially enable denial of service via local access...
Astra Linux – Vulnerability in Intel Microcode
In some IntelR processors, the incorrect order of behavior during the transition between the executive monitor and the SMI transfer monitor STM may allow a privileged user to potentially enable privilege escalation through local access...
Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: ipv4: iptunnel: A suspicious RCU usage warning was fixed in iptunnelinitflow. There are code paths where the function is called without holding the RCU read lock, resulting in a suspicious RCU usage warning 1. The issue was fixed...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: udmabuf: fixed an overflow issue related to the buffer size during the creation of udmabuf. By casting sizelimitmb as a u64 type when calculating pglimit...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fixed the nullptrderef issue in targetallocdevice There is a nullptrderef issue reported by KASAN: BUG: KASAN: nullptrderef in targetallocdevice+0xbc4/0xbe0 targetcoremod … kasanreport+0xb9/0xf0...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerabilities have been resolved: gpio: pca953x: Fixed the race condition in pca953xirqbussyncunlock. Ensure that i2clock is held when setting the interrupt latch and mask in pca953xirqBusSyncUnlock. This prevents race conditions. Another non-probing call site...
Astra Linux – Vulnerability in Qemu
A flaw was discovered in the virtio-fs shared file system daemon virtiofsd of QEMU. The new ‘xattrmap’ option may cause the ‘security.capability’ xattr in the guest to not be dropped when writing files, potentially allowing a modified, privileged executable to be executed within the guest. In rar...
Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1
In the Linux kernel, the following vulnerability has been resolved: ext4: Make sure the first directory block is not a hole. The syzbot constructs a directory that has no dirblock, but it is not inline; in other words, the first directory block is a hole. No errors are reported when creating file...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: initramfs: Avoid filename buffer overflow The initramfs filename field is defined in Documentation/driver-api/early-userspace/buffer-format.rst as follows: plaintext 37 cpiofile := ALGN4 + cpioheader + filename + "\0" + ALGN4 +...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: i2c: Fixed a potential use after free The adap structure should only be freed after we have finished using it. This patch simply moves the putdevice function slightly to avoid the potential issue after freeing the structure. wsa:...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerabilities have been resolved: netfilter: nfconntrack: A crash occurred when attempting to remove an uninitialized entry from the hash bucket list. A crash occurred while trying to remove the conntrack entry from the hash bucket list: Exception RIP:...
Astra Linux – Vulnerability in xorg-server
A vulnerability was discovered in X.Org. This security flaw arises because the handler for the ScreenSaverSetAttributes request may write to memory after it has been freed. This issue can lead to local privileges escalation on systems where the X server is running with privileged access, and may...
Astra Linux – Vulnerability in binutils
The bfdgenericreadminisymbols function in syms.c within the Binary File Descriptor BFD library also known as libbfd, as part of GNU Binutils 2.31, contains a memory leak that can occur due to an improperly crafted ELF file. This leads to a denial of service condition due to excessive memory...
Astra Linux – Vulnerability in curl
There is a vulnerability in input validation in curl 8.0. During communication using the TELNET protocol, this may allow an attacker to send maliciously crafted user names and “telnet options” during server negotiation. The lack of proper input scrubbing allows an attacker to send content or...
Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: cifs: Fixed an integer overflow issue while processing the acdirmax mount option. The user-provided mount parameter acdirmax, of type u32, is intended to have an upper limit. However, before this limit is validated, the value is...
Astra Linux – Vulnerability in SQLite3
SQLite 3.30.1 improperly handles certain parser-tree rewrites, related to files expr.c, vdbeaux.c, and window.c. This issue is caused by incorrect error handling in the sqlite3WindowRewrite function...
Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: Wait for previous GC cycles when removing a port. The syzbot encountered a use-after-free issue1. This issue occurs because the bridge does not ensure that all previous garbage collection cycles are completed...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: bpf: Fixed an out-of-bounds write in triegetnextkey The triegetnextkey function allocates a node stack with a size of trie-maxprefixlen. However, it writes trie-maxprefixlen + 1 nodes to the stack when the stack is full, after...
Astra Linux – Vulnerability in gnupg2
GnuPG versions up to 2.3.6 allow for signature forgery in unusual situations where an attacker possesses secret-key information from a victim’s keyring, and other constraints such as the use of GPGME are met. This can be achieved by injecting malicious data into the command line’s status line...
Astra Linux – Vulnerability in openjpeg2
A flaw was discovered in OpenJPEG’s encoder. This flaw allows an attacker to provide specially crafted x,y offset inputs to OpenJPEG during encoding. The greatest threat of this vulnerability is to confidentiality, integrity, and system availability...