21941 matches found
Astra Linux – Vulnerability in Firefox, Thunderbird
If a PAC URL was set, and the server hosting the PAC was unreachable, OCSP requests would be blocked, resulting in incorrect error pages being displayed. This vulnerability affects Firefox 102, Firefox ESR 91.11, Thunderbird 102, and Thunderbird 91.11...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Updated the intermediate power state for SI. Updated the current state to the boot state during dpm initialization. During subsequent initialization, setpowerstate is called to transition to the final power state...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: md/raid5-ppl: fixed a use-after-free in ppldoflush. The loop in ppldoFlush continues iterating after calling ppliounitfinished, accessing io-pendingflushes, and leading to a use-after-free. A break statement was added to stop the...
Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-5.10, Linux-6.1
In the Linux kernel, the following vulnerability has been resolved: Net: Fixed a UAF Use-after-Allocation issue in packetrelease due to a race condition involving NETDEVUP. packetrelease has a race condition where NETDEVUP can re-register a socket into the arr array of fanout groups. This...
Astra Linux – Vulnerability in Linux, Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: net: batman-adv: fix error handling Syzbot reported an ODEBUG warning in batadvncmeshfree. The problem lay in incorrect error handling in batadvmeshinit. Before this patch, batadvmeshinit would call batadvmeshfree in case any...
Astra Linux – Vulnerability in Linux, Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: drm/nouveau/debugfs: fixed the memory leak when releasing files. When using singleopen to open a file, singlerelease should be called. Otherwise, the memory allocated with singleopen may be leaked...
Astra Linux – Vulnerability in Linux
In the Linux kernel, the following vulnerability has been resolved: misc/libmasm/module: Two use-after-free operations in ibmasminitone have been fixed. In ibmasminitone, it calls ibmasminitremoteinputdev. Inside ibmasminitremoteinputdev, mousedev and keybddev are allocated by inputallocatedevice...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/qm – Set NULL to qm-debug.qmdiff regs. When the initialization of qm-debug.accdiff regs fails, the probe process does not exit. However, after qm-debug.qmdiff regs is freed, it is not set to NULL. This can lead ...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: drm/amd: check num of link levels when update pcie param In the SR-IOV environment, the value of pcietable-numoflinklevels will be 0, and numoflevels - 1 will cause an array index out of bounds...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: ice: fix vsi-txqmap sizing The approach of having XDP queue per CPU regardless of user's setting exposed a hidden bug that could occur in case when Rx queue count differ from Tx queue count. Currently vsi-txqmap's size is equal t...
Astra Linux – Vulnerability in Firefox, Thunderbird
The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such as executing scripts or navigating the top-level frame. This vulnerability affects Firefox 94, Thunderbird 91.3, and Firefox ESR 91.3...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: veth: Fixed a NAPI leak in the XDP enable error path. During XDP enablement in a veth device, if xdprxqinforeg or xdprxqinforegmemmodel fails, the driver rolls back the changes made. However, the rollback loop: for i--; i = start...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: net: skbuff: The SKBFLSHAREDFRAG bit was not properly propagated through the frag-transfer helpers. Two frag-transfer helpers pskbcopyfclone and skbshift fail to propagate the SKBFLSHAREDFRAG bit in skbshinfo-flags when moving...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer. Since the report buffer is used by various drivers in various ways, let’s initialize it to zero during allocation, so that it cannot ever be used to leak kernel memory through special...
Astra Linux – Vulnerability in Firefox
Incorrect boundary conditions in the Web Audio component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12...
Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: The error handling path in idxdcdevregister has been fixed. If a call to allocchrdevregion fails, the already allocated resources are being leaked. The necessary error handling path has been added to address this...
Astra Linux – Vulnerability in Wireshark
In Wireshark versions 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2.6.20, the TCP dissector could crash. This issue was addressed in the epan/dissectors/packet-tcp.c file by changing the handling of the invalid 0xFFFF checksum...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd934x: Properly handles channel mapping lists. Currently, each channel is added as a list to the dai channel list. However, there is a risk of adding the same channel to multiple dai channel lists, which could lea...
Astra Linux – Vulnerability in Chromium
Insufficient policy enforcement in the Sandbox feature of Google Chrome on Linux before version 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1
In the Linux kernel, the following vulnerabilities have been resolved: media: saa7134: Fixed a possible memory leak in saa7134videoinit1. In saa7134videoinit1, the return value of the first call to saa7134pgtablealloc is not checked. If this function fails, the function continues as if it was...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: gpio: gr gpio: Add a NULL check in gr gpioprobe. The devmkasprintf function can return a NULL pointer if it fails, but this returned value in gr gpioprobe is not checked. Add a NULL check in gr gpioprobe to handle the potential...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: nvme: fixed the SRCU protection for the nvmenshead list The process of walking the nvmenshead siblings list is protected by the head’s srcu in nvmensheadsubmitbio, but not in nvmempathrevalidatePaths. Removing namespaces from...
Astra Linux – Vulnerability in Chromium
Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leverage social engineering to bypass system access restrictions through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in grub2
A vulnerability has been identified in the GRUB2 bootloader’s normal command, posing an immediate Denial of Service DoS risk. This flaw is a Use-after-Free issue, caused by the fact that the normal command is not properly unregistered when the module is unloaded. An attacker who can execute this...
Astra Linux – Vulnerability in Chromium
A stack buffer overflow in the GPU process in Google Chrome on Linux prior to version 88.0.4324.182 allowed a remote attacker to potentially perform out-of-bounds memory access through a crafted HTML page...
Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: ip: Fixed data races related to sysctlipfwdupdatepriority. When reading sysctlipfwdupdatepriority, it can be changed concurrently. Therefore, we need to add READONCE to its readers...
Astra Linux – Vulnerability in klibc
A issue was discovered in klibc before version 2.0.9. Multiple potential integer overflows in the cpio command on 32-bit systems could lead to a buffer overflow or other security issues...
Astra Linux – Vulnerability in Chromium
“Type Confusion in V8 in Google Chrome” before version 131.0.6778.204 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: scsi: qla2xxx: Fixed a crash that occurred when I/O abort times out. During CPU hotplug, a crash was observed with the following stack: Call Trace: qla24xxprocessresponsequeue+0x42a/0x970 qla2xxx qla2x00startnvmemq+0x3a2/0x4b0...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: virtiofs: added a check for the filesystem context source name In certain scenarios, for example during fuzz testing, the source name may be NULL, which could lead to a kernel panic. Therefore, an additional check for the source...
Astra Linux – Vulnerability in Firefox
Widget-related Clickjacking issue with the Gtk component. This vulnerability has been fixed in Firefox 152 and Thunderbird 152...
Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: tpm: acpi: Calling acpiputtable to fix a memory leak. The size of the event log area is obtained from the TPM2 or TCPA table. Therefore, we call acpigettable to retrieve ACPI information. However, acpigettable should be used in...
Astra Linux – Vulnerability in Chromium
Missing authorization in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leverage social engineering to obtain sensitive information through UI interaction. Chromium security severity: Medium...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: fixed a potential memory leak in vfiointxenable If vfioirqctxalloc fails, it will lead to a ‘name’ memory leak...
Astra Linux – Vulnerability in Linux 5.15
A issue was discovered in ksmbd within the Linux kernel versions 5.15 through 5.19, prior to 5.19.2. There is a heap-based buffer overflow in the setntacldacl function, which is related to the use of the SMB2QUERYINFOHE function after an incorrectly formatted SMB2SETINFOHE command...
Astra Linux – Vulnerability in Firefox, Thunderbird
By using a link with rel="localization", a use-after-free could occur if an object is destroyed during JavaScript execution, and then the object is referenced through a freed pointer, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird 91.8, Firefox 99, and Firefo...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: drm/ast: Fixed soft lockup issue There is a while-loop in astdpsetonoff, which could lead to an infinite loop. This is because the register, VGACRI-Dx, is checked in this API; it is actually a scratch register controlled by a MCU...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: PCI/ASPM: Fixed the issue where the link state was exited during the removal of an upstream function. Before version 456d8aa37d0f “PCI/ASPM: Disabled ASPM during the removal of an MFD function to avoid use-after-free”, we only...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Do not leak a resource during the swapout movement operation. If moving the buffer to the system for swapout fails, we were leaking a resource. This issue has been fixed...
Astra Linux – Vulnerability in libmodbus
A issue was discovered in libmodbus before versions 3.0.7 and 3.1.x, prior to 3.1.5. There is a buffer overflow vulnerability in the MODBUSFCWRITEMULTIPLECOILS case, also known as VD-1302...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fixed a NULL dereference in I915CONTEXTPARAMSSEU. Setting the context engine slot N to I915ENGINECLASSINVALID / I915ENGINECLASSINVALIDNONE, and then attempting to apply I915CONTEXTPARAMSSEU to the same slot N will...
Astra Linux – Vulnerability in Chromium
The use of after-free in Animation in Google Chrome before version 152.0.7977.65 allowed a remote attacker to execute arbitrary code within the sandbox through a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in sdl-image1.2
SDLimage is a library for loading images of various formats as SDL surfaces. In the dolayersurface function in src/IMGxcf.c, pixel index values from decoded XCF tile data are used directly as colormap indices without being validated against the colormap size cmnum. A crafted .xcf file with a smal...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: bytcrrt5640 – Fixed invalid quirk input mapping. When an invalid value is passed via the quirk option, currently, the bytcrrt5640 driver only displays an error message but leaves the system unchanged. This may lead t...
Astra Linux – Vulnerability in Firefox
Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: vdpasim: A possible memory leak was fixed in vdpasimnetinit and vdpasimblkinit. When a fault is injected while probing a module, if deviceregister fails in vdpasimnetinit or vdpasimblkinit, and the refcount of kobject is not...
Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1
In the Linux kernel, the following vulnerabilities have been resolved: atl1c: Workaround for the DMA RX overflow issue. This work is based on the alx driver commit 881d0327db37 “net: alx: Workaround for the DMA RX overflow issue”. The alx and atl1c drivers both had RX overflow errors; therefore, ...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetrbtree: check for partial overlaps in anonymous sets The user space provides an optimized representation when the interval boundaries are adjacent, where the end element is omitted. The existing partial overlap...
Astra Linux – Vulnerability in Firefox
When parsing internationalized domain names, the high bits of the characters in the URLs were sometimes removed, resulting in inconsistencies that could cause confusion for users or lead to attacks like phishing. This vulnerability affects Firefox versions earlier than 94...