Astra Linux – Vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.0, a client-side heap buffer overflow occurred in the FreeRDP client’s AVC420/AVC444 YUV-to-RGB conversion process. This issue arose due to a lack of validation of the horizontal bounds of the H.264 metablock...

Astra Linux – Vulnerability in libde265

It was discovered that Libde265 v1.0.14 contains a heap-buffer-overflow vulnerability in the derivecombinedbipredictivemergingcandidates function at motion.cc...

Astra Linux – Vulnerability in Thunderbird

Ribose RNP before version 0.16.3 may hang when the input is malformed...

Astra Linux – Vulnerability in Chromium

The use of “after free” in Views in Google Chrome on Linux before version 149.0.7827.103 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code through a crafted Chrome Extension. Chromium security severity: Critical...

Astra Linux – Vulnerability in multipath-tools

In versions of multipath-tools from 0.7.0 to 0.9.x, up to 0.9.2, local users could obtain root access, either alone or in conjunction with CVE-2022-41973. Local users who had access to write to UNIX domain sockets could bypass access controls and manipulate the multipath setup. This could result ...

Astra Linux – Vulnerability in Chromium

Integer overflow in Skia in Google Chrome prior to version 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Redis

Redis is an open-source, in-memory database that persists data on disk. Versions 8.2.1 and earlier allow an authenticated user to use a specially crafted Lua script to manipulate various LUA objects and potentially execute their own code in the context of another user. This vulnerability exists i...

Astra Linux – Vulnerability in Redis

Redis is an open-source, in-memory database that persists data on disk. Versions 8.2.1 and earlier allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, triggering a use-after-free and potentially leading to remote code execution. This issue exists...

Astra Linux – Vulnerability in Apache2

Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: A memory leak has been fixed in the error-handling path of idxdalloc. The memory allocated for idxd is not freed if an error occurs during idxdalloc. To fix this issue, free the allocated memory in the reverse...

Astra Linux – Vulnerability in atftp

In tftpdfile.c in atftp up to 0.7.4, there is a buffer overflow issue due to improper handling of buffer-size parameters, which does not correctly account for combinations of data, OACK, and other options...

Astra Linux – Vulnerability in OpenSSL

To decrypt SM2 encrypted data, an application is expected to call the API function EVPPKEYdecrypt. Typically, an application will call this function twice. The first time, upon entry, the “out” parameter can be NULL, and upon exit, the “outlen” parameter contains the buffer size required to hold...

Astra Linux – Vulnerability in dnsmasq

A vulnerability was discovered in dnsmasq prior to version 2.81. This vulnerability involves a memory leak, allowing remote attackers to cause a denial of service due to excessive memory consumption through mechanisms related to DHCP response creation...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in File input in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in libpng1.6

LIBPNG is a reference library used in applications that read, create, and manipulate PNG Portable Network Graphics raster image files. Prior to version 1.6.55, there was an out-of-bounds read vulnerability in the pngsetquantize API function. When this function is called without a histogram and th...

Astra Linux – Vulnerability in Linux, Linux 5.10

A vulnerability was discovered in the cgroupreleaseagentwrite function of the Linux kernel, within the kernel/cgroup/cgroup-v1.c file. Under certain circumstances, this flaw allows the use of the cgroups v1 releaseagent feature to escalate privileges and bypass namespace isolation unexpectedly...

Astra Linux – Vulnerability in libgd2

The readheadertga function in gdtga.c within the GD Graphics Library also known as LibGD in versions up to 2.3.2 allows remote attackers to cause a denial of service out-of-bounds read through a crafted TGA file...

Astra Linux – Vulnerability in curl

curl 7.1.1 up to and including 7.75.0 is vulnerable to a “Exposure of Private Personal Information to an Unauthorized Actor” by leaking credentials in the HTTP Referer: header. libcurl does not remove user credentials from the URL when automatically filling in the Referer: HTTP request header fie...

Astra Linux – Vulnerability in golang-golang-x-net, golang-1.15

In Go, before versions 1.15.12 and 1.16.x, and before version 1.16.4, net/http allowed remote attackers to cause a denial of service panic through a large header sent to ReadRequest or ReadResponse. This issue can affect the Server, Transport, and Client components in certain configurations...

Astra Linux – Vulnerability in unbound

Unbound before version 1.9.5 allows for an integer overflow in the size calculation in dnscrypt/dnscrypt.c. NOTE: The vendor denies that this is a vulnerability. Although the code may be vulnerable, an active Unbound installation cannot be exploited remotely or locally...