Astra Linux – Vulnerability in Firefox

Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 and Thunderbird 152...

Astra Linux – Vulnerability in Chromium

Type Confusion in V8 in Google Chrome prior to 148.0.7778.216 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. Chromium security severity: Medium...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: mptcp: pm: in-kernel: always sets ID as available when rm endp is called. Syzkaller managed to identify a combination of actions that caused this warning to occur: WARNING: net/mptcp/pmkernel.c:1074 at marksubflowendpavailable...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ntfs: Check overflow when iterating ATTRRECORDs The kernel iterates over ATTRRECORDS in mft records in ntfsattrfind. Since ATTRRECORDS are adjacent to each other, the kernel can access the next ATTRRECORD from the end address of...

Astra Linux – Vulnerability in Chromium

No description...

Astra Linux – Vulnerability in Chromium

Before version 91.0.4472.77, using Tab Strip in Google Chrome allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerability in node-browserify-sign

“browserify-sign” is a package that duplicates the functionality of Node’s crypto public key functions. Much of this functionality is based on Fedor Indutny’s work on “indutny/tls.js”. There is a issue with upper-bound checking in the “dsaVerify” function, which allows an attacker to create...

Astra Linux – Vulnerability in openimageio

There is a heap-out-of-bounds read vulnerability in the RLA format parser of OpenImageIO master-branch-9aeece7a and v2.3.19.0. More specifically, it relates to how run-length encoded byte spans are handled. A malformed RLA file can lead to an out-of-bounds read of heap metadata, potentially...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: tty: ngsm: Fixed a use-after-free in gsmcleanupmux. Bug: KASAN: Slab-use-after-free in gsmcleanupmux+0x77b/0x7b0. drivers/tty/ngsm.c:3160 ngsm Read of size 8 at addr ffff88815fe99c00 by task poc/3379. CPU: 0; UID: 0; PID: 3379...

Astra Linux – Vulnerability in Golang-1.19, Golang-1.23

A discrepancy in how Go and C/C++ comments are parsed allowed for code to be smuggled into the resulting cgo binary...

Astra Linux – Vulnerability in Jinja2

Jinja is an extensible templating engine. The xmlattr filter in affected versions of Jinja accepts keys that contain non-attribute characters. XML/HTML attributes cannot contain spaces, /, , or =, as each of these characters would be interpreted as the start of a separate attribute. If an...

Astra Linux – Vulnerability in emacs

In Emacs versions before 29.3, the Org mode considers the contents of remote files to be trustworthy. This affects Org Mode in versions prior to 9.6.23...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: In isotp.bind, there is a need to check the CAN address family. A missing check was added to prevent binds that use a non-AFCAN address family. Syzbot created some code that correctly determined the appropriate size of the sockad...

Astra Linux – Vulnerability in Firefox and Thunderbird

A double-free issue could occur in secpkcs7decoderstartdecrypt, when handling an error path. Under certain conditions, the same symmetric key might be freed twice, potentially leading to memory corruption. This vulnerability affects Firefox 133, Thunderbird 133, Firefox ESR 128.7, and Thunderbird...

Astra Linux – Vulnerability in libpgjava

pgjdbc is the official PostgreSQL JDBC Driver. A security flaw was discovered in the JDBC driver for the postgresql database during security research. Systems that use the postgresql library will be vulnerable when an attacker controls the JDBC URL or connection properties. pgjdbc creates plugin...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel before version 6.1.3, fs/ntfs3/inode.c does not validate the attribute name offset. A unhandled page fault may occur...

Astra Linux – Vulnerability in Tomcat9

Improper handling of the case sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: versions from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, and from 7.0.0 through 7.0.109. Older,...

Astra Linux – Vulnerability in Firefox

A use-after-free vulnerability was identified during testing, and it was traced to an outdated Cairo library. Updating the library resolved the issue, and it may have also addressed other unknown security vulnerabilities. This vulnerability affects Firefox versions earlier than 90...

Astra Linux – Vulnerability in python-webob

WebOb provides objects for HTTP requests and responses. When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the URL that the user will be redirected to using Python’s urlparse function, and joining that parsed URL to the base URL. However, the...

Astra Linux – Vulnerability in openjpeg2

A heap-buffer overflow was discovered in the way openjpeg2 handles certain PNG format files. An attacker could exploit this flaw to cause an application to crash, or in some cases to execute arbitrary code with the permission of the user running such an application...