Astra Linux – Vulnerability in Chromium

The use of after-free in Views in Google Chrome before version 152.0.7977.65 allowed a remote attacker to leverage social engineering to potentially execute arbitrary code outside the sandbox through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – vulnerability in Chromium

Incorrect reference resolution in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – vulnerability in exempi

The XMP Toolkit SDK version 2020.1 and earlier is affected by a buffer overflow vulnerability that could potentially lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction; a victim must open a specially crafted file...

Astra Linux – Vulnerability in Qemu

A vulnerability related to out-of-bounds read/write access was discovered in the USB emulator of QEMU in versions prior to 5.2.0. This issue occurs during the processing of USB packets from a guest, when the value of USBDevice’s ‘setuplen’ exceeds the value of ‘databuf4096’ in the dotokenin and...

Astra Linux – vulnerability in Firefox and Thunderbird

Memory safety bugs present in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3. Some of these bugs exhibited signs of memory corruption; it is assumed that with sufficient effort, some of them could have been exploited to execute arbitrary code. This vulnerability affects Firefox versions...

Astra Linux - vulnerability in htmldoc

A flaw was found in htmldoc commit 31f7804. A heap buffer overflow in the function pdfwritenames in ps-pdf.cxx may lead to arbitrary code execution and Denial of Service DoS...

Astra Linux – vulnerability in ffmpeg5

FFmpeg v.n6.1-3-g466799d4f5 allows an attacker to trigger the use of a parameter with a negative size in the avsamplessetsilence function within the libsamplefmt.c file at line 9...

Astra Linux – vulnerability in python-git

GitPython versions prior to 3.1.59 fail to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives such as core.hooksPath. Attackers can craft config files containing embedded newlines; these become active git directives...

Astra Linux – vulnerability in webkit2gtk

The use-after-free issue has been resolved through improved memory management. This issue is fixed in iOS 14.7, Safari 14.1.2, macOS Big Sur 11.5, watchOS 7.6, and tvOS 14.7. Processing maliciously crafted web content may result in arbitrary code execution...

Astra Linux – vulnerability in webkit2gtk

A type confusion issue has been resolved through improved state handling. This issue is fixed in iOS 14.7, Safari 14.1.2, macOS Big Sur 11.5, watchOS 7.6, and tvOS 14.7. Processing maliciously crafted web content may result in arbitrary code execution...

Astra Linux – Vulnerability in openjpeg2

A heap-buffer overflow was discovered in the way openjpeg2 handles certain PNG format files. An attacker could exploit this flaw to cause an application to crash, or in some cases to execute arbitrary code with the permission of the user running such an application...

Astra Linux – vulnerability in webkit2gtk

Processing web content may lead to arbitrary code execution. This issue has been fixed in iOS 17 and iPadOS 17, macOS Sonoma 14, watchOS 10, tvOS 17, and Safari 17. The problem was resolved through improved memory handling...

Astra Linux – vulnerability in cpio

GNU cpio version 2.13 allows attackers to execute arbitrary code by using a specially crafted pattern file, due to an integer overflow in dstring.c’s dsfgetstr function which results in an out-of-bounds heap write. NOTE: It is unclear whether there are common scenarios where the pattern file...

Astra Linux – vulnerability in webkit2gtk

The issue has been resolved through improved checks. It is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, and visionOS 2.1.1. Processing maliciously crafted web content may result in arbitrary code execution. Apple is aware of reports...

Astra Linux - vulnerability in velocity

An attacker capable of modifying Velocity templates can execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify Velocity templates running Apache...

Astra Linux – Vulnerability in grub2

A flaw was discovered in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module that serves as a dependency without checking whether any other dependent modules are still loaded, leading to a “use-after-free” scenario. This could allow arbitrary code to be...

Astra Linux – Vulnerability in Firefox

Mozilla developers reported memory safety bugs in Firefox 84. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability affects versions of Firefox prior to 85...

Astra Linux – vulnerability in Firefox and Thunderbird

When Responsive Design Mode was enabled, it made references to objects that had previously been freed. We assume that with sufficient effort, this could have been exploited to execute arbitrary code. This vulnerability affects Firefox ESR 78.10, Thunderbird 78.10, and Firefox 88...

Astra Linux – vulnerability in Firefox

Due to unexpected data type conversions, a use-after-free might have occurred when interacting with the font cache. We assume that with sufficient effort, this could have been exploited to execute arbitrary code. This vulnerability affects Firefox 88...

Astra Linux – Vulnerability in Firefox

When Web Render components were destroyed, a race condition could lead to undefined behavior. We assume that with sufficient effort, this vulnerability could be exploited to execute arbitrary code. This vulnerability affects Firefox versions earlier than 88.0.1, as well as Firefox for Android...