Astra Linux – Vulnerability in PostgresSQL 11

A flaw was discovered in PostgreSQL versions prior to 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20, and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, ther...

Astra Linux – Vulnerability in sudo

Before version 1.9.13, sudo did not escape control characters in the sudoreplay output...

Astra Linux – Vulnerability in Python 3.7

A flaw was discovered in Python. In algorithms with quadratic time complexity that use non-binary bases, when using int“text”, a system may take 50 milliseconds to parse an int string with 100,000 digits, and 5 seconds for strings with 1,000,000 digits. Functions like float, decimal, int.frombyte...

Astra Linux – Vulnerability in python-django, python2.7

Packages containing “python/cpython” from versions 0 and earlier, including 3.6.13, 3.7.0 and earlier than 3.7.10, 3.8.0 and earlier than 3.8.8, 3.9.0 and earlier than 3.9.2 are vulnerable to Web Cache Poisoning via “urllib.parse.parseqsl” and “urllib.parse.parseqs”. This vulnerability occurs due...

Astra Linux - Vulnerability in Golang-1.23

The net/url package does not limit the number of query parameters in a query. Although the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing man...

Astra Linux – Vulnerability in libtar

The thread function does not free the variable t-thbuf.gnulongname after allocating memory, which may lead to a memory leak...

Astra Linux – Vulnerability in Firefox and Thunderbird

JIT compilation errors in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6...

Astra Linux – Vulnerability in Tomcat9

The issue involves a vulnerability in the generation of error messages containing sensitive information in Apache Tomcat. This issue affects Apache Tomcat versions starting from 8.5.7 through 8.5.63, and from 9.0.0-M11 through 9.0.43. Other, end-of-life versions may also be affected. It is...

Astra Linux – Vulnerability in Chromium

In Google Chrome versions prior to 92.0.4515.159, a data race in WebAudio allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerability in Chromium

In Google Chrome on Linux and ChromeOS before version 92.0.4515.107, an attacker who convinced a user to install a malicious extension could perform an out-of-bounds memory write by using a crafted HTML page. This vulnerability allowed the attacker to execute such an operation...

Astra Linux – Vulnerability in node-brace-expansion

@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion was vulnerable to a denial of service DoS issue caused by unbounded brace range expansion. When an attacker provided a pattern containing repeated numeric brace ranges,...

Astra Linux – Vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, xfAppUpdateWindowFromSurface reused a cached XImage, where the data pointer referred to an RDPGFX surface buffer that had been freed. This was because gdiDeleteSurface freed surface-data without invalidating...

Astra Linux – Vulnerability in Chromium

A stack buffer overflow in Printing in Google Chrome prior to version 92.0.4515.107 allowed a remote attacker who had compromised the renderer process to potentially exploit stack corruption through a crafted HTML page...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in image handling in iOS in Google Chrome on iOS prior to version 92.0.4515.107 allowed a remote attacker to leak cross-origin data through a crafted HTML page...

Astra Linux – Vulnerability in Perl

HTTP::Tiny, a Perl core module since version 5.13.9 and available as a standalone package on CPAN, has an insecure default TLS configuration. In this configuration, users are required to explicitly choose to verify certificates...

Astra Linux – Vulnerability in Chromium

Before version 92.0.4515.107, using “after free” in DevTools in Google Chrome allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerability in libavif

In libavif before version 1.3.0, the avifImageRGBToYUV function in reformat.c contains integer overflows during multiplications involving rgbRowBytes, yRowBytes, uRowBytes, and vRowBytes...

Astra Linux – Vulnerability in Chromium

The use of after free in ANGLE in Google Chrome before version 92.0.4515.159 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: powerpc/eeh: avoided possible crashes when edev-pdev changes. If a PCI device is removed during eehpereportedev, edev-pdev will change, which may cause a crash. It is recommended to hold the PCI rescan/remove lock while taking a...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ext4: Fix for corruption during online resizing We observed corruption during online resizing of a file system that is larger than 16 TiB and has a 4k block size. When there are more than 2^32 blocks, resizeinode is turned off by...