Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ieee802154: Avoid calling WARNON when -ENOMEM occurs in cfg802154switchnetns. It is pointless to call WARNON in the event of an allocation failure in devchangenetnamespace and devicerename, as it only leads to useless errors caus...

Astra Linux – Vulnerability in Commons-BeanUtils

Apache Commons has a vulnerability related to improper access control. A special BeanIntrospector class was added in version 1.9.2. This can be used to prevent attackers from using the declared class property of Java enum objects to gain access to the classloader. However, this protection was not...

Astra Linux – Vulnerability in gpac

A heap-based buffer overflow vulnerability exists in gpac version 2.3-DEV-rev588-g7edc40fee-master, allowing remote attackers to execute arbitrary code and cause a denial of service DoS via the gffwrite component in atutils/osfile.c...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Added a check for a valid ‘madagent’ pointer. When unregistering an MAD agent, the srpt module performs a non-null check on the ‘madagent’ pointer before invoking ibunregistermadagent. This check can fail if the...

Astra Linux – Vulnerability in Ceph

Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and earlier, it is possible to send a JWT with “none” as its JWT algorithm. By doing this, the JWT signature is not checked. The vulnerability lies most likely in the RadosGW OIDC provider. As of the time of...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

The vulnerability in Google Chrome videos on ChromeOS before version 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. Chromium security severity: Medium...

Astra Linux – Vulnerability in Firefox

Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Before version 148.0.7778.216, using free after in the DOM in Google Chrome allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Firefox and Thunderbird

Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5...

Astra Linux – Vulnerability in ujson

UltraJSON is a fast JSON encoder and decoder written in pure C, with bindings for Python 3.7+. It was found that affected versions incorrectly decoded certain characters. JSON strings containing escaped surrogate characters that were not part of a valid surrogate pair were decoded incorrectly. Th...

Astra Linux – Vulnerability in Chromium

Using "after free" in Chromoting in Google Chrome before version 149.0.7827.53 allowed a remote attacker to execute arbitrary code through malicious network traffic. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

The use of after free in WebAuthentication in Google Chrome before version 149.0.7827.53 allowed a remote attacker who convinced a user to perform certain UI gestures to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: usb: musb: omap2430: A use-after-free occurred in opmap2430probe. In opmap2430probe, the call to ofnodeputnp occurs prematurely, before the last access to np. This leads to a use-after-free if the reference count of the node drop...

Astra Linux – Vulnerability in Chromium

Before version 150.7871.47, using Codecs in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

The incorrect security interface in File Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to perform certain UI gestures to perform UI spoofing through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, xfPointerNew would free cursorPixels if there was a failure. After that, pointerfree would call xfPointerFree to free it again, which could trigger an ASan UAF. A malicious server could exploit this...