10064 matches found
Astra Linux – Vulnerability in Jackson-Databind
In FasterXML Jackson-Databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur due to the lack of a check in primitive value deserializers. This issue arises when the UNWRAPSINGLEVALUEARRAYS feature is enabled, and deep wrapper array nesting occurs...
Astra Linux – Vulnerability in Jackson-Databind
FasterXML Jackson-Databind 2.x versions before 2.9.10.8 mishandle the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool...
Astra Linux – Vulnerability in Jackson-Databind
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: veth: Fixed a NAPI leak in the XDP enable error path. During XDP enablement in a veth device, if xdprxqinforeg or xdprxqinforegmemmodel fails, the driver rolls back the changes made. However, the rollback loop: for i--; i = start...
Astra Linux – Vulnerability in Qemu
QEMU 5.0.0 has a heap-based Buffer Overflow in the flatviewreadcontinue function in exec.c, as hw/sd/sdhci.c improperly handles a write operation in the SDHCBLKSIZE case...
Astra Linux – Vulnerability in TIF format
A segmentation fault flaw was discovered in libtiff, which can be triggered by passing a crafted TIF file to the TIFFReadRGBATileExt API. This flaw allows a remote attacker to cause a heap buffer overflow, resulting in a denial of service...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: net: atlantic: freeing stranded TX buffers on ring deinit The aqvecdeinit function drains the TX rings with a single aqringtxclean call. This frees at most AQCFGTXCLEANBUDGET 256 descriptors. However, the reference to hwhead...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: Input: evdev – fixed an issue related to information leakage in evdevpassvalues In evdevpassvalues, the inputevent structure is allocated on the kernel stack and populated field-by-field. However, it is never fully initialized. O...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: dm array: Rejects an array block whose value size is not the caller’s. arrayblockcheck can only compare the header against itself. Therefore, a block with a valuesize of 4 and a maxEntries of 1018 is internally consistent and...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerabilities have been resolved: net: mana: Added NULL guards in the teardown process to prevent panics during attach failures. When queue allocation fails halfway through, error cleanup releases variables apc-txqp and apc-rxqs containing NULL values. Multipl...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: Input: iforce – validates the lengths of input packets. iforceprocesspacket reads fixed fields from joystick, wheel, and status packets without first checking their lengths. In particular, the shared “hats-and-buttons” helper...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: Input: In evdev, it is necessary to sanitize the event type index when fetching event masks. The event type index provided by the user and passed to EVIOCGMASK/EVIOCSMASK is used to index the static counts array in evdevgetmaskcn...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: eir: Fixed an issue with OOB reading in eirgetservicedata. eirgetservicedata processes advertising data for a Service Data field with a matching UUID. In case of a mismatch, it advances to the next field as follows:...
Astra Linux – Vulnerability in Firefox, Thunderbird
Memory safety bugs exist in Firefox ESR 140.5, Thunderbird ESR 140.5, Firefox 145, and Thunderbird 145. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability wa...
Astra Linux – Vulnerability in dovecot
Very large headers can cause resource exhaustion when parsing messages. The message parser usually reads relatively small chunks of the message. However, when these smaller chunks are fed into the message-header parser, the “fullvalue” buffer starts to grow excessively. The “fullvalue” buffer has...
Astra Linux – Vulnerability in Chromium
Integer overflow in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in PHP 7.3
In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when the pdomysql extension with the mysqlnd driver is used, if the third-party provider is allowed to provide the host and the connection password, an excessively long password can trigger a buffer overflow in PHP,...
Astra Linux – Vulnerability in Tomcat9
A missing critical step in the authentication process in Apache Tomcat’s vulnerability allows attackers to authenticate without providing the correct password. This issue affects Apache Tomcat versions ranging from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap002: fix runtime PM leak on read error The gp2ap002readraw function calls pmruntimegetsync before reading the lux value. However, if gp2ap002getlux fails, the function returns directly. This bypasses the...