Astra Linux – Vulnerability in Qemu

A use-after-free vulnerability was discovered in the am53c974 SCSI host bus adapter emulation in QEMU in versions prior to 6.0.0, during the handling of the ‘Information Transfer’ command CMDTI. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial ...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the Installer component of Google Chrome prior to version 92.0.4515.107 allowed a remote attacker to perform local privilege escalation through a crafted file...

Astra Linux – Vulnerability in Chromium

Before version 91.0.4472.101, using the "after free" mechanism in the Loader component in Google Chrome allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerability in WebKit2GTK

A problem related to injections has been addressed through improved validation. This issue is fixed in Safari 17.4, iOS 17.4, iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, and watchOS 10.4. A maliciously crafted webpage may potentially exploit this vulnerability...

Astra Linux – Vulnerability in Firefox and Thunderbird

An improper implementation of the new iframe sandbox keyword allow-top-navigation-by-user-activation could allow script execution when the allow-scripts flag is not set. This vulnerability affects Thunderbird version 91.9, Firefox ESR version 91.9, and Firefox version 100...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerabilities have been resolved: drm: bridge/panel: Cleans up the connector when the bridge is detached If we do not call drmconnectorcleanup manually in panelbridgedetach, the connector will be cleaned up along with other DRM objects during the call to...

Astra Linux – Vulnerability in WebKit2GTK

A buffer overflow issue has been addressed through improved memory handling. This issue is fixed in Safari 16, iOS 16, iOS 15.7, and iPadOS 15.7. Processing maliciously crafted web content may lead to arbitrary code execution...

Astra Linux – Vulnerability in exempi

The XMP Toolkit SDK version 2020.1 and earlier is affected by an improper input validation vulnerability, which may lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction, as the victim must open a specially crafted file...

Astra Linux – Vulnerability in WebKit2GTK

A logic issue has been addressed through improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.1, iOS 15.7.2, and iPadOS 15.7.2, macOS Ventura 13.1, iOS 16.2, and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may allow bypass of the...

Astra Linux – Vulnerability in Chromium

Before version 91.0.4472.77, using "Use after free" in DevTools in Google Chrome allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code through a crafted Chrome Extension. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Before version 96.0.4664.110, using Swiftshader in Google Chrome allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: net: caif: fixed a memory leak in cfusbldevicenotify. In the case of a failure in caifenrolldev, the allocated linksupport will not be assigned to the corresponding structure. Therefore, simply free the allocated pointer in case ...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in the iframe Sandbox in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to bypass file download restrictions via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in the 389-DS-base

A flaw was discovered in RHDS 11 and RHDS 12. While browsing entries using LDAP, the system attempts to decode the userPassword attribute instead of the userCertificate attribute, which could lead to sensitive information being leaked. An attacker with a local account where cockpit-389-ds is...

Astra Linux – Vulnerability in Chromium

Integer overflow in Core in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who had access to a race condition to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in htmldoc

A flaw was discovered in htmldoc version 1.9.12. A heap buffer overflow in the rendertablerow function, located in ps-pdf.cxx, may lead to arbitrary code execution and denial of service...

Astra Linux – Vulnerability in Chromium

The inappropriate implementation in Input in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to spoof the contents of cross-origin websites through a crafted HTML page...

Astra Linux – Vulnerability in Firefox

A malicious extension with the “search” permission could have installed a new search engine, and the favicon of this engine referenced a cross-origin URL. The response to this cross-origin request could have been read by the extension, allowing it to bypass the same-origin policy—even though the...

Astra Linux – Vulnerability in htmldoc

In the htmldoc v1.9.11 and earlier versions, a null pointer dereference vulnerability may allow attackers to execute arbitrary code and cause a denial of service through a crafted HTML file...

Astra Linux – Vulnerability in binutils

The readelf.c file in GNU Binutils 2.32 contains an integer overflow vulnerability that allows attackers to trigger a write access violation in the byteputlittleendian function in elfcomm.c through an ELF file, as demonstrated by readelf...