Astra Linux – Vulnerability in Chromium

Before version 102.0.5005.61, using the "after free" feature in the Performance Manager in Google Chrome allowed a remote attacker to potentially exploit heap corruption by using a crafted HTML page, as long as that attacker could convince a user to perform certain user interactions...

Astra Linux – Vulnerability in Thunderbird

After a VR process is destroyed, a reference to it may have been retained and used, leading to a “use-after-free” issue and potentially exploitable crashes. This vulnerability affects Thunderbird 91.8 and Firefox ESR 91.8...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: RISCV: Check whether the code to be patched lies within the exit section. Otherwise, we proceed to vmalloctopage, which panics because the address does not lie within the vmalloc region...

Astra Linux – Vulnerability in Linux 5.10, Linux

When sending malicious data to the kernel using the ioctl cmd FBIOPUTVSCREENINFO, the kernel will write data beyond the allocated memory boundaries...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fixed an oops during rmmod on single-CPU platforms. During the removal of the idxd driver, a registered offline callback was invoked as part of the cleanup process. However, on systems with only one CPU online, n...

Astra Linux – Vulnerability in Ruby 2.5

REXML is an XML toolkit for Ruby. The REXML gem before version 3.3.6 has a DoS vulnerability when it parses XMLs that contain many elements with the same local name attribute. If you need to parse untrusted XMLs using tree parser APIs like REXML::Document.new, you may be vulnerable to this...

Astra Linux – Vulnerability in Qemu

An infinite loop flaw was discovered in the e1000 NIC emulator of QEMU. This issue occurs when processing transmit tx descriptors in processtxdesc, especially if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in...

Astra Linux – Vulnerability in linux-astra-modules-5.10, linux-astra-modules-6.1, linux-astra-modules-5.15

The vulnerability of Linux Astra Modules’ kernel modules is related to insufficient validation of input data. Exploiting this vulnerability allows attackers to access confidential data, compromise its integrity, and cause service failures...

Astra Linux – Vulnerability in WebKit2GTK

There is a code execution vulnerability in the AudioSourceProviderGStreamer functionality of Webkit WebKitGTK 2.30.1. A specially crafted web page may lead to a use after free issue...

Astra Linux – Vulnerability in python-bottle

Fix the issue before 0.12.20: handling errors during early request binding...

Astra Linux – Vulnerability in WebKit2GTK

In WebKitGTK up to 2.36.0 and WPE WebKit, there is a heap-based buffer overflow in WebCore::TextureMapperLayer::setContentsLayer in WebCore/platform/graphics/texmap/TextureMapperLayer.cpp...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: prevented mss overflow in skbsegment Once again, syzbot is able to cause the kernel to crash in skbSegment. “GSOBYFRAGS” is a forbidden value, but unfortunately, the following calculation in skbSegment can easily result in...

Astra Linux – Vulnerability in WebKit2GTK

Multiple memory corruption issues have been resolved through improved memory handling. This issue is fixed in iOS 14.8 and iPadOS 14.8, watchOS 8, Safari 15, tvOS 15, iOS 15, and iPadOS 15, as well as iTunes 12.12 for Windows. Processing maliciously crafted web content may lead to arbitrary code...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net: dpaa2-eth: fix use-after-free in dpaa2ethremove Access to netdev after calling freenetdev may lead to a use-after-free bug. To prevent this issue, move the debug log before the freenetdev call...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ext4: Regenerate the buddy structure after block freeing fails when under fc replay. This fix primarily reverts to commit 6bd97bf273bd “ext4: Remove redundant mbregeneratebuddy”, and reintroduces the function mbregeneratebuddy...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix lock ordering in btrfszoneactivate The btrfs CI reported a lockdep warning as follows when running generic/129. WARNING: A circular locking dependency was detected. 6.7.0-rc5+ 1 Not tainted...

Astra Linux – Vulnerability in Firefox and Thunderbird

Mozilla developer Nika Layzell and the Mozilla Fuzzing Team reported memory safety bugs in Firefox 103 and Firefox ESR 102.1. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code...

Astra Linux – Vulnerability in Chromium

Before version 99.0.4844.74, using Safe Browsing in Google Chrome allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerability in Chromium

Before version 101.0.4951.41, using the "After Free" feature in Google Chrome on a Mac allowed a remote attacker to potentially exploit heap corruption by using a crafted HTML page. This attacker could convince a user to perform certain user interactions, thereby enabling them to exploit the syst...

Astra Linux – Vulnerability in libsndfile

Multiple signed integer overflows occur in the aureadheader function in src/au.c, as well as in the mat4open and mat4readheader functions in src/mat4.c within Libsndfile. This vulnerability allows an attacker to cause a Denial of Service or other unspecified impacts...