Astra Linux – Vulnerability in Chromium

Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Logback

A serialization vulnerability in the logback receiver component, as part of logback version 1.4.11, allows an attacker to carry out a Denial-of-Service attack by sending poisoned data...

Astra Linux – Vulnerability in Thrift

In Apache Thrift, all versions up to and including 0.12.0, a server or client may encounter an infinite loop when processing specific input data. Since this issue was partially addressed in version 0.11.0, it only affects certain language bindings, depending on the installed version...

Astra Linux – Vulnerability in Squid

Squid is vulnerable to a Denial of Service attack, where a remote attacker can carry out a buffer overflow attack by writing up to 2 MB of arbitrary data into heap memory when Squid is configured to accept HTTP Digest Authentication...

Astra Linux – Vulnerability in nss, Thunderbird

Versions of NSS Network Security Services prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications that use NSS to handle signatures encoded within CMS, S/MIME, PKCS \7, or PKCS \12 are likely to be affected. Applications that...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: ksmbd: It is required that the minimum ACE size is respected in smbcheckpermdacl. Both ACE-walking loops in smbcheckpermdacl only protect against a remaining buffer being undersized, not against an ACE whose declared ace-size ...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: f2fs: Fixed to avoid migrating empty sections. A bug has been reported from a device with zufs: F2FS-fs dm-64: Inconsistent segment type 1, 0 in SSA and SIT. F2FS-fs dm-64: The filesystem was stopped due to reason: 4. Thread A...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Compare MACs in constant time To prevent timing attacks, MAC comparisons need to be performed in constant time. Replace the memcmp function with the correct function, cryptomemneq...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

A deadlock flaw was discovered in the Linux kernel’s BPF subsystem. This flaw allows a local user to potentially crash the system...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ima: Fixed a potential memory leak in imainitcrypto. If the SHA1 template is unable to be allocated, IMA fails to initialize and exits without freeing the imaalgoarray. Adding the necessary kfree call for imaalgoarray will preven...

Astra Linux – Vulnerability in Qemu

A flaw was discovered in the QEMU implementation of VMWare’s paravirtual RDMA device. This flaw allows a malicious guest driver to execute hardware commands when shared buffers have not yet been allocated, potentially leading to a use-after-free condition...

Astra Linux – Vulnerability in gst-plugins-base1.0

GStreamer before version 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags...

Astra Linux – Vulnerability in joblib

The joblib package from versions 0 and before 1.2.0 is vulnerable to Arbitrary Code Execution through the predispatch flag in the Parallel class, due to the eval statement...

Astra Linux – Vulnerability in Firefox and Thunderbird

Memory safety bugs exist in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability affects Firefox version...

Astra Linux – Vulnerability in Firefox and Thunderbird

A bug in the calculation of popup notification delays could have allowed an attacker to trick a user into granting permissions. This vulnerability affects Firefox 116, Firefox ESR 102.14, and Firefox ESR 115.1...

Astra Linux – Vulnerability in Firefox and Thunderbird

In some cases, an untrusted input stream was copied to a stack buffer without checking its size. This resulted in a potentially exploitable crash, which could have led to a sandbox escape. This vulnerability affects Firefox 116, Firefox ESR 102.14, and Firefox ESR 115.1...

Astra Linux – Vulnerability in Firefox

Memory safety bugs exist in Firefox 115. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability affects Firefox versions prior to 116...

Astra Linux – Vulnerability in Firefox and Thunderbird

When the number of cookies per domain was exceeded in document.cookie, the actual cookie jar sent to the host was no longer consistent with the expected state of the cookie jar. This could result in requests being sent with some cookies missing. This vulnerability affects Firefox 116, Firefox ESR...

Astra Linux – Vulnerability in SQLite3

In SQLite 3.31.1, there is an out-of-bounds access issue involving the ALTER TABLE operation for views that contain nested FROM clauses...

Astra Linux – Vulnerability in Thunderbird, Firefox

A website could have obscured the full-screen notification by using a URL that was processed by an external program, such as a mailto URL. This could have caused confusion among users and potentially led to spoofing attacks. This vulnerability affects Firefox 116, Firefox ESR 115.2, and Thunderbi...