Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: cifs: Prevent NULL dereferencing in cifscomposemountoptions. The optional @ref parameter may contain a NULL nodename. Therefore, prevent dereferencing it in cifscomposemountoptions. Addresses-Coverity: 1476408 “Explicit NULL...

Astra Linux – Vulnerability in Chromium

Before version 99.0.4844.74, using "after free" in ANGLE with Google Chrome allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerability in Firefox and Thunderbird

Memory safety bugs exist in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability affects Firefox...

Astra Linux – Vulnerability in Firefox

A HTTP digest authentication nonce value was generated using rand, which may result in predictable values. This vulnerability affects Firefox versions less than 126...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: ipv4: Fixed a data race around the sysctlfibmultipathuseneigh function. When modifying sysctlfibmultipathuseneigh, it is possible for multiple processes to change it concurrently. Therefore, we need to add READONCE to its read...

Astra Linux – Vulnerability in Vim

A heap-based buffer overflow vulnerability occurs in Vim in the GitHub repository vim/vim, prior to version 8.2.4563...

Astra Linux – Vulnerability in Chromium

A heap buffer overflow in the Task Manager of Google Chrome prior to version 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerability in Linux, Linux 5.10

A flaw was discovered in the Linux SCTP stack. A blind attacker may be able to terminate an existing SCTP connection by using invalid chunks, provided that the attacker knows the IP addresses and port numbers being used, and that the attacker can send packets with spoofed IP addresses...

Astra Linux – Vulnerability in Firefox and Thunderbird

An attacker could have injected CSS into stylesheets that are accessible via internal URIs, such as resource:, thereby bypassing a page’s Content Security Policy. This vulnerability affects Firefox ESR 91.11, Thunderbird 102, Thunderbird 91.11, and Firefox 101...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: EFI: In runtime mode, a potential overflow of the size of the soft-reserved region has been fixed. If there are pages worth ≥ 4GB in a soft-reserved region, the value of mdsize will be reduced...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: hcicodec: Fixed leaking content of localcodecs The following memory leak can be observed when the controller supports codecs that are stored in the localcodecs list, but the elements are never freed: Unreferenced...

Astra Linux – Vulnerability in OpenVSwitch

A flaw was discovered in OpenVSwitch OVS. When processing an IP packet with protocol 0, OVS will install a datapath flow without modifying the IP header. This issue results in the installation of a datapath flow that matches all IP protocols with “nwproto” set to wildcard, but with an incorrect...

Astra Linux – Vulnerability in pcre3

In PCRE before version 8.44, libpcre allowed integer overflows due to a large number being used after a ?C substring...

Astra Linux – Vulnerability in Firefox and Thunderbird

A properly crafted CMS message could be processed incorrectly, resulting in an invalid memory read and potentially further memory corruption. This vulnerability affects Thunderbird 91.10, Firefox 101, and Firefox ESR 91.10...

Astra Linux – Vulnerability in Chromium

In Blink in Google Chrome prior to version 91.0.4472.77, a remote attacker could bypass the content security policy by using a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: scsi: advansys: Fixed kernel pointer leaks Pointers should be printed using %p or %px, rather than being cast to unsigned long and then printed using %lx. Change %lx to %p when printing hashed pointers...

Astra Linux – Vulnerability in libxpm

A flaw was discovered in libXpm. When processing files with the .Z or .gz extensions, the library calls external programs to compress and uncompress files. This process relies on the PATH environment variable to locate these programs. This vulnerability could allow a malicious user to execute oth...

Astra Linux – Vulnerability in Firefox

If the user adds a security exception for an invalid TLS certificate, opens an ongoing TLS connection with a server that uses that certificate, and then deletes the exception, Firefox will keep the connection alive, making it appear that the certificate is still trusted. This vulnerability affect...

Astra Linux – Vulnerability in Qemu

The vulnerability of the qxlsetmode function in the QEMU hardware emulation software is related to the insufficient use of the assert function. Exploiting this vulnerability allows a perpetrator to cause a system failure...

Astra Linux – Vulnerability in Firefox

When following a redirect to a publicly accessible web extension file, the URL may have been translated into the actual local path, potentially exposing sensitive information. This vulnerability affects Firefox versions earlier than 111...