Astra Linux – Vulnerability in OpenSSL

Applications that use non-default options when verifying certificates may be vulnerable to attacks from a malicious Certificate Authority CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL, and other certificate policy checks for tho...

Astra Linux – Vulnerability in Chromium

Before version 105.0.5195.125, writing out of bounds in Storage using Google Chrome allowed a remote attacker to perform an out-of-bounds memory write through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: USB: Fixed various gadgets’ null pointer dereferencing issues during 10Gbps networking scenarios. This issue was addressed by simply reusing the 5Gbps configuration for 10Gbps connections, thereby avoiding null pointer dereferenc...

Astra Linux – Vulnerability in Linux 5.10, Linux

Dm-verity is used to extend the root-of-trust to root file systems. LoadPin builds upon this feature to restrict module/firmware loads to only the trusted root file system. Currently, device-mapper table reloads allow users with root privileges to replace the target with an equivalent dm-linear...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ext4: Fixed a task that was stuck in ext4xattrdeleteinode. Syzbot reported a problem with stuck tasks: ================================================================== INFO: Task syz-executor232:5073 is blocked for more than...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: ARM: OMAP2+: Fixed a refcount leak in opmap3xxxprmlateinit. offindmatchingnode now returns a node pointer with a refcount incremented. We should use ofnodeput on this pointer when it is no longer needed. Added ofnodeput to avo...

Astra Linux – Vulnerability in Firefox and Thunderbird

Freeing arbitrary nsIInputStream's on a thread other than the one in which they were created could lead to a use-after-free, potentially causing a crash. This vulnerability affects Firefox ESR 102.5, Thunderbird 102.5, and Firefox 107...

Astra Linux – Vulnerability in OVN

A flaw was discovered in the Open Virtual Network OVN. In OVN clusters where BFD is used between hypervisors for high availability, an attacker can inject specially crafted BFD packets from within unprivileged workloads, including virtual machines or containers, which can trigger a denial of...

Astra Linux – Vulnerability in virglrenderer

A out-of-bounds write issue was discovered in the VirGL virtual OpenGL renderer virglrenderer. This flaw allows a malicious attacker to create a specially crafted virgil resource, then issue a VIRTGPUEXECBUFFER ioctl command, resulting in a denial of service or potential code execution...

Astra Linux – Vulnerability in Colorod

There are two information disclosure vulnerabilities in colord, and they reside in colord/src/cd-device-db.c and colord/src/cd-profile-db.c, respectively. These vulnerabilities exist because the 'errmsg' of 'sqlite3exec' does not get released after use, whereas libxml2 requires that the caller mu...

Astra Linux – Vulnerability in SOX

A floating-point exception division by zero issue was discovered in SoX during the execution of the startread function in the wav.c file. An attacker with a specially crafted wav file could cause the application to crash...

Astra Linux – Vulnerability in SOX

A floating-point exception division by zero issue was discovered in SoX within the readsamples function of the voc.c file. An attacker with a malicious file could cause the application to crash...

Astra Linux – Vulnerability in Vim

NULL pointer dereferencing in the GitHub repository for Vim/Vim before version 8.2...

Astra Linux – Vulnerability in dcmtk

DCMTK through version 3.6.6 does not handle string copying properly. When specific requests are sent to the dcmqrdb program, it queries its database and copies the result, even if the result is null. This can lead to a head-based overflow. An attacker can use this vulnerability to launch a DoS...

Astra Linux – Vulnerability in libjettison-java

Those who use Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks DOS. If the parser runs on user-supplied input, an attacker may provide content that causes the parser to crash due to a stack overflow. This vulnerability could facilitate a Denial of Servic...

Astra Linux – Vulnerability in bluez

BlueZ before version 5.59 allows physically nearby attackers to cause a denial of service, as malformed and invalid capabilities can be processed in the profiles/audio/avdtp.c file...

Astra Linux – Vulnerability in Firefox

When dragging and dropping an image across origins, the size of the image may be leaked. This behavior was present in version 109 and caused web compatibility issues, as well as this security concern. Therefore, this behavior was disabled until further review. This vulnerability affects Firefox...

Astra Linux – Vulnerability in Chromium

A heap buffer overflow in WebXR in Google Chrome prior to version 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. The supported versions affected are Java SE: 7u311, 8u301, 11.0.12; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. This easily exploitable vulnerability allows an unauthenticated...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel up to version 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory through a Speculative Store Bypass side-channel attack. This occurs because a certain preempting store operation does not necessarily occur before a store operation whose valu...