Astra Linux – Vulnerability in ffmpeg

FFmpeg n7.0 is affected by a double-free issue through the rkmppretrieveframe function in libavcodec/rkmppdec.c...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel up to version 6.7.1, there is a use-after-free in cecqueuemsgfh, related to drivers/media/cec/core/cec-adap.c and drivers/media/cec/core/cec-api.c...

Astra Linux – Vulnerability in Firefox

Missing thread synchronization primitives could have led to a data race on members of the PlaybackParams structure. This vulnerability affects Firefox 133 and Thunderbird 133...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/smc: It was fixed that link down work might be scheduled before lgr freed, but it would execute after lgr freed, which could lead to a crash. Therefore, it is necessary to hold a reference before scheduling the link down work...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: mm/memory-failure: fixed handling of dissolved but not removed from buddy pages. When I performed memory failure tests recently, the following panic occurred: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0...

Astra Linux – Vulnerability in Firefox, Thunderbird

Memory safety bugs exist in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Fenced Frames in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to obtain potentially sensitive information from the system via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Firefox

Malicious websites may have been able to confirm user intent through tapjacking. This could have led users to approve the launch of external applications without realizing it, potentially exposing them to underlying vulnerabilities. This vulnerability affects Firefox 133 and Thunderbird 133...

Astra Linux – Vulnerability in hdf5

The HDF5 Library from version 1.14.3 contains a heap-based buffer overflow issue in the H5Fint.c file, specifically in the H5Faddrdecodelen function, which leads to the corruption of the instruction pointer...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: sockmap: Added a condresched function in sockhashfree. Several reports of syzbot soft lockups involve sockhashfree. If a map with a large number of buckets is destroyed, we need to yield the CPU when necessary...

Astra Linux – Vulnerability in Firefox

The z-order of browser windows can be manipulated to hide the fullscreen notifications. This could potentially be used to carry out a spoofing attack. This vulnerability has been fixed in Firefox 135 and Thunderbird 135...

Astra Linux – Vulnerability in Chromium

In versions of Google Chrome prior to 132.0.6834.83, races in frames allowed a remote attacker who convinced a user to perform certain UI gestures to perform UI spoofing through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: fs/netfs/fscachecookie: added a check for the missing “naccesses” parameter. This fix addresses a NULL pointer dereference bug caused by a data race. The details of the bug are as follows: BUG: NULL pointer dereference in the...

Astra Linux – Vulnerability in Firefox, Thunderbird

A website configured to initiate a specially crafted WebTransport session could cause the Firefox process to crash, resulting in a denial-of-service condition. This vulnerability affects Firefox 131, Firefox ESR 128.3, Thunderbird 128.3, and Thunderbird 131...

Astra Linux – Vulnerability in PHP 8.2

In PHP versions 8.1. before 8.1.31, 8.2. before 8.2.26, and 8.3. before 8.3.14, uncontrolled long string inputs to the ldapescape function on 32-bit systems can lead to an integer overflow, resulting in an out-of-bounds write...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: um: ubd: Do not use drvdata in release. The drvdata is not available in release. Let’s simply use containerof to obtain the ubd instance. Otherwise, removing a ubd device will result in a crash: RIP: 0033:blkmqfreetagset+0x1f/0xb...

Astra Linux – Vulnerability in Firefox, NSS

Calling PK11Encrypt in NSS using CKMCHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy Bridge processor. In Firefox, this only affects the QUIC header protection feature when the connection uses the ChaCha20-Poly1305 cipher suite. The most likely outcome i...

Astra Linux – Vulnerability in Firefox, Thunderbird

It was possible for a web extension with minimal permissions to create a StreamFilter, which could be used to read and modify the response body of requests on any site. This vulnerability affects Firefox 129, Firefox ESR 115.14, Firefox ESR 128.1, Thunderbird 128.1, and Thunderbird 115.14...

Astra Linux – Vulnerability in Firefox, Thunderbird

The editor code failed to check an attribute value. This could have led to a out-of-bounds read. This vulnerability affects Firefox 129, Firefox ESR 115.14, Firefox ESR 128.1, Thunderbird 128.1, and Thunderbird 115.14...

Astra Linux – Vulnerability in WebKit2GTK

The issue was addressed through improved checks. This issue is fixed in Safari 18.3, iOS 18.3, iPadOS 18.3, macOS Sequoia 15.3, tvOS 18.3, visionOS 2.3, and watchOS 11.3. Processing maliciously crafted web content may lead to memory corruption...