Astra Linux – Vulnerability in grub2

A flaw was discovered in grub2 in versions prior to 2.06. The option parser allows an attacker to overwrite a heap-allocated buffer by calling certain commands with a large number of specific short forms of options. The greatest threat from this vulnerability is to data confidentiality and...

Astra Linux – Vulnerability in fig2dev

A flaw was discovered in fig2dev. This vulnerability allows for availability through local input manipulation using the gengeitpspline function...

Astra Linux – Vulnerability in Wireshark

In Wireshark versions 3.2.0 to 3.2.2, 3.0.0 to 3.0.9, and 2.6.0 to 2.6.15, the BACapp dissector could crash. This issue was addressed in the epan/dissectors/packet-bacapp.c file by limiting the amount of recursion...

Astra Linux – Vulnerability in highlight.js

Highlight.js is a syntax highlighter written in JavaScript. Versions of Highlight.js prior to 9.18.2 and 10.1.2 are vulnerable to “Prototype Pollution”. A malicious HTML code block can cause the base object’s prototype to be polluted during highlighting. If you allow users to insert custom HTML...

Astra Linux – Vulnerability in Firefox and Thunderbird

Applying a CSS filter effect could have access to out-of-bound memory. This could lead to a heap-buffer-overflow, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR 91.5, Firefox 96, and Thunderbird 91.5...

Astra Linux – Vulnerability in WebKit2GTK

A cross-origin issue in the IndexDB API has been resolved through improved input validation. This issue is fixed in iOS 15.3, iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, and macOS Monterey 12.2. It is possible for a website to track sensitive user information...

Astra Linux – Vulnerability in WebKit2GTK

A buffer overflow issue has been addressed through improved memory handling. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iTunes 12.12.3 for Windows, iOS 15.4, and iPadOS 15.4, as well as tvOS 15.4. Processing maliciously crafted web content may lead to arbitrary code...

Astra Linux – Vulnerability in Chromium

Type Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in pyyaml

PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and loadall functions due to a class deserialization issue. For example, Popen is a class in the subprocess module. NOTE: This issue exists because of an incomplete fix for CVE-2017-18342...

Astra Linux – Vulnerability in Ruby-Rack

Rack is a modular Ruby web server interface. Carefully crafted headers may cause header parsing in Rack to take longer than expected, potentially leading to a denial-of-service issue. The Accept and Forwarded headers are affected. Ruby 3.2 includes fixes for this problem, so Rack applications tha...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Trap RDMA segment overflows This fix prevents svcrdmabuildwrites from exceeding the end of a Write chunk’s segment array. This issue was identified using KASAN. The test that this fix replaces is invalid; it may have...

Astra Linux – Vulnerabilities in Firefox, Thunderbird, Expat, LibXMLTok

In xmltokimpl.c within Expat also known as libexpat, before version 2.4.5, there was no proper validation of encoding. This meant that there were no checks to determine whether a UTF-8 character was valid in a particular context...

Astra Linux – Vulnerability in Chromium

Before version 101.0.4951.41, using File Manager in Google Chrome allowed a remote attacker to potentially exploit heap corruption through specific and direct user interactions...

Astra Linux – Vulnerability in Linux

In bpfskbchangehead of filter.c, there is a possible out-of-bounds read due to a use after free. This could lead to a local escalation of privileges, as System execution privileges are required. User interaction is not necessary for exploitation. Product: Android Versions: Android kernel Android...

Astra Linux – Vulnerability in Vim

NULL pointer dereferencing in the GitHub repository for vim/vim before version 9.0.0240...

Astra Linux – Vulnerability in imagemagick

A divide-by-zero flaw was discovered in ImageMagick versions 6.9.11-57 and 7.0.10-57, located in the gem.c file. This flaw allows an attacker to submit a crafted file processed by ImageMagick, causing undefined behavior due to a division by zero. The greatest threat of this vulnerability is to...

Astra Linux – Vulnerability in Apache2

HTTP/2 incoming headers that exceed the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client continues to send headers, this can lead to memory exhaustion...

Astra Linux – Vulnerability in libbsd

The nlist.c file in libbsd before version 0.10.0 contains an out-of-bounds read during a comparison of a symbol name from the string table strtab...

Astra Linux – Vulnerability in Firefox

Race condition in the JavaScript: GC component. This vulnerability was fixed in Firefox 148 and Thunderbird 148...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted inputs in navigation in Google Chrome prior to version 146.0.7680.153 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: High...