Astra Linux – Vulnerability in Chromium

Using “after free” in Fonts in Google Chrome before version 88.0.4324.146 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerability in binutils

A vulnerability was discovered in GNU Binutils 2.45. The affected function is bfdx86elflatesizesections in the file bfd/elfxx-x86.c of the Linker component. This vulnerability leads to out-of-bounds read attacks. The attack must be approached locally. The exploit has been made public and can be...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in the GPU component of Google Chrome prior to version 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory through a crafted HTML page. Chromium security severit...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

The atmtcenqueue function in the net/sched/schatm.c file of the Linux kernel, as of version 6.1.4, allows attackers to cause a denial of service due to type confusion. In some cases, non-negative numbers can indicate a TCACTSHOT condition instead of valid classification results...

Astra Linux – Vulnerability in Composer

Composer is a dependency manager for PHP. Users who publish a composer.phar file to a publicly accessible web server where the file can be executed as a PHP file may be subject to a remote code execution vulnerability if PHP also has registerargcargv enabled in php.ini. Versions 2.6.4, 2.2.22, an...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: gadget: fix NULL pointer dereference in epqueue When the gadget endpoint is disabled or not yet configured, the ep-desc pointer can be NULL. This can lead to a NULL pointer dereference when cdns3gadgetepqueue is calle...

Astra Linux – Vulnerability in Squid

Squid is a caching proxy for the Web. In versions 6.3 and below, Squid is vulnerable to a heap buffer overflow and possible remote code execution attack when processing URNs due to incorrect buffer management. This issue has been fixed in version 6.4. To address this problem, disable URN access...

Astra Linux – Vulnerability in Firefox and Thunderbird

The WebAssembly JIT might miscalculate the size of a return type, which could lead to a null read and result in a crash. Note: This issue only affected x86-32 platforms. Other platforms are unaffected.. This vulnerability affects Firefox ESR 78.10, Thunderbird 78.10, and Firefox 88...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Tracing: Fixed the issue of reading strings from synthetic events. The following commands caused a crash: cd /sys/kernel/tracing echo 's:open char file' dynamicevents echo...

Astra Linux – Vulnerability in Chromium

A heap buffer overflow in the Tab Strip component in Google Chrome on Windows, prior to version 88.0.4324.182, allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: can: j1939: j1939sendone: fixed the issue of missing CAN header initialization. The read access to struct canxlframe::len within a j1939 object, which creates a skbuff, revealed that the reserved elements in struct canframe were...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrumacltcam: Fixed a possible use-after-free during activity updates. The “rule activity update” process periodically traverses a list of configured rules and queries their activity from the device. As part of this...

Astra Linux – Vulnerability in GhostScript

A issue was discovered in psi/zcolor.c in Artifex Ghostscript prior to version 10.04.0. There is a buffer overflow vulnerability when reading colors from the indexed color space...

Astra Linux – Vulnerability in Tomcat9

A flaw in improper authentication in Apache Tomcat allowed for a replay attack on the EncryptionInterceptor in the cluster component. This issue affects Apache Tomcat versions: 11.0.0-M1 through 11.0.22, 10.1.0-M1 through 10.1.55, 9.0.13 through 9.0.18, 8.5.38 through 8.5.100, and 7.0.100 through...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables – Do not compare internal table flags during updates. If a table update does not modify the flags, skip the transaction...

Astra Linux – Vulnerability in binutils

It has been discovered that GNU Binutils prior to version 2.40 contains a memory leak vulnerability in the findabstractinstance function in dwarf2.c...

Astra Linux – Vulnerability in libpcap

The sf-pcapng.c file in libpcap before version 1.9.1 does not properly validate the PHB header length before allocating memory...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Before versions 6.9.13-48 and 7.1.2-23, the distributed pixel cache was originally designed to work without a challenge-response authentication model. This has been changed in versions 6.9.13-48 and...

Astra Linux – Vulnerability in Jetty9

In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0alpha0 to 10.0.1, and 11.0.0alpha0 to 11.0.1, CPU usage can reach 100% when receiving a large invalid TLS frame...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Whitelist slab/slub objects for copying to userspace Reading the dispatch trace log from /sys/kernel/debug/powerpc/dtl/cpu- results in a bug when the CONFIGHARDENEDUSERCOPY configuration is enabled, as shown belo...