Astra Linux – Vulnerability in Ruby 2.5

REXML is an XML toolkit for Ruby. The REXML gem before version 3.2.6 has a denial-of-service vulnerability when it parses an XML document with many tags in an attribute value. Users who need to parse untrusted XMLs may be affected by this vulnerability. The REXML gem version 3.2.7 or later includ...

Astra Linux – Vulnerability in TIF format

A buffer overflow vulnerability has been discovered in Libtiff V.4.0.7. This vulnerability allows a local attacker to cause a denial of service through the tiffcp function in tiffcp.c...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105tabledeleteentry There are actually 2 problems: 1. Deleting the last element does not require moving elements. In fact, the element at position i+1 is out of bounds. 2...

Astra Linux – Vulnerability in Firefox and Thunderbird

A malicious web page could have caused an out-of-bounds write in WebGL, resulting in memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird 91.10, Firefox 101, and Firefox ESR 91.10...

Astra Linux – Vulnerability in WebKit2GTK

A memory management issue related to “use after free” operations has been addressed through improved memory management practices. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2, and iPadOS 16.2, as well as watchOS 9.2. Processing maliciously crafted web content may le...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

The nfqnlmangle function in net/netfilter/nfnetlinkqueue.c in the Linux kernel, as of version 5.18.14, allows remote attackers to cause a denial of service panic. This occurs because, in the case of an nfqueue verdict with a one-byte nftapayload attribute, an skbpull operation may encounter a...

Astra Linux – Vulnerability in pillow

In version 9.0.1, Pillow allows attackers to delete files because spaces in temporary pathnames are mishandled...

Astra Linux – Vulnerability in xwayland, xorg-server

A buffer overflow vulnerability was discovered in X.Org and Xwayland. The code in XkbVModMaskText allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and will copy the data regardless of the siz...

Astra Linux – Vulnerability in dnsmasq

A vulnerability was discovered in dnsmasq prior to version 2.81. This vulnerability involves a memory leak, allowing remote attackers to cause a denial of service due to excessive memory consumption through mechanisms related to DHCP response creation...

Astra Linux – Vulnerability in Samba

Windows Kerberos Elevation of Privilege Vulnerability...

Astra Linux – Vulnerability in Wireshark

The ECMP dissector crash in Wireshark versions 4.4.0 to 4.4.1 and 4.2.0 to 4.2.8 allows for denial of service through packet injection or malicious capture files...

Astra Linux – Vulnerability in WebKit2GTK

There was an issue involving “iframe” elements across origins. This issue has been resolved through improved tracking of security origins. This issue is fixed in Safari 18, iOS 18, iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, and watchOS 11. A malicious website may be able to exfiltrate data...

Astra Linux – Vulnerability in imagemagick

The PALM image coder in coders/palm.c makes an improper call to AcquireQuantumMemory in the routine WritePALMImage. This call requires an offset of 256 bytes. This could lead to a out-of-bounds read later in the routine. The patch adds 256 bytes to bytesperrow in the call to AcquireQuantumMemory...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fixed the race condition issue caused by session lookup and expiration. The session reference count was incremented within the lock during the lookup operation, thereby avoiding the race condition related to session...

Astra Linux – Vulnerability in Thunderbird, Firefox

The Content-Security-Policy-Report-Only header could allow an attacker to leak the unredacted URI of a child iframe when interaction with that iframe triggers a redirect. This vulnerability affects Firefox 110, Thunderbird 102.8, and Firefox ESR 102.8...

Astra Linux – Vulnerability in open-iscsi

A issue was discovered in Contiki version 3.0. A out-of-bounds read vulnerability exists in the uIP TCP/IP stack component when calculating checksums for IP packets in the upperlayerchksum function in net/ipv4/uip.c...

Astra Linux – Vulnerability in Zabbix

The Zabbix Agent 2 item key “smart.disk.get” does not sanitize its parameters before passing them to a shell command, which may lead to a vulnerability for remote code execution...

Astra Linux – Vulnerability in WebKit2GTK

A memory management issue related to “use after free” operations has been addressed through improved memory management practices. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iOS 15.4, and iPadOS 15.4, as well as tvOS 15.4. Processing maliciously crafted web content may...

Astra Linux – Vulnerability in Thunderbird

Thunderbird unexpectedly enabled JavaScript in the composition area. The JavaScript execution context was limited to this area and did not receive Chrome-level privileges; however, it could be used as a stepping stone for further attacks involving other vulnerabilities. This vulnerability affects...

Astra Linux – Vulnerability in gst-plugins-base1.0

GStreamer is a library for constructing graphs of media-handling components. A stack-buffer overflow has been detected in the vorbishandleidentificationpacket function within gstvorbisdec.c. The position array is a stack-allocated buffer of size 64. If vd-vi.channels exceeds 64, the for loop will...