Astra Linux – Vulnerability in Vim

Vim is vulnerable to Heap-based Buffer Overflow attacks...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: clk: Fixed the issue where clkcoreget could dereference a NULL value. It is possible for clkcoreget to dereference a NULL value in the following sequence: c clkcoreget ofclkgetHWFromClkspec ofclkgetHWFromProvider clkgetHW clkgetH...

Astra Linux – Vulnerability in Firefox and Thunderbird

Memory safety bugs exist in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability affects Firefox version...

Astra Linux – Vulnerability in Vim

Heap-based Buffer Overflow in the GitHub repository for Vim before version 8.2...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: drbd: Fixed five use-after-free bugs in getinitialstate. In getinitialstate, the function calls notifyinitialstatedoneskb,.. if cb-args5 == 1. If genlmsgput fails during notifyinitialstateDone, the skb will be freed by...

Astra Linux – Vulnerability in Firefox

A ambiguous file picker design could have confused users who intended to select and upload a single file, into uploading an entire directory. This issue was addressed by adding a new prompt. This vulnerability affects Firefox versions earlier than 85...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: PCI/AER: Fixed NULL pointer access via aerinfo. The kzallocGFPKERNEL function may return NULL, resulting in kernel panic when accessing aerinfo-xxx. This issue has been fixed...

Astra Linux – Vulnerability in Velocity

An attacker who is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify Velocity templates running Apache...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: cachefiles: fixed the slab-use-after-free issue in cachefileswithdrawcookie We encountered the following issue during our fault injection stress test: ================================================================== BUG: KASAN:...

Astra Linux – Vulnerability in Firefox

When Firefox is configured to block the storage of all cookies, it is still possible to store data in localstorage by using an iframe with a source of ‘about:blank’. This could allow malicious websites to store tracking data without permission. This vulnerability affects Firefox versions earlier...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: let netcore.devweight always be non-zero The following problem was encountered during stability testing: NULL netdevice: The NAPI poll function processbacklog+0x0/0x530 returned 1, exceeding its budget of 0. ------------ Cut...

Astra Linux – Vulnerability in Vim

Heap-based Buffer Overflow in the GitHub repository for vim/vim before version 8.2...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: amdkfd: Using calloc instead of kzalloc to avoid integer overflow. This approach uses calloc instead of performing multiplication, which might lead to overflow...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: lib/crypto: chacha – The permutedstate variable is zeroed before it leaves the scope of the function. Since the ChaCha permutation is invertible, the local variable permutedstate is sufficient to compute the original state, and...

Astra Linux – Vulnerability in exim4

Exim: Improper Neutralization of Special Elements Leading to Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected Exim installations. Authentication is not required to exploit this vulnerability. The specific flaw resides within the...

Astra Linux – Vulnerability in bluez

BlueZ Audio Profile: Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected BlueZ installations. User interaction is required to exploit this vulnerability, as the target must...

Astra Linux – Vulnerability in libde265

It was discovered that Libde265 v1.0.14 contains a heap-buffer-overflow vulnerability in the derivecombinedbipredictivemergingcandidates function at motion.cc...

Astra Linux – Vulnerability in PostgresSQL 11

The use of server error messages by clients in PostgreSQL allows a server that is not trusted under current SSL or GSS settings to send arbitrary non-NUL bytes to the libpq application. For example, a man-in-the-middle attacker could send a long error message claiming that a human user or someone...

Astra Linux – Vulnerability in Firefox and Thunderbird

A bug in the calculation of popup notification delays could have allowed an attacker to trick a user into granting permissions. This vulnerability affects Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7...

Astra Linux – Vulnerability in freeipa

A flaw was discovered in FreeIPA. This issue may allow a remote attacker to create an HTTP request with parameters that can be interpreted as command arguments for kinit on the FreeIPA server, resulting in a denial of service...