Astra Linux – Vulnerability in Chromium

The use of after free in Extensions in Google Chrome before version 139.0.7258.66 allowed a remote attacker to potentially exploit heap corruption through a crafted Chrome Extension. Chromium security severity: Medium...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: nvme-tcp: sanitize request list handling Validating the request in nvmetcphandler2t to ensure it is not part of any list; otherwise, a malicious R2T PDU might introduce a loop into the request list processing...

Astra Linux – Vulnerability in Apache2

In some modssl configurations on the Apache HTTP Server 2.4.35 to 2.4.63, it is possible for trusted clients to bypass access controls using TLS 1.3 session resumption. These configurations are affected when modssl is configured for multiple virtual hosts, with each virtual host restricted to a...

Astra Linux – Vulnerability in Python 3.11

When an address list is folded, and the separating comma ends up on a folded line that needs to be encoded using Unicode, then the separator itself must also be encoded using Unicode. The expected behavior is that the separating comma remains a plain comma. However, this can lead to the address...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: ofnuma: Fixed uninitialized memory nodes that caused kernel panic. When there are memory-only nodes nodes without CPUs, these nodes are not properly initialized, causing kernel panic during boot. ofnumainit ofnumaParseCPUNodes...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: wifi: mt76: fix linked list corruption Never leave scheduled wcid entries on the temporary on-stack list...

Astra Linux – Vulnerability in pam

A vulnerability was discovered in PAM. Secret information is stored in memory, and the attacker can trigger the victim’s program to execute by sending characters to its standard input stdin. During this process, the attacker can instruct the branch predictor to execute a ROP chain speculatively...

Astra Linux – Vulnerability in iniparser

Iniparser v4.1 is vulnerable to NULL Pointer Dereference in the iniparsergetlongint function, as there is no check for NULL values in the return value of the iniparsergetstring function...

Astra Linux – Vulnerability in Linux 6.1

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

Astra Linux – Vulnerability in MariaDB

MariaDB Server versions 10.10 through 10.11. and 11.0 through 11.4. crash when executing JOIN::fixallsplittingsinplan...

Astra Linux – Vulnerability in parsec-cups

The vulnerability of the Parsec Cups protection and marking mechanism is related to the improper release of memory before deleting the last reference. Exploiting this vulnerability allows a hacker to trigger a service failure...

Astra Linux – Vulnerability in libssh2

The vulnerability of the libssh2ntohu32 function in the SSH2 protocol implementation library Libssh2 involves reading data beyond the allowable buffer size. Exploiting this vulnerability allows a remote attacker to gain access to confidential data and also cause service failures...

Astra Linux – Vulnerability in Keepalived

The vulnerability of the Keepalived network traffic balancing system is related to unvalidated array indexing. Exploiting this vulnerability allows an attacker to cause service failures...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: hfs: fixed a general protection fault in hfsfindinit The hfsfindinit method can cause a crash if the tree pointer is NULL: 45.746290T9787 Oops: general protection fault, likely due to a non-canonical address 0xdffffc0000000008...

Astra Linux – Vulnerability in mbedtls

Mbed TLS before version 3.6.4 has a race condition in AESNI detection when certain compiler optimizations are applied. An attacker may be able to extract an AES key from a multithreaded program, or perform a GCM forgery...

Astra Linux – Vulnerability in edk2

EDK2 contains a vulnerability in the BIOS, where an attacker can cause a “Protection Mechanism Failure” through local access. Successful exploitation of this vulnerability will lead to the execution of arbitrary code, compromising Confidentiality, Integrity, and Availability...

Astra Linux – Vulnerability in Tiff

A vulnerability has been identified in LibTIFF 4.7.0. This affects the function main of the tiffcrop.c file in the tiffcrop component. Performing certain manipulations may lead to memory corruption. This attack can only be executed locally. The exploit has been made available to the public, and i...

Astra Linux – Vulnerability in PHP 8.2

In PHP versions 8.1. before 8.1.33, 8.2. before 8.2.29, 8.3. before 8.3.23, and 8.4. before 8.4.10, when parsing XML data in SOAP extensions, overly large 2Gb XML namespace prefixes may lead to null pointer dereferencing. This can result in crashes and affect the availability of the target server...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in Core in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Permissions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...