Astra Linux – Vulnerability in Chromium

In V8 of Google Chrome, out-of-bounds memory access prior to version 132.0.6834.110 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

“Type Confusion in V8 in Google Chrome” before version 131.0.6778.139 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in gnutls28

A flaw has been discovered in GnuTLS, where an application crash can occur when attempting to verify a specially crafted .pem bundle using the “certtool --verify-chain” command...

Astra Linux – Vulnerability in gnutls28

A flaw was discovered in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behaviors in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLSPRIVKEYFLAGREPRODUCIBLE flag, it can result in a noticeable reducti...

Astra Linux – Vulnerability in Firefox, Thunderbird

A missing delay in the directory upload UI could have allowed an attacker to trick a user into granting permissions through clickjacking. This vulnerability affects Firefox 131, Firefox ESR 128.3, Thunderbird 128.3, and Thunderbird 131...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: kTLS, Fixed incorrect page reference counting. The kTLS transaction handling code uses a combination of getpage and pagerefinc APIs to increment page references. However, in the release path...

Astra Linux – Vulnerability in ffmpeg

FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library, which allows for an integer overflow, potentially leading to a denial-of-service DoS attack...

Astra Linux – Vulnerability in WebKit2GTK

There was an issue involving “iframe” elements across origins. This issue has been resolved through improved tracking of security origins. This issue is fixed in Safari 18, iOS 18, iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, and watchOS 11. A malicious website may be able to exfiltrate data...

Astra Linux – Vulnerability in Firefox, Thunderbird

A potential memory corruption vulnerability could be triggered if an attacker had the ability to cause a “Out-of-Memory” exception at a specific moment during JIT compilation. This vulnerability affects Firefox 131, Firefox ESR 128.3, Thunderbird 128.3, and Thunderbird 131...

Astra Linux – Vulnerability in WebKit2GTK

The issue was addressed through improved checks. This issue is fixed in Safari 18.2, iOS 18.2, iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, and watchOS 11.2. Processing maliciously crafted web content may lead to an unexpected process crash...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fixed the race condition issue caused by session lookup and expiration. The session reference count was incremented within the lock during the lookup operation, thereby avoiding the race condition related to session...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free bugs caused by scosocktimeout When the sco connection is established and then, the sco socket is releasing, timeoutwork will be scheduled to judge whether the sco disconnection is timeout. The sock...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/sched: netem: account for backlog updates from child qdisc Generally, the qlen of any classful qdisc should reflect the number of packets held by the qdisc itself and all its children. In the case of netem, qlen only accounts...

Astra Linux – Vulnerability in Zabbix

A non-administrator user account on the Zabbix frontend, with the default User role, or any other role that grants API access, can exploit this vulnerability. There is an SQL injection vulnerability in the CUser class within the addRelatedObjects function. This function is called from the CUser.g...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ovl: Filtering invalid inodes with a missing lookup function. A check has been added to the ovldentryweird function to prevent the processing of directory inodes that lack the lookup function. This is important because such inode...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: STM class: A double-free issue in stmregisterdevice has been fixed. The call putdevice&stm-dev will trigger stmdevicerelease, which frees the stm structure. This means that the vfreestm on the next line constitutes a double-free...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Added a check for memory allocation. allocpbl can return an error when memory allocation fails. The driver does not check the status of memory allocation in some instances...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: UDP: The flag SOCKRCUFREE was set earlier in the udplibgetport function. The syzkaller triggered a warning 0 in the udpv4earlydemux function. In udpv46earlydemux and sklookup, we do not touch the refcount of the sk object;...

Astra Linux – Vulnerability in Firefox, Thunderbird

A permission leak could have occurred from a trusted site to an untrusted site through embed or object elements. This vulnerability affects Firefox 132, Firefox ESR 128.4, Firefox ESR 115.17, Thunderbird 128.4, and Thunderbird 132...

Astra Linux – Vulnerability in vlc

VLC Media Player 3.0.20 and earlier are vulnerable to denial of service due to an integer overflow. This vulnerability can be exploited by a maliciously crafted MMS stream heap-based overflow. If successful, a malicious third party can cause the VLC player to crash or execute arbitrary code with...