Astra Linux – Vulnerability in libvirt

A flaw was discovered in libvirt. A refactoring of the code that retrieves the list of interfaces for multiple APIs introduced a corner case on platforms where allocating 0 bytes of memory results in a NULL pointer. This corner case could lead to a NULL pointer being dereferenced, causing the...

Astra Linux – Vulnerability in Firefox, Thunderbird

A race condition could allow a cross-origin container to obtain permissions from the top-level origin. This vulnerability affects Firefox 128, Firefox ESR 115.13, Thunderbird 115.13, and Thunderbird 128...

Astra Linux – Vulnerability in GhostScript

Artifex Ghostscript before version 10.03.0 has a heap-based overflow issue when PDFPassword e.g., for runpdf contains a \000 byte in it...

Astra Linux – Vulnerability in Firefox, Thunderbird

The date picker may partially obscure security prompts. A malicious site could use this feature to trick users into granting permissions. This vulnerability affects Firefox 129, Firefox ESR 115.14, Firefox ESR 128.1, Thunderbird 128.1, and Thunderbird 115.14...

Astra Linux – Vulnerability in ffmpeg

FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder...

Astra Linux – Vulnerability in needrestart

Qualys discovered that before version 3.8, needrestart passed unsanitized data to a library Modules::ScanDeps, which expects safe input. This could allow a local attacker to execute arbitrary shell commands. Please refer to the related CVE-2024-10224 in Modules::ScanDeps...

Astra Linux – Vulnerability in GhostScript

Artifex Ghostscript before version 10.03.0 has a heap-based pointer disclosure observable in a constructed BaseFont name in the function pdfbasefontalloc...

Astra Linux – Vulnerability in pillow

In imagingcms.c within Pillow, before version 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy...

Astra Linux – Vulnerability in Chromium

Type Confusion in V8 in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Python 3.11

There is a low-severity vulnerability affecting CPython, specifically the ‘http.cookies’ standard library module. When parsing cookies where quotes were represented by backslashes in the cookie value, the parser uses an algorithm with quadratic complexity, resulting in excessive CPU resources bei...

Astra Linux – Vulnerability in OpenSSH

OpenSSH versions 9.5 through 9.7 before 9.8 sometimes allow timing attacks against password entry processes such as echo-off password input e.g., for su and Sudo, due to a logical error in the ObscureKeystrokeTiming mechanism. Similarly, other timing attacks against keystroke input operations may...

Astra Linux – Vulnerability in GSL

A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL GNU Scientific Library, versions 2.5 and 2.6. Processing input data that is maliciously crafted for the gslstatsquantilefromsorteddata function of this library may result in unexpected application...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: block/ioctl: prefer different overflow check Running syzkaller with the newly reintroduced signed integer overflow The sanitizer reports the following issues: 62.982337 ------------ cut here ------------ 62.985692 cgroup:...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in LibreOffice

Improper digital signature invalidation vulnerability in the Zip Repair Mode of The Document Foundation’s LibreOffice library allows for signature forgery vulnerabilities in LibreOffice. This issue affects LibreOffice versions starting from 24.2 before 24.2.5...

Astra Linux – Vulnerability in Chromium

Before version 130.0.6723.92, Dawn in Google Chrome allowed a remote attacker to perform out-of-bounds memory access through a crafted HTML page. Chromium security severity: Critical...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in V8 in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to potentially perform out-of-bounds memory access via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

No description...

Astra Linux – Vulnerability in Chromium

Insufficient data validation in Downloads in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in cloud-init

Sensitive data may be exposed in logs of cloud-init before version 23.1.2. Attackers could use this information to obtain hashed passwords and potentially escalate their privileges...