Astra Linux – Vulnerability in libxml-libxml-perl

XML::LibXML versions up to 2.0210 for Perl cause the reading of out-of-bounds heap memory when parsing XML node names that contain truncated UTF-8 byte sequences. A node name ending at the middle of a multi-byte UTF-8 sequence causes the parser to read past the end of the input string into adjace...

Astra Linux – Vulnerability in openexr

There is a flaw in OpenEXR’s deep tile sample size calculations in versions before 3.0.0-beta. An attacker who can submit a crafted file for processing by OpenEXR could trigger an integer overflow, resulting in an out-of-bounds read. The greatest risk of this flaw is to the application’s...

Astra Linux – Vulnerability in TIF format

The tiffcrop utility in libtiff has a flaw in input validation that can lead to out-of-bounds reading, and ultimately cause a crash if an attacker is able to provide a malicious file to tiffcrop...

Astra Linux – Vulnerability in gdisk

In the LoadPartitionTable function of gpt.cc, there is a potential out-of-bounds write vulnerability due to a missing bounds check. This could lead to a local escalation of privileges when inserting a malicious USB device, without the need for additional execution privileges. User interaction is...

Astra Linux – Vulnerability in Chromium

Before version 117.0.5938.62, SwiftShader in Google Chrome allowed a remote attacker to perform an out-of-bounds memory write through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in pcre2

A out-of-bounds read vulnerability was discovered in the PCRE2 library, specifically in the getrecursedatalength function of the pcre2jitcompile.c file. This issue affects recursions in JIT-compiled regular expressions due to duplicate data transfers...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: sched: fix ets qdisc OOB Indexing Haowei Yan discovered that etsclassfromarg can index an Out-Of-Bound class when the clid of 0 is passed. This may lead to local privilege escalation. 18.852298 ------------ Cut here ---...

Astra Linux – Vulnerability in libssh2

In libssh2 v1.9.0 and earlier versions, the SSHMSGDISCONNECT logic in packet.c has an integer overflow in a bounds check, allowing an attacker to specify an arbitrary out-of-bounds offset for a subsequent memory read. A malicious SSH server may be able to disclose sensitive information or cause a...

Astra Linux – Vulnerability in Chromium

Before version 146.0.7680.75, using Skia in Google Chrome allowed a remote attacker to perform out-of-bounds memory access through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Before version 114.0.5735.90, read and write access in ANGLE using Google Chrome allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in unzip

A flaw was discovered in Unzip. The vulnerability occurs during the conversion of a wide string to a local string, resulting in an out-of-bound write operation on the heap. This flaw allows an attacker to submit a specially crafted zip file, causing a crash or code execution...

Astra Linux – Vulnerability in pymongo

A out-of-bounds read in the ‘bson’ module of PyMongo 4.6.2 or earlier allows for deserialization of malformed BSON data provided by the server, which can trigger an exception that may contain arbitrary application memory...

Astra Linux – Vulnerability in xwayland, xorg-server

A flaw was discovered in the X.Org X server’s validation of XKB key type requests. A local attacker could send a specially crafted request to the X server, leading to a vulnerability where out-of-bounds memory access could occur. This could result in the disclosure of sensitive information or cau...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fixed out-of-band OOB access during the parseadvmonitorpattern function execution. In the parseadvmonitorpattern function, the value of the length variable is currently limited to HCIMAXEXTADLENGTH251. The size o...

Astra Linux – Vulnerability in ffmpeg, ffmpeg5

The unchecked return value and out-of-bounds read vulnerabilities in FFmpeg allow for the reading of sensitive constants within an executable file. This vulnerability is associated with the program file located at https://github.com/FFmpeg/FFmpeg/blob/master/libavfilter/afpan.C. This issue affect...

Astra Linux – Vulnerability in libarchive

A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are passed into bsdtar, potentially allowing for reading beyond the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior,...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

A race condition was detected in the Linux kernel’s IP framework for transforming packets XFRM subsystem, where multiple calls to xfrmprobealgs occurred simultaneously. This flaw could allow a local attacker to potentially trigger an out-of-bounds write or leak kernel heap memory by performing an...

Astra Linux – Vulnerability in glibc

Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single-byte and multibyte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer. This...

Astra Linux – Vulnerability in Chromium

Integer overflow in Skia in Google Chrome prior to version 145.0.7632.159 allowed a remote attacker to potentially perform out-of-bounds memory access through a crafted HTML page. Chromium security severity: Critical...

Astra Linux – Vulnerability in w3m

There is a out-of-bounds write in the checkType field located in etc.c in w3m 0.5.3. This issue can be triggered by sending a crafted HTML file to the w3m binary. It allows an attacker to cause a Denial of Service attack, or potentially have unspecified other impacts...