109305 matches found
Astra Linux – Vulnerability in Firefox and Thunderbird
When opening Diagcab files, Firefox did not warn the user that these files might contain malicious code. This vulnerability affects Firefox 115, Firefox ESR 102.13, and Thunderbird 102.13...
Astra Linux – Vulnerability in libpgjava
pgjdbc is an open-source PostgreSQL JDBC Driver. In affected versions, a prepared statement using either PreparedStatement.setTextint, InputStream or PreparedStatemet.setByteaint, InputStream will create a temporary file if the InputStream exceeds 2 kilobytes in size. This temporary file can be...
Astra Linux – Vulnerability in open-vm-tools
VMware Tools contains an insecure file handling vulnerability. A malicious actor with non-administrative privileges on a guest VM may tamper with local files to trigger insecure file operations within that VM...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: hfsplus: treating special inodes as regular files Since the commit af153bb63a33 "vfs: catching invalid modes in mayopen" requires that any inode be of one of the types SIFDIR/SIFLNK/SIFREG/SIFCHR/SIFBLK/SIFIFO/SIFSOCK, use SIFREG...
Astra Linux – Vulnerability in c-ares
c-ares is a C library for asynchronous DNS requests. aresreadline is used to parse local configuration files such as /etc/resolv.conf, /etc/nsswitch.conf, the HOSTALIASES file, and, if using a c-ares version prior to 1.27.0, the /etc/hosts file. If any of these configuration files contains a NULL...
Astra Linux – Vulnerability in Ruby-Rack
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static used a simple string prefix check to determine whether a request should be treated as a static file. When configured with URL prefixes like "/css", it matched any request path that began with th...
Astra Linux – Vulnerability in Linux 5.10, Linux
In the Linux kernel, the following vulnerability has been resolved: ipvs: A warning in ipvscleanupbatch has been fixed. During the initialization of ipvsconnnetinit, if the files ipvsconn or ipvsconnsync fail to be created, the initialization is successful by default. Therefore, the ipvsconn or...
Astra Linux – Vulnerability in openjpeg2
Integer overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service DoS attack. This occurs when the attacker uses the command line option "-ImgDir" on a directory that contains 1048576 files...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: fsnotify: Do not generate ACCESS/MODIFY events for special files in child processes. inotify/fanotify: Do not allow users who have no read access to a file to subscribe to events like INACCESS/INMODIFY. However, users can stil...
Astra Linux – Vulnerability in Golang-1.23
The “go bug” command writes to two files with predictable names in the system’s temporary directory for example, "/tmp". An attacker who has access to the temporary directory can create a symbolic link in one of these files, causing “go bug” to overwrite the target of the symbolic link...
Astra Linux – Vulnerability in Jetty9
In Eclipse Jetty versions 1.0 through 9.4.32.v20200930, 10.0.0alpha1 through 10.0.0.beta2, and 11.0.0alpha1 through 11.0.0.beta2O, on Unix-like systems, the system’s temporary directory is shared among all users on that system. A collocated user can observe the process of creating a temporary...
Astra Linux – Vulnerability in Samba
All versions of Samba prior to 4.15.5 are vulnerable to a malicious client that can use a server symlink to determine whether a file or directory exists in a part of the server file system that is not exported under the share definition. This attack can only succeed if SMB1 with unix extensions i...
Astra Linux – Vulnerability in libxml2
There is a flaw in the XML entity encoding functionality of libxml2 in versions prior to 2.9.11. An attacker who can provide a crafted file for processing by an application that utilizes the affected functionality of libxml2 may trigger an out-of-bounds read. The most likely impact of this flaw i...
Astra Linux – Vulnerability in Chromium
Insufficient policy enforcement in Google Chrome before version 90.0.4430.93 allowed a remote attacker to read arbitrary files through a malicious file. Chromium security severity: Medium...
Astra Linux – Vulnerability in Firefox and Thunderbird
If the browser.privatebrowsing.autostart preference is enabled, IndexedDB files are not properly deleted when the window is closed. This preference is disabled by default in Firefox. This vulnerability affects Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11...
Astra Linux – Vulnerability in ruby-sinatra
In versions of Sinatra before 2.2.0, it does not validate that the expanded path matches publicdir when serving static files...
Astra Linux – Vulnerability in SQLite
The osunix.c file in SQLite before version 3.13.0 improperly implements the temporary directory search algorithm. This may allow local users to obtain sensitive information, cause a denial of service application crash, or have unspecified other impacts by leveraging the current working directory...
Astra Linux – Vulnerability in gst-plugins-good1.0
GStreamer before version 1.18.4 may cause heap corruption when parsing certain malformed Matroska files...
Astra Linux – Vulnerability in TIF format
LibTIFF 4.4.0 contains an out-of-bounds read vulnerability in tiffcrop, located at line 3488 of tools/tiffcrop.c. This vulnerability allows attackers to cause a denial-of-service attack through a malicious tiff file. For users who compile LibTIFF from source code, the fix is available in the comm...