Astra Linux – Vulnerability in ffmpeg5

FFmpeg v.n6.1-3-g466799d4f5 allows an attacker to trigger the use of a parameter with a negative size in the avsamplessetsilence function in the libavutil/samplefmt.c:260:9 component...

Astra Linux – Vulnerability in Linux 5.10

A temporary execution vulnerability within AMD CPUs may allow a local user-privileged attacker to leak data through the floating-point divisor unit, potentially leading to a loss of confidentiality...

Astra Linux – Vulnerability in libarchive

An improper link resolution flaw during the extraction of an archive can cause changes to the access control list ACL of the target of the link. An attacker may provide a malicious archive to a victim user, triggering this flaw when the victim tries to extract the archive. A local attacker may...

Astra Linux – Vulnerability in Chromium

Inappropriate implementations of Skia in Google Chrome prior to version 88.0.4324.146 allowed a local attacker to spoof the contents of the Omnibox URL bar through a crafted HTML page...

Astra Linux – Vulnerability in Thunderbird

Signatures are written to disk before and read during verification. This may lead to a race condition if a malicious local process or user replaces the file. This vulnerability affects Thunderbird 78.10...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

A issue was discovered in the Linux kernel before version 6.2.9. A use-after-free was found in the bq24190remove function in the file drivers/power/supply/bq24190charger.c. This could allow a local attacker to cause the system to crash due to a race condition...

Astra Linux – Vulnerability in Chromium

The use of “after free” in Cast Streaming in Google Chrome before version 149.0.7827.53 allowed an attacker on the local network segment to execute arbitrary code via malicious network traffic. Chromium security severity: Critical...

Astra Linux – Vulnerability in libmodule-scandeps-perl

Qualys discovered that if unsanitized input was used with the Modules::ScanDeps library, before version 1.36, a local attacker could potentially execute arbitrary shell commands by opening a “pesky pipe” e.g., passing “commands|” as a filename or by passing arbitrary strings to the eval function...

Astra Linux – Vulnerability in Munge

MUNGE is an authentication service for creating and validating user credentials. From version 0.5 to 0.5.17, local attackers could exploit a buffer overflow vulnerability in MUNGE the authentication daemon to leak cryptographic key material from process memory. With the leaked key material,...

Astra Linux – Vulnerability in xrdp

xrdp is an open-source RDP server. In versions up to 0.10.5, the session execution component did not properly handle an error during the privilege drop process. This improper privilege management could allow an authenticated local attacker to escalate privileges to root and execute arbitrary code...

Astra Linux – Vulnerability in ffmpeg5

The Ffmpeg v.N113007-g8d24a28d06 contains a buffer overflow vulnerability that allows a local attacker to execute arbitrary code through libavutil/imgutils.c:353:9 in the imagecopyplane function...

Astra Linux – Vulnerability in SQLite3

A flaw was discovered in SQLite’s SELECT query functionality src/select.c. This flaw allows an attacker who is capable of executing SQL queries locally on the SQLite database to cause a denial of service or potentially lead to code execution by triggering a use-after-free. The most significant...

Astra Linux – Vulnerability in libxpm

A vulnerability was discovered in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer function. This flaw allows a local attacker to trigger an out-of-bounds read error and read the contents of memory on the system...

USN-8753-1 libinput vulnerability

It was discovered that libinput did not properly escape device properties. A local attacker could possibly use this issue to inject arbitrary udev properties and execute arbitrary code as root...

Astra Linux – Vulnerability in Systemd

It was discovered that a Systemd service that uses the DynamicUser property can create a SUID/SGID binary that will be allowed to run as the transient service’s UID/GID even after the service is terminated. A local attacker could exploit this flaw to access resources that will be owned by a...

Astra Linux – Vulnerability in libvirt

A flaw was discovered in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before performing the negative length check by the C API entry points. Passing a negative length to the gnew0 function results in a crash because the negative length is treate...

Astra Linux – Vulnerability in Linux

Linux Kernel Bluetooth CMTP Module Double Free Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of the Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in orde...

Astra Linux – Vulnerability in Linux 5.10, Linux

A NULL pointer dereference flaw exists in the diFree function in the fs/jfs/inode.c file of the Journaled File System JFS in the Linux kernel. This flaw could allow a local attacker to crash the system or leak internal kernel information...

Astra Linux – Vulnerability in Linux, Linux 5.10

A use-after-free vulnerability was discovered in the rtsxusbmsdrvremove function in the drivers/memstick/host/rtsxusbms.c file within the memstick module of the Linux kernel. In this flaw, a local attacker with user privileges could compromise the confidentiality of system resources. This...

Astra Linux – Vulnerability in Linux

An out-of-bounds memory access flaw was discovered in the fs/f2fs/node.c file within the f2fs module of the Linux kernel, in versions prior to 5.12.0-rc4. A failure in the bounds check allows a local attacker to gain access to out-of-bounds memory, resulting in a system crash or the leakage of...