Astra Linux – Vulnerability in sane-backends

A out-of-bounds read in SANE backends before version 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, also known as GHSL-2020-081...

Astra Linux – Vulnerability in sane-backends

A out-of-bounds read in SANE backends before version 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, also known as GHSL-2020-083...

Astra Linux – vulnerability in jetty9

In Eclipse Jetty versions 1.0 through 9.4.32.v20200930, 10.0.0.alpha1 through 10.0.0.beta2, and 11.0.0.alpha1 through 11.0.0.beta2O, on Unix-like systems, the system’s temporary directory is shared among all users on that system. A collocated user can observe the process of creating a temporary...

Astra Linux - vulnerability in linux

A flaw was found in how RTAS handles memory access from userspace to kernel communication. On a locked-down guest system running on top of PowerVM or KVM hypervisors pseries platform, a local user with root privileges could exploit this flaw to elevate their privileges to those of a running kerne...

Astra Linux – vulnerability in Thunderbird

OpenPGP secret keys imported using Thunderbird versions 78.8.1 through 78.10.1 were stored unencrypted on the user’s local disk. The master password protection mechanism was disabled for these keys. Version 78.10.2 will re-enable the protection mechanism for newly imported keys, as well as...

Astra Linux – vulnerability in sqlite3

A flaw was found in SQLite’s SELECT query functionality src/select.c. This flaw allows an attacker capable of executing SQL queries locally on the SQLite database to cause a denial of service or potential code execution by triggering a use-after-free. The primary threat posed by this vulnerabilit...

Astra Linux – vulnerability in intel-microcode

Improper access control on certain third-generation IntelR XeonR Scalable Processors prior to BIOS version MR7 may allow a local attacker to potentially enable information disclosure via local access...

Astra Linux – vulnerability in linux-5.10

This vulnerability enables local attackers to escalate privileges on affected installations of Linux Kernel 5.14-rc3. To exploit this vulnerability, an attacker must first gain the ability to execute low-privilege code on the target system. The specific flaw lies in how eBPF programs are handled...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the handling of offloads in ipgre.c, there is a possibility of a page fault due to an invalid memory access. This could lead to the disclosure of local information without the need for additional execution privileges. User interaction is not required for exploitation. Product: Android Versions...

Astra Linux – vulnerability in linux, linux-5.10

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fixed rxrpclocal leak in rxrpclookuppeer It is necessary to call rxrpcputlocal for a peer candidate prior to kfree, as it holds a reference to rxrpclocal. DH: v2: Changed to abstract the peer freeing code out into a functi...

Astra Linux – Vulnerability in Linux, Linux 5.10

In socksocknested of sock.c, there is a potential exploit after the free function due to a race condition. This could lead to a local escalation of privileges, as the execution privileges required by the system are involved. User interaction is not required for this exploitation. Product: Android...

Astra Linux – Vulnerability in Linux 5.10, Intel-Microcode

Incomplete cleanup of microarchitectural fill buffers on some Intel processors may allow an authenticated user to potentially enable information disclosure via local access...

Astra Linux – vulnerability in linux, linux-5.10

In the Linux kernel versions 5.4 through 5.6.10, net/netfilter/nfdupnetdev.c allows local users to gain privileges due to a heap out-of-bounds write. This issue is related to nftablesoffload...

Astra Linux – vulnerability in intel-microcode

Incomplete cleanup in certain special register read operations on some IntelR processors may allow an authenticated user to potentially enable information disclosure via local access...

Astra Linux – Vulnerability in unbound

Before version 1.9.5, Unbound allowed an integer overflow in the regional allocator through the ALIGNUP macro. NOTE: The vendor denies that this is a vulnerability. Although the code may be vulnerable, an ongoing Unbound installation cannot be remotely or locally exploited...

Astra Linux – Vulnerability in multipath-tools

Multipath-tools versions 0.7.7 through 0.9.x, prior to 0.9.2, allowed local users to obtain root access. This vulnerability was exploited in conjunction with CVE-2022-41974. Local users who had access to /dev/shm could modify symlinks within multipathd due to incorrect symlink handling. This coul...

Astra Linux – Vulnerability in multipath-tools

In versions of multipath-tools from 0.7.0 to 0.9.x, up to 0.9.2, local users could obtain root access, either alone or in conjunction with CVE-2022-41973. Local users who had access to write to UNIX domain sockets could bypass access controls and manipulate the multipath setup. This could result ...

Astra Linux – Vulnerability in PackageKit

PackageKit’s apt backend mistakenly treats all local deb files as trustworthy. The apt security model is based on repository trust, not the contents of individual files. On sites where PolicyKit rules are configured, this could allow users to install malicious packages...

Astra Linux – Vulnerability in Git

Git is an open-source, scalable, distributed version control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are vulnerable to exposure of sensitive information by malicious actors. When performing a local clone where the source and target of the clone...

Astra Linux – vulnerability in linux-5.10, linux-5.15, linux

A NULL pointer dereference flaw was found in the UNIX protocol in net/unix/diag.c within unixdiaggetexact in the Linux Kernel. The newly allocated skb lacks an “sk” field, resulting in a NULL pointer. This flaw may allow a local user to crash or potentially cause a denial of service...