Astra Linux – Vulnerability in assimp

A vulnerability exists in assimp v.5.4.3, allowing a local attacker to execute arbitrary code through the CallbackToLogRedirector function within the Assimp library...

Astra Linux – Vulnerability in binutils

A vulnerability was discovered in GNU Binutils 2.45. The affected function is bfdx86elflatesizesections in the file bfd/elfxx-x86.c of the Linker component. This vulnerability leads to out-of-bounds read attacks. The attack must be approached locally. The exploit has been made public and can be...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: soc: qcom: smsmm: Fixed refcount leaks in qcomsmsmprobe There are two refcount leaks in qcomsmsmprobe: 1 The localnode variable is escaped from foreachchildofnode at the end of the iteration. We should call ofnodeput for it in...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Before versions 7.1.2-15 and 6.9.13-40, ImageMagick’s path security policy was enforced on the raw filename string before the filesystem resolved it. As a result, policy rules such as /etc/ could be...

Astra Linux – vulnerability in munge

MUNGE is an authentication service used to create and validate user credentials. In versions 0.5 through 0.5.17, a local attacker can exploit a buffer overflow vulnerability in munged the MUNGE authentication daemon to leak cryptographic key material from process memory. Using this leaked key...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/smc: A logic flaw in smcsetsockopt allows a local unprivileged user to cause a Denial of Service DoS by holding the socket lock indefinitely. A logic flaw in smcsetsockopt allows a local unprivileged user to cause a Denial of...

Astra Linux – Vulnerability in edk2

EDK2 is vulnerable to a vulnerability in the Tcg2MeasureGptTable function, which allows a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in compromises of confidentiality, integrity, and/or availability...

Astra Linux – Vulnerability in sane-backends

A out-of-bounds read in SANE backends before version 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, also known as GHSL-2020-083...

Astra Linux – vulnerability in linux, linux-5.10

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fixed rxrpclocal leak in rxrpclookuppeer It is necessary to call rxrpcputlocal for a peer candidate prior to kfree, as it holds a reference to rxrpclocal. DH: v2: Changed to abstract the peer freeing code out into a functi...

Astra Linux – vulnerability in Firefox

Under certain circumstances, a WebExtension may receive a jar:file:/// URI instead of a moz-extension:/// URI during a load request. This results in leaked directory paths on the user’s machine. This vulnerability affects Firefox for Android 112, Firefox 112, and Focus for Android 112...

Astra Linux – Vulnerability in open-vm-tools

VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges, who has access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled, may exploit this vulnerability to escalate...

Astra Linux – vulnerability in Thunderbird

OpenPGP secret keys imported using Thunderbird versions 78.8.1 through 78.10.1 were stored unencrypted on the user’s local disk. The master password protection mechanism was disabled for these keys. Version 78.10.2 will re-enable the protection mechanism for newly imported keys, as well as...

Astra Linux – Vulnerability in Intel Microcode

Improper input validation in the UEFI firmware CseVariableStorageSmm for some Intel processors may allow a privileged user to potentially enable privilege escalation through local access...

Astra Linux – Vulnerability in sane-backends

A out-of-bounds read in SANE backends before version 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, also known as GHSL-2020-081...

Astra Linux – vulnerability in Chromium

An unchecked return value in Performance in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially read memory via a local program. Chromium security severity: Low...

Astra Linux – vulnerability in mdadm

Uncontrolled resource consumption in certain IntelR SSD Tools software versions prior to mdadm-4.2-rc2 might allow a privileged user to potentially trigger a denial of service via local access...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix ‘scheduling while atomic’ in mptcppmnlappendnewlocaladdr When multiple connection requests attempt to create an implicit mptcp endpoint simultaneously, more than one caller may end up in mptcppmnlappendnewlocaladdr...

Astra Linux – vulnerability in intel-microcode

Improperly implemented security checks for standard in the DDRIO configuration on certain IntelR XeonR 6 processors when using IntelR SGX or IntelR TDX may allow a privileged user to potentially enable privilege escalation via local access...

Astra Linux – vulnerability in openjdk-11

Vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition products under Oracle Java SE component: Security. Affected versions include Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and...

Astra Linux – Vulnerability in binutils

A flaw has been discovered in GNU Binutils 2.45. The affected function is bfdelfparseehframe in the file bfd/elf-eh-frame.c of the Linker component. Executing certain manipulations can lead to a heap-based buffer overflow. This attack is limited to local executions. The exploit has been published...