Astra Linux – Vulnerability in Linux 5.15

A flaw was discovered in the ksmbd component of the Linux kernel. A memory leak may occur if a client sends a session setup request with an unknown NTLMSSP message type, potentially leading to resource exhaustion...

Astra Linux – Vulnerability in WebKit2GTK

A flaw was discovered in WebKitGTK. Processing malicious web content may cause an unexpected process crash due to improper memory handling...

Astra Linux – Vulnerability in Tomcat9

An improper authorization vulnerability in Apache Tomcat occurs due to incorrect use of security-role-ref definitions as role aliases within the Realm, in addition to their proper use in Request.isUserInRole. This issue affects Apache Tomcat versions from 11.0.0-M1 through 11.0.24, from 10.1.0-M1...

Astra Linux – Vulnerability in Apache Log4j2

Apache Log4j2 versions 2.0-beta9 through 2.15.0 excluding security releases 2.12.2, 2.12.3, and 2.3.1 have JNDI features that are used in configuration, log messages, and parameters. However, these features do not protect against attacks from controlled LDAP endpoints and other JNDI-related...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: riscv: Rewrite kernelmappages to prevent sleeping in an invalid context. kernelmappages is a debugging function that clears the “valid bit” in page table entries for deallocated pages, thereby detecting illegal memory accesses to...

Astra Linux – Vulnerability in PostgresSQL 11

Row security policies ignore changes to user IDs after inline operations. PostgreSQL may allow incorrect policies to be applied in certain cases where role-specific policies are used, and where a given query is planned to be executed under one role and then executed under another role. This...

Astra Linux – Vulnerability in Firefox

Information disclosure in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 151 and Thunderbird 151...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fixed a slab-out-of-bounds issue in initsmb2rsphdr. When smb1 mounting fails, KASAN detects a slab-out-of-bounds issue in initsmb2rsphdr, as follows. For smb1’s negotiate56 bytes, initsmb2rsphdr is called for smb2. The iss...

Astra Linux – Vulnerability in python-cryptography

A flaw was discovered in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which could result in the exposure of confidential or sensitive data...

Astra Linux – Vulnerability in Firefox, Thunderbird

If a document creates a sandboxed iframe without allow-scripts, and then appends an element to the iframe’s document that has a JavaScript event handler—the event handler will still be executed despite the iframe being in a sandbox. This vulnerability affects Firefox versions earlier than 97,...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

A flaw was discovered in the Linux kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initialization function. While this will usually be correct, since tuntap devices require CAPNETADMIN, it may not always be the case. For example, a non-root user...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted inputs in the Input component in Google Chrome before version 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to bypass the same-origin policy through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: tls: Stop recv if the initial processrxlist contains a record that is not of the DATA type. If there is a record on rxlist that is not of the DATA type, and there is another record of the same type still in the queue, we will mer...

Astra Linux – Vulnerability in Parsec

The vulnerability of the macid utility in the PARSEC security subsystem is related to improper memory release after its use. Exploiting this vulnerability allows an attacker to cause a service failure...

Astra Linux – Vulnerability in jqueryui

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the of option of the .position utility from untrusted sources might execute untrusted code. This issue has been fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treat...

Astra Linux – Vulnerability in hiredis

Hiredis is a minimalistic C client library for the Redis database. In affected versions, Hiredis can be vulnerable to integer overflow if maliciously crafted or corrupted RESP mult-bulk protocol data is provided. When parsing mult-bulk array-like replies, Hiredis fails to check whether count...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: smb: client: Corrected the id, uid, and cruid values for multiuser automounts. When uid, gid, and cruid are not specified, we need to dynamically set them into the filesystem context used for automounting. Otherwise, they will en...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. The supported versions affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. The vulnerability is difficult to exploit; an unauthenticated...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. The supported versions affected are Java SE: 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. This easily exploitable vulnerability allows an unauthenticated attacke...

Astra Linux – Vulnerability in libxstream-java

XStream is a simple library for serializing objects to XML and back again. In affected versions, this vulnerability may allow a remote attacker with sufficient rights to execute commands on the host by manipulating the input stream being processed. No users are affected as long as they follow...