Astra Linux – Vulnerability in Firefox

One phishing tactic on the internet involves providing a link with HTTP Auth. For example, it might look like “https://[email protected]”. To mitigate this type of attack, Firefox will display a warning dialog box. However, this warning dialog would not be shown if evil.com used a...

Astra Linux – vulnerability in php7.3

In PHP versions prior to 7.4.31, 8.0.24, and 8.1.11, the phar uncompressor code would recursively uncompress “quines” gzip files, leading to an infinite loop...

Astra Linux – vulnerability in Firefox

Mozilla developers Gabriele Svelto, Timothy Nikkel, Randell Jesup, Jon Coppeard, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 100. Some of these bugs showed evidence of memory corruption; we assume that with sufficient effort, some of them could have been exploited ...

Astra Linux – vulnerability in sudo

Sudo prior to version 1.9.13 fails to escape control characters in log messages...

Astra Linux – vulnerability in Firefox

Memory safety bugs present in Firefox 113. Some of these bugs showed evidence of memory corruption; we assume that with sufficient effort, some of them could have been exploited to execute arbitrary code. This vulnerability affects Firefox versions prior to 114...

Astra Linux – Vulnerability in Python-Django

In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with appropriately crafted file names...

Astra Linux – vulnerability in Firefox

Uploading files containing symlinks could allow an attacker to trick a user into submitting sensitive data to a malicious website. This vulnerability affects Firefox versions prior to 115...

Astra Linux – vulnerability in Thunderbird

A data race may occur in the PK11ChangePW function, potentially leading to a use-after-free vulnerability. In Firefox, this lock protects the data when a user changes their master password. This vulnerability affects Firefox ESR 102.2 and Thunderbird 102.2...

Astra Linux – vulnerability in Imagemagick

A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file processed by ImageMagick could trigger undefined behavior, resulting in values outside the range of unsigned long type. This would most likely affect application availability, but could potentially...

Astra Linux – Vulnerability in Firefox

Mozilla developers Christian Holler and Jason Kratzer reported memory safety bugs in Firefox 95. Some of these bugs exhibited signs of memory corruption, and we believe that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability affects...

Astra Linux – Vulnerability in Redis

Redis is an in-memory database that persists data on disk. By exploiting vulnerabilities in the Lua script execution environment, an attacker with access to Redis prior to versions 7.0.0 or 6.2.7 can inject Lua code that will execute with the potentially higher privileges of another Redis user. T...

Astra Linux – vulnerability in Imagemagick

A flaw was found in ImageMagick’s MagickCore/quantum.h. An attacker submitting a specially crafted file for processing by ImageMagick could trigger undefined behavior, resulting in values outside the permissible range for float and unsigned char. This would most likely compromise application...

Astra Linux – vulnerability in Git

Git is a distributed revision control system. Git versions prior to 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5 are vulnerable to privilege escalation across all platforms. For instance, an unsuspecting user might still be affected by the issue described in...

Astra Linux – vulnerability in libxml2

Libxml2 versions prior to 2.12.10 and 2.13.x prior to 2.13.6 contain a stack-based buffer overflow in xmlSnprintfElements within valid.c. To exploit this vulnerability, DTD validation must be performed on an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047...

Astra Linux – Vulnerability in Qemu

A reentrancy issue related to DMA was discovered in the USB EHCI controller emulation of QEMU. EHCI does not verify whether the Buffer Pointer overlaps with its MMIO region when transferring USB packets. Crafted content may be written to the controller’s registers, potentially triggering...

Astra Linux – Vulnerability in Firefox and Thunderbird

Mozilla developers reported memory safety bugs in Firefox 90 and Firefox ESR 78.12. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability affects Thunderbird...

Astra Linux – Vulnerability in Chromium

The use of “after free” in Extensions in Google Chrome before version 114.0.5735.90 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Firefox

Mozilla developers reported memory safety bugs in Firefox 85. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability affects Firefox versions earlier than 86...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in SiteIsolation in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

The use of after-free in Blink in Google Chrome before version 149.0.7827.53 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: Medium...