Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: pstore/zone: Added a null pointer check to pszkmsgread. The kasprintf function returns a pointer to dynamically allocated memory, which may be NULL in case of failure. Ensure that the allocation was successful by checking the...

Astra Linux – Vulnerability in Linux

A heap out-of-bounds write that affects Linux since v2.6.19-rc1 was discovered in net/netfilter/xtables.c. This vulnerability allows an attacker to gain privileges or cause a Denial-of-Service attack through heap memory corruption by manipulating the user name space...

Astra Linux – Vulnerability in Firefox, NSS

When the memory resources are nearly exhausted, an elliptic curve key that was never allocated can be reclaimed. This vulnerability affects Firefox 128 and Thunderbird 128...

Astra Linux – Vulnerability in Poppler

A issue was discovered in Poppler 0.71.0. There is a NULL pointer dereference in goo/GooString.h, which can lead to a denial of service. This issue is evident in utils/pdfdetach.cc, where it does not validate the filename of an embedded file before constructing a save path...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: L2CAP: Fixed an UAF in l2capconnect Reported by Syzbot BUG: KASAN: Use of a slab object after a free call in l2capconnectconstprop.0+0x10d8/0x1270 net/bluetooth/l2capcore.c:3949 Read of size 8 at address...

Astra Linux – Vulnerability in Firefox

Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: can: ctucanfd: handle skb allocation failure If the skb allocation fails, the pointer to struct canframe becomes NULL. This issue is actually handled everywhere within ctucanerrinterrupt, except for the only place where it is not...

Astra Linux – Vulnerability in libxml2

There is a flaw in libxml2’s xmllint in versions before 2.9.11. An attacker who can submit a crafted file for processing by xmllint could trigger a use-after-free. The most significant impact of this flaw is on confidentiality, integrity, and availability...

Astra Linux – Vulnerability in Chromium

The use of after-free in PresentationAPI in Google Chrome before version 148.0.7778.96 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Qemu

A potential stack overflow issue due to an infinite loop was identified in various NIC emulators of QEMU, in versions up to and including 5.2.0. The issue occurs in the loopback mode of a NIC, where reentrant DMA checks are bypassed. A guest user/process may exploit this flaw to consume CPU cycle...

Astra Linux – Vulnerability in Python 3.11, Python 3.7

There is an issue in CPython when using bytes.decode"unicodeescape", error="ignore|replace". If you are not using the "unicodeescape" encoding or an error handler, your usage is not affected. To work around this issue, you can stop using the error handling mechanism and instead wrap the...

Astra Linux – Vulnerability in Chromium

Before version 148.0.7778.168, writing WebRTC in Google Chrome allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Vim

Vim 8.2.2348 is vulnerable to null pointer dereferencing, allowing local attackers to cause a Denial of Service DoS attack through the exbufferall method...

Astra Linux – Vulnerability in Chromium

The use of after-free in WebRTC in Google Chrome before version 147.0.7727.138 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

A heap buffer overflow in WebRTC in Google Chrome prior to version 149.0.7827.155 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in edk2

EDK2’s Network Package is vulnerable to a buffer overflow vulnerability when handling the Server ID option from a DHCPv6 proxy Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality, Integrity, and/or...

Astra Linux – Vulnerability in Firefox and Thunderbird

Memory safety bugs exist in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149, and Thunderbird 149. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability ha...

Astra Linux – Vulnerability in glibc

There exists an exploitable signed comparison vulnerability in the ARMv7 memcpy implementation of GNU glibc 2.30.9000. Calling memcpy on ARMv7 targets that utilize the GNU glibc implementation with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attack...

Astra Linux – Vulnerability in curl

When curl is instructed to use the Certificate Status Request TLS extension, also known as OCSP stapling, to verify that the server certificate is valid, it may fail to detect certain OCSP issues and instead incorrectly consider the response to be fine. If the returned status reports an error oth...