Astra Linux – Vulnerability in etcd

A DNS rebinding vulnerability has been discovered in etcd 3.3.1 and earlier versions. An attacker can manipulate their DNS records to direct requests to localhost, thereby tricking the browser into sending requests to localhost or any other address...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: l2tp: avoided a data race in l2tptunneldelwork We should only access sk-sksocket when dealing with kernel sockets. syzbot reported the following data race: BUG: KCSAN: data race in l2tptunneldelwork / skcommonrelease Task 5365...

Astra Linux – Vulnerability in qpdf

In QPDF 8.2.1, within libqpdf/QPDFWriter.cc, the functions QPDOrWriter::unparseObject and QPDOrWriter::unparseChild contain recursive calls that last for a long time. This allows remote attackers to cause a denial of service by using a crafted PDF file...

Astra Linux – Vulnerability in libsoup2.4

A flaw was discovered in the cookie parsing logic of the libsoup HTTP library, which is used in GNOME applications and other software. The vulnerability arises when processing the expiration dates of cookies, where a specially crafted value can trigger an integer overflow. This may lead to...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: pstore/platform: Added a check for kstrdup. Added a check on the return value of kstrdup, and return an error if it fails, in order to avoid NULL pointer dereferencing...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 – fixed the use of memory after it is freed in rmiunregisterfunction. The putdevice function calls rmireleasefunction, which frees the “fn” pointer. Therefore, dereferencing fn-numofirqs in the next line...

Astra Linux – Vulnerability in Node.js

Node.js versions prior to 16.6.1, 14.17.5, and 12.22.5 are vulnerable to a “use after free” attack, where an attacker could exploit memory corruption to alter the behavior of the process...

Astra Linux – Vulnerability in OpenSSL

A security vulnerability has been identified in all supported versions of OpenSSL, related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use o...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in background fetch in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: Validates user input to ensure it is of the expected length. I received multiple syzbot reports indicating that old bugs were exposed due to BPF after the commit 20f2505fb436 “bpf: Try to avoid kzalloc in...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in WebUI in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a crafted domain name. Chromium security severity: Low...

Astra Linux – Vulnerability in curl

curl will incorrectly reuse an existing HTTP proxy connection when making a CONNECT request to a server, even if the new request uses different credentials for the HTTP proxy. The correct behavior is to create or use a separate connection...

Astra Linux – Vulnerability in LibreOffice

LibreOffice can import presentations in the legacy PPT format. There was a stack buffer overflow issue when importing a color-replacement record. Two fixed-size color tables were populated from the file, but the write position was not reset between these two operations on the record. As a result,...

Astra Linux – Vulnerability in Chromium

Using the “after free” mechanism in the Digital Credentials API in Google Chrome before version 146.0.7680.153 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Jackson-Databind

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the Loader component of Google Chrome prior to version 138.0.7204.49 allowed a remote attacker to bypass content security policies through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to version 104.0.5112.101 allowed a remote attacker to arbitrarily browse to a malicious website via a crafted HTML page...

Astra Linux – Vulnerability in Thunderbird

It may be possible for an attacker to create an email message that causes Thunderbird to perform an out-of-bounds write operation, writing one byte when processing the message. This vulnerability affects Thunderbird versions prior to 91.6.1...

Astra Linux – Vulnerability in Chromium

The use of after free in Navigation in Google Chrome before version 147.0.7727.138 allowed a remote attacker to execute arbitrary code through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

The use of after-free in memory allocation in Google Chrome before version 134.0.6998.117 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: Critical...