Astra Linux – Vulnerability in Chromium

The use of after-free in Animation in Google Chrome before version 152.0.7977.65 allowed a remote attacker to execute arbitrary code within the sandbox through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Firefox and Thunderbird

Memory safety bugs exist in Firefox ESR 115.28, Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143, and Thunderbird 143. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code...

Astra Linux – Vulnerability in Chromium

The confused deputy in DataTransfer in Google Chrome before version 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Before version 151.0.7922.72, Autofill in Google Chrome allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Incorrect reference resolution in the FileSystem component in Google Chrome prior to version 152.0.7977.65 allowed a remote attacker to leverage social engineering techniques to potentially execute arbitrary code outside of the sandbox, through a crafted HTML page. Chromium security severity: Med...

Astra Linux – Vulnerability in Chromium

A heap buffer overflow in the Codecs component of Google Chrome prior to version 151.0.7922.72 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Before version 151.0.7922.109, using the “After Free” feature in Google Chrome extensions allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code within a sandbox through a crafted Chrome extension. Chromium security severity: High...

Astra Linux – Vulnerability in busybox

The BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client udhcpc6 DNSSERVERS option handler in the networking/udhcp/d6dhcpc.c file. This vulnerability allows network-adjacent attackers to trigger memory corruption by sending a crafted DHCPv6 response wit...

Astra Linux – Vulnerability in Chromium

Before version 151.0.7922.72, using free after in the DOM in Google Chrome allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

The race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code within the sandbox through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Firefox

Memory safety bugs exist in Firefox 144 and Thunderbird 144. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability has been fixed in Firefox 145 and Thunderbird...

Astra Linux – Vulnerability in pillow

In Pillow’s PIL.ImageMath.eval before version 9.0.0, it was possible to evaluate arbitrary expressions, including those that used the Python exec method. A lambda expression could also be used...

Astra Linux – Vulnerability in Chromium

Before version 152.0.7977.65, using free after in the Chromecast with Google Chrome allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox through a crafted HTML page. Chromium security severity: Critical...

Astra Linux – Vulnerability in Chromium

The use of after-free in Skia in Google Chrome before version 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in exempi

The XMP Toolkit version 2020.1 and earlier versions is affected by a memory corruption vulnerability, which may lead to the execution of arbitrary code within the context of the current user. User interaction is required to exploit this vulnerability...

Astra Linux – Vulnerability in Git

Git is a distributed revision control system. git log can display commits in an arbitrary format using its --format specifiers. This functionality is also exposed to git archive via the export-subst gitattribute. When processing the padding operators, there is an integer overflow in...

EUVD-2026-92416

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that location. In fixed versions an entry in...

kernel: netfilter: flowtable: publish GC-visible tuple last

A flaw was found in the netfilter flowtable component of the Linux kernel. This vulnerability occurs due to a timing issue where the system's garbage collection can free a network flow while it is still being set up. This can lead to a 'use-after-free' condition, where the system attempts to acce...

kernel: nvme: add missing SRCU grace period in error path

A flaw was found in the NVMe Non-Volatile Memory Express driver of the Linux kernel. The nvmeallocns function's error handling path fails to wait for all SRCU Sleepable Read-Copy Update readers to complete before freeing a namespace structure. This oversight allows a concurrent reader to access a...

kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors

A flaw was found in the Linux kernel's IP Virtual Server IPVS component. When processing Internet Control Message Protocol ICMP errors for tunneled packets, the system can incorrectly use a stale IPv4 option offset. A remote attacker could exploit this by sending a specially crafted ICMP packet,...