Astra Linux – Vulnerability in Chromium

Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netdevsim: fixed a race condition related to operations on the bpfboundprogs list. The netdevsim driver lacks a protection mechanism for operations on the bpfboundprogs list. When the nsimbpfcreateprog function performs...

Astra Linux – Vulnerability in Firefox

Memory safety bugs exist in Firefox 151 and Thunderbird 151. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability has been fixed in Firefox 152 and Thunderbird...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ext4: Fixed a use-after-free in updatesuperwork when racing with unmount. The commit b98535d09179 “ext4: fix bugon in startthishandle during umount filesystem” moved ext4unregistersysfs before flushing ssbupdwork to prevent new...

Astra Linux – Vulnerability in SQLite3

In SQLite version 3.31.1, the ALTER TABLE implementation contains a use-after-free issue, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: iouring: Any code related to SCMRIGHTS has been removed. This is dead code after we stopped supporting the use of iouring for handling file I/O via SCMRIGHTS; it can now be discarded...

Astra Linux – Vulnerability in Chromium

Before version 91.0.4472.114, using WebAudio with "after free" in Google Chrome allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerability in ffmpeg, ffmpeg5

FFmpeg n6.1.1 has an integer overflow vulnerability. The vulnerability exists in the parseoptions function in sbgdec.c within the libavformat module. When parsing certain options, the software does not properly validate the input. This allows negative duration values to be accepted without proper...

Astra Linux – Vulnerability in Apache2

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue...

Astra Linux – Vulnerability in Mariadb 10.3

MariaDB before version 10.6.2 allows an application to crash due to improper handling of a pushdown from a HAVING clause to a WHERE clause...

Astra Linux – Vulnerability in libarchive

An improper link resolution flaw can occur during the extraction of an archive, resulting in changes to the mode, times, access control lists, and flags of a file within the archive. An attacker may provide a malicious archive to a victim user, triggering this flaw when the victim attempts to...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: - net: bonding: Fixed a NULL dereference in bonddebugrlbhashshow. - rlbclearslave intentionally keeps RLB hash-table entries on the rxhashtblusedhead list with the slave set to NULL when no replacement slave is available...

Astra Linux – Vulnerability in Linux, Linux 5.10

A heap buffer overflow flaw was discovered in the IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with normal user privileges to overwrite kernel heap objects and may lead to a local privilege escalation attack...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Wifi: wfx – Fix for a memory leak when starting an AP Kmemleak reported this error: Unreferenced object 0xd73d1180 size 184: Command “wpasupplicant”, PID 1559, jiffies 13006305 age 964.245 seconds Hex dump first 32 bytes: 00 0...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: Validates user input to ensure it is of the expected length. I received multiple syzbot reports indicating that old bugs were exposed due to BPF after the commit 20f2505fb436 “bpf: Try to avoid kzalloc in...

Astra Linux – Vulnerability in dcmtk

There is an improper array index validation vulnerability in the nowindow functionality of OFFIS DCMT 3.6.8. A specially crafted DICOM file can lead to an out-of-bounds write. An attacker can provide a malicious file to exploit this vulnerability...

Astra Linux – Vulnerability in Chromium

Before version 87.0.4280.141, using the "drag and drop" feature in Google Chrome on Linux allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ARM: bcm: Fixed a refcount leak in bcmkonasmcinit. The offindmatchingnode function returns a node pointer with a refcount incremented. We should use ofnodeput on it when there is no longer a need for it. Added ofnodeput to avo...

Astra Linux – Vulnerability in exiv2

In Exiv2 0.26, the Exiv2::IptcParser::decode function in iptc.cpp called from psdimage.cpp in the PSD image reader may experience a denial of service attack due to a heap-based buffer overflow, caused by an integer overflow occurring through a specially crafted PSD image file...

Astra Linux – Vulnerability in Wireshark

Excessive memory consumption in the MS-WSP dissector in Wireshark versions 3.4.0 to 3.4.4, and 3.2.0 to 3.2.12 may allow denial of service through packet injection or crafted capture files...