Astra Linux – Vulnerability in PHP 7.3

In PHP versions 8.0. before 8.0.30, 8.1. before 8.1.22, and 8.2. before 8.2.8, when loading PHAR files, insufficient length checking may lead to a stack buffer overflow, potentially causing memory corruption or Remote Code Execution RCE...

Astra Linux – Vulnerability in busybox

A use-after-free condition in Busybox’s awk applet leads to denial of service and potentially code execution when processing a crafted awk pattern in the getvari function...

Astra Linux – Vulnerability in Chromium

A heap buffer overflow in the Layout component of Google Chrome prior to version 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Side-channel information leakage in navigation and loading processes in Google Chrome prior to version 139.0.7258.66 allowed a remote attacker to bypass site isolation through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerabilities in Python 2.7, Python 3.11, Python 3.7

When constructing nested elements using XMLDom.minidom methods like appendChild, which rely on clearidcache, the algorithm has a quadratic complexity. This can affect the availability of documents when they are constructed with excessively nested structures...

Astra Linux – Vulnerability in pgbouncer

In PgBouncer, the untrusted search path in the authquery connection handler before version 1.25.1 allows an unauthenticated attacker to execute arbitrary SQL during authentication through a malicious searchpath parameter in the StartupMessage...

Astra Linux – Vulnerability in Chromium

The use of “after free” in the Cart component in Google Chrome before version 109.0.5414.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption through database corruption and a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Qemu

A use-after-free vulnerability was discovered in the am53c974 SCSI host bus adapter emulation in QEMU in versions prior to 6.0.0, during the handling of the ‘Information Transfer’ command CMDTI. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial ...

Astra Linux – Vulnerability in Wireshark

The MEGACO dissector infinite loop in Wireshark versions 4.6.0 to 4.6.1 and 4.4.0 to 4.4.11 allows for denial of service attacks...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Picture In Picture in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially spoof the contents of the Omnibox URL bar via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Python 3.11

When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially leading to Out-of-Memory errors or other types of...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a local attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Inappropriate implementations in Downloads in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to perform certain UI gestures to bypass download protections through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

The use of “after free” in Media Stream in Google Chrome before version 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ip6mr: Fixed skbunderpanic in ip6mrcachereport. skbuff: skbunderpanic: Text: fffffffff88771f69; Len: 56; Put: -4; Head: ffffff88c0f86a800; Data: fffff887f5f86a850; Tail: 0x88; End: 0x2c0; Device: pim6reg. ----------- Cut here...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: tty: serial: fsllpuart: disable dma rx/tx use flags in lpuartdmashutdown lpuartdmashutdown tears down the lpuart DMA mechanism, but lpuartFlushBuffer can still occur. This attempt to access DMA APIs occurs if the lpuartDMATXuse...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: - clk: tegra20: Fixed a refcount leak in tegra20clockinit. - offindmatchingnode returns a node pointer with a refcount incremented. We should use ofnodeput on it when there is no longer a need for it. - Added ofnodeput to avoi...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: hinic: A memory leak occurs when reading the function table. When the input parameter idx matches the expected case option in hinicdbggetfunctable, the readdata function is not released properly. This issue has been fixed...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: fs/ntfs3: Validates buffer length during parsing of index The indxread function is called when there are certain NTFS directory operations that require more information from the index buffers. This adds a sanity check to ensur...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: A leak was fixed in devfreqdevrelease. The srcuinitnotifierhead function allocates resources that need to be released using a srcucleanupnotifierhead call. Reported by kmemleak...