Astra Linux – Vulnerability in Chromium

Using “after free” in FedCM in Google Chrome before version 146.0.7680.165 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, the MAT decoder used 32-bit arithmetic due to incorrect parenthesization, resulting in a heap over-read. This vulnerability has been fixed in versions 7.1.2-16...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, there was a heap-buffer-overflow vulnerability in the PCL encoding process, due to an undersized output buffer allocation. This vulnerability has been fixed in...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, there was a heap-use-after-free vulnerability in the MSL encoder, where a cloned image was destroyed twice. The MSL encoder does not support writing MSL, so the...

Astra Linux – Vulnerability in gst-plugins-bad1.0

GStreamer DVB Subtitles Out-of-Bounds: Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability, but the attack vectors may vary dependi...

Astra Linux – Vulnerability in Chromium

Before version 146.0.7680.153, read and write operations in WebGL in Google Chrome allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. Chromium security severity: Critical...

Astra Linux – Vulnerability in WebKit2GTK

A memory management issue related to “use after free” operations has been addressed through improved memory management practices. This issue is fixed in macOS Monterey 12.3, iOS 15.4, iPadOS 15.4, tvOS 15.4, and Safari 15.4. Processing maliciously crafted web content may lead to arbitrary code...

Astra Linux – Vulnerability in Chromium

The use of Mojo after free in Google Chrome before version 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Side-channel information leakage in Navigation in Google Chrome prior to version 148.0.7778.168 allowed a remote attacker to leak cross-origin data through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: “Revert ‘hwmon: ibmpex fix use-after-free in high/low store’” This change is reflected in commit 6946c726c3f4c36f0f049e6f97e88c510b15f65d. Jean Delvare points out that the patch does not completely fix the reported problem...

Astra Linux – Vulnerability in libusb-1.0

Libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor. Such descriptors may claim a bNumEndpoints value greater than zero, followed by a class-specific descriptor whose bLeng...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mmc: core: Avoid using the bitfield RMW for control flags related to claims/retunes. Move the control flags related to claims and retunes out of the bitfield to avoid unrelated side effects of RMW in asynchronous contexts. The...

Astra Linux – Vulnerability in gnutls28

A flaw was discovered in gnutls. When validating certificates, an excessively large Subject Alternative Name SAN could cause the validation process to incorrectly revert to checking the Common Name CN field. This could allow a remote attacker to bypass proper certificate validation, potentially...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ext4: Do not set EXT4GETBLOCKSCONVERT when splitting an unwritten extent before submitting I/O. When allocating blocks during within-EOF DIO and with dioreadnolock enabled, EXT4GETBLOCKSPREIO was set to split an existing unwritte...

Astra Linux – Vulnerability in Samba

A flaw was discovered in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/sched: fqpie: avoid stalls in fqpietimer When setting a high number of flows limit being 65536, fqpietimer is currently using too much time as syzbot reported. Add logic to yield the cpu every 2048 flows less than 150 usec on...

Astra Linux – Vulnerability in hplip

A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software. This vulnerability may allow for escalation of privileges and/or execution of arbitrary code through operating system command injection...

Astra Linux – Vulnerability in Firefox and Thunderbird

Bypass of the same-origin policy in the Networking: HTTP component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/rds: opnents is reset when zerocopy page pin fails. When iovitergetpages2 fails in rdsmessagezcopyfromuser, the pinned pages are released using putpage, and rm-data.opmmpznotifier is cleared. However, we fail to properly clea...

Astra Linux – Vulnerability in Sogo

SOGo versions 5.12.7 and earlier contain a SQL injection vulnerability in the Access Control List management functionality. This vulnerability allows authenticated users to extract arbitrary data from the database by injecting SQL subqueries through the uid parameter of the addUserInAcls endpoint...