Astra Linux – Vulnerability in libtar

The thread function does not free the variable t-thbuf.gnulongname after allocating memory, which may lead to a memory leak...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fixed the rxrpclocal leak in rxrpclookuppeer. It is necessary to call rxrpcPutlocal for the peer candidate before kfree, as it holds a reference to rxrpclocal. DH: v2: The peer freeing code has been abstracted into a...

Astra Linux – Vulnerability in Chromium

The use of “after free” in Navigation in Google Chrome before version 119.0.6045.159 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Vim

Heap-based Buffer Overflow in the GitHub repository for vim/vim before version 8.2...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: - dm integrity: Fixed a UAF Use-after-Free in dmintegritydtr. - dmintegrity also has the same UAF problem when dmresume and dmdestroy are executed concurrently. Therefore, the timer is cancelled again in dmintegritydtr...

Astra Linux – Vulnerability in Chromium

In Google Chrome, out-of-bounds memory access during DOM bindings before version 112.0.5615.49 allowed a remote attacker to perform out-of-bounds memory access through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Firefox

Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12...

Astra Linux – Vulnerability in OpenSSL

The function PEMreadbioex reads a PEM file from a BIO, parses, and decodes the “name” e.g., “CERTIFICATE”, any header data, and the payload data. If the function succeeds, the “nameout”, “header”, and “data” arguments are populated with pointers to buffers containing the relevant decoded data. Th...

Astra Linux - Vulnerability in Golang-1.23

The HTTP client discards sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header, which is redirected to b.com/, will not send that header to b.com. However, if the client receives a subsequent same-domain redirect, the...

Astra Linux – Vulnerability in golang-go.crypto

SSH servers that implement file transfer protocols are vulnerable to a denial of service attack from clients that complete the key exchange slowly, or not at all. This results in pending data being read into memory but never being transmitted...

Astra Linux – Vulnerability in Golang-1.19, Golang-1.23

Due to the use of a variable time instruction in the assembly implementation of an internal function, a small number of bits from secret scalars are leaked on the ppc64le architecture. Given the way this function is used, we believe that this leakage is not sufficient to allow recovery of the...

Astra Linux – Vulnerability in curl

curl 7.84.0 supports “chained” HTTP compression algorithms, which means that a server response can be compressed multiple times, possibly using different algorithms. The number of allowable “links” in this “decompression chain” is unlimited, allowing a malicious server to insert virtually an...

Astra Linux – Vulnerability in openjdk-11

A vulnerability exists in the Oracle Java SE and Oracle GraalVM Enterprise Edition products from Oracle Java SE component: Lightweight HTTP Server. The versions affected include Oracle Java SE: 8u341, 8u345-perf, 11.0.16.1, 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3, and...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in Cast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

A heap buffer overflow in CSS in Google Chrome prior to version 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Before version 148.0.7778.216, using Accessibility in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in exiv2

In Exiv2 0.27.99.0, the PngImage::readMetadata function in the pngimage.cpp file allows attackers to cause a denial of service heap-based buffer over-read through a crafted image file...

Astra Linux – Vulnerability in Firefox

Memory safety bugs exist in Firefox 119. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability affects Firefox versions prior to 120...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: usb:dwc2: check return value after calling platformgetresource This issue could lead to a null-ptr-deref error if platformgetresource returns NULL. Therefore, we need to check the return value...

Astra Linux – Vulnerability in Chromium

Before version 89.0.4389.114, the out-of-bounds read in IPC in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page...