Astra Linux – Vulnerability in libpod

There is a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file is stored in a Secret or a ConfigMap volume, and such volumes contain symbolic links to host file paths. In a successful attack, the attacker can control only the target...

Astra Linux – Vulnerability in Firefox, Thunderbird

On arm64, an WASM brtable instruction with many entries could cause the label to be too far away from the instruction, leading to truncation and incorrect computation of the branch address. This vulnerability was fixed in Firefox 141, Firefox ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1,...

Astra Linux – Vulnerability in Chromium

The use of after-free in Serviceworker in Google Chrome on desktops before version 140.0.7339.127 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: Critical...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: media: venus: Added a check for the packet size after reading from shared memory. A check was added to ensure that the packet size does not exceed the number of available words after reading the packet header from shared memory...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: smb: client: Fixed a use-after-free in cryptmessage when using asynchronous crypto. The fix for CVE-2024-50047 removes the asynchronous crypto handling from cryptmessage, assuming that all crypto operations are synchronous...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: f2fs: prevents kernel warnings due to negative inlink from corrupted images WARNING: CPU: 1 PID: 9426 at fs/inode.c:417 dropnlink+0xac/0xd0 home/cc/linux/fs/inode.c:417 Modules linked in: CPU: 1 UID: 0 PID: 9426 Comm:...

Astra Linux – Vulnerability in Intel Microcode

An improperly implemented security check for standard in the DDRIO configuration for some IntelR XeonR 6 processors, when using IntelR SGX or IntelR TDX, may allow a privileged user to potentially enable privilege escalation through local access...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions of ImageMagick below 14.8.2 contain insecure functions: SeekBlob, which allows advancing the stream offset beyond the current end without increasing capacity, and WriteBlob, which expands the...

Astra Linux – Vulnerability in catdoc

There is a memory corruption vulnerability in the implementation of the Shared String Table Record Parser in the xls2csv utility version 0.95. A specially crafted, malformed file can lead to a heap buffer overflow. An attacker can provide a malicious file to exploit this vulnerability...

Astra Linux – Vulnerability in catdoc

There is an integer overflow vulnerability in the OLE Document File Allocation Table Parser functionality of catdoc 0.95. A specially crafted, malformed file can lead to heap-based memory corruption. An attacker can provide a malicious file to exploit this vulnerability...

Astra Linux – Vulnerability in pgagent

When batch jobs are executed by pgAgent, a script is created in a temporary directory and then executed. In versions of pgAgent prior to 4.2.3, an insufficiently seeded random number generator was used when generating the directory name, which allows a local attacker to pre-create the directory a...

Astra Linux – Vulnerability in Python 3.11

The Python standard library functions urllib.parse.urlsplit and urlparse accept domain names that include square brackets, which is not valid according to RFC 3986. Square brackets are only intended to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could lead to...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: fix idafree call while not allocated In the sndutimercreate function, if the kasprintf function return NULL, sndutimerputid will be called, finally use idafree to free the unallocated id 0. the syzkaller reported the...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: nfsd: nfsd4spomustallow must check whether this is a v4 compound request. If the request being processed is not a v4 compound request, then examining the cstate can have undefined results. This patch adds a check to ensure that t...

Astra Linux – Vulnerability in Python 3.11

There is an issue in CPython when using bytes.decode"unicodeescape", error="ignore|replace". If you are not using the "unicodeescape" encoding or an error handler, your usage is not affected. To work around this issue, you can stop using the error handling mechanism and instead wrap the...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Added error handling for retrieving the RX metadata pointer. Proper error checking was added for the dmaenginedescgetmetadataptr function, which may return an error pointer, potentially leading to crashes or...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: A sanity check for the file name has been added. The length of the file name should be smaller than the directory entry size...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net: phy: Do not register LEDs for genphy. If a PHY has no driver, the genphy driver is probed with respect to the PHY during the phyattach or phydetach functions. If the PHY’s ofnode has a “leds” subnode, then the LEDs will be...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: iio: adc: axp20xadc: Add a missing sentinel to the AXP717 ADC channel maps. The AXP717 ADC channel maps lacks a sentinel entry at the end. This causes a KASAN warning. Please add the missing sentinel entry...

Astra Linux – Vulnerability in Thunderbird

An HTML email containing links to .pdf files can trigger automatic, unsolicited downloads of those files to the user’s desktop or home directory without any prompts, even if auto-saving is disabled. This behavior can be exploited to fill the disk with junk data e.g., using /dev/urandom on Linux o...