Astra Linux – Vulnerability in libsoup2.4, libsoup3

GNOME libsoup before version 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in the soupheaderparseparamliststrict function. There is a plausible way to exploit this vulnerability remotely through the soupmessageheadersgetcontenttype function for example, an...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in BFCache in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially obtain user information via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in the FileSystemAccess API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

The use of after-free in memory management in Google Chrome before version 137.0.7151.103 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Before version 137.0.7151.55, using V8 in Google Chrome allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in the Background Fetch API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to leak cross-origin data through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in libarchive

A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are passed into bsdtar, potentially allowing for reading beyond the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior,...

Astra Linux – Vulnerability in Git

Gitk is a Tcl/Tk-based Git history browser. Starting with version 2.41.0, a Git repository can be manipulated in such a way that, through some social engineering, a user who has cloned the repository can be tricked into running any script e.g., Bourne shell, Perl, Python, ... provided by the...

Astra Linux – Vulnerability in Firefox

When Multi-Account Containers was enabled, DNS requests could bypass a SOCKS proxy when the domain name was invalid or the SOCKS proxy was not responding. This vulnerability was fixed in Firefox 140 and Thunderbird 140...

Astra Linux – Vulnerability in Chromium

Before version 134.0.6998.35, using “After Free” in Google Chrome allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

The use of “after free” in Metrics in Google Chrome before version 137.0.7151.119 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

The use of “after free” in Blink in Google Chrome before version 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in PHP 8.2

In PHP versions 8.1. up to 8.1.32, 8.2. up to 8.2.28, 8.3. up to 8.3.19, and 8.4. up to 8.4.5, when requesting an HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect. This may result in...

Astra Linux – Vulnerability in Ruby-Rack

Rack provides an interface for developing web applications in Ruby. Before versions 2.2.13, 3.0.14, and 3.1.12, Rack::Static could serve files under the specified root: even if urls: was provided. This might lead to unexpected access to other files under the same root: directory. The vulnerabilit...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net: avoid race conditions between device unregistration and ethl operations. The following error can occur if a device is unregistered while its channel count is being modified: DEBUGLOCKSWARNONlock-magic != lock WARNING: CPU: 3...

Astra Linux – Vulnerability in Erlang

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, OTP-26.2.5.10, and OTP-25.3.2.19, a maliciously formed KEX init message could result in high memory usage. The implementation does not verify the RFC specified limits on the length of algorithm nam...

Astra Linux - уязвимость в python-werkzeug

Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing...

Astra Linux - уязвимость в yajl

yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of yajl contain an integer overflow which leads to subsequent heap memory corruption when dealing with large 2GB inputs. The reallocation logic at yajlbuf.cL64 may result in the need 32bit...

Astra Linux - уязвимость в thunderbird

When browsing private tabs, some data related to location history or webpage thumbnails could be persisted incorrectly within the sandboxed app bundle after app termination This vulnerability affects Firefox for iOS 127...

Astra Linux - уязвимость в firefox, thunderbird

Scanning certain QR codes that included text with a website URL could allow the URL to be opened without presenting the user with a confirmation alert first This vulnerability affects Firefox for iOS 136...