Astra Linux – Vulnerability in symfony

The Symphony process is a module for the Symphony PHP framework that executes commands in sub-processes. When using a persisted remember-me cookie, Symphony does not check whether the username stored in the database matches the username contained in the cookie, resulting in an authentication...

Astra Linux – Vulnerability in Firefox, Thunderbird

An attacker was able to execute code in the content process by exploiting a use-after-free in Animation timelines. There have been reports of this vulnerability being exploited in real-world scenarios. This vulnerability affects Firefox 131.0.2, Firefox ESR 128.3.1, Firefox ESR 115.16.1,...

Astra Linux – Vulnerability in ffmpeg

FFmpeg n7.0 is affected by a double-free issue through the rkmppretrieveframe function in libavcodec/rkmppdec.c...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: mm/memory-failure: fixed handling of dissolved but not removed from buddy pages. When I performed memory failure tests recently, the following panic occurred: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0...

Astra Linux – Vulnerability in xwayland, xorg-server

A buffer overflow vulnerability was discovered in X.Org and Xwayland. The function GetBarrierDevice searches for the pointer device based on its device ID and returns the matching value, or NULL, if no match is found. However, if no matching device ID is found, the code will return the last eleme...

Astra Linux – Vulnerability in Firefox, Thunderbird

A compromised content process could have allowed for the arbitrary loading of cross-origin pages. This vulnerability affects Firefox 131, Firefox ESR 128.3, Firefox ESR 115.16, Thunderbird 128.3, and Thunderbird 131...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: iwlwifi: mvm – Check nssids before accessing the ssids. In some versions of cfg80211, the ssids pointed to might be a valid value even when nssids is 0. Accessing the pointer in this case could lead to an out-of-bound acces...

Astra Linux – Vulnerability in Parsec

The vulnerability of the PARSEC security subsystem is related to type conversion errors. Exploiting this vulnerability allows an attacker to cause a service failure...

Astra Linux – Vulnerability in Chromium

Using “after free” in DevTools in Google Chrome before version 132.0.6834.159 allowed a remote attacker to potentially exploit heap corruption through a crafted Chrome Extension. Chromium security severity: Medium...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: devres: A memory leak caused by the driver API devmfreepercpu has been fixed. A memory leak occurs when the driver API devmfreepercpu is used to release memory allocated by devmallocpercpu. This issue was addressed by using...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: cfg80211: handling of 2x996 RU allocation in cfg80211calculatebitratehe Currently, NL80211RATEINFOHERUALLOC2x996 is not being handled in cfg80211calculatebitratehe, resulting in the following warning: kernel: Invalid HE MCS...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Fenced Frames in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to obtain potentially sensitive information from the system via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: The defined value for AMDGPUDMUBNOTIFICATIONMAX has been corrected. Why & How This issue actually exposes ‘6’ types in the enum dmubnotificationtype. It wasn’t 5. Using a smaller number to create arrays like...

Astra Linux – Vulnerability in cups

OpenPrinting CUPS is an open-source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, when the AuthType is set to anything other than Basic, if the request contains an Authorization: Basic ... header, the password is not checked. This leads to...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: media: amphion: Set video drvdata before registering the video device. video drvdata should be set before the video device is registered; otherwise, videodrvdata may return NULL in the open file operations, leading to errors...

Astra Linux – Vulnerability in Firefox, Thunderbird

It was possible for a web extension with minimal permissions to create a StreamFilter, which could be used to read and modify the response body of requests on any site. This vulnerability affects Firefox 129, Firefox ESR 115.14, Firefox ESR 128.1, Thunderbird 128.1, and Thunderbird 115.14...

Astra Linux – Vulnerability in Firefox, Thunderbird

The editor code failed to check an attribute value. This could have led to a out-of-bounds read. This vulnerability affects Firefox 129, Firefox ESR 115.14, Firefox ESR 128.1, Thunderbird 128.1, and Thunderbird 115.14...

Astra Linux – Vulnerability in Firefox

Memory safety bugs exist in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability has be...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: fs: Fixed an issue with uninitialized values in fromkuid and fromkgid. ocfs2setattr uses attr-iamode, attr-iauid, and attr-iagid in a trace point, even though ATTRMODE, ATTRUID, and ATTRGID are not set. All fields of newattrs...

Astra Linux – Vulnerability in Linux 6.1

BlueZ HID over GATT Profile: Improper Access Control Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected BlueZ installations. Authentication is not required to exploit this vulnerability. The specific flaw lies in the...