Astra Linux – Vulnerability in curl

When curl is instructed to use the Certificate Status Request TLS extension, also known as OCSP stapling, to verify that the server certificate is valid, it may fail to detect certain OCSP issues and instead incorrectly consider the response to be fine. If the returned status reports an error oth...

Astra Linux – Vulnerability in nano

A vulnerability was discovered in GNU Nano, which allows for potential privilege escalation through an insecure temporary file. If Nano is terminated while editing, a file that it saves to an emergency file, with permissions set to those of the running user, creates an opportunity for attackers t...

Astra Linux – Vulnerability in oath-toolkit

pamoath.so in oath-toolkit 2.6.7 through 2.6.11—before 2.6.12—allows root privilege escalation. This is because, in the context of PAM code running as root, it improperly handles user file access, such as by calling fchown when a symlink exists...

Astra Linux – Vulnerability in Firefox

Selected options might obscure the full-screen notification dialog box. This could be exploited by a malicious site to carry out a spoofing attack. This vulnerability affects Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1...

Astra Linux – Vulnerability in curl

When an application instructs libcurl to enable HTTP/2 server push, and the number of received headers for the push exceeds the maximum allowed limit 1000, libcurl abends the server push. During this process, libcurl inadvertently does not free all of the previously allocated headers; instead, it...

Astra Linux – Vulnerability in gtk+3.0, gtk+2.0

A flaw was discovered in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the current working directory...

Astra Linux – Vulnerability in Firefox

If a website is allowed to display pop-up windows, it can cause Select elements to appear above other websites, thereby performing a spoofing attack. This vulnerability affects Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2...

Astra Linux – Vulnerability in Firefox

Firefox typically asks for confirmation before requesting the operating system to find an application to handle schemes that the browser does not support. It did not ask for confirmation before handling Usenet-related schemes such as news: and snews:. Since most operating systems do not have a...

Astra Linux – Vulnerability in Chromium

Type Confusion in V8 in Google Chrome before version 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in tidy-html5

A vulnerability in HTACG HTML Tidy v5.7.28 allows attackers to execute arbitrary code through the -g option of the CleanNode function in gdoc.c...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in navigations in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to bypass content security policy through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in dcmtk

In DCMTK, versions prior to 3.6.9 have a segmentation fault due to an invalid DIMSE message...

Astra Linux – Vulnerability in Chromium

Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

In DevTools in Google Chrome before version 126.0.6478.182, it was possible for an attacker to convince a user to install a malicious extension, allowing them to inject scripts or HTML into a privileged page through a crafted Chrome Extension. Chromium security severity: High...

Astra Linux – Vulnerability in Tiff

A null pointer dereference flaw was detected in Libtiff through the tifdirinfo.c file. This issue may allow an attacker to trigger memory allocation failures through certain methods, such as restricting the heap space size or injecting faults, resulting in a segmentation fault. This can cause the...

Astra Linux – Vulnerability in Firefox

Incorrect garbage collection interactions in IndexedDB could lead to a use-after-free vulnerability. This vulnerability affects Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1...

Astra Linux – Vulnerability in unbound

The DNS protocol in RFC 1035 and its updates allows remote attackers to cause a denial of service resource consumption by arranging for DNS queries to be accumulated over seconds. As a result, responses are sent in a pulsing burst, which can be considered traffic amplification in some cases. This...

Astra Linux – Vulnerability in Chromium

The use of “after free” in Navigation in Google Chrome before version 126.0.6478.182 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption through a crafted Chrome Extension. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

The use of after-free in Audio in Google Chrome before version 126.0.6478.182 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Memory access out of bounds in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: High...