Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix uninit-value for saddr in dooutputroute4 syzbot reports for uninit-value for the saddr argument 1. commit 4754957f04f5 "ipvs: do not use random local source address for tunnels" already implies that the input value of...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: dmaengine: idxd: The call with idxdcleanup helper has been removed from the refactoring process. The idxdcleanup helper is responsible for cleaning up operations related to perfmon, interrupts, internals, etc. Removing this ca...

Astra Linux – Vulnerability in Firefox, Thunderbird

An attacker who has control over a content process could potentially use the privileged UITour actor to leak sensitive information or escalate privileges. This vulnerability was fixed in Firefox 138 and Thunderbird 138...

Astra Linux – Vulnerability in Firefox

Due to insufficient escaping of special characters in the “copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user’s system. This vulnerability was fixed in Firefox 138 and Thunderbird 138...

Astra Linux – Vulnerability in Chromium

A heap buffer overflow in HTML in Google Chrome prior to version 136.0.7103.59 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in PostgresSQL-15

Over-reading of buffers in PostgreSQL’s GB18030 encoding validation allows a database input provider to cause temporary denial of service on platforms where a 1-byte over-reading can lead to process termination. This affects both the database server and libpq. Versions prior to PostgreSQL 17.5,...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in the FileSystemAccess API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in the Tab Strip component in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Firefox and Thunderbird

Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin leak attacks. This vulnerability was fixed in Firefox 139, Firefox ESR 115.24, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11...

Astra Linux – Vulnerability in Firefox, Thunderbird

Script elements that load cross-origin resources generated load and error events, which allowed information to be leaked and enabled XS-Leaks attacks. This vulnerability was fixed in Firefox 139, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11...

Astra Linux – Vulnerability in GIMP

GIMP ICO File Parsing: Integer Overflow and Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability, as the target must visit a malicious page or open a...

Astra Linux – Vulnerability in Chromium

The use of after-free in memory management in Google Chrome before version 137.0.7151.103 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Firefox

If a user visited a webpage with an invalid TLS certificate and granted an exception, the webpage was able to present a WebAuthn challenge that the user was prompted to complete. This violates the WebAuthN specification, which requires a secure transport connection without errors. This...

Astra Linux – Vulnerability in Firefox

Memory safety bugs exist in Firefox 139 and Thunderbird 139. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability has been fixed in Firefox 140 and Thunderbird...

Astra Linux – Vulnerability in libarchive

A vulnerability has been identified in the libarchive library. This flaw involves an “off-by-one” calculation error when handling prefixes and suffixes for file names. This can lead to a 1-byte write overflow. Although seemingly minor, such an overflow can corrupt adjacent memory, resulting in...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: The issue of unexpectedly changing the path in ksmbdvfskernpathlocked has been fixed. When ksmbdvfskernpathlocked encounters an error, and it isn’t the last entry, it will exit without restoring the changed path buffer...

Astra Linux – Vulnerability in ffmpeg

It was discovered that FFmpeg git-master, N-113007-g8d24a28d06 contains a segmentation violation through the component /libavcodec/jpeg2000dec.c...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: perf/core: The order of the PMU list needs to be adjusted to fix a warning regarding an unordered pmuctxlist. The Syskaller trigger a warning because prevepc-pmu does not equal nextepc-pmu in perfeventswaptaskctxdata. vmcore...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Autofill in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Firefox, Thunderbird

A clickjacking vulnerability could have been exploited to trick users into revealing their saved payment card details to a malicious page. This vulnerability has been fixed in Firefox 139, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11...