Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: eth:bnxt: fixed the issue of missing ring index trimming on the error path. The commit under “Fixes” changed txprod to be a free-running entity, but this was overlooked; the issue was only masked on the Tx error path. This causes...

Astra Linux – Vulnerability in mongo-c-driver

The bsonstringappend function in the MongoDB C Driver may be vulnerable to a buffer overflow. In this scenario, the function might attempt to allocate a buffer that is too small, which could lead to memory corruption in the neighboring heap memory. This issue affects versions of libbson prior to...

Astra Linux – Vulnerability in Firefox

The length of the certificate was not properly checked when it was added to the certificate store. In practice, only trusted data was processed. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135...

Astra Linux – Vulnerability in Intel Microcode

Improper finite state machines FSMs in hardware logic of certain Intel processors may allow a privileged user to potentially exploit a denial of service attack through local access...

Astra Linux – Vulnerability in Cpio

The vulnerability of the parserparseopt function in the Cpio archiver utility is related to an incorrect bit shifting of a integer value. Exploiting this vulnerability could allow an attacker to cause a service failure...

Astra Linux – Vulnerability in Firefox

The exception page for the HTTPS-Only feature, which appears when a website is accessed via HTTP, lacked an anti-clickjacking mechanism. This allowed attackers to trick users into granting an exception and loading a webpage via HTTP. This vulnerability has been fixed in Firefox 140 and Thunderbir...

Astra Linux – Vulnerability in Ruby 3.1

Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5, there was a possibility of a denial-of-service attack due to memory exhaustion when the net-imap component read server responses. At any time while the clien...

Astra Linux – Vulnerability in Subversion

Insufficient validation of filenames against control characters in Apache Subversion repositories served via moddavsvn allows authenticated users with commit access to commit a corrupted revision, resulting in disruptions for users of the repository. All versions of Subversion, including Subversi...

Astra Linux – Vulnerability in usbutils

The vulnerability of the list.h component of the USButils utility is related to pointer dereferencing errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

Astra Linux – Vulnerability in libbpf

The vulnerability of the BPF Libbpf loader library is related to errors in pointer dereferencing involving NULL. Exploiting this vulnerability could allow an attacker to cause a service failure...

Astra Linux – Vulnerability in Chromium

The use of “after free” in the Network component of Google Chrome before version 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption through a crafted web application. Chromium security severity: Medium...

Astra Linux – Vulnerability in GIMP

GIMP XWD File Parsing: Integer Overflow and Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability, as the target must visit a malicious page or open a...

Astra Linux – Vulnerability in Chromium

The use of after-free in Animation in Google Chrome before version 138.0.7204.49 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: RDMA/hns: Fixed a soft lockup that occurred during the loop that allocates BT pages. The driver executes a for-loop when allocating BT pages and mapping them with buffer pages. When a large buffer e.g., an MR of over 100GB is...

Astra Linux – Vulnerability in requests

Requests is an HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This issue arises due to the way we use rebuildproxies to reattach the Proxy-Authorization header to requests. For HTTP connections...

Astra Linux – Vulnerability in grub2

A flaw was discovered in grub2. When performing a symlink lookup, the grub’s UFS module checks the data size of the inode to allocate an internal buffer to read the file content. However, it fails to check whether the data size of the symlink has exceeded its allocated limit. As a result, the...

Astra Linux – Vulnerability in grub2

A flaw was discovered in grub2. When reading data from a squash4 filesystem, grub’s squash4 fs module uses user-controlled parameters from the filesystem’s geometry to determine the internal buffer size. However, it improperly checks for integer overflows. A maliciously crafted filesystem may cau...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: drm/xe: The local fence was used in the error path of xemigrateclear. The purpose of the error path in xemigrateclear is to wait for the locally generated fence before returning. The code is waiting for m-fence, which could be th...

Astra Linux – Vulnerability in Chromium

The use of “after free” in Blink in Google Chrome before version 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

In V8, reading and writing outside the allowed boundaries in Google Chrome before version 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...