Astra Linux – Vulnerability in pyyaml

PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and loadall functions due to a class deserialization issue. For example, Popen is a class in the subprocess module. NOTE: This issue exists because of an incomplete fix for CVE-2017-18342...

Astra Linux – Vulnerability in PHP 8.1, PHP 7.3

In PHP versions starting from 8.1. up to 8.1.32, and from 8.2. up to 8.2.28, and from 8.3. up to 8.3.19, as well as in PHP versions starting from 8.4. up to 8.4.5, headers that lack a colon : are treated as valid headers, even though they are not. This can cause applications to accept invalid...

Astra Linux – Vulnerability in Chromium

Type Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Ruby-Rack

Rack is a modular Ruby web server interface. Carefully crafted headers may cause header parsing in Rack to take longer than expected, potentially leading to a denial-of-service issue. The Accept and Forwarded headers are affected. Ruby 3.2 includes fixes for this problem, so Rack applications tha...

Astra Linux – Vulnerability in Chromium

Before version 101.0.4951.41, using File Manager in Google Chrome allowed a remote attacker to potentially exploit heap corruption through specific and direct user interactions...

Astra Linux – Vulnerability in python-cryptography

A flaw was discovered in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which could result in the exposure of confidential or sensitive data...

Astra Linux – Vulnerability in python-gevent

A vulnerability in Gevent prior to version 23.9.0 allows a remote attacker to escalate privileges through a crafted script to the WSGIServer component...

Astra Linux – Vulnerability in c3p0

C3P0 versions less than 0.9.5.4 may be exploited by a “billion laughs attack” when loading XML configuration, due to the lack of protections against recursive entity expansion during the loading of configuration files...

Astra Linux – Vulnerability in open-vm-tools

A fully compromised ESXi host can cause VMware Tools to fail in authenticating host-to-guest operations, thereby affecting the confidentiality and integrity of the guest virtual machine...

Astra Linux – Vulnerability in unbound

NLnet Labs Unbound, including version 1.16.1, is vulnerable to a new type of “ghost domain names” attack. The vulnerability operates by targeting an Unbound instance. When the cached delegation information is about to expire, Unbound queries for a rogue domain name. The rogue nameserver delays th...

Astra Linux – Vulnerability in astra-safepolicy

The vulnerability of the astra-safepolicy security configuration software is related to the lack of a data security mechanism. Exploiting this vulnerability allows attackers to access confidential data, compromise its integrity, and cause service failures...

Astra Linux – Vulnerability in ffmpeg5

FFmpeg v.n6.1-3-g466799d4f5 allows a heap-based buffer overflow through the ffgaussianblur8 function in libavfilter/edgetemplate.c:116:5 component...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in File Systems in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

“Type Confusion in V8 in Google Chrome” before version 144.0.7559.132 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in node-glob-parent

This affects the glob-parent package before version 5.1.2. The enclosure regex used to check for strings ending with an enclosure containing a path separator is affected...

Astra Linux – Vulnerability in Firefox

Memory safety bugs exist in Firefox 135 and Thunderbird 135. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability has been fixed in Firefox 136 and Thunderbird...

Astra Linux – Vulnerability in Thunderbird

An attacker could create a malicious link that uses bidirectional characters to spoof the location in the address bar when visited. This vulnerability affects Firefox 117, Firefox ESR 115.4, and Thunderbird 115.4.1...

Astra Linux – Vulnerability in rabbitMQ-server

Versions of RabbitMQ prior to 3.8.16 are vulnerable to a denial-of-service vulnerability due to improper input validation in the AMQP 1.0 client connection endpoint. A malicious user can exploit this vulnerability by sending malicious AMQP messages to the target RabbitMQ instance where the AMQP 1...

Astra Linux – Vulnerability in Mariadb 10.3

It has been discovered that MariaDB Server v10.7 and earlier contain a global buffer overflow in the decimalbinsize component, which can be exploited through specially crafted SQL statements...

Astra Linux – Vulnerability in curl

This flaw allows an attacker to insert cookies into a running program using libcurl, provided that certain conditions are met. Libcurl performs transfers. In its API, an application creates “easy handles”—individual handles used for single transfers. Libcurl provides a function called...