Astra Linux – Vulnerability in PHP 7.3, PHP 8.1

In PHP versions 8.0. before 8.0.27, 8.1. before 8.1.15, and 8.2. before 8.2.2, when using the PDO::quote function to quote user-supplied data for SQLite, providing an overly long string may cause the driver to incorrectly quote the data. This can further lead to SQL injection vulnerabilities...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the Content Security Policy of Google Chrome prior to version 91.0.4472.77 allowed a remote attacker to bypass the content security policy through a crafted HTML page...

Astra Linux – Vulnerability in freerdp3, freerdp2

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, in ClearCodec, when glyphData was present, cleardecompress called freerdpimagecopynooverlap without validating the destination rectangle. This allowed out-of-bounds read/writing through crafted RDPGFX surfac...

Astra Linux – Vulnerability in fig2dev

Fig2dev 3.2.7b contains a global buffer overflow in the convpatternindex function in gencgm.c...

Astra Linux – Vulnerability in WebKit2GTK

A memory management issue related to “use after free” operations has been addressed through improved memory management practices. This issue is fixed in tvOS 15.5, watchOS 8.6, iOS 15.5, iPadOS 15.5, macOS Monterey 12.4, Safari 15.5, and iTunes 12.12.4 for Windows. Processing maliciously crafted...

Astra Linux – Vulnerability in plasma-workspace

In KDE Plasma Workspaces also known as plasma-workspace, prior to versions 5.27.11.1 and 6.x, before version 6.0.5.1, connections were made via ICE, purely based on the host system. This means that all local connections were accepted. This allowed another user on the same machine to gain access t...

Astra Linux – Vulnerability in unbound

Before version 1.9.5, Unbound allowed assertion failures due to a compressed name in dnamepktcopy. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, an ongoing Unbound installation cannot be exploited remotely or locally...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the File System API of Google Chrome prior to version 88.0.4324.96 allowed a remote attacker to bypass the file extension policy through a crafted HTML page...

Astra Linux – Vulnerability in Ruby 2.5

There is a buffer over-read issue in Ruby before version 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. This issue occurs during the conversion from strings to floats, including in methods like KernelFloat and Stringtof...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fixed a potential UAF Uninitialized Address Fault in isoconnfree. This fix addresses a similar issue to scoconnfree, where if conn-sk is not set to NULL, it may lead to a UAF in isoconnfree...

Astra Linux – Vulnerability in WebKit2GTK

This issue has been resolved through improved redaction of sensitive information. This issue is fixed in iOS 16.7.2 and iPadOS 16.7.2. A user’s password may be read aloud by VoiceOver...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: leds: led-core: A reference count leak was fixed in ledget. The classfinddevicebyofnode function calls classfinddevice, which will hold a reference. The putdevice function is used to release the reference when no longer needed...

Astra Linux – Vulnerability in Linux, Linux 5.10

It was discovered that there was a lack of CPU resources in the Linux kernel tracing module functionality in versions prior to 5.14-rc3. This issue occurred due to the way users utilize the trace ring buffer. Only privileged local users with the CAPSYSADMIN capability could exploit this flaw to...

Astra Linux – Vulnerability in Chromium

Type confusion in CSS in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in atftp

In AtFTP, before version 0.7.5, the options.c file contained code that read past the end of an array. As a result, server-side /etc/group data was disclosed to a remote client...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: devres: A memory leak caused by the driver API devmfreepercpu has been fixed. A memory leak occurs when the driver API devmfreepercpu is used to release memory allocated by devmallocpercpu. This issue was addressed by using...

Astra Linux – Vulnerability in exiv2

Exiv2 0.27.99.0 has a global buffer over-read issue in the Exiv2::Internal::Nikon1MakerNote::print0x0088 function, located in nikonmnint.cpp. This issue can lead to an information leak...

Astra Linux – Vulnerability in GhostScript

A issue was discovered in Artifex Ghostscript prior to version 10.03.1. The file contrib/opvp/gdevopvp.c allows for arbitrary code execution through a custom Driver library, which can be exploited using a crafted PostScript document. This occurs because the Driver parameter for opvp and oprp...

Astra Linux – Vulnerability in SQLite3

SQLite 3.32.2 has a use-after-free issue in the resetAccumulator function in select.c, as the re-write of the parse tree for window functions occurs too late...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: soc: qcom: llcc: Handle a second device without data corruption. Usually, there is only one llcc device. But if there were a second one, even a failed probe call would modify the global drvdata pointer. Therefore, check whether...