Astra Linux – Vulnerability in WebKit2GTK

A memory corruption issue has been resolved through improved state management. This issue is fixed in tvOS 15.5, watchOS 8.6, iOS 15.5, iPadOS 15.5, macOS Monterey 12.4, and Safari 15.5. Processing maliciously crafted web content may lead to code execution...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ila: Serialized calls to nfregisternethooks have been fixed. A race condition was identified in ilaaddmapping 1. The commit 031ae72825ce “ila: Calling nfunregisternethooks earlier” attempted to address a similar issue. Upon...

Astra Linux – Vulnerability in bluez

A issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free condition can occur when a client disconnects during D-Bus processing of a WriteValue call...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: jfs: Fixed the uninit-value access to newea in eabuffer syzbot reports that lzo1x1docompress uses uninit-value: ===================================================== BUG: KMSAN: Uninit-value in lzo1x1docompress+0x19f9/0x2510,...

Astra Linux – Vulnerability in Chromium

Object corruption in V8 in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Firefox and Thunderbird

An attacker was able to cause memory corruption in the GMP process, which handles encrypted media. This process is also highly sandboxed, but it operates with slightly different privileges compared to the content process. This vulnerability has been fixed in Firefox 142, Firefox ESR 115.27, Firef...

Astra Linux - Vulnerability in Golang-1.19

Templates that contain actions within unquoted HTML attributes e.g., “attr=.” and are executed with an empty input can result in unexpected outputs when parsed due to HTML normalization rules. This may allow for the injection of arbitrary attributes into tags...

Astra Linux – Vulnerability in Chromium

Using “after free” in Dawn in Google Chrome before version 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in fig2dev

In the xfig diagramming tool, a segmentation fault occurs when running fig2dev. This allows an attacker to gain control by manipulating inputs locally through the readarcobject function...

Astra Linux – Vulnerability in exim4

Exim 4 before 4.94.2 allows out-of-bounds write-ups, because the main function, while having setuid root, copies the current working directory pathname into a buffer that is too small on some common platforms...

Astra Linux – Vulnerability in Chromium

In Google Chrome, a data race in the audio processing mechanism prior to version 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerability in usbguard

A issue was discovered in USBGuard prior to version 1.1.0. On systems where the usbguard-dbus daemon is running, a non-privileged user could enable USBGuard to allow all USB devices to be connected in the future...

Astra Linux – Vulnerability in Firefox

If array shift operations are not used, the Garbage Collector may become confused regarding valid objects. This vulnerability affects Firefox versions less than 101...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the File System API of Google Chrome prior to version 112.0.5615.49 allowed a remote attacker to bypass filesystem restrictions through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in fly-wm

The vulnerability of the fly-adjust-palette utility in the window graphical manager fly-wm is related to reading data beyond the allowed buffer size. Exploiting this vulnerability allows an attacker to cause a service failure...

Astra Linux – Vulnerability in edk2

EDK2’s Network Package is vulnerable to an infinite loop vulnerability when parsing unknown options in the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of availability...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: can: j1939: fixed Use-after-Free, failed to increment the ref count of the skb while it was in use. This patch addresses a Use-after-Free issue identified by the syzbot. The problem arises when a skb is taken from the per-session...

Astra Linux – Vulnerability in ffmpeg5

A flaw was discovered in FFmpeg’s HLS demuxer. This vulnerability allows bypassing checks for unsafe file extensions and triggering arbitrary demuxers using base64-encoded data URIs, along with specific file extensions...

Astra Linux – Vulnerability in libxstream-java

XStream is an open-source Java library for serializing objects to XML and back. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% of the CPU time on the target system, depending on the CPU type or through parallel execution of such operations. This can lead to a denial of...

Astra Linux – Vulnerability found in linux-astra-modules-5.15, linux-astra-modules-6.1, linux-astra-modules-5.10, linux-astra-modules-5.4, linux-5.10, linux-5.15, linux-6.1, linux

The vulnerability of Linux Astra Modules’ kernel modules is related to insufficient validation of input data. Exploiting this vulnerability allows attackers to access confidential data, compromise its integrity, and cause service failures...