Astra Linux – Vulnerability in Firefox

When downloading an update for an addon, the version of the downloaded addon update was not verified to match the version selected from the manifest. If the manifest had been tampered with on the server, an attacker could trick the browser into downgrading the addon to a previous version. This...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: nvme-core: fixed a memory leak in dhchapctrlsecret. Free dhchapsecret from nvmectrldhchapctrlsecretstore before returning, when nvmeauthGenerateKey returns an error...

Astra Linux – Vulnerability in PostgresSQL 11

Row security policies ignore changes to user IDs after inline operations. PostgreSQL may allow incorrect policies to be applied in certain cases where role-specific policies are used, and where a given query is planned to be executed under one role and then executed under another role. This...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the Web Payments API in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass content security policy through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in sysstat

Before version 12.1.6, sysstat experienced memory corruption due to an integer overflow in the remapstruct function within sacommon.c...

Astra Linux – Vulnerability in xorg-server

A vulnerability, which was classified as problematic, has been identified in the X.org Server. The affected component is the function ProcXkbGetKbdByName in the file xkb/xkb.c. This vulnerability causes a memory leak. It is recommended that a patch be applied to address this issue. The identifier...

Astra Linux – Vulnerability in nss

When converting coordinates from projective to affine, the modular inversion was not performed in constant time, allowing for a timing-based side channel attack. This vulnerability affects Firefox versions less than 80, as well as Firefox for Android versions less than 80...

Astra Linux – Vulnerability in openimageio

There are multiple memory corruption vulnerabilities in the IFFOutput alignment padding functionality of the OpenImageIO Project, specifically in OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to arbitrary code execution. An attacker can provide malicious input to trigger...

Astra Linux – Vulnerability in Samba

Samba does not validate the Validated-DNS-Host-Name property for the dNSHostName attribute, which may allow unprivileged users to modify it...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: dm: fixed a NULL pointer race issue when completing IO operations. The dmiodecpending function calls endioacct first, and then decreases the number of pending DMA operations. However, if a task swaps the DM table at the same...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: “fou”: fixed the initialization of grc. Grc must be initialized first. There may be a situation where if fou is NULL, “goto out” will be executed, and grc will be used in an uninitialized state...

Astra Linux – Vulnerability in json-smart

A vulnerability was discovered in the indexOf function of JSONParserByteArray in JSON Smart versions 1.3 and 2.4, which causes a denial of service DOS through a crafted web request...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: hci: validate codec capability element length The hcireadcodeccapabilities function returns a sequence of capability elements. Each element begins with a one-byte length, followed by that many payload bytes...

Astra Linux – Vulnerability in libgoogle-gson-java

The com.google.code Gson:gson package before version 2.8.9 is vulnerable to deserialization of untrusted data through the writeReplace method in internal classes, which may lead to DoS attacks...

Astra Linux – Vulnerability in python-urllib3

In the urllib3 library, as of version 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameters...

Astra Linux – Vulnerability in libcommons-compress-java

There is a vulnerability related to the “Unreachable Exit Condition” „Infinite Loop“ in Apache Commons Compress. This issue affects Apache Commons Compress versions from 1.3 to 1.25.0. Users are recommended to upgrade to version 1.26.0, which fixes this issue...

Astra Linux – Vulnerability in Ansible

A flaw was discovered in Ansible, where a user’s controller is vulnerable to template injection. This issue can occur when facts used in the template do not include special template characters, especially if the user attempts to embed templates within multi-line YAML strings. This flaw allows...

Astra Linux – Vulnerability in Firefox and Thunderbird

A website configured to initiate a specially crafted WebTransport session could cause the Firefox process to crash, resulting in a denial-of-service condition. This vulnerability affects Firefox 131, Firefox ESR 128.3, Thunderbird 128.3, and Thunderbird 131...

Astra Linux – Vulnerability in Chromium

The incorrect security UI in Downloads in Google Chrome prior to version 119.0.6045.105 allowed a remote attacker to obfuscate the security UI through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Linux, Linux 5.10

A vulnerability was discovered in btrfsalloctreeb in fs/btrfs/extent-tree.c within the Linux kernel, due to an improper lock operation in btrfs. This flaw allows a user with local privileges to cause a denial of service DOS due to a deadlock issue...