Astra Linux – Vulnerability in xwayland, xorg-server

A flaw was discovered in the RandR extension, where the RRChangeProviderProperty function does not properly validate inputs. This issue leads to an integer overflow when calculating the total size to allocate...

Astra Linux – Vulnerability in WebKit2GTK

A problem related to injections has been addressed through improved validation. This issue is fixed in Safari 17.4, iOS 17.4, iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, and watchOS 10.4. A maliciously crafted webpage may potentially exploit this vulnerability...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Downloads in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to obfuscate security UI through a malicious file. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Before version 104.0.5112.101, using “after free” in ANGLE with Google Chrome allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerability in Thunderbird

A missing check related to text units could have led to a use-after-free condition and potentially exploitable crashes.Note: This advisory was added on December 13th, 2022 after we better understood the impact of the issue. The fix was included in the original release of Firefox 105. This...

Astra Linux – Vulnerability in WebKit2GTK

A vulnerability related to out-of-bounds reads has been addressed through improved bounds checking. This issue is fixed in Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, and watchOS 10.6. Processing maliciously crafted web content...

Astra Linux – Vulnerability in glibc

Calling getnetbyaddr or getnetbyaddrr with a configured nsswitch.conf that specifies the library’s DNS backend can lead to a situation where a zero-valued network is queried during operations in the GNU C Library versions 2.0 to 2.42. This could result in the leakage of stack contents to the...

Astra Linux – Vulnerability in Thunderbird, Firefox

An attacker could have exploited a use-after-free issue through the Custom Highlight API, resulting in a potentially exploitable crash. This vulnerability has been fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135...

Astra Linux – Vulnerability in Firefox

There was a race condition in nsHttpTransaction that could be exploited to cause memory corruption, potentially leading to an exploitable issue. This vulnerability has been fixed in Firefox 137.0.2...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Now treats platformmax consistently as a control value. This change is reflected in commit 9bdd10d57a88 “ASoC: ops: Shifted test values in sndsocputvolsw by +min”, and some additional related updates have been made...

Astra Linux – Vulnerability in Tomcat9

The simplified implementation of blocking reads and writes introduced in Tomcat 10, and backported to Tomcat 9.0.47 and later versions, exposed a long-standing but extremely difficult to trigger concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60, and...

Astra Linux – Vulnerability in rabbitMQ-server

Pivotal RabbitMQ versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, as well as RabbitMQ for Pivotal Platform versions 1.16.x prior to 1.16.7 and 1.17.x prior to 1.17.4, contain a web management plugin that is vulnerable to a denial-of-service attack. The “X-Reason” HTTP header can be...

Astra Linux – Vulnerability in Samba

A flaw was discovered in Samba. The security vulnerability occurs when the KDC and the kpasswd service share a single account and set of keys, allowing them to decrypt each other’s tickets. A user who has been requested to change their password can exploit this flaw to obtain and use tickets for...

Astra Linux – Vulnerability in Linux

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

Astra Linux – Vulnerability in Chromium

Rejected reason: Further investigation indicates that the issue is not a vulnerability...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

Astra Linux – Vulnerability in Chromium

Uninitialized data in PDFium in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted PDF file...

Astra Linux – Vulnerability in Chromium

The inappropriate implementation of the File Picker in Google Chrome prior to version 139.0.7258.127 allowed a remote attacker who convinced a user to perform certain UI gestures to leak cross-origin data through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

In Google Chrome versions prior to 88.0.4324.96, uninitialized usage in USB devices allowed a local attacker to potentially perform out-of-bound memory access through a USB device...

Astra Linux – Vulnerability in vtk6, vtk7

There is a NULL pointer dereference vulnerability in VTK before 9.2.5. This vulnerability resides in the file IO/Infovis/vtkXMLTreeReader.cxx. The vendor did not check the return value of the libxml2 API function ‘xmlDocGetRootElement’, and tried to dereference that NULL pointer. This is unsafe, ...