Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: TCP: Fixed a data race around sysctltcpmtuprobefloor. When reading sysctltcpmtuprobefloor, it can be changed concurrently. Therefore, we need to add READONCE to its reader...

Astra Linux – Vulnerability in Chromium

The use of after-free in Dawn, prior to version 124.0.6367.78, allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerabilities in Firefox, Thunderbird, and Expat

Expat also known as libexpat before version 2.4.4 has an integer overflow in the doProlog function...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

A out-of-bounds memory access vulnerability was discovered in the vmwgfx driver, located in the vmxgfx/vmxgfxkms.c file within the GPU component of the Linux kernel. The vulnerability affects device files such as '/dev/dri/renderD128 or Dxxx'. This flaw allows a local attacker with a user account...

Astra Linux – Vulnerability in the 389-DS-base

A vulnerability was discovered in the 389 Directory Server, which allows an unauthenticated attacker with network access to the LDAP port to cause a denial of service. The denial of service is triggered by a single message sent over a TCP connection, without the need for any bind or other...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the WebView tag in Google Chrome prior to version 143.0.7499.192 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. Chromium security severity: High...

Astra Linux – Vulnerability in c-ares

A flaw was discovered in the c-ares library. A missing input validation check for host names returned by DNS Domain Name Servers can result in incorrect hostnames being displayed. This could potentially lead to Domain Hijacking. The greatest threat posed by this vulnerability is related to...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: ext4: Fixed an uninitialized value in ‘ext4evict inode’. Syzbot identified the following issue: ===================================================== BUG: KMSAN: Uninitialized value in ext4evict inode+0xdd/0x26b0,...

Astra Linux – Vulnerability in Chromium

Before version 89.0.4389.72, using the "tab search" function in Google Chrome allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

A null pointer dereference vulnerability was discovered in the function ath10kwmitlvoppullmgmttxcomplev within drivers/net/wireless/ath/ath10k/wmi-tlv.c in the Linux kernel. This issue could be exploited to cause a denial of service attack...

Astra Linux – Vulnerability in Linux, Linux 5.10

A use-after-free flaw was discovered in fs/ext4/namei.c:dxinsertblock, within the Linux kernel’s filesystem sub-component. This flaw allows a local attacker with user privileges to cause a denial of service...

Astra Linux – Vulnerability in HAPProxy

HAProxy versions 2.0.32, 2.1.x, and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 send empty Content-Length headers, violating section 8.6 of RFC 9110. In rare cases, an HTTP/1 server behind HAPProxy may interpret...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted XML file. Chromium security severity: Medium...

Astra Linux – Vulnerability in linux-astra-modules-6.1, linux-astra-modules-5.15

The vulnerability of Linux Astra Modules’ kernel modules is related to insufficient verification of data authenticity. Exploiting this vulnerability allows attackers to access confidential data, compromise its integrity, and cause service failures...

Astra Linux – Vulnerability in Chromium

A heap buffer overflow in ANGLE in Google Chrome prior to version 125.0.6422.76 allowed a remote attacker to perform an out-of-bounds memory read through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Firefox

Starting with Firefox 142, it became possible for a compromised child process to trigger a use-after-free in the GPU or browser process through WebGPU-related IPC calls. This vulnerability could potentially be exploited to escape the child process sandbox. This vulnerability was fixed in Firefox...

Astra Linux – Vulnerability in Intel Microcode

Improper input validation in some IntelR TDX module software prior to version 1.5.05.46.698 may allow a privileged user to potentially enable privilege escalation through local access...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in the iframe Sandbox in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to bypass file download restrictions via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in edk2

NetworkPkg/IScsiDxe has remotely exploitable buffer overflows...

Astra Linux – Vulnerability in Redis

Redis is an open-source, in-memory database that persists data on disk. In versions starting from 2.6 and prior to 7.4.3, an unauthenticated client can cause the output buffer to grow indefinitely, until the server runs out of memory or is terminated. By default, Redis’s configuration does not...