Astra Linux – Vulnerability in sysstat

Sysstat is a set of system performance tools for the Linux operating system. On 32-bit systems, in versions 9.1.16 and later, but before version 12.7.1, the allocatestructures function contained a sizet overflow in the sacommon.c file. The allocatestructures function insufficiently checked the...

Astra Linux – Vulnerability in Chromium

In V8 of Google Chrome, before version 116.0.5845.110, unauthorized memory access allowed a remote attacker to perform an out-of-bounds memory read through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Linux 5.10

In the dplinksettingswrite function in the file drivers/gpu/drm/amd/display/amdgpudm/amdgpudmdebugfs.c in the Linux kernel, up to version 5.14.14, there is a vulnerability that allows for a heap-based buffer overflow by an attacker. This vulnerability arises because the attacker can write a strin...

Astra Linux – Vulnerability in Linux, Linux 5.10

A flaw was discovered in the Linux kernel. A use-after-free vulnerability in the NFC stack can pose a threat to confidentiality, integrity, and system availability...

Astra Linux – Vulnerability in Golang 1.19, Golang 1.23

If the PATH environment variable contains paths that are executable files rather than just directories, passing certain strings to LookPath "", ".", and ".." may cause the binaries listed in the PATH to be returned unexpectedly...

Astra Linux – Vulnerability in libde265

It was discovered that Libde265 v1.0.14 contains a heap-buffer-overflow vulnerability in the derivecombinedbipredictivemergingcandidates function at motion.cc...

Astra Linux – Vulnerability in Firefox and Thunderbird

Undefined behavior in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Custom Tabs in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

The use of Site Isolation in Google Chrome before version 135.0.7049.84 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in OpenSSH

In SSH in OpenSSH before version 9.6, OS command injection could occur if a user name or host name contained shell metacharacters, and this name was referenced by an expansion token in certain situations. For example, a untrusted Git repository might contain a submodule with shell metacharacters ...

Astra Linux – Vulnerabilities in expat, Firefox, Thunderbird

In libexpat before version 2.7.4, the doContent function does not properly determine the buffer size bufSize, as there is no check for integer overflow during the reallocation of the tag buffer...

Astra Linux – Vulnerability in Netty

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high-performance protocol servers and clients. In Netty-Codec-Compression versions 4.1.124.Final and below, as well as Netty-Codec versions 4.2.4.Final and below, when supplied with specially...

Astra Linux – Vulnerability in Python 3.11, Python 3.7

A vulnerability has been identified in the CPython venv module and CLI. This vulnerability arises from improper quoting of path names when creating a virtual environment. As a result, attackers can inject commands into the virtual environment “activation” scripts e.g., using “source...

Astra Linux – Vulnerability in node-tar

The npm package “tar” also known as node-tar in versions prior to 4.4.16, 5.0.8, and 6.1.7 has vulnerabilities related to arbitrary file creation/overwriting and arbitrary code execution. node-tar aims to ensure that any file whose location would be modified by a symbolic link is not extracted...

Astra Linux – Vulnerability in db5.3

SQLite3 versions from 3.6.0 through 3.27.2 are vulnerable to heap out-of-bound reads in the rtreenode function when handling invalid rtree tables...

Astra Linux – Vulnerability in OpenVSwitch

An out-of-bounds read in the Organization-Specific TLV was found in various versions of OpenvSwitch...

Astra Linux – Vulnerability in requests

Requests is an HTTP library. Due to an URL parsing issue, versions of Requests before 2.32.4 may expose .netrc credentials to third parties for specific, maliciously crafted URLs. Users should upgrade to version 2.32.4 to resolve this issue. For earlier versions of Requests, the use of the .netrc...

Astra Linux – Vulnerability in PHP 7.3

In PHP versions prior to 7.4.31, 8.0.24, and 8.1.11, this vulnerability allows network and same-site attackers to set an insecure cookie in the victim’s browser. This cookie is treated as a Host- or Secure- cookie by PHP applications...

Astra Linux – Vulnerability in Ruby-Rack

Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the Rack::File middleware or the...

Astra Linux – Vulnerability in python-django, python2.7

Packages containing “python/cpython” from versions 0 and earlier, including 3.6.13, 3.7.0 and earlier than 3.7.10, 3.8.0 and earlier than 3.8.8, 3.9.0 and earlier than 3.9.2, are vulnerable to Web Cache Poisoning via “urllib.parse.parseqsl” and “urllib.parse.parseqs”. This vulnerability occurs du...