Astra Linux – Vulnerability in WebKit2GTK

The issue was resolved through improved checks. This issue is fixed in iOS 16.6, iPadOS 16.6, tvOS 16.6, macOS Ventura 13.5, Safari 16.6, and watchOS 9.6. Processing web content may lead to arbitrary code execution...

Astra Linux – Vulnerability in Chromium

The use of “after free” in videos within Google Chrome before version 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in busybox

A use-after-free in Busybox 1.35-x’s awk applet leads to denial of service and potentially code execution when processing a crafted awk pattern in the copyvar function...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: “Revert ‘media: v4l2-ctrls: show all owned controls in logstatus’”. This change is reflected in commit 9801b5b28c6929139d6fceeee8d739cc67bb2739. This patch introduced a potential deadlock scenario: Wed May 8 10:02:06 2024 Possibl...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: drm/etnaviv: checking for the reaped mapping in etnaviviommuunmapgem. When the mapping has already been reaped, the unmap operation must be a no-op. Otherwise, we would try to remove the mapping twice, corrupting the involved dat...

Astra Linux – Vulnerability in Chromium

Before version 102.0.5005.61, using the "after free" feature in Indexed DB in Google Chrome allowed a remote attacker to potentially perform a sandbox escape through a crafted HTML page...

Astra Linux – Vulnerability in pillow

In the path.c file of Pillow, before version 9.0.0, there was an issue where the pathgetbbox function had a buffer over-reading during the initialization of ImagePath.Path...

Astra Linux – Vulnerability in pillow

The pathgetbbox function in path.c of Pillow, prior to version 9.0.0, improperly initializes ImagePath.Path...

Astra Linux – Vulnerability in ntfs-3g

A properly crafted NTFS image can lead to a out-of-bounds access vulnerability in the ntfsdecompress function in NTFS-3G, version 2021.8.22...

Astra Linux – Vulnerability in symfony

Symfony is a PHP framework for web and console applications, along with a set of reusable PHP components. When authenticating users, Symfony automatically regenerates the session ID upon login, but preserves the remaining session attributes. Since this does not reset the CSRF tokens upon login, i...

Astra Linux – Vulnerability in Firefox and Thunderbird

Memory safety bugs exist in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability affects Firefox version...

Astra Linux – Vulnerability in Firefox and Thunderbird

Set-Cookie response headers were being honored incorrectly in multipart HTTP responses. If an attacker could control the Content-Type response header, as well as part of the response body, they could inject Set-Cookie headers that would be honored by the browser. This vulnerability affects Firefo...

Astra Linux – Vulnerability in WebKit2GTK

A inconsistent user interface issue has been resolved through improved state management. This issue is fixed in iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1 and iPadOS 17.1, Safari 17.1, and macOS Sonoma 14.1. Visiting a malicious website may result in address bar spoofing...

Astra Linux – Vulnerability in Vim

Vim is vulnerable to Heap-based Buffer Overflow attacks...

Astra Linux – Vulnerability in Zabbix

Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected from a web application to the victim’s browser. The script is activated through a link, which sends a request to a website with a vulnerability that allows the execution of malicious scripts...

Astra Linux – Vulnerability in Squid

Squid is a caching proxy for the web that supports HTTP, HTTPS, FTP, and other protocols. Due to a Buffer Overread bug, Squid is vulnerable to a Denial of Service attack targeting the Squid HTTP message processing mechanism. This bug has been fixed in Squid version 6.5. Users are advised to...

Astra Linux – Vulnerability in Wireshark

In Wireshark versions 3.2.0 to 3.2.4, the GVCP dissector could enter an infinite loop. This issue was addressed in the epan/dissectors/packet-gvcp.c file by ensuring that the offset increased in all situations...

Astra Linux – Vulnerability in cifs-utils

cifs-utils from version 6.14 onwards, with verbose logging, can cause an information leak when a file contains equal sign characters but is not a valid credentials file...

Astra Linux – Vulnerability in NBD

In nbd-server in nbd before 3.24, there is a stack-based buffer overflow. An attacker can cause a buffer overflow in the parsing of the name field by sending a crafted NBDOPTINFO or NBDOPTGO message with a large value as the length of the name...

Astra Linux – Vulnerability in Wireshark

The T.38 dissector crash in Wireshark versions 4.2.0 to 4.0.3, and 4.0.0 to 4.0.13 allows for denial of service through packet injection or malicious capture files...