Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fixed a NULL pointer dereferencing issue in smb2getinfofilesystem. If share is provided, share-path will be NULL, which can lead to a NULL pointer dereferencing issue...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: drm/xe/guc: Fixed the use of stackdepot. Added the missing stackdepotinit call when CONFIGDRMXEDEBUGGUC is enabled to fix the following call stack: BUG: Kernel NULL pointer dereferencing, address: 0000000000000000 Workqueue:...

Astra Linux – Vulnerability in Mariadb 10.3

In MariaDB, the getsortbytable function before version 10.6.2 allows an application to crash due to certain uses of the ORDER BY clause...

Astra Linux – Vulnerability in Wireshark

In Wireshark versions 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the LTE RRC dissector could leak memory. This issue was addressed in the epan/dissectors/packet-lte-rrc.c file by adjusting certain append operations...

Astra Linux – Vulnerability in Python-Django

A issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters are vulnerable to a denial-of-service attack due to very large inputs containing a specific sequence of characters...

Astra Linux - уязвимость в tomcat9

There is a vulnerability related to observable timing discrepancies when comparing AJP secrets in Apache Tomcat. This issue affects Apache Tomcat versions as follows: 11.0.0-M1 through 11.0.21, 10.1.0-M1 through 10.1.54, 9.0.0.M1 through 9.0.117, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109...

Astra Linux – Vulnerability in exiv2

In Jp2Image::readMetadata in jp2image.cpp in Exiv2 0.27.2, an input file may lead to an infinite loop and system hangs, accompanied by high CPU consumption. Remote attackers could exploit this vulnerability to cause a denial of service by using a specially crafted file...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the content security policy of Google Chrome prior to version 91.0.4472.77 allowed a remote attacker to bypass the content security policy through a crafted HTML page. Chrome security severity: Medium...

Astra Linux – Vulnerability in Mariadb 10.3

MariaDB before version 10.6.2 allows an application to crash due to improper handling of a pushdown from a HAVING clause to a WHERE clause...

Astra Linux – Vulnerability in Jetty9

In the Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that may result in the active connections and associated resources not being properly cleaned up. This can lead to a Denial of Service scenario, where there are not enough...

Astra Linux – Vulnerability in pillow

A issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

Information exposure due to microarchitectural states after transient execution in certain vector execution units of some Intel processors may allow an authenticated user to potentially enable information disclosure through local access...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: f2fs: Explicitly terminate the xattr list with a null character. When setting an xattr, ensure that the xattr list is explicitly terminated with a null character. This eliminates the fragile assumption that the unused xattr space...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: Fixed an integer overflow in radeoncs parserinit. The type of size is unsigned. If size is 0x40000000, there will be an integer overflow. After size = sizeofuint32t, size will become zero, which may lead to referencin...

Astra Linux – Vulnerability in Linux 5.10

The network backend may cause Linux netfront to use freed SKBs. While adding logic to support XDP eXpress Data Path, a code label was moved in a way that allows SKBs to retain references pointers for further processing, so that they can still be freed...

Astra Linux – Vulnerability in freeipa

A flaw was discovered in all IPA versions ranging from 4.x.x to 4.8.0. When sending a very long password = 1,000,000 characters to the server, the password hashing process could exhaust memory and CPU resources, resulting in a denial of service and making the website unresponsive. The greatest...

Astra Linux – Vulnerability in Zabbix

JavaScript preprocessing, webhooks, and global scripts can lead to uncontrolled utilization of CPU, memory, and disk I/O resources. The ability to preprocess/webhook/configure and test global scripts is only available to Administrative roles Admin and Superadmin. Administrative privileges should...

Astra Linux – Vulnerability in gst-plugins-good1.0

DOS: Potential heap overwrite in qtdemux using zlib decompression. Integer overflow in the qtdemux element within the qtdemuxinflate function can lead to a segfault, or it may cause a heap overwrite, depending on the libc and operating system. Depending on the libc used and the underlying operati...

Astra Linux – Vulnerability in Firefox and Thunderbird

When a ServiceWorker intercepted a request using FetchEvent, the origin of the request was lost after the ServiceWorker took control of it. This caused the SameSite cookie protections to be negated. This issue was addressed in the specifications, and later in various browsers. This vulnerability...

Astra Linux – Vulnerability in Firefox

Mozilla developers reported memory safety bugs in Firefox 85. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability affects Firefox versions earlier than 86...