Astra Linux – Vulnerability in python-tornado

Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the provided “reason” phrase is used unescaped in HTTP headers where it could be used for header injection or in HTML on the default error page where it could be used for XSS attacks. This...

Astra Linux – Vulnerabilities in expat, Firefox, Thunderbird

In ExPat before version 2.7.2, the libexpat library allowed attackers to trigger large dynamic memory allocations through a small document that was submitted for parsing...

Astra Linux – Vulnerability in gst-plugins-base1.0

In GStreamer through 1.26.1, the subparse plugin’s subripunescapeformatting function may dereference a NULL pointer during the parsing of a subtitle file, resulting in a crash...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ice: fixed the cleanup of PTP resources during driver removal in error paths. The cleanup of PTP resources was improved when releasing resources in error paths. This error can occur either at the driver probe or during PTP featur...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: In tcpconnrequest, do not call reqskfastopenremove. The syzbot reported the following issue in tcpconnrequest: 0 If a listener is closed while a TFO socket is being processed in tcpconnrequest, inetcskreqskqueueadd does not set...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix KMSAN uninit-value issue in hfsplusdeletecat The syzbot reported issue in hfsplusdeletecat: 70.682285 T9333 ===================================================== 70.682943 T9333 BUG: KMSAN: uninit-value in...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: parisc: Avoid crashes due to unaligned access in the unwinder Guenter Roeck reported this kernel crash on his emulated B160L machine: - Starting network: udhcpc: started, version 1.36.1 - Backtrace: unwindonce+0x1c/0x5c...

Astra Linux – Vulnerability in nbdkit

There is a flaw in the “blocksize” filter of nbdkit that can be triggered by a specific type of client request. When a client requests block status information for a very large data range, exceeding a certain limit, it causes an internal error in nbdkit, resulting in a denial of service...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: erofs: Avoid infinite loops due to incomplete zstd-compressed data. Currently, the decompression logic incorrectly processes compressed data if the data is truncated in crafted deliberately corrupted images...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: nbd: restricts sockets to TCP and UDP Recently, syzbot began abusing NBD using various types of sockets. The commit cf1b2326b734 “nbd: verify that sockets are supported during setup” ensured that the socket supported a shutdown...

Astra Linux – Vulnerability in Firefox, Thunderbird

Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6...

Astra Linux – Vulnerability in Firebird 3.0

Firebird is a relational database. Prior to versions 3.0.13, 4.0.6, and 5.0.3, there was a NULL pointer dereferencing denial-of-service vulnerability in Firebird. This specific flaw existed in the parsing of xdr messages from clients. It led to NULL pointer dereferencing and denial-of-service...

Astra Linux – Vulnerability in Firefox

Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5...

Astra Linux – Vulnerability in WebKit2GTK

A buffer overflow was addressed through improved bounds checking. This issue has been fixed in Safari 26.1, iOS 18.7.2, and iPadOS 18.7.2; iOS 26.1 and iPadOS 26.1; macOS Tahoe 26.1; tvOS 26.1; visionOS 26.1; and watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected...

Astra Linux – Vulnerability in Firefox

A compromised web process was able to trigger unauthorized reads and writes in a more privileged process by using manipulated WebGL textures. This vulnerability has been fixed in Firefox 144, Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: listmount: Do not call pathput under the namespace semaphore. Ensure that we do not call pathput under the namespace semaphore. If we do so, we will be fine after performing fsck...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: - media: v4l2-subdev: Fixed an issue with the check for allocation failures in v4l2subdevcallstatetry. The v4l2subdevcallstatetry macro uses v4l2subdevstatealloc to allocate a subdev state, but does not check the returned valu...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: x86/CPU/AMD: Added a fix for RDSEED in Zen5. There is an issue with the 16-bit and 32-bit register output variants of RDSEED in Zen5, which return a random value of 0 “at a rate inconsistent with randomness, while incorrectly...

Astra Linux – Vulnerability in Chromium

Leakage of side-channel information in Storage in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to perform arbitrary read/write operations through a crafted HTML page. Chromium security severity: Medium...