Astra Linux – Vulnerability in Chromium

Inappropriate implementation in WebRTC in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in the 389-DS-base

A flaw was discovered in the 389-ds-base LDAP Server. This issue occurs when performing an Modify DN LDAP operation via the ldap protocol, where the function’s return value is not checked, and a NULL pointer is dereferenced. If a privileged user performs an LDAP MODDN operation after a failed...

Astra Linux - уязвимость в linux, linux-5.15, linux-5.10

In the Linux kernel, the following vulnerability has been resolved: mfd: dln2: Fix memory leak in dln2probe When dln2setuprxurbs in dln2probe fails, error outfree forgets to call usbputdev to decrease the refcount of dln2-usbdev. Fix this by adding usbputdev in the error handling code of dln2prob...

Astra Linux – Vulnerability in Tiff

A flaw was discovered in Libtiff. This vulnerability operates under the “write-what-where” condition, and is triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file’s metadata, an attacker can trick the library into...

Astra Linux – Vulnerability in curl

Successfully using libcurl to perform a transfer over a specific HTTP proxy proxyA with Digest authentication. Then, changing the proxy host to another one proxyB for a second transfer, while reusing the same handle, causes libcurl to incorrectly pass the Proxy-Authorization: header field meant f...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: x86/cpu/hygon: Added resctrlcpudetect to the bspinit helper. Since 923f3a2b48bd “x86/resctrl: Query LLC monitoring properties once during boot”, resctrlcpudetect has been moved from the common CPU initialization code to the...

Astra Linux – Vulnerability in pgbouncer

In PgBouncer, a password can be used after it has expired due to the fact that the authquery does not take into account Postgres’s VALID UNTIL value. This allows an attacker to log in with a password that is already expired...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fixed the sleeping-in-atomic behavior in ath11kmacopsetbitratemask The ath11kmacdisablepeerfixedrate function is passed as an iterator to ieee80211iteratestationsatomic. It should be noted that the iterator must be...

Astra Linux – Vulnerability in Firefox, Thunderbird

An attacker who enumerated resources from the WebCompat extension could obtain a persistent UUID that identified the browser. This UUID could be used to switch between container-based modes and normal/private browsing mode, but not profiles. This vulnerability has been fixed in Firefox 140, Firef...

Astra Linux – Vulnerability in Firefox, Thunderbird

Firefox may have incorrectly parsed a URL and reverted it to the youtube.com domain during parsing of the URL specified in an embed tag. This could have bypassed website security checks that restrict which domains users are allowed to embed. This vulnerability was fixed in Firefox 140, Firefox ES...

Astra Linux – Vulnerability in Firefox, Thunderbird

Memory safety bugs exist in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141, and Thunderbird 141. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability ha...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: fixed the issue of out-of-range access to the vnicinfo array. The bnxtqueuestart | stop access to vnicinfo results in excessive allocation of resources, which indicates bp-nrvnics. Therefore, it should not access...

Astra Linux – Vulnerability in Python 3.11

When an address list is folded, and the separating comma ends up on a folded line that needs to be encoded using Unicode, then the separator itself must also be encoded using Unicode. The expected behavior is that the separating comma remains a plain comma. However, this can lead to the address...

Astra Linux – Vulnerability in jq

jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-bufferoverflow error occurs in the jvstringvfmt function within the jqfuzzexecute harness from oss-fuzz. This error happens at line 1456 of the jv.c file: void p = mallocsz;. As of the time of publication, no patch...

Astra Linux – Vulnerability in Chromium

Type Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Type Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

The use of “after free” in Media Stream in Google Chrome before version 138.0.7204.183 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

The use of after free in Extensions in Google Chrome before version 139.0.7258.66 allowed a remote attacker to potentially exploit heap corruption through a crafted Chrome Extension. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in File Systems in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in Core in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page. Chromium security severity: Low...