Astra Linux – Vulnerability in open-vm-tools

VMware Tools contains an insecure file handling vulnerability. A malicious actor with non-administrative privileges on a guest VM may tamper with local files to trigger insecure file operations within that VM...

Astra Linux – Vulnerability in Node.js

A memory leak could occur when a remote peer abruptly closes the socket without sending a “GOAWAY” notification. Additionally, if an invalid header is detected by nghttp2, causing the connection to be terminated by the peer, the same memory leak will be triggered. This flaw could lead to increase...

Astra Linux – Vulnerability in openjpeg2

A flaw was discovered in OpenJPEG. Pictures constructed maliciously can cause the program to enter a large loop and continuously print warning messages on the terminal...

Astra Linux – Vulnerability in Intel Microcode

Improper handling of overlap between protected memory ranges in some IntelR XeonR 6 processors with IntelR TDX may allow a privileged user to potentially enable an escalation of privileges through local access...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: cloneprivatemnt: Make sure that the caller has CAPSYSADMIN in the correct user namespaces. What we want to ensure is that cloneprivatemnt will not expose something hidden by a mount that we wouldn’t be able to undo. “ wouldn’t be...

Astra Linux – Vulnerability in Zabbix

The endpoint /zabbix.php?action=export.valuemaps is vulnerable to a Cross-Site Scripting attack due to the backurl parameter. This vulnerability arises from the reflection of user-provided data without proper HTML escaping or output encoding. As a result, a JavaScript payload may be injected into...

Astra Linux – Vulnerability in Firefox, Thunderbird

The username:password portion was not properly removed from URLs in CSP reports, which could potentially expose HTTP Basic Authentication credentials. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1...

Astra Linux – Vulnerability in Firefox, Thunderbird

Uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 142, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2...

Astra Linux – Vulnerability in Firefox, Thunderbird

DoS attack due to out-of-memory in the Graphics:WebRender component. This vulnerability was fixed in Firefox 142, Firefox ESR 140.2, Thunderbird 142, and Thunderbird 140.2...

Astra Linux – Vulnerability in Firefox, Thunderbird

Memory safety bugs exist in Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140, and Thunderbird 140. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have...

Astra Linux – Vulnerability in libnbd

A flaw was discovered in libnbd. A server may respond with a block size larger than 2^63 the NBD specification states that the size is a 64-bit unsigned value. This issue could cause an application to crash or lead to other unintended behaviors for NBD clients that do not properly handle the retu...

Astra Linux – Vulnerability in freeipa

A privilege escalation flaw from the host to the domain administrator was discovered in FreeIPA. This vulnerability is similar to CVE-2025-4404, as it fails to validate the uniqueness of the krbCanonicalName. While the previously released version added validations for the admin@REALM credential,...

Astra Linux – Vulnerability in catdoc

There is an integer underflow vulnerability in the OLE Document DIFAT Parser functionality of catdoc 0.95. A specially crafted, malformed file can lead to heap-based memory corruption. An attacker can provide a malicious file to exploit this vulnerability...

Astra Linux – Vulnerability in libssh2

The vulnerability in the src/kex.c component of the SSH2 protocol implementation library Libssh2 involves reading data beyond the allowed buffer limits. Exploiting this vulnerability allows a remote attacker to gain access to confidential data...

Astra Linux – Vulnerability in Chromium

Using “after free” in Dawn in Google Chrome before version 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Firefox, Thunderbird

The XSLT document loading failed to properly propagate the source document, which bypassed its CSP. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1...

Astra Linux – Vulnerability in Apache2

Splitting of HTTP responses within the core of the Apache HTTP Server allows attackers who can manipulate the Content-Type response headers of applications hosted or proxied by the server to split the HTTP response. This vulnerability was identified as CVE-2023-38709, but the patch included in...

Astra Linux – Vulnerability in curl

When performing TLS-related transfers using reused easy or multi-handles, and altering the CURLSSLOPTNOPARTIALCHAIN option, libcurl may accidentally reuse a CA store cached in memory, where the partial chain option is reversed. This goes against the user’s wishes and expectations. As a result,...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: Wifi: ath11k: The “clear initialized flag” for the deinitialized srng lists was cleared. In several cases, we observe kernel panics upon resuming operations due to ath11k kernel page faults. These incidents occur under the...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net: phy: Do not register LEDs for genphy. If a PHY has no driver, the genphy driver is probed with respect to the PHY during the phyattach or phydetach functions. If the PHY’s ofnode has a “leds” subnode, then the LEDs will be...