Astra Linux – Vulnerability in WebKit2GTK

The issue was resolved through improved bounds checks. This issue is fixed in Safari 17.5, iOS 17.5, iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, and watchOS 10.5. Processing maliciously crafted web content may lead to arbitrary code execution...

Astra Linux – Vulnerability in WebKit2GTK

The issue was resolved through improved memory handling. This issue is fixed in Safari 18.3, iOS 18.3, iPadOS 18.3, macOS Sequoia 15.3, tvOS 18.3, visionOS 2.3, and watchOS 11.3. Processing web content may result in a denial-of-service...

Astra Linux – Vulnerability in WebKit2GTK

This issue was addressed through improved state management. This issue is fixed in Safari 18.3, iOS 18.3, iPadOS 18.3, macOS Sequoia 15.3, tvOS 18.3, visionOS 2.3, and watchOS 11.3. Processing maliciously crafted web content may lead to an unexpected process crash...

Astra Linux – Vulnerability in Firefox, Thunderbird

By checking the results of calls to window.open with specifically configured protocol handlers, an attacker can determine whether the application that implements that protocol handler is installed. This vulnerability affects Firefox 131, Firefox ESR 128.3, Thunderbird 128.3, and Thunderbird 131...

Astra Linux – Vulnerability in opensc

A vulnerability was discovered in the pkcs15-init function in OpenSC. An attacker could use a specially crafted USB Device or Smart Card, causing the system to send a specially crafted response to APDUs. Insufficient or missing checks on the return values of functions lead to unexpected behavior...

Astra Linux – Vulnerability in Zabbix

A non-administrator user account on the Zabbix frontend, with the default User role, or any other role that grants API access, can exploit this vulnerability. There is an SQL injection vulnerability in the CUser class within the addRelatedObjects function. This function is called from the CUser.g...

Astra Linux – Vulnerability in Firefox, Thunderbird

Incomplete handling of WebAssembly exceptions could lead to a use-after-free vulnerability. This vulnerability affects Firefox 129, Firefox ESR 115.14, Firefox ESR 128.1, Thunderbird 128.1, and Thunderbird 115.14...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: um: vector: Do not use drvdata in release. The drvdata is not available in the release version. We should use containerof to obtain the vectordevice instance. Otherwise, removing a vector device will result in a crash. RIP:...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: TCP: The check skb variable is not NULL in tcprtodeltaus. We have some machines running stock Ubuntu 20.04.6; these machines have a kernel version of 5.4.0-174-generic and are running Ceph. Recently, a NULL pointer dereference...

Astra Linux – Vulnerability in Qemu

The vulnerability of the QEMU hardware emulation software is related to insufficient testing of input data. Exploiting this vulnerability allows a remote attacker to cause service failures...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: HID: logitech-dj: Fixed a memory leak in logidjrecvswitchtodjmode. Fixed a memory leak in the logidjrecvsendreport error path...

Astra Linux – Vulnerability in libebml

In libebml before version 1.4.5, an integer overflow can occur in MemIOCallback.cpp when reading or writing data. This may lead to buffer overflows...

Astra Linux – Vulnerability in linux-astra-modules-6.1

The vulnerability of Linux Astra Modules’ kernel modules is related to insufficient blocking measures. Exploiting this vulnerability allows an attacker to cause service failures...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Assign linearpitchalignment even for VM Description Assign linearpitchalignment to prevent division by zero errors in VM environments...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Unregister notifier on eswitch init failure Otherwise, the notifier remains registered, and a subsequent attempt to enable eswitch may trigger warnings of the following type: 682.589148 ------------ Cut here -----------...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Input: adp5589-keys – fixed a NULL pointer dereferencing issue. We have registered a devm action to call adp5589clearconfig, and then passed the i2c client as an argument. This allows us to call i2cgetclientdata in order to obtai...

Astra Linux – Vulnerability in mpg123

A out-of-bounds write flaw was discovered in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write beyond the end of a heap-located buffer. As a result, heap corruption may occur, and arbitrary code execution is not prevented. The complexity required to exploit this fla...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: cpufreq: CPPC: Fixed a possible nullptrderef issue in cpufreqcpugetraw. cpufreqcpugetraw may return NULL if the CPU is not included in policy-cpus cpu mask, which could lead to a null pointer dereference...

Astra Linux – Vulnerability in xwayland, xorg-server

A flaw related to accessing an uninitialized pointer was discovered in X.Org and Xwayland. The compCheckRedirect function may fail if it cannot allocate the backing pixmap. In such cases, compRedirectWindow will return a BadAlloc error without validating the window tree just before processing; as...

Astra Linux – Vulnerability in xwayland, xorg-server

A buffer overflow vulnerability was discovered in X.Org and Xwayland. The code in XkbVModMaskText allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and will copy the data regardless of the siz...