Astra Linux – Vulnerability in Chromium

Inappropriate implementation in FedCM in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Firefox, Thunderbird

The date picker may partially obscure security prompts. A malicious site could use this feature to trick users into granting permissions. This vulnerability affects Firefox 129, Firefox ESR 115.14, Firefox ESR 128.1, Thunderbird 128.1, and Thunderbird 115.14...

Astra Linux – Vulnerability in curl

When a protocol selection parameter option disables all protocols without adding any new ones, the default set of protocols remains in the allowed list due to an error in the logic for removing protocols. The following command will send a request to curl.se using a plaintext protocol that has bee...

Astra Linux – Vulnerability in ntfs-3g

NTFS-3G before version 75dcdc2 has a use-after-free issue in the ntfsuppercasembs function in libntfs-3g/unistr.c. NOTE: Discussions suggest that exploiting this vulnerability would be challenging...

Astra Linux – Vulnerability in pillow

In imagingcms.c within Pillow, before version 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy...

Astra Linux – Vulnerability in dovecot

Very large headers can cause resource exhaustion when parsing messages. The message parser usually reads relatively small chunks of the message. However, when these smaller chunks are fed into the message-header parser, the “fullvalue” buffer starts to grow excessively. The “fullvalue” buffer has...

Astra Linux - уязвимость в p7zip

7-Zip is a file archiver with a high compression ratio. 7-Zip supports extracting from Compound Documents. Prior to version 25.0.0, a null pointer dereference in the Compound handler may lead to denial of service. Version 25.0.0 contains a fix cor the issue...

Astra Linux – Vulnerability in WebKit2GTK

A “use-after-free” issue has been addressed through improved memory management. This issue is fixed in Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, and watchOS 10.6. Processing maliciously crafted web content may lead to an...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: jfs: Fixed an array-index-out-of-bounds issue in diFree...

Astra Linux – Vulnerability in Plasma-Workspace

In KDE Plasma Workspaces also known as plasma-workspace, prior to versions 5.27.11.1 and 6.x, before version 6.0.5.1, connections were made via ICE, purely based on the host system. This means that all local connections were accepted. This allowed another user on the same machine to gain access t...

Astra Linux – Vulnerability in Chromium

No description...

Astra Linux – Vulnerability in GSL

A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL GNU Scientific Library, versions 2.5 and 2.6. Processing input data that is maliciously crafted for the gslstatsquantilefromsorteddata function of this library may result in unexpected application...

Astra Linux – Vulnerability in LibreOffice

Unchecked script execution in the “Graphic on-click binding” mechanism in affected LibreOffice versions allows an attacker to create a document that will execute scripts built into LibreOffice upon clicking a graphic, without any prompts. These scripts were previously considered trusted, but now...

Astra Linux – Vulnerability in python-tornado

A vulnerability in Tornado versions 6.3.1 and earlier allows a remote, unauthenticated attacker to redirect a user to an arbitrary web site and carry out a phishing attack by causing the user to access a specially crafted URL...

Astra Linux – Vulnerability in Jinja2

Jinja is an extensible templating engine. The xmlattr filter in affected versions of Jinja accepts keys that contain non-attribute characters. XML/HTML attributes cannot contain spaces, /, , or =, as each of these characters would be interpreted as the start of a separate attribute. If an...

Astra Linux – Vulnerability in needrestart

Qualys discovered that needrestart, prior to version 3.8, allowed local attackers to execute arbitrary code as root by tricking needrestart into running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable...

Astra Linux – Vulnerability in Chromium

Insufficient data validation in Downloads in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Type Confusion in V8 in Google Chrome before version 129.0.6668.100 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Before version 130.0.6723.92, Dawn in Google Chrome allowed a remote attacker to perform out-of-bounds memory access through a crafted HTML page. Chromium security severity: Critical...

Astra Linux – Vulnerability in needrestart

Qualys discovered that before version 3.8, needrestart passed unsanitized data to a library Modules::ScanDeps, which expects safe input. This could allow a local attacker to execute arbitrary shell commands. Please refer to the related CVE-2024-10224 in Modules::ScanDeps...