Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Payments in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted Chrome Extension. Chromium security severity: Low...

Astra Linux – Vulnerability in Python 3.11

There is a HIGH-severity vulnerability affecting the CPython “zipfile” module, specifically the “zipfile.Path” class. It should be noted that the more commonly used API “zipfile.ZipFile” class is not affected by this vulnerability. When iterating over the names of entries in a zip archive for...

Astra Linux – Vulnerability in p7zip

7-ZIP CopyCoder Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition in affected installations of 7-ZIP. Interaction with this library is required to exploit this vulnerability, but the attack vectors may vary depending ...

Astra Linux – Vulnerability in dcmtk

In DCMTK, versions prior to 3.6.9 have a segmentation fault due to an invalid DIMSE message...

Astra Linux – Vulnerability in Chromium

A heap buffer overflow in Skia in Google Chrome prior to version 128.0.6613.113 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Firefox

Firefox adds web-compatibility shims as a replacement for some tracking scripts that are blocked by Enhanced Tracking Protection. On a site protected by the Content Security Policy in “strict-dynamic” mode, an attacker who can inject an HTML element could use a DOM Clobbering attack on some of th...

Astra Linux – Vulnerability in PHP 8.2

In PHP versions 8.1. before 8.1.30, and 8.2. before 8.2.24, as well as 8.3. before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could result in legitimate data not being processed. This could allow malicious attackers to control a portion of the submitted dat...

Astra Linux – Vulnerability in ffmpeg

It was discovered that FFmpeg version n6.1.1 contains a heap use-after-free issue through the avhwframectxinit function...

Astra Linux – Vulnerability in ffmpeg

The Ffmpeg v.N113007-g8d24a28d06 contains a buffer overflow vulnerability that allows a local attacker to execute arbitrary code through libavfilter/afstereowiden.c:120:69...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in DevTools in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Python 3.11

The “ipaddress” module contained incorrect information regarding whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the isprivate and isglobal properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and...

Astra Linux – Vulnerability in krb5

Kerberos 5 also known as krb5 version 1.21.2 contains a memory leak vulnerability in the file /krb5/src/kdc/ndr.c...

Astra Linux – Vulnerability in PHP 8.2

In PHP versions 8.1. before 8.1.30, and 8.2. before 8.2.24, as well as 8.3. before 8.3.12, the HTTPREDIRECTSTATUS variable was used to determine whether a CGI binary was being executed by the HTTP server. However, in certain scenarios, the content of this variable could be controlled by the reque...

Astra Linux – Vulnerability in PostgresSQL-15

Incorrect privilege assignments in PostgreSQL allow a less-privileged application user to view or modify rows that were not intended for them. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or equivalent features. The problem arises when an application query uses...

Astra Linux – Vulnerability in PostgresSQL-15

The use of server error messages by clients in PostgreSQL allows a server that is not trusted under current SSL or GSS settings to send arbitrary non-NUL bytes to the libpq application. For example, a man-in-the-middle attacker could send a long error message claiming that a human user or someone...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially perform out-of-bounds memory access via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

The use of “after free” in Media Stream in Google Chrome before version 126.0.6478.182 allowed a remote attacker who convinced a user to perform certain UI gestures to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in curl

When an application instructs libcurl to enable HTTP/2 server push, and the number of received headers for the push exceeds the maximum allowed limit 1000, libcurl abends the server push. During this process, libcurl inadvertently does not free all of the previously allocated headers; instead, it...

Astra Linux – Vulnerability in Firefox

Incorrect garbage collection interactions in IndexedDB could lead to a use-after-free vulnerability. This vulnerability affects Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1...

Astra Linux – Vulnerability in Firefox, Thunderbird

ANGLE failed to initialize parameters, which resulted in reading from uninitialized memory. This vulnerability could be exploited to leak sensitive data from memory. This issue affects Firefox 129, Firefox ESR 115.14, Firefox ESR 128.1, Thunderbird 128.1, and Thunderbird 115.14...