Astra Linux – Vulnerability in curl

When a protocol selection parameter option disables all protocols without adding any new ones, the default set of protocols remains in the allowed list due to an error in the logic for removing protocols. The following command will send a request to curl.se using a plaintext protocol that has bee...

Astra Linux – Vulnerability in LibreOffice

Unchecked script execution in the “Graphic on-click binding” mechanism in affected LibreOffice versions allows an attacker to create a document that will execute scripts built into LibreOffice upon clicking a graphic, without any prompts. These scripts were previously considered trusted, but now...

Astra Linux – Vulnerability in cloud-init

Sensitive data may be exposed in logs of cloud-init before version 23.1.2. Attackers could use this information to obtain hashed passwords and potentially escalate their privileges...

Astra Linux – Vulnerability in PHP 8.2

In PHP versions 8.1. before 8.1.29, and 8.2. before 8.2.20, and 8.3. before 8.3.8, due to a code logic error, filtering functions such as filterVar when validating URLs using FILTERVALIDATEURL will result in invalid user information such as username and password parts of URLs being treated as val...

Astra Linux – Vulnerability in LibreOffice

Improper digital signature invalidation vulnerability in the Zip Repair Mode of The Document Foundation’s LibreOffice library allows for signature forgery vulnerabilities in LibreOffice. This issue affects LibreOffice versions starting from 24.2 before 24.2.5...

Astra Linux – Vulnerability in Firefox, Thunderbird

The date picker may partially obscure security prompts. A malicious site could use this feature to trick users into granting permissions. This vulnerability affects Firefox 129, Firefox ESR 115.14, Firefox ESR 128.1, Thunderbird 128.1, and Thunderbird 115.14...

Astra Linux – Vulnerability in Chromium

Type Confusion in V8 in Google Chrome prior to 128.0.6613.113 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

The use of “after free” in the Loader component in Google Chrome before version 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Permissions in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Insufficient data validation in Downloads in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in libvirt

A flaw was discovered in libvirt. A refactoring of the code that retrieves the list of interfaces for multiple APIs introduced a corner case on platforms where allocating 0 bytes of memory results in a NULL pointer. This corner case could lead to a NULL pointer being dereferenced, causing the...

Astra Linux – Vulnerability in LibreOffice

LibreOffice Calc compiles cell formulas when opening a spreadsheet. A heap buffer overflow occurred when compiling a very long formula consisting of many opening tokens. The array that tracks nesting depth was allocated with one element too small in the worst-case scenario; as a result, such a...

Astra Linux – Vulnerability in ffmpeg

FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a negative-size-param bug at libavcodec/mpegvideoenc.c:1216:21 in loadinputpicture in FFmpeg7.0...

Astra Linux – Vulnerability in bluez

BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vulnerability, as the target must connect...

Astra Linux – Vulnerability in Plasma-Workspace

In KDE Plasma Workspaces also known as plasma-workspace, prior to versions 5.27.11.1 and 6.x, before version 6.0.5.1, connections were made via ICE, purely based on the host system. This means that all local connections were accepted. This allowed another user on the same machine to gain access t...

Astra Linux – Vulnerability in Chromium

Type Confusion in V8 in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in cjson

It has been discovered that cJSON v1.7.17 contains a segmentation violation, which can occur through the second parameter of the cJSONSetValuestring function in the cJSON.c library...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: jfs: Fixed an array-index-out-of-bounds issue in diFree...

Astra Linux – Vulnerability in Chromium

No description...

Astra Linux – Vulnerability in libppd, cups

CUPS is a standards-based, open-source printing system, and libppd can be used for supporting legacy PPD files. The ppdCreatePPDFromIPP2 function in libppd does not sanitize IPP attributes when creating the PPD buffer. When used in conjunction with other functions such as cfGetPrinterAttributes5,...