Astra Linux – Vulnerability in Chromium

The use of WebCodecs with “after free” in Google Chrome before version 123.0.6312.86 allowed a remote attacker to perform arbitrary read/write operations through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in imagemagick

A flaw was discovered in ImageMagick’s MagickCore/statistic.c file. An attacker who submits a crafted file processed by ImageMagick could trigger undefined behavior, resulting in values that are outside the range of type unsigned long. This likely affects the availability of the application, but ...

Astra Linux – Vulnerability in Chromium

Chromium: CVE-2021-30617 – Policy bypass in Blink...

Astra Linux – Vulnerability in Firefox and Thunderbird

Firefox was vulnerable to a heap buffer overflow in nsTextFragment due to insufficient OOM handling. This vulnerability affects Firefox ESR 115.6, Thunderbird 115.6, and Firefox 121...

Astra Linux – Vulnerability in Chromium

Inappropriate implementations of WebAuthentication in Google Chrome prior to version 96.0.4664.45 allowed a remote attacker to leak cross-origin data through a crafted HTML page...

Astra Linux – Vulnerability in Linux 5.15

A out-of-bounds memory read flaw was discovered in the parseleasestate function within the KSMBD implementation of the in-kernel Samba server and CIFS in the Linux kernel. When an attacker sends the CREATE command along with a malformed payload to KSMBD, due to a lack of checks on the NameOffset...

Astra Linux – Vulnerability in ntfs-3g, Containerd-app

NTFS-3G before version 75dcdc2 has a use-after-free issue in the ntfsuppercasembs function in libntfs-3g/unistr.c. NOTE: Discussions suggest that exploiting this vulnerability would be challenging...

Astra Linux – Vulnerability in Chromium

Side-channel information leakage in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to leak cross-origin data through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in SQLite3

A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 through the idxGetTableInfo function, when a crafted SQL query is executed. NOTE: The vendor disputes the relevance of this report, as the sqlite3.exe user already has full privileges i.e., they are...

Astra Linux – Vulnerability in GIMP

GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow attacks. Through a specially crafted XCF file, the program will allocate a large amount of memory, leading to insufficient memory resources or the program crashing...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fixed NULL pointer dereference in the KFD queue. Through KFD IOCTL fuzing, we encountered a NULL pointer dereference when calling kfdqueueacquirebuffers. Cherry-picked from commit 049e5bf3c8406f87c3d8e1958e0a16804fa1d...

Astra Linux – Vulnerability in libde265

A issue has been found in libde265 v1.0.8 due to incorrect access control. A segmentation fault has occurred as a result of a READ memory access in the deriveboundaryStrength function of deblock.cc. This vulnerability causes a segmentation fault and results in the crash of the application, leadin...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/buddy: Fixed the error handling code for allocrange. A few users have reported display corruption when booting the machine into KDE Plasma or playing games. We have identified a problem where, whenever allocrange failed to fi...

Astra Linux – Vulnerability in Git

Git is a revision control system. Before versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, when cloning a local source repository that contained symlinks through the filesystem, Git might create hardlinks to arbitrary user-readable files within the same filesystem as the target...

Astra Linux – Vulnerability in TeXeVe-Bin

LuaTeX prior to version 1.17.0 allows a document compiled with default settings to make arbitrary network requests. This occurs because full access to the socket library is allowed by default, as stated in the documentation. This also applies to TeX Live prior to version 2023 r66984 and MiKTeX...

Astra Linux – Vulnerability in WebKit2GTK

The issue was resolved through improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6, iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, and watchOS 11.6. Processing web content may result in a denial-of-service condition...

Astra Linux – Vulnerability in docker.io-app

Moby v25.0.5 is affected by a race condition in the builder/builder-next/adapters/snapshot/layer.go file. This vulnerability could be exploited to trigger concurrent builds that invoke the EnsureLayer function, leading to resource leaks or exhaustion...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: spi: microchip-core-qspi: Stop checking the validity of op-maxfreq in the supportsop callback. In commit 13529647743d9 “spi: microchip-core-qspi: Support frequency switches per spi-memory operation”, the logic for checking the...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: Fixed the issue where getnodes accesses an array out of bounds when the number of nodes specified by the user exceeds the supported limit...

Astra Linux – Vulnerability in Wireshark

A crash occurred in the USB HID protocol dissector, and possibly in other dissectors in Wireshark versions 3.4.0, 3.2.0 to 3.2.8. This issue allows for denial of service through packet injection or with crafted capture files...