Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the File System API of Google Chrome on Windows prior to version 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions through a crafted HTML page...

Astra Linux – Vulnerability in sysstat

In sysstat versions up to 12.7.2, there is a multiplication integer overflow in the checkoverflow function in common.c. NOTE: This issue exists due to an incomplete fix for CVE-2022-39377...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: afunix: Do not use GC if MSGPEEK occurred. Igor Ushakov reported that GC purged the receive queue of a live socket due to a race with MSGPEEK, with a fix provided. This is exactly the same issue that was previously fixed in the...

Astra Linux – Vulnerability in python-git

GitPython is a Python library used for interacting with Git repositories. Prior to version 3.1.48, there was a vulnerability in GitPython that allowed attackers who could provide a crafted reference path to an application using GitPython to write, overwrite, move, or delete files outside the...

Astra Linux – vulnerability in LibreOffice

Vulnerability allowing unauthorized actors to manipulate environment variables and arbitrary values in INI files within The Document Foundation LibreOffice. URLs can be crafted to expand environment variables or INI file values; thus, potentially sensitive information may be exfiltrated to a remo...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix uninitialized pointer free on readalloconename error The function readalloconename fails to initialize the name field of the passed fscryptstr struct if kmalloc cannot allocate the corresponding buffer. As a result, it...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ocfs2: Fixed an uninitialized value in ocfs2filereaditer. Syzbot has reported the following KMSAN errors: BUG: KMSAN: Uninitialized value in ocfs2filereaditer+0x9a4/0xf80; ocfs2filereaditer+0x9a4/0xf80; ioread+0x8d4/0x20f0;...

Astra Linux – vulnerability in linux-5.10

In the Linux kernel, the following vulnerability has been resolved: NFS: Fix potential buffer overflow in nfssysfslinkrpcclient The name field is defined as char64, while the size of clnt-clprogram-name remains unknown. Direct invocation of strcat can also result in a potential buffer overflow...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: NFSD: fix hang in nfsd4shutdowncallback If nfs4client is in a courtesy state, there is no reason to send the callback. This causes nfsd4shutdowncallback to hang, as clcbinflight is not set to 0. This hang lasts approximately 15...

Astra Linux – Vulnerability in Git

Git GUI allows you to use Git source control management tools through a graphical interface. When a user clones an untrusted repository and is tricked into editing a file located in a directory with a malicious name in the repository, Git GUI can create and overwrite files for which the user has...

Astra Linux – vulnerability in exim4

Exim 4 prior to version 4.94.2 allows execution with unnecessary privileges. Since Exim runs as root in the spool directory which is owned by a non-root user, an attacker can write to the /var/spool/exim4/input spool header file; a specially crafted recipient address in this file can then...

Astra Linux – Vulnerability in Chromium

Insufficient data validation in the File System API of Google Chrome prior to version 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions through a crafted HTML page...

Astra Linux – vulnerability in Firefox

An ambiguous file picker design might have confused users who intended to select and upload a single file by allowing them to upload an entire directory. This issue was resolved by adding a new prompt. This vulnerability affects Firefox versions prior to 85...

Astra Linux – vulnerability in Chromium

Insufficient policy enforcement in the Installer in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to perform local privilege escalation via a crafted file...

Astra Linux – Vulnerability in ntfs-3g

A properly crafted NTFS image can lead to a out-of-bounds read, caused by an invalid attribute in ntfsattrfindinattrdef, in NTFS-3G 2021.8.22...

Astra Linux – Vulnerability in ntfs-3g

A properly crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in ntfsgetattributevalue, in NTFS-3G 2021.8.22...

Astra Linux – Vulnerability in Firefox

The sourceMapURL feature in devtools lacked security checks, which would have prevented a webpage from attempting to include local files or other files that should be inaccessible. This vulnerability affects Firefox versions earlier than 99...

Astra Linux – vulnerability in curl

When curl 7.84.0 performs FTP transfers secured by krb5, it fails to properly handle message verification errors. This flaw allows Man-In-The-Middle attacks to go undetected and even enables attackers to inject data into the client...

Astra Linux – vulnerability in linux-5.10, linux-5.15, linux

In the Linux kernel, the following vulnerability has been resolved: NFSv4: Do not hold the layoutget locks across multiple RPC calls When performing layoutget as part of the open compound, we must be careful to release the layout locks before we can call any further RPC calls, such as setattr. Th...

Astra Linux – vulnerability in golang-1.15

In Go versions prior to 1.15.9 and 1.16.x prior to 1.16.1, encoding XML contains an infinite loop if a custom TokenReader used with xml.NewTokenDecoder returns EOF mid-element. This can happen in the Decode, DecodeElement, or Skip methods...