Astra Linux – Vulnerability in exiv2

In Exiv2 versions 0.27.1, an uncontrolled memory allocation for PngChunk::parseChunkContent allows an attacker to cause a denial of service crash due to a std::badalloc exception through a crafted PNG image file...

Astra Linux – vulnerability in Pandoc

Pandoc is a Haskell library for converting between different markup formats, as well as a command-line tool that utilizes this library. Versions 1.13 and earlier up to 3.1.4 of Pandoc are vulnerable to a arbitrary file write issue. This vulnerability can be triggered by providing a specially...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ext4: Fix for a possible UAF Use-after-Write when remounting a read-only mmp-protected file system. After committing the change 618f003199c6 “ext4: Fix memory leak in ext4fillsuper”, there is a race condition where the kmmpd thre...

Astra Linux – vulnerability in orc

A stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked into processing a specially crafted file using the affected ORC compiler, arbitrary code may be executed on their build environment. This could result in compromise of...

Astra Linux – vulnerability in Chromium

Uninitialized data in PDFium in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted PDF file...

Astra Linux – Vulnerability in node-tar

The npm package “tar” also known as node-tar in versions prior to 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has a vulnerability related to arbitrary file creation/overwriting, due to insufficient symlink protection. node-tar aims to ensure that any file whose location would be modified by a symbolic link i...

Astra Linux – Vulnerability in node-tar

The npm package “tar” also known as node-tar in versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has an arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent the extraction of absolute file paths by converting absolute paths into relative...

Astra Linux – Vulnerability in libde265

libde265 v1.0.4 contains a heap buffer overflow vulnerability in the mmloadlepi64 function, which can be exploited through a specially crafted file...

Astra Linux – vulnerability in Chromium

The lack of authorization checks in the Storage API within Google Chrome prior to version 153.0.8010.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation by using a specially crafted PDF file. Chromium security severity: Medium...

Astra Linux – Vulnerability in python-git

GitPython before version 3.1.51 fails to protect against dangerous Git options passed as keyword arguments in Repo.archive and git.lsremote. This allows command injection through options such as --exec/--upload-pack, leading to arbitrary command execution. Additionally, Repo.itercommits and...

Astra Linux – vulnerability in linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate rec-used in journal-replay file record check checkfilerecord validates rec-total against the record size but never validates rec-used. The doaction journal-replay handlers read rec-used from disk and use it to...

Astra Linux – vulnerability in linux-5.15

In Linux kernel 6.0.8, there is a use-after-free in ntfstrimfs in fs/ntfs3/bitmap.c...

Astra Linux – vulnerability in Imagemagick

A vulnerability was found in ImageMagick; it occurs when input crafted or untrusted is processed, resulting in values outside the valid range for unsigned long types in coders/pcl.c. This can lead to reduced application availability or other issues related to undefined behavior...

Astra Linux – Vulnerability in cifs-utils

It was discovered that cifs-utils’ mount.cifs function invoked a shell when requesting the Samba password, which could be exploited to inject arbitrary commands. An attacker who had special permissions, such as those through sudo rules, could use this vulnerability to escalate their privileges...

Astra Linux – vulnerability in exim4

Exim 4 prior to version 4.94.2 allows execution with unnecessary privileges. Since Exim runs as root in the log directory which is owned by a non-root user, a symlink or hard link attack can overwrite critical files owned by root at any location on the filesystem...

Astra Linux – Vulnerability in exim4

Exim 4 before 4.94.2 allowed execution with unnecessary privileges. The -oP option is available to the exim user, and it could lead to a denial of service, as files owned by root could be overwritten...

Astra Linux - vulnerability in linux

In the Linux kernel, the following vulnerability has been resolved: NFS: Do not corrupt the value of pgbyteswritten in nfsdorecoalesce The value of mirror-pgbyteswritten should only be updated after a successful attempt to flush out the requests on the list...

Astra Linux – Vulnerability in pillow

In Pillow before 8.1.2, attackers can cause a denial of service due to excessive memory consumption. This occurs because the reported size of the contained image is not properly checked for an ICO container. As a result, a memory allocation attempt can be quite large...

Astra Linux – Vulnerability in DjVuLibre

A flaw was discovered in djvulibre-3.5.28 and earlier. A malicious read operation in the function DJVU::DataPool::hasdata, through a crafted djvu file, may cause the application to crash and lead to other issues...

Astra Linux – vulnerability in linux, linux-5.10

In the Linux kernel, the following vulnerability has been resolved: cifs: prevent NULL deref in cifscomposemountoptions The optional @ref parameter might contain a NULL nodename; therefore, prevent dereferencing it in cifscomposemountoptions. Addresses-Coverage: 1476408 “Explicit null dereference...