Astra Linux – vulnerability in exempi

The XMP Toolkit SDK version 2020.1 and earlier is affected by an Improper Input Validation vulnerability that may lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction; a victim must open a specially crafted file...

Astra Linux – Vulnerability in ffmpeg

A buffer overflow vulnerability exists in FFmpeg 4.2 in the movwritevideotag function, due to an out-of-bounds access in the libavformat/movenc.c file. This vulnerability could allow a remote malicious user to obtain sensitive information, cause a Denial of Service, or execute arbitrary code...

Astra Linux – Vulnerability in ntfs-3g

A properly crafted NTFS image can lead to a out-of-bounds read in ntfsrunlistsmergei in NTFS-3G 2021.8.22...

Astra Linux – vulnerability in tar

A TOCTOU Time-of-Check Time-of-Use vulnerability in GNU tar’s incremental dumpdir ‘X’ rename handling allows a local attacker with write access to a directory being backed up to influence the restore process, provided the attacker has access to the system where the restore is being performed...

Astra Linux – vulnerability in linux, linux-5.10

In the Linux kernel prior to version 5.15.3, fs/quota/quotatree.c fails to validate the block number within the quota tree on disk. This can, for instance, result in a kernel/locking/rwsem.c use-after-free condition if a corrupted quota file exists...

Astra Linux – Vulnerability in libde265

It was discovered that Libde265 v1.0.8 contains a heap-buffer-overflow vulnerability through the putepel16fallback in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service DoS attack using a specially crafted video file...

Astra Linux – Vulnerability in libde265

There is an incorrect access control vulnerability in libde265 v1.0.8 due to a SEGV in slice.cc...

Astra Linux – Vulnerability in libde265

It was discovered that Libde265 v1.0.8 contains a heap-buffer-overflow vulnerability through the use of putqpelfallback in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service DoS attack using a specially crafted video file...

Astra Linux – vulnerability in libde265

LibDe265 v1.0.4 contains a heap buffer overflow in the mcchroma function, which can be exploited via a specially crafted file...

Astra Linux – vulnerability in linux-5.10, linux-5.15, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix a NULL pointer dereference when failed to start a new transaction BUG Syzbot reported a NULL pointer dereference with the following crash: FAULTINJECTION: forcing a failure. starttransaction+0x830/0x1670...

Astra Linux – vulnerability in faad2

An issue was found in faad2 up to version 2.10.0. A heap buffer overflow exists in the ltprediction function located in ltpredict.c. This allows an attacker to trigger code execution...

Astra Linux – vulnerability in ntfs-3g

A crafted NTFS image can cause out-of-bounds reads in ntfsattrfind and ntfsexternalattrfind in NTFS-3G versions prior to 2021.8.22...

Astra Linux – vulnerability in sox

The readsamples function in hcom.c within Sound eXchange SoX 14.4.2 enables remote attackers to cause a denial of service invalid memory read and application crash by using a specially crafted hcom file...

Astra Linux – vulnerability in linux, linux-5.10

An issue was found in fs/nfs/dir.c within the Linux kernel prior to version 5.16.5. When an application sets the ODIRECTORY flag and attempts to open a regular file, nfsatomicopen performs a standard lookup. If a regular file is found, ENOTDIR should be returned; however, the server instead retur...

Astra Linux – Vulnerability in python-git

GitPython versions before 3.1.54 contain a vulnerability where an arbitrary file overwrite is possible, due to a flaw in the Diffable.diff method. This method fails to validate git options passed through thekwargs parameter. Attackers can provide the --output argument via another parameter, or us...

Astra Linux – vulnerability in lxml

Lxml is a library for processing XML and HTML in Python. Prior to version 6.1.0, using either of the two parsers with the default configuration with resolveentities=True allowed untrusted XML input to read local files. Setting the resolveentities option explicitly to resolveentities='internal' or...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: bfs: Reconstruct file type when loading from disk SyZBot reports that the SIFMT bits in inode-imode may become invalid when the 32-bit “mode” field loaded from disk is corrupted, or when the 32-bit “attributes” field loaded from...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix reflink preserve cleanup issue Commit c06c303832ec “ocfs2: fix xattr array entry countedby error” does not handle all cases and fails to properly clean up preserved xattr entries. Still contains bugs: - The ‘last’...

Astra Linux – vulnerability in Chromium

Insufficient validation of untrusted input in Codecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially perform out of bounds memory access via a crafted video file. Chromium security severity: Low...

Astra Linux – vulnerability in linux-5.10, linux-5.15, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ext4: detect invalid INLINEDATA + EXTENTS flag combination SyZBot reported a BUGON in ext4escacheextent when opening a verity file on a corrupted ext4 filesystem mounted without a journal. The issue is that the filesystem has an...