Astra Linux – Vulnerability in sysstat

In sysstat versions up to 12.7.2, there is a multiplication integer overflow in the checkoverflow function in common.c. NOTE: This issue exists due to an incomplete fix for CVE-2022-39377...

Astra Linux – vulnerability in linux-5.15

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Added null pointer check to attrloadrunsvcn Certain metadata files are processed prior to MFT. This includes a null pointer check for some edge cases that could lead to NPD when reading these metadata files from a...

Astra Linux – vulnerability in Imagemagick

A vulnerability was found in ImageMagick; it occurs when input crafted or untrusted is processed, resulting in values outside the valid range for unsigned long types in coders/pcl.c. This can lead to reduced application availability or other issues related to undefined behavior...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fat: Fix for uninitialized fields in nostale filehandles When the function fatencodefhnostale encodes a file handle without a parent handle, it only stores the first 10 bytes of the file handle. However, the length of the file...

Astra Linux – vulnerability in Chromium

Uninitialized data in PDFium in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted PDF file...

Astra Linux – Vulnerability in Firefox

The sourceMapURL feature in devtools lacked security checks, which would have prevented a webpage from attempting to include local files or other files that should be inaccessible. This vulnerability affects Firefox versions earlier than 99...

Astra Linux – Vulnerability in node-tar

The npm package “tar” also known as node-tar in versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has an arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent the extraction of absolute file paths by converting absolute paths into relative...

Astra Linux – vulnerability in exim4

Exim 4 prior to version 4.94.2 allows execution with unnecessary privileges. Since Exim runs as root in the spool directory which is owned by a non-root user, an attacker can write to the /var/spool/exim4/input spool header file; a specially crafted recipient address in this file can then...

Astra Linux – vulnerability in Firefox

An ambiguous file picker design might have confused users who intended to select and upload a single file by allowing them to upload an entire directory. This issue was resolved by adding a new prompt. This vulnerability affects Firefox versions prior to 85...

Astra Linux – vulnerability in Chromium

Insufficient policy enforcement in the Installer in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to perform local privilege escalation via a crafted file...

Astra Linux – Vulnerability in ntfs-3g

A properly crafted NTFS image can lead to a out-of-bounds read, caused by an invalid attribute in ntfsattrfindinattrdef, in NTFS-3G 2021.8.22...

Astra Linux – Vulnerability in ntfs-3g

A properly crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in ntfsgetattributevalue, in NTFS-3G 2021.8.22...

Astra Linux – vulnerability in linux-5.10, linux-5.15, linux

In the Linux kernel, the following vulnerability has been resolved: NFSv4: Do not hold the layoutget locks across multiple RPC calls When performing layoutget as part of the open compound, we must be careful to release the layout locks before we can call any further RPC calls, such as setattr. Th...

Astra Linux – vulnerability in golang-1.15

In Go versions prior to 1.15.9 and 1.16.x prior to 1.16.1, encoding XML contains an infinite loop if a custom TokenReader used with xml.NewTokenDecoder returns EOF mid-element. This can happen in the Decode, DecodeElement, or Skip methods...

Astra Linux – Vulnerability in libcommons-net-java

Prior to Apache Commons Net 3.9.0, Net’s FTP client trusted the host based on the PASV response by default. A malicious server could redirect the Commons Net code to use a different host, but the user had to connect to the malicious server in the first place. This could result in the leakage of...

Astra Linux – Vulnerability in rsync

A vulnerability was discovered in rsync prior to version 3.2.5. This vulnerability allows malicious remote servers to write arbitrary files into the directories of connecting peers. The server determines which files/directories are sent to the client. However, the rsync client lacks sufficient...

Astra Linux – vulnerability in ffmpeg

A use-after-free in the mpegmuxwritepacket function within libavformat/mpegenc.c in FFmpeg 4.2 can lead to a denial of service DOS by using a specially crafted AVI file...

Astra Linux – Vulnerability in imagemagick

A flaw was discovered in ImageMagick’s MagickCore/segment.c file. An attacker who submits a crafted file processed by ImageMagick could trigger undefined behavior, specifically a division by zero in mathematics. This likely results in a disruption to the application’s functionality, but it may al...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ipv6: fixed an error in ip6routenetexitlate During the initialization of ip6routenetinitlate, if the files ipv6route or rt6stats fail to be created, the initialization is successful by default. Therefore, the ipv6route or rt6stat...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel up to version 6.2.7, fs/ntfs3/inode.c contains an invalid kfree function because it does not validate the MFT flags before replaying logs...