Astra Linux – Vulnerability in emacs

GNU Emacs version 28.2 allows attackers to execute commands using shell metacharacters within the name of a source-code file. This is because the lib-src/etags.c file uses a system C library function in its implementation of the etags program. For example, a victim might use the “etags -u ” comma...

Astra Linux – Vulnerability in jsoup

jsoup is a Java library for working with HTML. Users of jsoup versions prior to 1.14.2 who parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user-supplied input, an attacker may provide content that causes the parser to become stuck loop indefinitely until...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Netty

The Snappy frame decoder function does not limit the chunk length, which can lead to excessive memory usage. In addition, it may also buffer reserved skipable chunks until the entire chunk is received, which can also result in excessive memory usage. This vulnerability can be exploited by providi...

Astra Linux – Vulnerability in JRuby

In versions of Ruby from 2.4.7, 2.5.x up to 2.5.6, and 2.6.x up to 2.6.4, code injection is possible if the first argument also known as the “command” argument passed to Shell or Shelltest in lib/shell.rb is untrusted data. An attacker can exploit this vulnerability to call arbitrary Ruby methods...

Astra Linux – Vulnerability in Pypy, Jython

The documentation XML-RPC server in Python, from versions 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4, has XSS vulnerabilities due to the servertitle field. This issue occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If the setservertitle function ...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to execute arbitrary code via user action in Devtools. Chromium security severity: Low...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: HID: asus: fixed UAF via HIDCLAIMEDINPUT validation After the hidhwstart function is called, hidinputconnect will eventually be called to configure the device with the input layer. This process involves processing all input and...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: xtensa: simdisk: added input size checking in procwritesimdisk A malicious user could potentially enter an arbitrarily bad value into memdupusernul, which might cause the kernel to crash. This follows the same pattern as the patc...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: bytcrrt5640 – Fixed invalid quirk input mapping. When an invalid value is passed via the quirk option, currently, the bytcrrt5640 driver only displays an error message but leaves the system unchanged. This may lead t...

Astra Linux – Vulnerability in libexif

LibExif through version 0.6.25 has a flaw in decoding MakerNotes. If the exifmnotedatagetvalue function receives a 0 size as input, the passed-in buffer will be overwritten due to an integer underflow...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate userq input args. This will assist in validating the userq input arguments and rejecting invalid userq requests during IOCTLs...

Astra Linux – Vulnerability in Raptor2

A malformed input file can lead to a segfault due to an out of bounds array access in raptorxmlwriterstartelementcommon...

Astra Linux – Vulnerability in CGal

There are multiple code execution vulnerabilities in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted, malformed file can lead to an out-of-bounds read and type confusion, which may result in code execution. An attacker can provide malicious input to trigger a...

Astra Linux – Vulnerability in Linux-Firmware

Improper input validation in some IntelR PROSet/Wireless WiFi and KillerTM WiFi software may allow an authenticated user to potentially enable escalation of privileges via local access...

Astra Linux – Vulnerability in CGal

There is a code execution vulnerability in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. There is also an oob read vulnerability in NefS2/SNCioparser.h: SNCioparser::readsface and storesmboundaryitem. A specially crafted malformed file can lead to an out-of-bounds read and typ...

Astra Linux – Vulnerability in exiv2

There is a vulnerable assertion in the Internal::TiffReader::visitDirectory function in tiffvisitor.cpp of Exiv2 0.26, which can lead to a remote denial-of-service attack due to malicious input...

Astra Linux – Vulnerability in Zabbix

The URL validation scheme receives input from a user and then parses it to identify its various components. This validation scheme ensures that all URL components comply with internet standards...

Astra Linux – Vulnerability in WebKit2GTK

A memory corruption issue has been resolved through improved input validation. This issue is fixed in Safari 18.1, iOS 18.1, iPadOS 18.1, macOS Sequoia 15.1, tvOS 18.1, visionOS 2.1, and watchOS 11.1. Processing maliciously crafted web content may lead to an unexpected process crash...

Astra Linux – Vulnerability in Tomcat9

There is a vulnerability related to improper input validation in Apache Tomcat Native and Apache Tomcat. When using an OCSP responder, Apache Tomcat Native and Tomcat’s FFM port of the Apache Tomcat Native code failed to perform verification or freshness checks on the OCSP response, allowing...