Astra Linux – Vulnerability in imagemagick

In the IntensityCompare function within /MagickCore/quantize.c, a double value was being converted to an int and then returned. In some cases, this resulted in a value that was outside the range of the type int. This flaw could be triggered by a malicious input file under certain conditions when...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

A issue was discovered in the drivers/input/input.c file within the Linux kernel before version 5.17.10. An attacker can cause a denial of service panic if inputsetcapability mishandles situations where an event code falls outside of a bitmap...

Astra Linux – Vulnerability in Thrift

In Apache Thrift versions 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when receiving invalid input data...

Astra Linux – Vulnerability in openexr

A flaw was discovered in OpenEXR’s TiledInputFile functionality. This flaw allows an attacker who can submit a crafted single-part non-image file to have it processed by OpenEXR, resulting in a floating-point exception error. The greatest threat posed by this vulnerability is to system availabili...

Astra Linux – Vulnerability in Twig

Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates whose names are user-inputs. It’s possible to use the source or include statement to read arbitrary files from outside the...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Prevent buffer overflow crashes in debugfs due to malformed user input. Malformed user input to debugfs can lead to buffer overflow crashes. It is necessary to adjust the length of the input string to fit within the...

Astra Linux – Vulnerability in libjettison-java

Those who use Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks DOS. If the parser runs on user-supplied input, an attacker may provide content that causes the parser to crash due to a stack overflow. This vulnerability could facilitate a Denial of Servic...

Astra Linux – Vulnerability in openjpeg2

There is a flaw in openjpeg in versions prior to 2.4.0, located in src/lib/openjp2/pi.c. When an attacker can provide crafted input that is processed by the openjpeg encoder, it may lead to an out-of-bounds read. The most significant impact of this flaw is the application’s availability...

Astra Linux – Vulnerability in binutils

GNU binutils gold gold v1.11-v1.16 GNU binutils v2.21-v2.31.1 is affected by: Improper input validation, signed/unSigned comparison, out-of-bounds reading. The impact is: Denial of service. The component involved is: gold/fileread.cc:497, elfcpp/elfcppfile.h:644. The attack vector is: An ELF file...

Astra Linux – Vulnerability in pygments

In pygments 1.1+ and fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of these regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS attacks. By introducing malicious input, an attacker can cause a...

Astra Linux – Vulnerability in netcdf

A issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxmldecode, when parsing a crafted XML file, performs incorrect memory handling, resulting in a NULL pointer being dereferenced while running strlen on a NULL pointer...

Astra Linux – Vulnerability in Python-Django

A issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, as well as the AdminURLFieldWidget widget, are susceptible to a potential denial-of-service attack due to certain inputs containing a very large number of Unicode characters...

Astra Linux – Vulnerability in libslirp

An invalid pointer initialization issue was discovered in the SLiRP networking implementation of QEMU. The flaw exists in the udp6input function and can occur when processing an UDP packet that is smaller than the size of the ‘udphdr’ structure. This issue may lead to out-of-bounds read access or...

Astra Linux – Vulnerability in Chromium

Side-channel information leakage in keyboard input in Google Chrome prior to 104.0.5112.79 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to version 104.0.5112.101 allowed a remote attacker to arbitrarily browse to a malicious website via a crafted HTML page...

Astra Linux – Vulnerability in libxstream-java

XStream is a simple library for serializing objects to XML and back again. In affected versions, this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available, by manipulating the processed input stream with a Java runtime version 14 to 8. ...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in Mojo in Google Chrome prior to 90.0.4430.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page...

kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report()

A flaw was found in the Linux kernel's Bluetooth Human Interface Device Protocol HIDP. A remote attacker, by sending specially crafted truncated packets from a paired Bluetooth device, could trigger an out-of-bounds read in the hidpinputreport function. This vulnerability may lead to unintended...

kernel: wifi: nl80211: reject oversized EMA RNR lists

A flaw was found in the Linux kernel's nl80211 Wi-Fi subsystem. The nl80211parsernrelems function, responsible for parsing EMA RNR Enhanced Multiple Access Reduced Neighbor Report lists, does not properly handle an excessive number of nested NL80211ATTREMARNRELEMS inputs. This improper input...

kernel: wifi: cfg80211: validate PMSR FTM preamble range

A flaw was found in the cfg80211 component of the Linux kernel's Wi-Fi subsystem. This vulnerability allows the PMSR FTM request parser to accept preamble values outside the defined nl80211 range. An attacker could exploit this by providing malformed input, potentially leading to unexpected syste...