Astra Linux – Vulnerability in Firefox

Service workers may reveal the script-based base URL due to dynamic import. This vulnerability affects Firefox versions earlier than 113...

Astra Linux – Vulnerability in Chromium

Insufficient data validation in Blink Editing in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to inject arbitrary scripts or HTML via a crafted HTML page...

Astra Linux – Vulnerability in Firefox and Thunderbird

Module load requests that failed were not checked to determine whether they had been cancelled, resulting in a use-after-free in ScriptLoadContext. This vulnerability affects Firefox 110, Thunderbird 102.8, and Firefox ESR 102.8...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Serial in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in SVG in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in dovecot

The attacker can upload a malicious Sieve script through the ManageSieve service or locally to bypass the configured CPU time limits for Sieve up to 130 times the configured limit. This allows the attacker to degrade server performance and bypass the configured CPU time limits for Sieve scripts. ...

Astra Linux – Vulnerability in Golang-1.19

The html/template package does not properly handle HTML-like “” comment tokens, nor hashbang “!” comment tokens, in contexts. This may cause the template parser to incorrectly interpret the contents of contexts, resulting in actions being incorrectly escaped. This could be exploited to carry out ...

Astra Linux – Vulnerability in Firefox and Thunderbird

A crafted URL containing Arabic script and whitespace characters could potentially hide the true origin of the page, leading to a potential spoofing attack. This vulnerability affects Firefox 133, Firefox ESR 128.5, Thunderbird 133, and Thunderbird 128.5...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in MHTML in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Apache2

There is a vulnerability in the core of the Apache HTTP Server version 2.4.59 and earlier. This vulnerability allows for information disclosure, SSRF attacks, or local script execution through backend applications whose response headers are malicious or exploitable. Users are recommended to upgra...

Astra Linux - Vulnerability in Golang-1.23

If a trusted template author wrote a tag with an empty type attribute or a type attribute containing ASCII whitespace, the execution of the template would incorrectly escape any data passed into the block...

Astra Linux – Vulnerability in Chromium

In incorrect security user interfaces of web app installations in Google Chrome on Android before version 90.0.4430.212, an attacker who convinced a user to install a web application could inject scripts or HTML into a privileged page through a crafted HTML page...

Astra Linux – Vulnerability in unbound

Before version 1.9.5, Unbound allowed configuration injection in the createunboundadservers.sh script after a successful man-in-the-middle attack on a cleartext HTTP session. NOTE: The vendor does not consider this a vulnerability of the Unbound software. createunboundadservers.sh is a contribute...

Astra Linux – Vulnerability in hsqldb1.8.0, hsqldb

A flaw was discovered in the Libreoffice package. An attacker can create an odb file that contains a “database/script” file with a SCRIPT command. The contents of this file can then be written into a new file, whose location is determined by the attacker...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Insufficient data validation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. Chromium security severity: Medium...

Astra Linux – Vulnerability in dovecot

Dovecot has provided a script that can be used for attaching files during text conversion. However, this script handles zip-style attachments in a way that is unsafe. An attacker could use specially crafted OOXML documents to cause unintended files on the system to be indexed, thereby ending up i...

Astra Linux – Vulnerability in Samba

A flaw was discovered in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the “check password script” feature. If this script is configured with the %u substitution character, the client-controlled username is passed without...

Astra Linux – Vulnerability in Redis

Redis is an open-source, in-memory database that persists data on disk. A authenticated user may use a specially crafted Lua script to manipulate the garbage collector, potentially leading to remote code execution. This issue has been fixed in versions 7.4.2, 7.2.7, and 6.2.17. An additional...