Astra Linux – Vulnerability in Chromium

Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: binder: A check for offset alignment was added in bindergetobject. Commit 6d98eb95b450 “binder: avoid potential data leakage when copying txn” introduced changes to the way binder objects are copied. As a result, the offset...

Astra Linux – Vulnerability in Python 3.11, Python 3.7

The poplib module, when a user-controlled command is passed to it, can have additional commands injected using newlines. Mitigation rejects commands that contain control characters...

Astra Linux – Vulnerability in exempi

The XMP Toolkit version 2020.1 and earlier versions is affected by a memory corruption vulnerability, which may lead to the execution of arbitrary code within the context of the current user. User interaction is required to exploit this vulnerability...

Astra Linux – Vulnerability in Zabbix

A non-administrator user account on the Zabbix frontend, with the default User role, or any other role that grants API access, can exploit this vulnerability. There is an SQL injection vulnerability in the CUser class within the addRelatedObjects function. This function is called from the CUser.g...

Astra Linux – Vulnerability in Zabbix

A authenticated user with API access e.g., a user with the default User role can be added to any group e.g., Zabbix Administrators. Specifically, a user with access to the user.update API endpoint can be added to any group, except for groups that are disabled or have restricted GUI access...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ublkdrv: A NULL pointer dereference issue was fixed in ublkctrlstartrecovery. When two UBLKCMDSTARTUSERRECOVERY commands are submitted, the first one sets ‘ubq-ubqdaemon’ to NULL, and the second one triggers a WARN in...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: Do not allow an ‘F’ entry to pin its own instance. An entry registered with ‘F’ opens its interpreter at the time of registration and holds that file until the entry is freed. Any entry that is manually removed is onl...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: s390/monwriter: Rejection of buffer reuse with different data lengths When data buffers are reused, for example, for interval sample records, the data length of the first record determines the data length of the buffer for user...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fbdev: smscufx – The data passed through ioctl is copied to the kernel’s space properly. The UFXIOCTLREPORTDAMAGE ioctl does not copy data from user space to the kernel’s space properly. Instead, it directly references the memory...

Astra Linux – Vulnerability in Linux

A heap out-of-bounds write that affects Linux since v2.6.19-rc1 was discovered in net/netfilter/xtables.c. This vulnerability allows an attacker to gain privileges or cause a Denial-of-Service attack through heap memory corruption by manipulating the user name space...

Astra Linux – Vulnerability in Qemu

The ethgetgsotype function in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure. A guest can crash the QEMU process by sending packet data that lacks a valid Layer 3 protocol...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: BPF: The unnecessary user-triggable WARNONCE message in the verifier log was removed. It is trivial for a user to trigger the “verifier log line truncated” warning. The verifier has a fixed-size buffer of 1024 bytes currently...

Astra Linux - Vulnerability in Golang-1.19

If errors returned from MarshalJSON methods contain user-controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates...

Astra Linux – Vulnerability in Samba

A flaw was discovered in the Samba AD LDAP server. The AD DC database audit logging module can access values of LDAP messages freed by a preceding database module, leading to a use-after-free issue. This issue only occurs when certain privileged attributes are modified, such as userAccountControl...

Astra Linux – Vulnerability in Chromium

Inappropriate implementations in Downloads in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to perform certain UI gestures to bypass download protections through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Payments in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in OpenSSH

In OpenSSH versions prior to 10.3, a file downloaded using scp might be installed with setuid or setgid permissions, which contradicts some users’ expectations. This occurs when the download is performed as the root user with the -O legacy scp protocol option, and without the -p preserve mode...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in MHTML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Downloads in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...