210829 matches found
Astra Linux - vulnerability in oddjob
A race condition was found in the mkhomedir tool included with the oddjob package in versions prior to 0.34.5 and 0.34.6. During home creation, mkhomedir copies the /etc/skel directory into the newly created home and changes its ownership to the home’s user, without properly validating the homedi...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: netsched: clsflow: validate TCAFLOWRSHIFT attribute The syzbot found that the TCAFLOWRSHIFT attribute was not validated. Shifting a 32-bit integer is undefined for large shift values. UBSAN: Shift-out-of-bounds in...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: comedi: das16m1: Fix bit shift out of bounds When checking for a supported IRQ number, the following test is used: / Only IRQs 2, 3, 4, 5, 6, 7, 10, 11, 12, 14, and 15 are valid / if 1 options1 & 0xdcfc However, it-optionsi is an...
Astra Linux – Vulnerability in Tomcat9
There is a vulnerability related to improper input validation in Apache Tomcat. Tomcat did not restrict HTTP/0.9 requests to only the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, users could bypass this constraint on GET requests by...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: i40e: added validation for the ringlen parameter. The ringlen parameter provided by the virtual function VF is assigned directly to the hardware memory context HMC without any validation. To address this issue, a upper boundar...
Astra Linux – Vulnerability in Tomcat9
Improper input validation vulnerability. This issue affects Apache Tomcat: versions 11.0.0-M1 through 11.0.14, 10.1.0-M1 through 10.1.49, and 9.0.0-M1 through 9.0.112. The following versions were at the end of their support lifecycles at the time the CVE was created, but are still affected: 8.5.0...
Astra Linux – vulnerability in linux-6.1
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix buffer validation by including null terminator size in EA length The smb2setea function, which handles Extended Attributes EA, was performing buffer validation checks that incorrectly omitted the size of the null...
Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fwtracer, Validate format string parameters Add validation for format string parameters in the firmware tracer to prevent potential security vulnerabilities and crashes caused by malformed format strings received from...
Astra Linux – vulnerability in linux-5.15
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Validate index root when initialize NTFS security This enhances the sanity check for $SDH and $SII while initializing NTFS security, ensuring that these index roots are legitimate. 162.459513 BUG: KASAN: use-after-free ...
Astra Linux – vulnerability in linux-6.1
In the Linux kernel, the following vulnerability has been resolved: netfilter: nftobjref: validate objref and objrefmap expressions Referring to a synproxy stateful object from the OUTPUT hook causes a kernel crash due to infinite recursive calls: BUG: The TASK stack guard page was hit at...
Astra Linux – vulnerability in libsodium
libsodium prior to ad3004e, in atypical usage cases involving certain custom cryptography or untrusted data to cryptocoreed25519isvalidpoint, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren’t in the main cryptographic group...
Astra Linux – Vulnerability in Chromium
Insufficient validation of untrusted inputs in the Network component of Google Chrome before version 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
Insufficient validation of untrusted input in WebXR in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
Insufficient validation of untrusted input in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Insufficient validation of untrusted input in Navigation in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Improper input validation in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Improper input validation in the ServiceWorker mechanism in Google Chrome prior to version 152.0.7977.65 allowed a remote attacker to bypass system access restrictions through a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
Improper input validation in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...
Astra Linux – vulnerability in Chromium
Improper certificate validation in FedCM within Google Chrome prior to version 153.0.8010.36 allowed a remote attacker to exploit social engineering techniques to bypass web origin policies by sending specially crafted network traffic. Chromium security severity: Low...
Astra Linux – Vulnerability in gnutls28
A flaw was discovered in gnutls. When validating certificates, an excessively large Subject Alternative Name SAN could cause the validation process to incorrectly revert to checking the Common Name CN field. This could allow a remote attacker to bypass proper certificate validation, potentially...