Astra Linux – Vulnerability in Tomcat9

There is a vulnerability related to improper input validation in Apache Tomcat. This issue affects Apache Tomcat versions as follows: 11.0.0-M1 through 11.0.21, 10.1.0-M1 through 10.1.54, 9.0.0.M1 through 9.0.117, and 10.0.0-M1 through 10.0.27. Older, end-of-support versions may also be affected...

Astra Linux – Vulnerability in binutils

Heap-based Buffer Overflow in the bfdgetl32 function in Binutils objdump 3.37...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: A memory leak has been fixed in the error-handling path of idxdalloc. The memory allocated for idxd is not freed if an error occurs during idxdalloc. To fix this issue, free the allocated memory in the reverse...

Astra Linux – Vulnerability in wpa

A vulnerability was discovered in the way p2p/p2ppd.c in wpasupplicant processes P2P Wi-Fi Direct provision discovery requests before version 2.10. This could lead to denial of service or other impacts, potentially including the execution of arbitrary code, if an attacker is within range of the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: powerpc/rtas: Prevent Spectre v1 gadget construction in sysrtas. Smatch warns: arch/powerpc/kernel/rtas.c:1932 dosysrtas warning: potential Spectre issue with ‘args args’ r local limit The ‘nargs’ and ‘nret’ locals originate from...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the Actor component of Google Chrome prior to version 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in poppler, poppler-22

A floating-point exception in the PSStack::roll function of Poppler before version 25.04.0 can cause an application to crash when handling malformed inputs associated with INTMIN...

Astra Linux – Vulnerability in Chromium

The use of after free in ANGLE in Google Chrome before version 92.0.4515.159 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerability in advancecomp

It was discovered that Advancecomp v2.3 contains a heap buffer overflow issue through the leuint32read function in /lib/endianrw.h...

Astra Linux – Vulnerability in hdf5

The HDF5 Library from version 1.14.3 has a heap-based buffer over-read issue in the H5VMcopyvv function within H5VM.c invoked from H5Dcompactreadvv in H5Dcompact.c...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in the Network section of Google Chrome before version 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to leak cross-origin data through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

The use of after-free in the Network mechanism in Google Chrome before version 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in docker.io-app

Docker Compose relies on the path information embedded in remote OCI Compose artifacts. When a layer includes the annotations com.dockercompose.extends or com.dockercompose.envfile, Compose incorporates the value provided by the attacker from com.dockercompose.file/com.dockercompose.envfile into...

Astra Linux – Vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a missing bounds check in smartcardunpackreadsizealign libfreerdp/utils/smartcardpack.c:1703 allowed a malicious RDP server to crash the FreeRDP client through a reachable WINPRASSERT → abort mechanism. This...

Astra Linux – Vulnerability in libxstream-java

XStream is software used for serializing Java objects into XML and back again. A vulnerability exists in XStream versions prior to 1.4.17, which may allow a remote attacker with sufficient rights to execute commands on the host by manipulating the input stream being processed. However, users who...

Astra Linux – Vulnerability in Chromium

Using the "after free" mechanism in the File API in Google Chrome before version 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerability in Gegl

The loadcache function in GEGL before version 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. This issue arises due to the use of the system library function for executing the ImageMagick convert fallback in magick-load. NOTE: GEGL versions...

Astra Linux – Vulnerabilities in Firefox, Thunderbird, Rust-Regex

Regex is an implementation of regular expressions for the Rust language. The regex crate includes built-in measures to prevent denial-of-service attacks caused by untrusted regexes or untrusted inputs matched by trusted regexes. These measures already provide reasonable defaults to prevent attack...

Astra Linux – Vulnerability in Chromium

The use of “after free” in Extensions in Google Chrome before version 149.0.7827.155 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption through a crafted Chrome Extension. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

The use of after-free in V8 in Google Chrome before 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. Chromium security severity: Medium...