Astra Linux – Vulnerability in Flatpak

Flatpak is a Linux application sandboxing and distribution framework. Prior to version 1.16.4, the Flatpak portal allowed paths to be specified in the “sandbox-expose” options. These paths could be app-controlled symbolic links that pointed to arbitrary locations. When a Flatpak application was...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: Synchronize devfreqmonitorstart/stop There is a risk that frequent changes to the governor, performed in a loop, may lead to corruption of the timer list. Specifically, the timer cancellation process, which occurs...

Astra Linux – Vulnerability in Batik

A server-side request forgery SSRF vulnerability exists in Apache Software Foundation Apache XML Graphics Batik. This issue affects Apache XML Graphics Batik version 1.16. In version 1.16, a malicious SVG file may trigger the loading of external resources by default, leading to resource consumpti...

Astra Linux – Vulnerability in Vim

NULL pointer dereferencing in the function vimregexecstring at regexp.c:2729 in the GitHub repository vim/vim, prior to version 8.2.4901. NULL pointer dereferencing in function vimregexecstring at regexp.c:2729 allows attackers to cause a denial of service application crash through crafted inputs...

Astra Linux – Vulnerability in unbound

Unbound before version 1.9.5 can cause assertion failures and denial of service in synthcname. NOTE: The vendor denies that this is a vulnerability. Although the code may be vulnerable, an active UnBound installation cannot be exploited remotely or locally...

Astra Linux – Vulnerability in Chromium

The use of “after free” in Peer Connection in Google Chrome before version 106.0.5249.119 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in dcmtk

A vulnerability was detected in DCMTK up to version 3.6.7. The affected element is the function DcmQueryRetrieveConfig::readPeerList in the file /dcmqrcnf.cc of the component dcmqrscp. This vulnerability results in a null pointer dereference. The attack can be carried out locally. The exploit is...

Astra Linux – Vulnerability in Vim

Use After Free in the GitHub repository vim/vim before version 9.0.1858...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the Network of Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the utility process to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in hdf5

The HDF5 library from version 1.14.3 has memory corruption in the H5Aclose function, which results in the corruption of the instruction pointer. This causes a denial of service or potentially leads to code execution...

Astra Linux – Vulnerability in cyrus-sasl2

In Cyrus SASL 2.1.17 through 2.1.27 up to 2.1.28, the plugins/sql.c file does not escape the password used in SQL INSERT or UPDATE statements...

Astra Linux – Vulnerability in Chromium

Integer overflow in Skia in Google Chrome prior to version 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in libpng1.6

LIBPNG is a reference library used in applications that read, create, and manipulate PNG Portable Network Graphics raster image files. Prior to version 1.6.51, there was a heap buffer over-read vulnerability in the libpng’s pngdoquantize function when processing PNG files with malformed palette...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Handle the return value of hdrfirstde The hdrfirstde function returns a pointer to a struct NTFSDE. This pointer may be NULL. To effectively handle the NULL error, it is important to implement an error handler. This wil...

Astra Linux – Vulnerability in Chromium

Accessing the V8 engine in Google Chrome before version 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

The use of uninitialized variables in Google Chrome prior to version 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Tomcat9

The “Allocation of Resources Without Limits or Throttling” vulnerability in Apache Tomcat exists. This issue affects Apache Tomcat versions from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, and from 9.0.0.M1 through 9.0.105. The following versions were already at the end of their...

Astra Linux – Vulnerability in Chromium

A heap buffer overflow in Media in Google Chrome prior to version 145.0.7632.109 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in DirectSockets in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform arbitrary read/write via a crafted Chrome Extension. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

In the UI framework of Google Chrome, using “after free” before version 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...