Astra Linux – Vulnerability in Firefox, Thunderbird

Incomplete handling of WebAssembly exceptions could lead to a use-after-free vulnerability. This vulnerability affects Firefox 129, Firefox ESR 115.14, Firefox ESR 128.1, Thunderbird 128.1, and Thunderbird 115.14...

Astra Linux – Vulnerability in Golang-1.15

In Go versions before 1.15.13 and 1.16.x, as well as before 1.16.5, certain configurations of ReverseProxy from net/http/httputil lead to a situation where an attacker can drop arbitrary headers...

Astra Linux – Vulnerability in Python-Django

A issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. Methods like QuerySet.annotate, QuerySet.alias, QuerySet.aggregate, and QuerySet.extra are vulnerable to SQL injection when column aliases are used, especially when a properly crafted dictionary is passed...

Astra Linux – Vulnerability in Linux

There is an information disclosure vulnerability in the ARM SIGPAGE functionality of the Linux Kernel v5.4.66 and v5.4.54. The latest version 5.11-rc4 appears to still be vulnerable. A userland application can read the contents of the sigpage, which may lead to the exposure of kernel memory...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Do not leak memory if devsetname fails. When devsetname fails, zcdncreate does not free the newly allocated resources. Fix this issue...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: JAXP. The supported versions affected by this vulnerability include Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK:...

Astra Linux – Vulnerability in qtbase-opensource-src

A issue was discovered in the private API function qDecodeDataUrl within QtCore, which is used in QTextDocument and QNetworkReply, and potentially in user code. If this function is called with malformed data—for example, a URL that contains a “charset” parameter without a value such as...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Oracle Java SE and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: Libraries. The supported versions affected include Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1, and 22.0.0.2. This easily...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Audit: Fixed a possible soft lockup in audit inode child. Tracefs or debugfs might cause hundreds to thousands of PATH records. Too many PATH records might lead to a soft lockup. For example: 1. CONFIGKASAN=y && CONFIGPREEMPTION=...

Astra Linux – Vulnerability in Thunderbird, Firefox

A race condition could have led to private browsing tabs being opened in regular browsing windows. This could have resulted in a potential privacy breach. This vulnerability has been fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135...

Astra Linux – Vulnerability in curl

Due to the use of a dangling pointer, libcurl versions 7.29.0 through 7.71.1 can use the wrong connection when sending data...

Astra Linux – Vulnerability in Firefox, Thunderbird

Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks were executed for those events. Web content that attempted to use those interfaces would not be able to do so with elevated privileges. However, the presence of these interfaces indicated...

Astra Linux – Vulnerability in Chromium

In Google Chrome, policy bypass in CORS before version 126.0.6478.54 allowed a remote attacker to bypass discretionary access control through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Munge

MUNGE is an authentication service for creating and validating user credentials. From version 0.5 to 0.5.17, local attackers could exploit a buffer overflow vulnerability in MUNGE the authentication daemon to leak cryptographic key material from process memory. With the leaked key material,...

Astra Linux – Vulnerability in Firefox

Under certain conditions, Firefox did not display a warning when a user attempted to navigate to a new protocol handler. This vulnerability affects Firefox versions earlier than 121...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: amdgpu: validated offsetinbo of drmamdgpugemva This issue arises due to OOB access in amdgpuvmupdaterange when offsetinbo + mapsize causes an overflow. v2: retained the validations for amdgpuvmbomap v3: added the validations t...

Astra Linux – Vulnerability in symfony

Symfony is a PHP framework for web and console applications, along with a set of reusable PHP components. Symfony’s HttpFoundation component defines an object-oriented layer for handling HTTP requests. Starting from version 2.0.0 and before versions 5.4.50, 6.4.29, and 7.3.7, the Request class...

Astra Linux – Vulnerability in Firefox and Thunderbird

Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in Oracle Java SE component: Hotspot. The supported versions affected are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4, and 23. This vulnerability is difficult to exploit; an unauthenticated attacker with network access via multiple protocols can compromise Oracle Jav...

Astra Linux – Vulnerability in curl

Curl versions 7.41.0 through 7.73.0 are vulnerable to a flaw related to improper checks for certificate revocation, due to insufficient verification of the OCSP response...