Astra Linux – Vulnerability in SQLite3

In SQLite 3.30.1, selectExpander in select.c continues with the WITH stack unwinding process even after a parsing error occurs...

Astra Linux – Vulnerability in Chromium

In COOP mode in Google Chrome prior to version 98.0.4758.80, it was possible for a remote attacker to bypass the iframe sandbox through a crafted HTML page...

Astra Linux – Vulnerability in Squid

Versions of Squid before 4.15 and 5.x before 5.0.6 allowed remote servers to cause a denial of service, affecting the availability of all clients through an HTTP response. The issue is triggered by a header that is expected to exist in HTTP traffic, without any malicious intent on the part of the...

Astra Linux – Vulnerability in dcmtk

There is an incorrect type conversion vulnerability in the DVPSSoftcopyVOIPList::createFromImage function of OFFIS DCMTK 3.6.8. A specially crafted, malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to exploit this vulnerability...

Astra Linux – Vulnerability in Chromium

The use of After Free in Media in Google Chrome before version 149.0.7827.53 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ksmbd: discard write access to the directory open The mayopen function does not allow a directory to be opened with write access. However, certain write flags set by clients result in adding write access on the server, making...

Astra Linux – Vulnerability in Chromium

The use of after-free in the Network mechanism in Google Chrome before version 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption through malicious network traffic. Chromium security severity: Medium...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: l2tp: avoided a data race in l2tptunneldelwork We should only access sk-sksocket when dealing with kernel sockets. syzbot reported the following data race: BUG: KCSAN: data race in l2tptunneldelwork / skcommonrelease Task 5365...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted inputs in Google Chrome’s Enterprise Reporting before version 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Firefox and Thunderbird

Using tables within an iframe, an attacker could cause the iframe contents to be rendered outside the boundaries of the iframe, leading to potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR 102.5, Thunderbird 102.5, and Firefox 107...

Astra Linux – Vulnerability in Chromium

Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

The poor implementation of the Loader component in Google Chrome before version 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Node.js

Node.js versions prior to 16.6.1, 14.17.5, and 12.22.5 are vulnerable to a “use after free” attack, where an attacker could exploit memory corruption to alter the behavior of the process...

Astra Linux – Vulnerability in Linux

A heap out-of-bounds write that affects Linux since v2.6.19-rc1 was discovered in net/netfilter/xtables.c. This vulnerability allows an attacker to gain privileges or cause a Denial-of-Service attack through heap memory corruption by manipulating the user name space...

Astra Linux – Vulnerability in poppler-22, poppler

In Poppler 22.07.0, the PDFDoc::savePageAs function in PDFDoc.c allows attackers to cause a denial-of-service attack the application crashes with SIGABRT by manipulating a PDF file in which the xref data structure is improperly handled during the getCatalog process. Note that this vulnerability i...

Astra Linux – Vulnerability in Firefox, NSS

When the memory resources are nearly exhausted, an elliptic curve key that was never allocated can be reclaimed. This vulnerability affects Firefox 128 and Thunderbird 128...

Astra Linux – Vulnerability in Nasm

In Netwide Assembler NASM 2.15rc10, the SEGV condition can be triggered in toktext within asm/preproc.c by accessing the READ memory...

Astra Linux – Vulnerability in Ansible

A vulnerability was discovered in Ansible Engine 2.x up to 2.8, and in Ansible Tower 3.x up to 3.5. When a module has an argumentspec with sub parameters marked as nolog, passing an invalid parameter name to the module will cause the task to fail before the nolog options in the sub parameters are...

Astra Linux – Vulnerability in python-pip

The pip package before version 19.2 for Python allows Directory Traversal when a URL is provided in an install command. This is possible because the Content-Disposition header can contain "../ in the filename, as demonstrated by overwriting the /root/.ssh/authorizedkeys file. This behavior occurs...

Astra Linux – Vulnerability in Wireshark

In Wireshark versions 3.0.0 to 3.0.3, and 2.6.0 to 2.6.10, the Gryphon dissector could enter an infinite loop. This issue was addressed in the plugin file plugins/epan/gryphon/packet-gryphon.c by checking for a packet length of zero...