20376 matches found
Astra Linux – Vulnerability in Chromium
Type Confusion in V8 in Google Chrome before version 126.0.6478.54 allowed a remote attacker to potentially perform out-of-bounds memory access through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Yard
YARD is a Ruby documentation tool. The “frames.html” file within the Yard Doc’s generated documentation is vulnerable to Cross-Site Scripting XSS attacks due to inadequate sanitization of user input within the JavaScript segment of the “frames.erb” template file. This vulnerability has been fixed...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: nvmet: fixed a use-after-free issue. Fixed the following use-after-free complaint triggered by blktests nvme/004: BUG: KASAN: user-memory-access in blkmqcompleterequestremote+0xac/0x350 Read of size 4 at addr 0000607bd1835943 ...
Astra Linux – Vulnerability in Chromium
Insufficient policy enforcement in downloads in Google Chrome prior to 148.0.7778.96 allowed a local attacker to bypass navigation restrictions through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
The use of Mojo after free in Google Chrome before version 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Before version 148.0.7778.96, writing in Skia using Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to perform arbitrary read/write via a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Insufficient validation of untrusted input in Cast in Google Chrome prior to 148.0.7778.96 allowed an attacker on the local network segment to bypass the same-origin policy via malicious network traffic. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
Insufficient validation of untrusted input in DataTransfer in Google Chrome prior to version 148.0.7778.168 allowed a remote attacker who convinced a user to perform certain UI gestures to obtain potentially sensitive information from process memory through a crafted HTML page. Chromium security...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in Cast in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
Before version 147.0.7727.117, using "Use after free" in DevTools in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
The use of after free in MediaRecording in Google Chrome before version 148.0.7778.96 allowed a remote attacker who convinced a user to perform certain UI gestures to execute arbitrary code through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
The inappropriate implementation of navigation features in Google Chrome prior to version 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass site isolation through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Integer overflow in the Network component of Google Chrome prior to version 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Firefox and Thunderbird
JIT compilation errors in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...
Astra Linux – Vulnerability in Linux 5.10
Ubuntu Linux 6.8, 6.17, and 7.0 contain SAUCE patches that may include a NULL pointer dereferencing issue in the handling of AFINET/AFINET6 socket mediation. This bug can be triggered by an unprivileged local user, and it can lead to a kernel oops...
Astra Linux – Vulnerability in nss
When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; this resulted in the leakage of partial information regarding the nonce used during signature generation. Given an electro-magnetic trace from several generations of signatures, the private key could...
Astra Linux – Vulnerability in Linux, Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: comedi: vmk80xx: fixed transfer-buffer overflows The driver uses USB transfer buffers sized at the endpoint level, but until recently, there were no sanity checks on these buffer sizes. The commit e1f13c879a7c “staging: comedi...
Astra Linux – Vulnerability in jupyter-core
Jupyter Core is a package for the core common functionalities of Jupyter projects. Prior to version 4.11.2, Jupyter Core contained an arbitrary code execution vulnerability in “jupytercore,” which stemmed from “jupytercore” executing untrusted files in the CWD environment. This vulnerability...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: serial: imx: fix tx statemachine deadlock When using the serial port as a RS485 port, the tx statemachine is used to control the RTS pin to drive the RS485 transceiver’s TXEN pin. When the TTY port is closed mid-transmission e.g....
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: mm/secretmem: A panic occurs when growing a memfdsecret. When attempting to grow an existing memfdsecret using ftruncate, a panic occurs 1. For example, performing the following reliably will cause the panic: c fd = memfdsecret;...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: qcom: Fix potential memory leak The function dwc3qcomprobe allocates memory for the resource structure pointed by the parentres pointer. This memory is not freed, leading to a memory leak. Using stack memory can preven...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: ftrace: Fixed NULL pointer dereferencing in isftracetrampoline when ftrace is disabled. ftracestartup does not remove ops from ftraceopslist when ftracestartupenable fails: registerftracefunction ftracestartup...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation of Passkeys in Google Chrome prior to 140.0.7339.80 allowed a local attacker to obtain potentially sensitive information through debug logs. Chromium security severity: Low...
Astra Linux – Vulnerability in libslirp
An invalid pointer initialization issue was discovered in the SLiRP networking implementation of QEMU. The flaw resides in the tftpinput function and can occur when processing an UDP packet that is smaller than the size of the ‘tftpt’ structure. This issue may lead to out-of-bounds read access or...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fill the first free targets slot during auto-discovery Any invalid endpoint decoder pointer in the target array of an active region is not allowed by the cxl driver. This means that the cxl driver always assumes that...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: bnxt: Avoid overflow in bnxtgetnvramdirectory. The value of an arithmetic expression may be subject to overflow due to a failure to cast the operands to a larger data type before performing arithmetic operations. A macro was used...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: NFSv4/pnfs: A use-after-free bug has been fixed in open. If someone cancels the open RPC call, then we must not attempt to free either the open slot or the layoutget operation arguments, as they are likely still in use by the hun...
Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15
In the Linux kernel, the following vulnerabilities have been resolved: ocfs2: A memory leak has been fixed in ocfs2mountvolume. There is a memory leak reported by kmemleak: - Unreferenced object: 0xffff88810cc65e60 size 32 Command: “mount.ocfs2”, PID: 23753, Jiffies: 4302528942 Age: 34735.105s He...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: fixed a memory leak in sja1105setupdevlinkregions. When dsadevlinkregioncreate failed in sja1105setupdevlinkregions, priv-regions was not released...
Astra Linux – Vulnerability in Linux, Linux 5.15
A vulnerability has been identified in the Linux kernel and is classified as problematic. This vulnerability affects the function inet6streamops/inet6dgramops of the IPv6 Handler component. The vulnerability causes a race condition. It is recommended that a patch be applied to address this issue...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15
A use-after-free flaw was identified due to a race between the superblock operations in the gadgetfs Linux driver. This flaw could be triggered by removing a device that is running the gadgetfs side...
Astra Linux – Vulnerability in Golang-1.23
The net/url package does not limit the number of query parameters in a query. Although the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing man...
Astra Linux – Vulnerability in WebKit2GTK
A vulnerability related to out-of-bounds writes operations has been addressed through improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4, and iPadOS 15.8.4; iOS 16.7.11 and iPadOS 16.7.11; iOS 18.3.2 and iPadOS 18.3.2; iPadOS 17.7.6; macOS Sequoia...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: serial: sc16is7xx: Converted the raw to noinc versions of regmap functions for FIFO operations. The SC16IS7XX IC supports a burst mode for accessing FIFOs, where the initial register address is sent first $00$, followed by all th...
Astra Linux – Vulnerability in requests
The Requests library is an HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function used a predictable filename when extracting files from zip archives into the system’s temporary directory. If the target file already existed, it was reused without validation....
Astra Linux – Vulnerability in docker.io
Moby is an open-source container framework developed by Docker Inc., distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component, dockerd, which was originally developed as “moby/moby”, is commonly referred to as Docker. Swarm Mode ...
Astra Linux – Vulnerability in openjdk-11
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: Hotspot. The supported versions affected by this vulnerability are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK:...
Astra Linux – Vulnerability in openssl1.0
Calls to the EVPCipherUpdate, EVPEncryptUpdate, and EVPDecryptUpdate functions may cause the output length argument to overflow in some cases where the input length is close to the maximum permissible length for integers on the platform. In such cases, the return value from the function call will...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: USB: Gadget: pxa25xudc: fixed a memory leak that occurred when using debugfslookup. When calling debugfslookup, the result must be processed by calling dput; otherwise, a memory leak will occur over time. To simplify things, simp...
Astra Linux – Vulnerability in Ansible
A flaw was discovered in Ansible’s amazon.aws collection when using the towercallback parameter from the amazon.aws.ec2instance module. This flaw allows an attacker to exploit the issue, as the module handles the parameter insecurely, resulting in the password being leaked in the logs...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: media: mceusb: Use new usbcontrolmsg routines Automatic kernel fuzzing led to a WARN message regarding an invalid pipe direction in the mceusb driver: ------------ Cut here ------------ usb 6-1: BOGUS control dir, pipe 80000380...
Astra Linux – Vulnerability in Linux 5.10
A flaw in the Linux kernel’s implementation of the RDMA communication manager listener code allowed an attacker with local access to set up a socket to listen on a high port. This allowed for a memory element to be used after it was freed. With the ability to execute code, a local attacker could...
Astra Linux – Vulnerability in Linux
A flaw was discovered in the CAN BCM networking protocol within the Linux kernel. A local attacker can exploit this flaw in the CAN subsystem to corrupt memory, cause the system to crash, or escalate privileges. This race condition in the net/can/bcm.c file of the Linux kernel allows for local...
Astra Linux – Vulnerability in Thunderbird, Firefox
By confusing the browser, the fullscreen notification could have been delayed or suppressed, leading to potential user confusion or spoofing attacks. This vulnerability affects Firefox versions earlier than 108...
Astra Linux – Vulnerability in Firefox
Search queries in the default search engine might appear to be the currently navigated URL, provided that the search query itself is a properly formed URL. This could lead to a site spoofing another site, if it was maliciously set as the default search engine. This vulnerability affects Firefox...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: scsi: pm80xx: Avoid leaking tags when processing the OPCINBSETCONTROLLERCONFIG command. The tags allocated for the OPCINBSETCONTROLLERCONFIG command need to be freed when we receive the response...
Astra Linux – Vulnerability in WebKit2GTK
A logic issue was addressed through improved checks. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.1, macOS Ventura 13.1, iOS 16.2, and iPadOS 16.2, as well as watchOS 9.2. Processing maliciously crafted web content may disclose sensitive user information...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: netfilter: xtables: Fixed a block leak of the percpu counter on the error path when creating new netns. This issue occurs at the stack location where the percpu counter block is allocated: +- ip6tregistertable +- translatetable...