20387 matches found
Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Added a sanity check for the file name. The length of the file name should be smaller than the directory entry size...
Astra Linux – Vulnerability in libfile-find-rule-perl
File::Find::Rule in Perl version 0.34 is vulnerable to arbitrary code execution when grep encounters a crafted filename. A file handle is opened using the 2-argument form of open, allowing an attacker-controlled filename to specify the MODE parameter, thereby turning the filename into an executab...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: crypto: lib/mpi – avoid null pointer dereference in mpicmpui During NVMeTCP authentication, a controller can trigger a kernel oops by specifying the 8192-bit Diffie Hellman group and passing a correctly sized, but zeroed Diffie...
Astra Linux – Vulnerability in Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: ax25: Fixing use-after-free bugs caused by ax25dsdeltimer. When the ax25 device is being detached, the ax25devdevicedown function calls ax25dsdeltimer to clean up the slavetimer. When the timer handler is running, the...
Astra Linux – Vulnerability in freerdp3, freerdp2
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.22.0, there was a NULL pointer dereference vulnerability in rdpwritelogoninfov2. This vulnerability allowed a malicious RDP server to crash the FreeRDP proxy by sending a specially crafted LogonInfoV2 PDU with...
Astra Linux – Vulnerability in openjdk-11
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. The supported versions affected by this vulnerability are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4, and 22.3.0...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: AppArmor: Fixed the issue where an unprivileged local user could perform privileged policy management. An unprivileged local user can load, replace, and remove policies by opening the AppArmor interfaces. This can be achieved...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1
In the Linux kernel, the following vulnerabilities have been resolved: ocfs2: fixed the issue with preserving cleanup for reflinks. The commit c06c303832ec “ocfs2: fixed the error where xattr array entries were not properly handled” does not handle all cases, and the cleanup of preserved xattr...
Astra Linux – Vulnerability in Apache2
Apache HTTP Server versions 2.4.0 to 2.4.46: A specially crafted Digest nonce can cause a stack overflow in modauthdigest. There is no report of this overflow being exploitable, nor can the Apache HTTP Server team have created such a report. However, certain compilers and/or compilation options...
Astra Linux – Vulnerability in binutils
The stabxcoffbuiltintype function in stabs.c within the GNU Binutils from version 2.37 allows attackers to cause a denial of service attack due to a heap-based buffer overflow. It is also possible that other unspecified impacts may occur, as demonstrated by an out-of-bounds write vulnerability...
Astra Linux – Vulnerability in giflib
Giflib contains a double-free vulnerability, which is caused by a shallow copy in GifMakeSavedImage and incorrect error handling. The conditions necessary to trigger this vulnerability are complex, but it may still occur...
Astra Linux – Vulnerability in Node-EJS
The ejs also known as Embedded JavaScript templates package version 3.1.6 for Node.js enables server-side template injection in settings view optionsoutputFunctionName. This is parsed as an internal option, and the outputFunctionName option is overwritten with an arbitrary OS command which is...
Astra Linux – Vulnerability in Linux 6.12
In the Linux kernel, the following vulnerabilities have been resolved: eventpoll: Fixed an UAF Use-After-Free in epremovestruct eventpoll, struct file. epremove via epremovefile clears file-fep under file-flock, but then continues using @file within the critical section isfileepoll, hlistdelrcu,...
Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: i40e: Fixed DMA mapping leaks During the reallocation of RX buffers, new DMA mappings are created for those buffers. Reproduction steps: While doing the following: Do For i=0; i=8160; i=i+32 Do ethtool -G enp130s0f0 rx $i tx $...
Astra Linux – Vulnerability in Vim
Heap-based Buffer Overflow in the GitHub repository vim/vim before version 8.2.4968...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: UBLK: Failure to recover a device if queue setup is interrupted. In ublkctrlendrecovery, if waitforcompletioninterruptible is interrupted by a signal, the queues are not set up successfully. Therefore, we must fail the...
Astra Linux – Vulnerability in openjdk-11
Vulnerability in the Oracle Java SE and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: Scripting. The supported versions affected by this vulnerability are Oracle Java SE: 8u451, 8u451-perf, and 11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14. The vulnerability is...
Astra Linux – Vulnerability in Apache2
Delayed memory release after the effective lifetime vulnerability in the Apache HTTP Server. This issue affects the Apache HTTP Server: from version 2.4.17 up to 2.4.63. Users are recommended to upgrade to version 2.4.64, which fixes this issue...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: PCI: Endpoint: Fixed incorrect parameter order in functions pciprimary/epcepfunlink and pcisecondary/epcepfunlink. The callbacks for struct configfsitemoperations are defined as follows: c int allowlinkstruct configitem src, stru...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: can: kvaserusb: kvaserusbreadbulkcallback: fixed the URB memory leak. The memory leak was fixed in a similar manner to the issue in commit 7352e1d5932a “can: gsusb: gsusbreceivebulkcallback: fixed the URB memory leak”. In the...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: cifs: preventing use-after-free by freeing the cfile later. In smb2compoundop, there is a potential use-after-free that may lead to difficult debugging issues in the future. This issue was identified during stress testing with th...
Astra Linux – Vulnerability in gst-plugins-good1.0
GStreamer rtpqdm2depay: Out-of-bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability, but the attack vectors may vary...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1
A denial-of-service vulnerability was discovered in tipccryptokeyrevoke in the net/tipc/crypto.c file within the TIPC subsystem of the Linux kernel. This flaw allows guests with local user privileges to trigger a deadlock and potentially cause the system to crash...
Astra Linux – Vulnerability in Firefox, Thunderbird
Sandbox escape in the Graphics: WebRender component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...
Astra Linux – Vulnerability in Chromium
Using “after free” in Dawn in Google Chrome before version 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Firefox and Thunderbird
Memory safety bugs exist in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147, and Thunderbird 147. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability ha...
Astra Linux – Vulnerability in freerdp3
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.22.0, videotimer could send client notifications after the control channel was closed, by dereferencing a freed callback and triggering an action after it was freed. This vulnerability has been fixed in version...
Astra Linux – Vulnerability in Firefox and Thunderbird
Memory safety bugs exist in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1, and Thunderbird 149.0.1. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This...
Astra Linux – Vulnerability in Linux, Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: nvme-tcp: fixed a possible use-after-free issue in the transport errorrecovery process. While nvmetcpsubmitasynceventwork checks the ctrl and queue states before preparing the AER command and scheduling iowork, this check is...
Astra Linux – Vulnerability in krb5
The vulnerability of the krb5chpwmessage function in the Kerberos authentication protocol is related to insufficient input validation. Exploiting this vulnerability allows an attacker to access confidential data and also cause service interruptions...
Astra Linux – Vulnerability in FontForge
Splinefont in FontForge, with a version number of 20230101, allows for command injection via crafted filenames...
Astra Linux – Vulnerability in Thunderbird
A memory safety bug exists in Firefox ESR 128.9 and Thunderbird 128.9. This bug exhibited signs of memory corruption, and we assume that with sufficient effort, this flaw could have been exploited to execute arbitrary code. This vulnerability has been fixed in Firefox ESR 128.10 and Thunderbird...
Astra Linux – Vulnerability in Python-Click
This CVE record was assigned without following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below: Pallets Click, versions 8.3.2 and below, contains a command injection vulnerability in the click.edit...
Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15
A buffer overflow vulnerability was discovered in the Linux kernel’s Broadcom Full MAC Wi-Fi driver. This issue occurs when a user connects to a malicious USB device. It can allow a local user to crash the system or escalate their privileges...
Astra Linux – Vulnerability in WebKit2GTK
A race condition has been addressed through improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3, and iPadOS 18.7.3; iOS 26.2 and iPadOS 26.2; macOS Tahoe 26.2; tvOS 26.2; visionOS 26.2; and watchOS 26.2. Processing maliciously crafted web content may lead to an unexpected...
Astra Linux – Vulnerability in Linux
In the Linux kernel, the following vulnerabilities have been resolved: Tracing: The length check that causes memory corruption was corrected. We have experienced severe kernel crashes due to memory corruption in our production environment. For example: Call Trace: 1640542.554277 General protectio...
Astra Linux – Vulnerability in Qemu
A flaw was discovered in the QEMU-built-in VNC server during the processing of ClientCutText messages. A incorrect exit condition may lead to an infinite loop when inflating a zlib buffer controlled by an attacker in the inflatebuffer function. This could allow a remotely authenticated client, wh...
Astra Linux – Vulnerability in Chromium
A cryptographic flaw in PDFium in Google Chrome prior to version 147.0.7727.55 allowed an attacker to read potentially sensitive information from encrypted PDFs through a brute-force attack. Chromium security severity: Medium...
Astra Linux – Vulnerability in Parsec
The vulnerability of the pdpl-user utility in the PARSEC security subsystem is related to improper memory release after its use. Exploiting this vulnerability allows an attacker to cause a service failure...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in Custom Tabs in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
Insufficient policy enforcement in DevTools in Google Chrome prior to 147.0.7727.55 allowed an attacker who convinced a user to install a malicious extension to bypass enterprise host restrictions for cookie modification via a crafted Chrome Extension. Chromium security severity: Low...
Astra Linux – Vulnerability in Firefox and Thunderbird
Undefined behavior in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...
Astra Linux – Vulnerability in Chromium
A heap buffer overflow in WebAudio in Google Chrome prior to version 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: iio: adc: at91-sama5d2adc: Fixed a potential use-after-free in the sama5d2adc driver. The at91adcinterrupt function can call the at91adctouchdatahandler function to initiate the processing via schedulework&st-touchst.workq. If we...
Astra Linux – Vulnerability in Chromium
The use of “after free” in Navigation in Google Chrome before version 119.0.6045.159 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in curl
Curl versions 7.21.0 through 7.73.0 are vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing...
Astra Linux – Vulnerability in WebKit2GTK
A “use-after-free” issue has been addressed through improved memory management. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14, watchOS 10, tvOS 17, and Safari 17. Processing web content may lead to arbitrary code execution...
Astra Linux – Vulnerability in Chromium
Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...
Astra Linux – Vulnerability in Chromium
Insufficient policy enforcement in the Popup Blocker component of Google Chrome prior to version 108.0.5359.71 allowed a remote attacker to bypass navigation restrictions through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Before version 88.0.4324.182, using "Use after free" in Downloads in Google Chrome on Windows allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page...