Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: cifs: Fixed the locking usage for tcon fields. Previously, we used cifstcpseslock to protect many objects that weren’t just server, ses, or tcon lists. Later, we introduced svrlock, seslock, and tc Lock to protect fields withi...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: perf/arm-cmn: Rejects unsupported hardware configurations. So far, we have been fairly lenient in accepting both unknown CMN models at least with a warning, as well as unknown revisions of those models that we do know about...

Astra Linux – Vulnerability in giflib

Giflib contains a double-free vulnerability, which is caused by a shallow copy in GifMakeSavedImage and incorrect error handling. The conditions necessary to trigger this vulnerability are complex, but it may still occur...

Astra Linux – Vulnerability in TIF format

A flaw was discovered in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: btrfs: Fixed a race condition related to bitfield writes in btrfsclearspaceinfofull. According to the memory-barriers.txt document regarding memory barrier ordering guarantees: - These guarantees do not apply to bitfields, as...

Astra Linux – Vulnerability in glibc

Passing an excessively large alignment parameter to the memalign functions memalign, posixmemalign, alignedalloc in the GNU C Library versions 2.30 to 2.42 may lead to an integer overflow, which could subsequently cause heap corruption. It should be noted that the attacker must have control over...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check dcehwseq before dereferencing it. WHAT hws was checked for being null earlier in dce110blankstream, indicating that hws can be null. This check should be performed whenever hws is used. Cherry-picked from...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: eventpoll: Fixed an UAF Use-After-Free issue with epremovestruct eventpoll and struct file. The epremove function via epremovefile clears the file-fep field under file-flock, but then continues using @file within the critical...

Astra Linux – Vulnerability in Firefox

DoS attacks in the Audio/Video: Playback component. This vulnerability has been fixed in Firefox 150 and Thunderbird 150...

Astra Linux – Vulnerability in Firefox

Use-after-free in the DOM: Networking component. This vulnerability was fixed in Firefox 150.0.2, Firefox ESR 140.10.2, Firefox ESR 115.35.2, Thunderbird 150.0.2, and Thunderbird 140.10.2...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

A heap buffer overflow in the Codecs component of Google Chrome prior to version 148.0.7778.168 allowed a remote attacker to execute arbitrary code within a sandbox using a specially crafted video file. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

The use of “after free” in PDFium in Google Chrome before version 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption through a crafted PDF file. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Preload in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in SSL in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in HTML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

The use of after-free in CSS in Google Chrome before version 148.0.7778.96 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in DirectSockets in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform arbitrary read/write via a crafted Chrome Extension. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Before version 149.0.7827.103, the out-of-bounds reading in WebRTC in Google Chrome allowed a remote attacker who had compromised the GPU process to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Uninitialized use in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Inappropriate implementations of AI in Google Chrome prior to version 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the Network of Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass content security policy through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

The inappropriate implementation of Media in Google Chrome prior to version 148.0.7778.216 allowed a remote attacker to bypass the same-origin policy through a crafted video file. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Using “after free” in Ozone within Google Chrome on Linux before version 150.0.7871.47 allowed a remote attacker who convinced a user to perform certain UI gestures to execute arbitrary code through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Using “after free” in DevTools in Google Chrome before version 150.0.7871.47 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

A heap buffer overflow in WebRTC in Google Chrome prior to version 147.0.7727.138 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Using "after free" in Canvas in Google Chrome on Linux and ChromeOS before version 147.0.7727.138 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: Critical...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in the GPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...

Astra Linux – Vulnerability in Chromium

Using “after free” in V8 in Google Chrome before version 149.0.7827.103 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in Cast in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to perform privilege escalation via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

The use of after-free in GPU memory management in Google Chrome before version 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Before version 148.0.7778.216, reading out of bounds in ANGLE using Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Input in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

The use of after free in Aura in Google Chrome before version 148.0.7778.216 allowed a remote attacker who convinced a user to perform certain UI gestures to execute arbitrary code through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass discretionary access control through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in V8 in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out-of-bounds memory access via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

A heap buffer overflow in WebGL in Google Chrome prior to version 146.0.7680.165 allowed a remote attacker to perform an out-of-bounds memory read through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

In WebML, out-of-bounds memory access in Google Chrome prior to version 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Using “after free” in the Network component of Google Chrome before version 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in ChromeDriver in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

The use of “after free” in WebMIDI within Google Chrome before version 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

In Web Speech of Google Chrome, before version 146.0.7680.71, it was possible for a remote attacker to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in WebGPU in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially perform out-of-bounds memory access via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Downloads in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Firefox

Memory safety bugs exist in Firefox 146 and Thunderbird 146. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability has been fixed in Firefox 147 and Thunderbird...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in Frames in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Linux

A issue was discovered in Xen through version 4.14.x. Some operating systems, such as Linux, FreeBSD, and NetBSD, process watch events using a single thread. If these events are received faster than the thread can handle them, they will be queued up. Since the queue is unbounded, a guest system m...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Wifi: ath12k – The WoW offload is only performed on the primary link. In cases of multi-link connections, the WCN7850 firmware crashes due to the WoW offload being enabled on both the primary and secondary links. This issue can b...