20178 matches found
Astra Linux – Vulnerability in Chromium
The use of after-free in FileSystem in Google Chrome before version 147.0.7727.101 allowed a remote attacker to potentially exploit object corruption through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in gnupg2
A flaw was discovered in the way certificate signatures can be forged using collisions found in the SHA-1 algorithm. Attackers could exploit this weakness to create forged certificate signatures. This issue affects GnuPG versions prior to 2.2.18...
Astra Linux – Vulnerability in imagemagick
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, when performing a polynomial distortion, an excessive read of 24 bytes could occur when specifying certain arguments. This issue has been fixed in versions...
Astra Linux – Vulnerability found in Python 3.11, Python 2.7, Python 3.7, and Pypy
There is a medium-severity vulnerability affecting CPython. Regular expressions that allow excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS through specifically crafted tar archives...
Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: regulator: core: Fix resource leak in regulatorregister I received some reports of resource leaks during fault injection tests: - ERROR: Memory leak; expected refcount 1 instead of 100 - ofnodeget/ofnodeput unbalanced – destro...
Astra Linux – Vulnerability in Firefox
A spoofing issue exists in the Privacy: Anti-Tracking component. This vulnerability has been fixed in Firefox 149 and Thunderbird 149...
Astra Linux – Vulnerability in Firefox and Thunderbird
Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...
Astra Linux – Vulnerability in Chromium
A heap buffer overflow in WebGL in Google Chrome prior to version 146.0.7680.165 allowed a remote attacker to perform an out-of-bounds memory read through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Firefox and Thunderbird
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7...
Astra Linux – Vulnerability in jqueryui
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the of option of the .position utility from untrusted sources might execute untrusted code. This issue has been fixed in jQuery UI 1.13.0. Any string value passed to the of option is now treat...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: Wifi: Wil6210: debugfs: fixed the use of uninitialized variables in wilwritefilewmi Commit 7a4836560a61 replaces the simplewritetobuffer function with memdupuser, but it forgets to change the value returned by the...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: drm/radeon: A potential buffer overflow issue was fixed in nisetmcspecialregisters. The last case label can write two buffers, mcregaddressj and mcdataj, where the offset of ‘j’ equals SMCNISLANDSMCREGISTERARRAYSIZE. Since there...
Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: ICE: xsk: prohibit usage of non-balanced queue ID Fix the following scenario: 1. ethtool -L $IFACE rx 8 tx 96 2. xdpsock -q 10 -t -z The above refers to a situation where a user wants to attach an XSK socket in txonly mode at a...
Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: x86/kprobes: Updates the kcb status flag after single-stepping. The kprobes function is fixed to update the kcb kprobes control block status flag to KPROBEHITSSDONE, even if the kp-posthandler is not set. This bug may cause a...
Astra Linux – Vulnerability in Samba
A vulnerability related to information leaks was discovered in Samba’s LDAP server. Due to missing access control checks, a authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store...
Astra Linux – Vulnerability in f2fs-tools
There is an exploitable information disclosure vulnerability in the devread functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem can lead to an uninitialized read operation, resulting in information disclosure. An attacker can provide a malicious file to trigger this...
Astra Linux – Vulnerability in Firefox, Thunderbird
Incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...
Astra Linux – Vulnerability in Parsec
The vulnerability of the audtotxt function in the PARSEC security subsystem is related to improper memory release after its use. Exploiting this vulnerability allows an attacker to cause a service failure...
Astra Linux – Vulnerabilities in Firefox, Thunderbird, Expat, LibXMLTok
In doProlog, within xmlparse.c of the Expat library also known as libexpat, there is an integer overflow issue related to mgroupSize before version 2.4.3...
Astra Linux – Vulnerability in Chromium
Type confusion in V8 in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: socinfo: Added kfree in kstrdup. Added kfree in the subsequent error handling steps to avoid memory leaks...
Astra Linux – Vulnerability in poppler-22, poppler
A issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h; this could lead to a denial of service. This issue arises because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving an embedded file...
Astra Linux - Vulnerability in Golang-1.19
The html/template package does not properly handle HTML-like “” comment tokens, nor hashbang “!” comment tokens, in contexts. This may cause the template parser to incorrectly interpret the contents of contexts, resulting in actions being incorrectly escaped. This could be exploited to carry out ...
Astra Linux – Vulnerability in librsvg
A directory traversal vulnerability exists in the URL decoder of librsvg before version 2.56.3. This vulnerability could be exploited by local or remote attackers to access files located in the local filesystem, outside of the expected area. This was demonstrated with the URL...
Astra Linux – Vulnerability in grub2
A flaw was discovered in grub2. When performing a symlink lookup from a romfs filesystem, grub’s romfs filesystem module uses user-controlled parameters from the filesystem geometry to determine the internal buffer size. However, it improperly checks for integer overflows. A maliciously crafted...
Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: Integrity: Fixed memory leakage in the keyring allocation error path. Keys are allocated in the integrityinitkeyring function. However, if the keyring allocation fails, the allocated keys are not freed, resulting in memory lea...
Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15
A race condition was detected in the Linux kernel’s watch queue due to a missing lock in the piperesizering function. The specific flaw lies in the handling of pipe buffers. The problem arises from the lack of proper locking when performing operations on an object. This flaw allows a local user t...
Astra Linux – Vulnerability in Firefox and Thunderbird
Incorrect boundary conditions in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...
Astra Linux – Vulnerability in openjdk-11
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Library. The supported versions affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2 and 21.1.0. This easily exploitable vulnerability allows an...
Astra Linux - Vulnerability in Linux, Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Fix kvmarchvcpuioctl vcpuload leak vcpuput is not called if the user copy fails. This can result in preemption notifier corruption and crashes, among other issues...
Astra Linux – Vulnerability in Tomcat9
Vulnerability of resource allocation without limits or throttling in Apache Tomcat. This issue affects Apache Tomcat: versions from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, and from 9.0.0.M1 through 9.0.117. Older, unsupported versions may also be affected. Users are recommended...
Astra Linux – Vulnerability in Chromium
The inappropriate implementation of Media in Google Chrome prior to version 148.0.7778.216 allowed a remote attacker to bypass the same-origin policy through a crafted video file. Chromium security severity: High...
Astra Linux – Vulnerability in libxml2
libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier, as well as other products, does not provide a direct flag indicating that the current document may be read, but other files may not be opened. This makes it easier for remote attackers to carry out XML External Entity XXE attacks...
Astra Linux – Vulnerability in Chromium
The use of after-free in Prerender in Google Chrome before version 147.0.7727.101 allowed a remote attacker to execute arbitrary code through a crafted HTML page. Chromium security severity: Critical...
Astra Linux – Vulnerability in Linux
A issue was discovered in the Linux kernel through version 5.16-rc6. The function kfdparsesubtypeiolink in drivers/gpu/drm/amd/amdkfd/kfdcrat.c lacks a check for the return value of kmemdup...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15
A flaw was discovered in the udmabuf device driver of the Linux kernel, within a fault handler. This issue arises due to the lack of proper validation of user-supplied data, which can lead to memory access beyond the end of an array. This may allow an attacker to escalate privileges and execute...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: sctp: Handle the error returned from sctpauthasocinitactivekey. When an error is returned from sctpauthasocinitactivekey, the activekey is not actually updated. The old shkey remains freed while it’s still being used as the activ...
Astra Linux – Vulnerability in Samba
A flaw was discovered in Samba’s libldb. Multiple consecutive leading spaces in an LDAP attribute can lead to an out-of-bounds memory write, causing the LDAP server process handling the request to crash. The greatest threat of this vulnerability is to system availability...
Astra Linux – Vulnerability in libssh
A flaw was discovered in the libssh library in versions prior to 0.11.2. An out-of-bounds read vulnerability can occur in the sftphandle function due to an incorrect comparison check. This allows the function to access memory beyond the valid handle list and to return an invalid pointer, which is...
Astra Linux – Vulnerability in grub2
A flaw was discovered in grub2. When reading data from a squash4 filesystem, grub’s squash4 fs module uses user-controlled parameters from the filesystem’s geometry to determine the internal buffer size. However, it improperly checks for integer overflows. A maliciously crafted filesystem may cau...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in V8 in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
In Google Chrome, operations outside the bounds were allowed before 127.0.6533.88; this enabled a remote attacker to potentially perform out-of-bounds memory access through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Firefox
Multiple NSS NIST curves were vulnerable to a side-channel attack known as “Minerva”. This attack could potentially allow an attacker to recover the private key. This vulnerability affects Firefox versions less than 121...
Astra Linux – Vulnerability in Chromium
Using “after free” in WebRTC in Google Chrome before version 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Firefox and Thunderbird
If the browser.privatebrowsing.autostart preference is enabled, IndexedDB files are not properly deleted when the window is closed. This preference is disabled by default in Firefox. This vulnerability affects Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11...
Astra Linux – Vulnerability in Chromium
The use of after free in Passwords in Google Chrome prior to version 117.0.5938.132 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption through crafted UI interactions. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
The incorrect security UI in BFCache in Google Chrome prior to version 116.0.5845.179 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Apache Log4j1.2
CVE-2020-9493 identified a deserialization issue present in Apache Chainsaw. Prior to Chainsaw V2.0, Chainsaw was a component of Apache Log4j 1.2.x, and the same issue still exists there...
Astra Linux – Vulnerability in Flatpak
Flatpak is a Linux application sandboxing and distribution framework. Prior to version 1.16.4, the caching mechanism for ld.so removed outdated cache files without properly checking whether the app’s control over the path to the outdated cache was valid within the cache directory. This allowed...