21941 matches found
Astra Linux – Vulnerability in Chromium
In DevTools in Google Chrome prior to version 145.0.7632.45, it was possible for a remote attacker to convince a user to perform certain UI gestures and install a malicious extension, thereby potentially exploiting object corruption through a malicious file. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in V8 in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out-of-bounds memory access via a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Firefox
Memory safety bugs exist in Firefox 148.0.2. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability has been fixed in Firefox 148.0.2...
Astra Linux – Vulnerability in Chromium
In Web Speech of Google Chrome, before version 146.0.7680.71, it was possible for a remote attacker to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Integer overflow in Skia in Google Chrome prior to version 145.0.7632.159 allowed a remote attacker to potentially perform out-of-bounds memory access through a crafted HTML page. Chromium security severity: Critical...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in DevTools in Google Chrome prior to 145.0.7632.116 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via DevTools. Chromium security severity: High...
Astra Linux – Vulnerability in Linux 6.12
In the Linux kernel, the following vulnerability has been resolved: ice: fixed the Rx page leak in multi-buffer frames. The iceputrxmbuf function handles calling iceputrxbuf for each buffer in the current frame. This function was introduced as part of handling multi-buffer XDP support in the ice...
Astra Linux – Vulnerability in libssh
A flaw was discovered in the libssh library in versions prior to 0.11.2. An out-of-bounds read vulnerability can occur in the sftphandle function due to an incorrect comparison check. This allows the function to access memory beyond the valid handle list and to return an invalid pointer, which is...
Astra Linux – Vulnerability in Linux 6.12
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Check the untrusted offset in FF-A memory share. Verify the offset to prevent OOB access in the hypervisor. The FF-A buffer contains a value that is too large and potentially untrusted. U32MAX – sizeofstruct...
Astra Linux – Vulnerability in Linux 6.12
In the Linux kernel, the following vulnerability has been resolved: igc: Do not fail igcprobe on LED setup errors When igcledsetup fails, igcprobe fails, leading to a kernel panic in freenetdev. This occurs because unregisternetdev is not called. This behavior can be tested using the...
Astra Linux – Vulnerability in Botan
Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or by explicitly encoding the parameters. A bug in the parsing of name constraint extensions in X.509 certificates meant that if the extension included both permitted and exclude...
Astra Linux – Vulnerability in Linux 6.12
In the Linux kernel, the following vulnerability has been resolved: In the net: libwx section, the Rx ring descriptor is properly reset after a device reset. When a device reset is triggered due to changes in features, such as toggling Rx VLAN, wx-doreset is called to reinitialize the Rx rings. T...
Astra Linux – Vulnerability in Linux 6.12
In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: A stack overflow issue was fixed when loading vlenb. The user-space load mechanism can place up to 2048 bits into the xlen bit stack buffer. Since we only need the xlen bits, we check the size of the buffer in advanc...
Astra Linux – Vulnerability in Apache2
Delayed memory release after the effective lifetime vulnerability in the Apache HTTP Server. This issue affects the Apache HTTP Server: from version 2.4.17 up to 2.4.63. Users are recommended to upgrade to version 2.4.64, which fixes this issue...
Astra Linux – Vulnerability in Linux 6.12
In the Linux kernel, the following vulnerability has been resolved: BPF, ARM64: Fixed the initialization of the floating-point register for exception boundaries. When using ARM64 BPF JIT, if prog-aux-exceptionboundary is set for a BPF program, the findusedcallee regs function is not called. This ...
Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12
In the Linux kernel, the following vulnerability has been resolved: atm: Revert atmaccounttx if copyfromiterfull fails. In vccsendmsg, we set sk-skwmemalloc based on account skb-truesize using atmaccounttx. This change is expected to be reverted by atmpopraw, which is called later in...
Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12
Improper initialization of the CPU cache memory could allow a privileged attacker with access to the hypervisor to overwrite the SEV-SNP guest memory, resulting in loss of data integrity...
Astra Linux – Vulnerability in Linux 6.12
In the Linux kernel, the following vulnerability has been resolved: xfrm: Duplicate SPI Handling The issue arises when Strongswan initiates an XFRMMSGALLOCSPI Netlink message, which triggers the kernel function xfrmallocspi. This function is supposed to ensure the uniqueness of the Security...
Astra Linux – Vulnerability in Firefox
Mitigation bypass in Web Compatibility: Tooling component. This vulnerability has been fixed in Firefox 143 and Thunderbird 143...
Astra Linux - уязвимость в wireshark
Infinite loop in the F5 Ethernet Trailer protocol dissector in Wireshark 3.6.0 to 3.6.7 and 3.4.0 to 3.4.15 allows denial of service via packet injection or crafted capture file...
Astra Linux - уязвимость в linux-5.10
In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs The driver, through the SAS transport, exposes a sysfs interface to enable/disable PHYs in a controller/expander setup. When multiple PHYs are disabled and...
Astra Linux - уязвимость в tcl8.6
In Tcl 8.6.11, a format string vulnerability in nmakehlp.c might allow code execution via a crafted file. NOTE: multiple third parties dispute the significance of this finding...
Astra Linux – Vulnerability in binutils
A vulnerability classified as problematic was discovered in GNU Binutils 2.43/2.44. The function bfdsetformat in the file format.c is affected by this vulnerability. Manipulation of this function leads to memory corruption. The attack can be launched remotely. The complexity of executing this...
Astra Linux – Vulnerability in Thunderbird
A memory safety bug exists in Firefox ESR 128.9 and Thunderbird 128.9. This bug exhibited signs of memory corruption, and we assume that with sufficient effort, this flaw could have been exploited to execute arbitrary code. This vulnerability has been fixed in Firefox ESR 128.10 and Thunderbird...
Astra Linux – Vulnerability in Linux 6.12
In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Added a missing deinit call. A warning is triggered when repeatedly connecting and disconnecting the rnbd interface: The listadd structure is corrupted. prev-next should be set to next ffff88800b13e480, but it was set ...
Astra Linux – Vulnerability in Linux 6.12
In the Linux kernel, the following vulnerability has been resolved: Ring-buffer: Validates the persistent meta-data subbuf array The meta-data for a mapped ring buffer contains an array of indexes of all subbuffers. The first entry represents the “reader page,” and the remaining entries specify t...
Astra Linux – Vulnerability in libbpf
The vulnerability in the src/libbpf.c component of the BPF loader library in Libbpf is related to pointer dereferencing errors. Exploiting this vulnerability could allow an attacker to cause a system failure...
Astra Linux – Vulnerability in Keepalived
The vulnerability of the parser.c component in the Keepalived network traffic balancing system is related to pointer dereferencing errors. Exploiting this vulnerability allows an attacker to cause service failures...
Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12
In the Linux kernel, the following vulnerabilities have been resolved: KVM: x86 – Reject Hyper-V’s SENDIPI hypercalls if the local APIC is not part of the kernel. Advertise support for Hyper-V’s SENDIPI and SENDIPIEX hypercalls only if the local API is emulated/virtualized by KVM. Explicitly reje...
Astra Linux – Vulnerability in Linux 6.12
In the Linux kernel, the following vulnerabilities have been resolved: idpf: fixed the issue where the NULL pointer dereferencing occurred during reboot. When SRIOV is enabled, idpf calls idpfremove twice. First, via idpfshutdown, and then again when idpfremove calls sriovdisable. This is because...
Astra Linux – Vulnerability in Intel Microcode
Improper input validation in UEFI firmware for some Intel processors may allow a privileged user to potentially enable privilege escalation through local access...
Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12
In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: Add a check for the returned value of devmkasprintf. devmkasprintf can return a NULL pointer in case of failure, but this returned value is not checked...
Astra Linux – Vulnerability in Erlang
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, OTP-26.2.5.10, and OTP-25.3.2.19, a maliciously formed KEX init message could result in high memory usage. The implementation does not verify the RFC specified limits on the length of algorithm nam...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: Wifi: mt76 – Do not call mt76unregisterdevice on unregistered hardware devices. Attempting to probe a mt7921e PCI card without firmware results in a successful probe, but ieee80211registerhw is not called. When removing the drive...
Astra Linux – Vulnerability in libstb
STBVorbis is a single-file library licensed under MIT, designed for processing OGG Vorbis files. A properly crafted file may cause a memory allocation failure in the startdecoder function. In such cases, the function returns early; f-commentlist is set to NULL, but f-commentlistlength is not rese...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: media: i2c: ar0521: Use cansleep version of gpiodsetvalue If we use GPIO reset from I2C port expander, we must use cansleep variant of GPIO functions. This was not done in ar0521poweron/ar0521poweroff functions. Let's fix that...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerabilities have been resolved: nfc: nci: Fixed an uninit-value issue in ncirxwork. syzbot reported the following uninit-value access issue 1. ncirxwork parses the received packet from ndev-rxq. It is necessary to validate the header size, payload size, and...
Astra Linux – Vulnerability in OpenVPN
Before version 2.6.11, OpenVPN did not properly sanitize PUSHREPLY messages. This vulnerability could be exploited by attackers who control the server, allowing them to inject unexpected arbitrary data into client logs...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerabilities have been resolved: net/iucv: Fixed the issue where iucvsockclose was used after memory was freed. The iucvseverpath function is called from both process context and thread context. The iucv-path variable is used to indicate whether someone else ...
Astra Linux – Vulnerability in curl
When curl is instructed to use the Certificate Status Request TLS extension, also known as OCSP stapling, to verify that the server certificate is valid, it may fail to detect certain OCSP issues and instead incorrectly consider the response to be fine. If the returned status reports an error oth...
Astra Linux – Vulnerability in libheif
In Libheif 1.17.6, insufficient checks during the decoding of a heif file using ImageOverlay::parse can lead to out-of-bounds read and write operations when processing a file containing an overlay image with forged offsets...
Astra Linux – Vulnerability in Chromium
In Skia within Google Chrome, out-of-bounds memory access was allowed before version 128.0.6613.84. This allowed a remote attacker who had compromised the renderer process to perform out-of-bounds memory access through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in LibreOffice
LibreOffice can import EMF+ graphics, which may be embedded in documents. A heap buffer overflow occurred when importing an EMF+ gradient brush. The number of gradient blend points was read from the file and used to compute an allocation size; however, this multiplication could lead to a buffer...
Astra Linux – Vulnerability in Chromium
Type Confusion in V8 in Google Chrome prior to 128.0.6613.137 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in docker.io
Moby is an open-source container framework developed by Docker Inc. It is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component dockerd, which is developed as moby/moby, is commonly referred to as Docker. Swarm Mode, which is...
Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: drm: bridge: adv7511: Unregistering the i2c device after unregistering the CEC adapter. The cecunregisteradapter function assumes that the underlying CEC adapter is callable. For example, if the CEC adapter currently has a valid...
Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: mm/swapfile: condresched was added to getswappages. A softlockup still occurs in getswappages under memory pressure. With 64 CPU cores, 64GB of memory, and 28 zram devices, the size of each zram device is 50MB, and they all have...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in imagemagick
A flaw was discovered in ImageMagick, specifically in the code file coders/hdr.c. An attacker who submits a crafted file processed by ImageMagick could trigger undefined behavior, resulting in values that are outside the range of the type unsigned char. This likely leads to a disruption in the...