21806 matches found
Astra Linux – Vulnerability in Chromium
Using after-free in WebGL in Google Chrome before version 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox through a crafted HTML page. Chromium security severity: Critical...
Astra Linux – Vulnerability in Chromium
The inappropriate implementation of passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to perform certain UI gestures to leak cross-origin data through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
The race condition in Payments in Google Chrome prior to version 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak cross-origin data through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
The use of after free in Web Authentication in Google Chrome before version 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
An observable discrepancy in forms in Google Chrome prior to version 152.0.7977.65 allowed a remote attacker to obtain sensitive information through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Before 152.0.7977.65, accessing memory outside the sandbox in Google Chrome allowed a remote attacker to exploit social engineering techniques to read memory through a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in WebProtect in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
The race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code within the sandbox through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Incorrect authorization in DeviceBoundSessionCredentials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via crafted network traffic. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in the Network component of Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Missing authorization in Omnibox in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leverage social engineering to bypass system access restrictions and gain access to a privileged page through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Incorrect reference resolution in passwords in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions through a crafted file. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Insufficient policy enforcement in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and utilized social engineering to potentially execute arbitrary code outside the sandbox through a crafted HTML page. Chromium security severit...
Astra Linux – Vulnerability in ffmpeg, ffmpeg5
There is a heap-buffer-overflow write in jpeg2000dec FFmpeg that allows an attacker to potentially gain remote code execution or cause a denial of service through the JPEG2000’s channel definition cdef atom...
Astra Linux – Vulnerability in PHP 8.1, PHP 7.3
In PHP versions 8.1. before 8.1.33, 8.2. before 8.2.29, 8.3. before 8.3.23, and 8.4. before 8.4.10, when parsing XML data in SOAP extensions, overly large 2Gb XML namespace prefixes may lead to null pointer dereferencing. This can result in crashes and affect the availability of the target server...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in Split View in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted domain name. Chromium security severity: Low...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: RISCV: Stacktrace: Disabling KASAN checks for non-current tasks. When unwinding the stack of a task other than the current one, KASAN will report “BUG: KASAN: out-of-bounds access in walkstackframe+0x41c/0x460”. This same issue...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: nilfs2: A shift-out-of-bounds condition has been fixed due to an overly large exponent of the block size. If the slogblocksize field in the superblock data is corrupted and too large, initnilfs and loadnilfs may still trigger a...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: blk-mq: Check the kobject creation status in sysfs before deleting it in blkmqunregisterhctx. In the function blkmqupdatenrHWqueues, the return value of blkmqsysfsregisterhctxs is not checked. If the creation of hctxs in sysfs...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: PCI/DOE: Fixed the race involving destroyworkonstack. The following debug object splat was observed during testing: ODEBUG: Freeing an active object active state 0: 0000000097d23782; Object type: workstruct; Hint:...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: cnic: Fixed use-after-free bugs in cnicdeletetask. The original code used canceldelayedwork in cniccmstopbnx2xHW, which does not guarantee that the delayed work item “deletetask” has fully completed if it was already running...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: In the tcpdisconnect function, the tcpsksk-fastopenrsk field was not cleared. The syzbot reported that a socket had tcpsksk-fastopenrsk in the TCPESTABLISHED state. The syzbot reused the server-side TCP Fast Open socket as a new...
Astra Linux – Vulnerability in Linux 5.10, Linux
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fixed the issue where immediate work requests were flushed to the completion queue prematurely. The opcode of the send queue element was correctly set during the flushing of immediate work requests in the post-sendqueue...
Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: Soundwire: Fixing enumeration completion The Soundwire subsystem uses two completion structures that allow drivers to wait for the Soundwire device to be enumerated on the bus and initialized by their respective drivers. The code...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Added a check for kmemdup. Since kmemdup may return a NULL pointer, it would be better to add a check on the return value to avoid dereferencing a NULL pointer...
Astra Linux – Vulnerability in Chromium
Before version 130.0.6723.92, Dawn in Google Chrome allowed a remote attacker to perform out-of-bounds memory access through a crafted HTML page. Chromium security severity: Critical...
Astra Linux – Vulnerability in ffmpeg5
It was discovered that FFmpeg versions n5.1 to n6.1 contain an Off-by-one Error vulnerability in the libavfilter/avfshowspectrum.c file. This vulnerability allows attackers to cause a Denial of Service DoS attack through crafted inputs...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerabilities have been resolved: nfc: llcp: fixed unsafe copies in nfcllcpsetsockopt syzbot reported unsafe calls to copyfromsockptr 1 Use copysafefromsockptr instead. 1 BUG: KASAN: out-of-bounds access in copyfromsockptroffset include/linux/sockptr.h:49 inli...
Astra Linux – Vulnerability in xrdp
xrdp is an open-source RDP server. Versions of xrdp prior to 0.10.0 have a vulnerability that allows attackers to make an infinite number of login attempts. The number of maximum login attempts is supposed to be limited by a configuration parameter MaxLoginRetry in /etc/xrdp/sesman.ini. However,...
Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1
In the Linux kernel, the following vulnerabilities have been resolved: gtp: The network headers were pulled into gtpdevxmit. syzbot/KMSAN reported the use of uninitvalue in getdevxmit. 1 We must ensure that the IPv4 or IPv6 headers are pulled into skb-head before accessing fields within them. Use...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: The default value of “denominators” should be set to 1. WHAT & HOW Variables that are used as denominators and may not be assigned to other values should not have a default value of 0. Change their default value ...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerabilities have been resolved: Platform/x86: x86-android-tablets: Fixed errors caused by using the pdevs array after it has been freed via platformdeviceregister. The x86androidtabletremove function frees the pdevs array. Therefore, it should not be used...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: net/sun382586: A potential memory leak has been fixed in sun382586sendpacket. In sun382586sendpacket, if skb-len is too long, it returns NETDEVTXOK without freeing the skb. To address this issue, add a call to devkfreeskb to...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/vas: Added a close callback in the vasvmops structure. The VMA address is saved in the VAS window structure when the paste address is mapped. This VMA address is used during migration to unmap the paste address if...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerabilities have been resolved: gtp: Fixed the list corruption issue in gtpnetexitbatchrtnl. Brad Spengler reported the listdel corruption issue in gtpnetexitbatchrtnl. 0 The commit eb28fd76c0a0 “gtp: Destroy the device along with the udp socket’s netns...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: scsi: qla1280: A kernel oops occurs when the debug level is greater than 2. A null dereference or oops exception will eventually occur when the qla1280.c driver is compiled with DEBUGQLA1280 enabled and when qldebuglevel is great...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi parser: A check was added to avoid out-of-bound access. There is a possibility that initcodecs may be invoked multiple times during manipulation of the payload from video firmware. In such cases, if codecscount...
Astra Linux – Vulnerability in poppler, poppler-22
A floating-point exception in the PSStack::roll function of Poppler before version 25.04.0 can cause an application to crash when handling malformed inputs associated with INTMIN...
Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: USB: wdm: the race between wdmopen and wdmwwanportstop has been eliminated. Clearing WDMWWANINUSE must be the last action; otherwise, we may open a device whose URBs User-Role-Based Services are still compromised...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: Fixed use-after-free bugs caused by pn532CmdTimeout. When the pn532 UART device is detached, the pn532uartRemove function is called. However, there are no functions in pn532uartRemove that can delete the cmdTimeout...
Astra Linux – Vulnerability in Linux 5.10, Linux
In the Linux kernel, the following vulnerability has been resolved: ALSA: ac97 – a possible memory leak has been fixed in sndac97devregister. If devregister fails in sndac97devregister, it should call putdevice to release the reference, otherwise the name allocated by devsetname may be leaked...
Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: ubifs: Memory freed for the tmpfile name When opening a ubifs tmpfile in an encrypted directory, the function fscryptsetupfilename allocates memory for the name that will be stored in the directory entry. However, after the name ...
Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: net: fec: Better handling of the case where pmruntimeget fails in .remove. In the unlikely event that pmruntimeget disguised as pmruntimeresumeandget fails, the remove callback returns an error early. The problem with this is tha...
Astra Linux – Vulnerability in opensc
A heap usage issue after a free operation was detected in Opensc before version 0.22.0 in scfilevalid...
Astra Linux – Vulnerability in Golang-1.19
The html/template package does not properly handle HTML-like “” comment tokens, nor hashbang “!” comment tokens, in contexts. This may cause the template parser to incorrectly interpret the contents of contexts, resulting in actions being incorrectly escaped. This could be exploited to carry out ...
Astra Linux – Vulnerability in musl
Musl libc versions 0.9.13 through 1.2.5 before 1.2.6 have a out-of-bounds write vulnerability, which means that an attacker can trigger the iconv conversion of untrusted EUC-KR text to UTF-8...
Astra Linux – Vulnerability in Linux 5.10, Linux
In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: Fixed a possible warning in privcmdioctlmmapresource. Since ‘kdata.num’ is a user-controlled data, if the user attempts to allocate memory larger than MAXORDER, then kcalloc will fail. This will also generate a stack...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: virtionet: Fixed an issue with error unwinding of XDP initialization. When initializing XDP in virtnetopen, some rq xdp initializations may encounter errors, resulting in failed network device openings. However, previous rqs have...
Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: RDMA/cma: Allow UD qptype to join multicast only Regarding multicast: - The SIDR is the only mode that makes sense; - In addition to PSUDP, other port spaces like PSIB are also allowed, as they are UD-compatible. In this case,...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: drm/i915/gvt: fixed the issue where vGPU debugfs was cleaned up during the remove operation. Check carefully whether the root debugfs is available when destroying the vGPU. For example, in the remove operation, the DRM minor’s...