21820 matches found
Astra Linux – Vulnerability in Firefox and Thunderbird
As specified in the W3C Content Security Policy draft, when creating a violation report, “User agents need to ensure that the source file is the URL requested by the page, with pre-redirecting. If this is not possible, user agents must strip the URL to its origin to prevent unintentional leakage....
Astra Linux – Vulnerability in Firefox
The developer’s page for about:memory includes a Measure function for exploring which object types the browser has allocated and their sizes. When this function was invoked, we incorrectly called the sizeof function instead of using the API method that checks for invalid pointers. This...
Astra Linux – Vulnerability in Firefox and Thunderbird
Mozilla developers reported memory safety bugs in Firefox 85 and Firefox ESR 78.7. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability affects Firefox version...
Astra Linux – Vulnerability in Firefox and Thunderbird
Mozilla developers and community members reported memory safety bugs in Firefox 86 and Firefox ESR 78.8. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability...
Astra Linux – Vulnerability in Firefox
By using 3D CSS in conjunction with JavaScript, content could be rendered outside the webpage’s viewport. This led to a spoofing attack that could be used for phishing or other attacks against users. This vulnerability affects Firefox versions earlier than 88...
Astra Linux – Vulnerability in Firefox and Thunderbird
Through complicated navigation with new windows, an HTTP page could inherit a secure lock icon from an HTTPS page. This vulnerability affects Firefox ESR 78.10, Thunderbird 78.10, and Firefox 88...
Astra Linux – Vulnerability in glib2.0
A issue was discovered in GNOME GLib before versions 2.66.7 and 2.67.x before version 2.67.4. If the gbytearraynewtake function was called with a buffer of 4GB or more on a 64-bit platform, the length would be truncated modulo 2^32, resulting in unintended length truncation...
Astra Linux – Vulnerability in Linux
A issue was discovered in the Linux kernel through version 5.11.6. The fastrpcinternalinvoke function in drivers/misc/fastrpc.c does not prevent user applications from sending kernel RPC messages, also known as CID-20c40794eb85. This is a related issue to CVE-2019-2308...
Astra Linux – Vulnerability in RustC
In the standard library of Rust before version 1.50.0, readtoend does not validate the return value from Read in an unsafe context. This bug could lead to a buffer overflow...
Astra Linux – Vulnerability in Firefox and Thunderbird
The WebAssembly JIT might miscalculate the size of a return type, which could lead to a null read and result in a crash. Note: This issue only affected x86-32 platforms. Other platforms are unaffected.. This vulnerability affects Firefox ESR 78.10, Thunderbird 78.10, and Firefox 88...
Astra Linux – Vulnerability in Firefox
A transient execution vulnerability, named Floating Point Value Injection FPVI, allowed attackers to leak arbitrary memory addresses and may have also enabled JIT type confusion attacks. A related vulnerability, Speculative Code Store Bypass SCSB, did not affect Firefox. This vulnerability affect...
Astra Linux – Vulnerability in Thunderbird
OpenPGP secret keys that were imported using Thunderbird versions 78.8.1 up to 78.10.1 were stored unencrypted on the user’s local disk. The master password protection was inactive for those keys. Version 78.10.2 will restore the protection mechanism for newly imported keys, and will automaticall...
Astra Linux – Vulnerability in Thunderbird
If a MIME-encoded email contains an OpenPGP inline signed or encrypted message part, but also contains an additional unprotected part, Thunderbird did not indicate that only certain parts of the message are protected. This vulnerability affects Thunderbird versions earlier than 78.10.2...
Astra Linux – Vulnerability in Firefox and Thunderbird
Mozilla developers reported memory safety bugs in Firefox 88 and Firefox ESR 78.11. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability affects Thunderbird...
Astra Linux – Vulnerability in Firefox and Thunderbird
A suspected race condition during the call of getaddrinfo led to memory corruption and a potentially exploitable crash. Note: This issue only affected Linux operating systems. Other operating systems are unaffected. This vulnerability affects Thunderbird 78.13, Thunderbird 91, Firefox ESR 78.13,...
Astra Linux – Vulnerability in Firefox and Thunderbird
After requesting multiple permissions and closing the first permission panel, subsequent permission panels will be displayed in a different position, but still record a click at the default location. This allows users to be tricked into accepting permissions they do not want to grant. This bug on...
Astra Linux – Vulnerability in Firefox and Thunderbird
Mozilla developers reported memory safety bugs in Firefox 90 and Firefox ESR 78.12. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability affects Thunderbird...
Astra Linux – Vulnerability in md4c
The mdanalyzeline function in md4c.c, within md4c 0.4.7, allows attackers to trigger the use of uninitialized memory, thereby causing a denial of service through a malformed Markdown document...
Astra Linux – Vulnerability in Chromium
In incorrect security user interfaces of web app installations in Google Chrome on Android before version 90.0.4430.212, an attacker who convinced a user to install a web application could inject scripts or HTML into a privileged page through a crafted HTML page...
Astra Linux – Vulnerability in Chromium
A heap buffer overflow in Media Feeds in Google Chrome prior to version 90.0.4430.212 allowed an attacker who convinced a user to enable certain features in Chrome to potentially exploit heap corruption through a crafted HTML page...
Astra Linux – Vulnerability in Chromium
Before the release of 90.0.4430.212, writing out-of-bounds data using TabStrip in Google Chrome allowed an attacker who convinced a user to install a malicious extension to perform an out-of-bounds memory write through a crafted HTML page and a crafted Google Chrome extension...
Astra Linux – Vulnerability in Chromium
Inappropriate implementations of offline features in Google Chrome on Android before version 90.0.4430.212 allowed a remote attacker who had compromised the renderer process to bypass site isolation through a crafted HTML page...
Astra Linux – Vulnerability in Chromium
Before version 90.0.4430.212, using “after free” in Google Chrome’s payments functionality allowed an attacker who convinced a user to install a malicious payment app to potentially exploit heap corruption through a crafted HTML page...
Astra Linux – Vulnerability in Chromium
Before version 91.0.4472.77, using WebAuthentication in Google Chrome on Android allowed a remote attacker who had compromised the renderer process of a user who had saved a credit card in their Google account to potentially exploit heap corruption through a crafted HTML page...
Astra Linux – Vulnerability in Chromium
In Google Chrome’s spell check feature, before version 91.0.4472.101, an attacker who convinced a user to install a malicious extension could potentially exploit heap corruption through a crafted HTML page...
Astra Linux – Vulnerability in Chromium
Before version 91.0.4472.114, using WebAudio with "after free" in Google Chrome allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...
Astra Linux – Vulnerability in Chromium
In Google Chrome on Linux and ChromeOS before version 92.0.4515.107, an attacker who convinced a user to install a malicious extension could perform an out-of-bounds memory write by using a crafted HTML page. This vulnerability allowed the attacker to execute such an operation...
Astra Linux – Vulnerability in Chromium
A stack buffer overflow in Printing in Google Chrome prior to version 92.0.4515.107 allowed a remote attacker who had compromised the renderer process to potentially exploit stack corruption through a crafted HTML page...
Astra Linux – Vulnerability in Chromium
Before version 92.0.4515.107, Autofill in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption through a crafted HTML page...
Astra Linux – Vulnerability in Chromium
In Google Chrome, the use of "after free" in protocol handling before version 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...
Astra Linux – Vulnerability in Chromium
Insufficient policy enforcement in the Installer component of Google Chrome prior to version 92.0.4515.107 allowed a remote attacker to perform local privilege escalation through a crafted file...
Astra Linux – Vulnerability in Chromium
In Google Chrome, uninitialized use in media before version 92.0.4515.107 allowed a remote attacker to perform out-of-bounds memory access through a crafted HTML page...
Astra Linux – Vulnerability in Chromium
Before version 92.0.4515.107, using "use after free" in sensor handling in Google Chrome allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...
Astra Linux – Vulnerability in Chromium
Insecure security interfaces in the Downloads section of Google Chrome on Android before version 92.0.4515.107 allowed a remote attacker to perform domain spoofing through a crafted HTML page...
Astra Linux – Vulnerability in Chromium
In Windows, the use of “after free” in dialog box handling in Google Chrome before version 92.0.4515.107 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption through a crafted HTML page...
Astra Linux – Vulnerability in Chromium
Type confusion in V8 in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...
Astra Linux – Vulnerability in Chromium
Insufficient validation of untrusted inputs in the Sharing feature of Google Chrome before version 92.0.4515.107 allowed a remote attacker to bypass navigation restrictions through a crafted click-to-call link...
Astra Linux – Vulnerability in Chromium
Type confusion in V8 in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page...
Astra Linux – Vulnerability in Chromium
Chromium: CVE-2021-30607 – Use after free in Permissions...
Astra Linux – Vulnerability in Chromium
Chromium: CVE-2021-30606 – Use after free in Blink...
Astra Linux – Vulnerability in Chromium
Chromium: CVE-2021-30617 – Policy bypass in Blink...
Astra Linux – Vulnerability in Chromium
Chromium: CVE-2021-30616 Use after free in Media...
Astra Linux – Vulnerability in Chromium
Before version 93.0.4577.82, using the "after free" method in the Selection API in Google Chrome allowed a remote attacker to potentially exploit heap corruption by using a crafted HTML page, as long as that attacker could convince the user to visit a malicious website...
Astra Linux – Vulnerability in Chromium
Type confusion in Blink layout in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...
Astra Linux – Vulnerability in Chromium
Before version 93.0.4577.82, using “after free” in Permissions in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption through a crafted HTML page...
Astra Linux – Vulnerability in WebKit2GTK
A logic issue has been addressed through improved state management. This issue is fixed in tvOS 14.6, iOS 14.6, iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, and watchOS 7.5. Processing maliciously crafted web content may lead to cross-site scripting vulnerabilities...
Astra Linux – Vulnerability in WebKit2GTK
Multiple memory corruption issues have been resolved through improved memory handling. This issue is fixed in tvOS 14.6, iOS 14.6, iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, and watchOS 7.5. Processing maliciously crafted web content may lead to arbitrary code execution...
Astra Linux – Vulnerability in WebKit2GTK
A memory management issue related to “use after free” operations has been addressed through improved memory management practices. This issue is fixed in iOS 14.7, Safari 14.1.2, macOS Big Sur 11.5, watchOS 7.6, and tvOS 14.7. Processing maliciously crafted web content may lead to arbitrary code...
Astra Linux – Vulnerability in WebKit2GTK
This issue has been addressed through improved checks. This issue is fixed in iOS 14.7, Safari 14.1.2, macOS Big Sur 11.5, watchOS 7.6, and tvOS 14.7. Processing maliciously crafted web content may lead to code execution...
Astra Linux – Vulnerability in WebKit2GTK
A memory corruption issue has been resolved through improved memory handling. This issue is fixed in iOS 14.8 and iPadOS 14.8, Safari 15, iOS 15, and iPadOS 15. Processing maliciously crafted web content may lead to code execution...