20392 matches found
Astra Linux – Vulnerability in Golang-github-appc-cni
A flaw in path name limitations was identified in containernetworking/cni in versions prior to 0.8.1. When specifying the plugin to be loaded in the ‘type’ field of the network configuration, it is possible to use special elements such as “/” separators to reference binaries located elsewhere on...
Astra Linux – Vulnerability in connman
A issue was discovered in the DNS proxy of Connman through version 1.40. The implementation of the TCP server’s reply mechanism lacks a check to ensure that there is sufficient Header Data, resulting in an out-of-bounds read...
Astra Linux – Vulnerability in openexr
A flaw was discovered in OpenEXR in versions prior to 3.0.0-beta. A specially crafted input file provided by an attacker, when processed by the Dwa decompression functionality of OpenEXR’s IlmImf library, could lead to a NULL pointer dereferencing error. The greatest threat posed by this...
Astra Linux – Vulnerability in krb5
MIT Kerberos 5 also known as krb5 before versions 1.17.2 and 1.18.x before version 1.18.3 allowed unbounded recursion through an ASN.1-encoded Kerberos message. This issue arises because the lib/krb5/asn.1/asn1encode.c file does not have a recursion limit, resulting in support for BER indefinite...
Astra Linux – Vulnerability in exim4
Exim 4 before 4.94.2 allowed execution with unnecessary privileges. Since Exim operates as root in the log directory which is owned by a non-root user, a symlink or hard link attack could allow overwriting of critical root-owned files anywhere in the filesystem...
Astra Linux – Vulnerability in Chromium
Type confusion in V8 in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...
Astra Linux – Vulnerability in SQLite3
A flaw was discovered in SQLite’s SELECT query functionality src/select.c. This flaw allows an attacker who is capable of executing SQL queries locally on the SQLite database to cause a denial of service or potentially lead to code execution by triggering a use-after-free. The most significant...
Astra Linux – Vulnerability in liblivemedia
In Live Networks, Inc., liblivemedia version 20200625, there is a potential buffer overflow bug in the server’s handling of the RTSP “PLAY” command, especially when the command specifies seeking by absolute time...
Astra Linux – Vulnerability in md4c
The mdanalyzeline function in md4c.c, within md4c 0.4.7, allows attackers to trigger the use of uninitialized memory, thereby causing a denial of service through a malformed Markdown document...
Astra Linux – Vulnerability in Chromium
Type confusion in Blink layout in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...
Astra Linux – Vulnerability in libgcrypt20
It was discovered that there was an ECDSA timing attack in the libgcrypt20 cryptographic library. Affected versions: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Fixed versions: 1.8.5-2 and 1.6.3-2+deb8u7...
Astra Linux – Vulnerability in squashfs-tools
The squashfsopendir function in unsquash-2.c within Squashfs-Tools 4.5 enables Directory Traversal, another vulnerability distinct from CVE-2021-40153. A squashfs filesystem that includes a symbolic link, along with files under the same filename, can cause unsquashfs to first create the symbolic...
Astra Linux – Vulnerability in Linux
The 802.11 standard that underpins Wi-Fi Protected Access WPA, WPA2, and WPA3 and Wired Equivalent Privacy WEP does not require that all fragments of a frame be encrypted with the same key. An adversary can exploit this weakness to decrypt selected fragments when another device sends fragmented...
Astra Linux – Vulnerability in exiv2
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An inefficient algorithm quadratic complexity was found in Exiv2 versions v0.27.3 and earlier. This inefficient algorithm occurs when Exiv2 is used to write metadata into a...
Astra Linux – Vulnerability in RustC
In the standard library of Rust before version 1.29.0, there is weak synchronization in the Arc::getmut method. This synchronization issue can lead to memory safety issues due to race conditions...
Astra Linux – Vulnerability in WebKit2GTK
This issue has been addressed through improved checks. This issue is fixed in iOS 14.7, Safari 14.1.2, macOS Big Sur 11.5, watchOS 7.6, and tvOS 14.7. Processing maliciously crafted web content may lead to code execution...
Astra Linux – Vulnerability in Netty
Netty is an asynchronous, event-driven network application framework designed for rapid development of maintainable, high-performance protocol servers and clients. In versions prior to 4.1.71.Final, Netty would skip control characters when they appeared at the beginning or end of a header name...
Astra Linux – Vulnerability in Chromium
Insufficient policy enforcement in navigations in Google Chrome prior to 89.0.4389.72 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page...
Astra Linux – Vulnerability in libuv1
Node.js versions prior to 16.4.1, 14.17.2, and 12.22.2 are vulnerable to an out-of-bounds read when the uvidnatoascii function is used to convert strings to ASCII. The pointer p is read and incremented without checking whether it lies beyond pe, where pe holds a pointer to the end of the buffer...
Astra Linux – Vulnerability in WebKit2GTK
A memory management issue related to “use after free” operations has been addressed through improved memory management practices. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 14.2, iPadOS 14.2, iCloud for Windows 11.5, Safari 14.0.1, tvOS 14.2, and iTunes 12.11 for Windows...
Astra Linux – Vulnerability in Chromium
A heap buffer overflow in Blink in Google Chrome prior to version 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...
Astra Linux – Vulnerability in ffmpeg
A buffer overflow vulnerability exists in FFmpeg 4.2, specifically in the filtervertically8 function within libavfilter/vfavgblur.c. This vulnerability could lead to a remote Denial of Service attack...
Astra Linux – Vulnerability in Chromium
Insufficient policy enforcement regarding cookies in Google Chrome prior to version 91.0.4472.77 allowed a remote attacker to bypass cookie policies through a crafted HTML page...
Astra Linux – Vulnerability in ncurses
A issue was discovered in ncurses through v6.2-1. nccaptoinfo in captoinfo.c has a heap-based buffer overflow...
Astra Linux – Vulnerability in Firefox and Thunderbird
An incorrect type conversion of sizes from 64-bit to 32-bit integers allowed an attacker to corrupt memory, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird 91.4.0, Firefox ESR 91.4.0, and Firefox 95...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to obtain potentially sensitive information from the disk via a crafted HTML page...
Astra Linux – Vulnerability in Chromium
Before version 87.0.4280.88, using free memory in the clipboard in Google Chrome allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...
Astra Linux – Vulnerability in Zabbix
In Zabbix versions 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code within this controller calls diableSIDValidation within the init method. An...
Astra Linux – Vulnerability in Firefox
Mozilla developers and community members reported memory safety bugs in Firefox 87. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability affects Firefox versio...
Astra Linux – Vulnerability in libxstream-java
XStream is a simple library for serializing objects to XML and back again. In affected versions, this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. No users are affected if they follow the recommendation...
Astra Linux – Vulnerability in Chromium
Before version 91.0.4472.114, using “after free” in TabGroups in Google Chrome allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption through a crafted HTML page...
Astra Linux – Vulnerability in imagemagick
A floating-point mathematical calculation within the ScaleAnyToQuantum function in /MagickCore/quantum-private.h could lead to undefined behavior, resulting in a value that falls outside the range of the type unsigned long long. This flaw can be triggered by a malicious input file under certain...
Astra Linux – Vulnerability in openjdk-11
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. The supported versions affected are Java SE: 7u311, 8u301, 11.0.12; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. This easily exploitable vulnerability allows an unauthenticated...
Astra Linux – Vulnerability in Linux
A flaw was discovered in the way RTAS handled memory accesses in user space for kernel communication. In a guest system that is under lockdown usually due to Secure Boot, running on top of PowerVM or KVM hypervisors pseries platform, a root-like local user could exploit this flaw to further...
Astra Linux – Vulnerability in docker.io-app
Moby is an open-source container framework. In versions prior to 29.5.1, as well as in moby/moby v2 before v2.0.0-beta.14, when a compressed archive was uploaded to a container via PUT /containers/id/archive or piped through docker cp -, the daemon would resolve the decompression binaries such as...
Astra Linux – Vulnerability in Linux, Linux 5.10
In the Linux kernel up to version 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory through a Speculative Store Bypass side-channel attack. This occurs because a certain preempting store operation does not necessarily occur before a store operation whose valu...
Astra Linux – Vulnerability in RustC
In the standard library of Rust before version 1.51.0, the Zip implementation calls iteratorgetunchecked more than once for the same index when it’s nested. This bug can lead to a memory safety violation due to a failure to meet the safety requirements of the TrustedRandomAccess trait...
Astra Linux – Vulnerability in Chromium
Inappropriate implementations of performance APIs in Google Chrome prior to version 89.0.4389.72 allowed a remote attacker to leak cross-origin data through a crafted HTML page...
Astra Linux – Vulnerability in exiv2
There is a vulnerability in the SEGV method in Exiv2::Internal::TiffParserWorker::findPrimaryGroups of the tiffimageint.cpp file, within Exiv2 0.27-RC3. A crafted input can lead to a remote denial-of-service attack...
Astra Linux – Vulnerability in libxml2
In libxml2 version 2.9.13, the valid.c file contains a use-after-free issue with the ID and IDREF attributes...
Astra Linux – Vulnerability in libde265
A issue was discovered in libde265 v1.0.8. There is a heap-use-after-free issue in intrapred.h when decoding files using dec265...
Astra Linux – Vulnerability in Chromium
A heap buffer overflow in Media Feeds in Google Chrome prior to version 90.0.4430.212 allowed an attacker who convinced a user to enable certain features in Chrome to potentially exploit heap corruption through a crafted HTML page...
Astra Linux – Vulnerability in netcdf
A issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxmlcharcontent places a pointer to the internal address of a larger block as xml-txt. This pointer is later deallocated using free, resulting in a segmentation fault...
Astra Linux – Vulnerability in Chromium
Chromium: CVE-2021-30608 – Use after free in Web Share...
Astra Linux – Vulnerability in Golang-1.15
In Go versions before 1.15.13 and 1.16.x, as well as before 1.16.5, certain configurations of ReverseProxy from net/http/httputil lead to a situation where an attacker can drop arbitrary headers...
Astra Linux – Vulnerability in Apache2
The Apache HTTP Server protocol handler for the HTTP/2 protocol checks the received request headers against the size limitations configured for the server. These restrictions are also applied to the HTTP/1 protocol. If any violations occur, an HTTP response is sent to the client with a status cod...
Astra Linux – Vulnerability in glibc
The iconv function in the GNU C Library also known as glibc or libc6 versions 2.32 and earlier, when processing invalid multi-byte input sequences in encodings such as IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399, fails to advance the input state properly. This can lead to an infinite loop in...
Astra Linux – Vulnerability in golang-github-gin-gonic-gin
This affects all versions of the package github.com/gin-gonic/gin. When gin is exposed directly to the internet, a client’s IP address can be spoofed by setting the X-Forwarded-For header...