22497 matches found
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Do not leak memory if devsetname fails. When devsetname fails, zcdncreate does not free the newly allocated resources. Fix this issue...
Astra Linux – Vulnerability in Vim
Heap-based Buffer Overflow in the GitHub repository for vim/vim before version 8.2...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: fs/ntfs3: Enhanced sanity check during attribute list generation The nicreateattrlist function uses WARNON to catch error cases during attribute list generation. Currently, it only prints the stack trace, which may not be...
Astra Linux – Vulnerability in busybox
A use-after-free condition in Busybox’s awk applet leads to denial of service and potentially code execution when processing a crafted awk pattern in the nextinputfile function...
Astra Linux – Vulnerability in Linux
In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: hcicore: Fixed possible buffer overflow issues. The struct hcidevinfo structure has a name8 field with a fixed size. In cases where hdev-name is larger than this size, strcpy would attempt to write beyond its size...
Astra Linux – Vulnerability in Vim
Out-of-bounds read in the GitHub repository for Vim before version 9.0.0104...
Astra Linux – Vulnerability in Firefox and Thunderbird
It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an insufficient activation-delay. This vulnerability affects Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4.1...
Astra Linux – Vulnerability in Parsec
The vulnerability of the pdp-ls utility in the PARSEC security subsystem is related to improper memory release after its use. Exploiting this vulnerability allows an attacker to cause a service failure...
Astra Linux – Vulnerability in Chromium
Using “after free” in FedCM in Google Chrome before version 146.0.7680.165 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: f2fs: prevents kernel warnings due to negative inlink in corrupted images WARNING: CPU: 1 PID: 9426 at fs/inode.c:417 dropnlink+0xac/0xd0 home/cc/linux/fs/inode.c:417 Modules linked in: CPU: 1 UID: 0 PID: 9426 Comm: syz-executor5...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: mm/swap: fixed a race condition when skipping swapcache When skipping swapcache for SWPSYNCHRONOUSIO, if two or more threads swap the same entry at the same time, they may obtain different pages A, B. Before one thread T0 finishe...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in Payments in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: crypto: arm64/neonbs – fixed an issue of out-of-bounds access due to short inputs. The bit-sliced implementation of AES-CTR operates on blocks of 128 bytes. For tail blocks or inputs that are shorter than 128 bytes, it will fall...
Astra Linux – Vulnerability in ffmpeg
There is a heap-based Buffer Overflow vulnerability in FFmpeg 4.2, located in libavfilter/vfcolorconstancy.c, specifically in the slicegetderivative function within fadegetderivative. This vulnerability may lead to memory corruption and other potential issues...
Astra Linux – Vulnerability in ffmpeg
A denial-of-service vulnerability exists in FFmpeg 4.2 due to a memory leak in the ffframepoolget function in framepool.c...
Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: Fixed the issue where f2fswaitonpagewriteback was called in f2fswriterawpages. A BUG will be triggered when writing files concurrently, because the same page may be written back multiple times. The bug occurs at...
Astra Linux – Vulnerability in xrdp
xrdp is an open-source project that provides a graphical login to remote machines using the Microsoft Remote Desktop Protocol RDP. xrdp versions prior to 0.9.21 contain a buffer overflow in the audinsendopen function. There are no known workarounds for this issue. Users are advised to upgrade...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in Views in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
The use of “after free” in CSS in Google Chrome before version 127.0.6533.72 allowed a remote attacker who convinced a user to perform certain UI gestures to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Before version 148.0.7778.96, using free in the UI of Google Chrome allowed a remote attacker who had compromised the renderer process to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in Site Isolation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass content security policy via a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
The use of “after free” in Extensions in Google Chrome before version 114.0.5735.90 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
The use of Mojo with “after free” in Google Chrome before version 122.0.6261.57 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in rsync
There is a path traversal vulnerability in rsync. This vulnerability stems from a behavior enabled by the --inc-recursive option, which is a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the --inc-recursive...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: seg6: A separate dstcache is used for input and output paths in the seg6 lwtunnel. The seg6 lwtunnel uses a single dstcache per encap route, which is shared between seg6inputcore and seg6outputcore. These two paths can perform th...
Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1
In the Linux kernel, the following vulnerability has been resolved: Thermal: Prevent potential string overflows. The dev-id value comes from idaalloc, so it’s a number between zero and INTMAX. If it’s too high, the sprintf functions will cause overflow...
Astra Linux – Vulnerability in Chromium
“Type Confusion in V8” in Google Chrome before version 129.0.6668.100 allowed a remote attacker to perform an out-of-bounds memory write through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in openjdk-11
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. The supported versions affected by this vulnerability are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2 and 21.1.0. The vulnerability is difficult t...
Astra Linux – Vulnerability in python-kdcproxy
If kdcproxy receives a request for a realm whose configuration does not define any server addresses, it will, by default, query DNS zone records that match the requested realm name. This creates a server-side request-forgery vulnerability, as an attacker could send a request for a realm that...
Astra Linux – Vulnerability in gst-plugins-bad1.0
A out-of-bounds read vulnerability was discovered in the VA JPEG decoder within GStreamer’s gst-plugins-bad. The JPEG parser reads the segment length value from the bitstream without validating it against available data. A remote attacker could trick a user into opening a specially crafted JPEG...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: espintcp: A race condition in espintcpclose has been fixed. This issue was discovered during a code audit. After espintcpclose is called, espintcptxwork can still be scheduled using functions like the Delayed ACK handler or...
Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Update log-pagemask,bits if log-pagesize changes. If an NTFS file system is mounted to another system with a different PAGESIZE than the original system, log-pagesize will change in logreplay, but log-pagemask,bits will...
Astra Linux – Vulnerability in Zabbix
The cause of the vulnerability is improper validation of the “Name” field in the form input on the Graph page in the Items section...
Astra Linux – Vulnerability in ffmpeg
A memory corruption issue in the mpegmuxwritepacket function in libavformat/mpegenc.c of FFmpeg 4.2 can lead to a denial of service DOS attack through a specially crafted AVI file...
Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15
In the Linux kernel, the following vulnerability has been resolved: jfs: Fixed an out-of-bounds shift in dbDiscardAG. When searching for the next smaller log2 block, BLKSTOL2 returned 0, causing the shift exponent -1 to become negative. This patch fixes the issue by exiting the loop directly when...
Astra Linux – Vulnerability in Squid
A buffer overflow was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection, the SSPI and SMB authentication helpers were vulnerable to reading unintended memory locations. In some configurations, cleartext credentials from these locations were sent to a...
Astra Linux – Vulnerability in Linux
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: A sysfs leak was fixed in allociommu. The iommudevicesysfsadd function is called before this, so it must be cleaned up in subsequent errors...
Astra Linux – Vulnerability in Linux, Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: scsi: bnx2fc: Flush destroywork queue before calling bnx2fcinterfaceput The bnx2fcdestroy function removes the interface before calling destroywork. This causes multiple WARNings from sysfsremovegroup, as the controller rport...
Astra Linux – Vulnerability in Golang-1.19
Templates do not properly handle backticks as JavaScript string delimiters, and do not escape them as expected. Backticks have been used since ES6 for JavaScript template literals. If a template contains a Go template action within a JavaScript template literal, the contents of the action can be...
Astra Linux – Vulnerability in pillow
A issue was discovered in Pillow before version 8.2.0. For BLP data, BlpImagePlugin did not properly check the returned data after jumping to file offsets. This could lead to a denial-of-service attack, where the decoder could be executed multiple times with empty data...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: Wifi: nl80211 – Reject the “COOKFRAMES” flag if it is set along with other flags. It is possible for users to set both MONITORFLAGCOOKFRAMES and MONITORFLAGACTIVE flags simultaneously on the same monitor interface from the user...
Astra Linux – Vulnerability in Zabbix
A authenticated user can create a link containing reflected JavaScript code for a graph page and send it to other users. The payload can only be executed with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all the sa...
Astra Linux – Vulnerability in busybox
A flaw was discovered in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by creating a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead...
Astra Linux – Vulnerability in Chromium
In Google Chrome’s spell check feature, before version 91.0.4472.101, an attacker who convinced a user to install a malicious extension could potentially exploit heap corruption through a crafted HTML page...
Astra Linux – Vulnerability in Chromium
A heap buffer overflow in ANGLE in Google Chrome prior to version 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Tomcat9
Improper neutralization of script-related HTML tags in a web page constitutes an XSS vulnerability in the number guessing example for Apache Tomcat. This issue affects Apache Tomcat versions as follows: 11.0.0-M1 through 11.0.22, 10.1.0-M1 through 10.1.55, 9.0.0.M1 through 9.0.118, 8.5.0 through...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Prevents handling of any completions after the destruction of a QP Queue Pair. The hardware may generate completions indicating that the QP has been destroyed. The driver should not schedule any completion handlers f...
Astra Linux – Vulnerability in dovecot
The attacker can upload a malicious Sieve script through the ManageSieve service or locally to bypass the configured CPU time limits for Sieve up to 130 times the configured limit. This allows the attacker to degrade server performance and bypass the configured CPU time limits for Sieve scripts. ...
Astra Linux – Vulnerability in Chromium
Insufficient policy enforcement in downloads in Google Chrome prior to 148.0.7778.96 allowed a local attacker to bypass navigation restrictions through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Firefox and Thunderbird
Mozilla developers reported memory safety bugs in Firefox 90 and Firefox ESR 78.12. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability affects Thunderbird...