21806 matches found
Astra Linux – Vulnerability in Firefox
Memory safety bugs exist in Firefox 126. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability affects Firefox versions prior to 127...
Astra Linux – Vulnerability in Chromium
Type Confusion in V8 in Google Chrome before version 126.0.6478.54 allowed a remote attacker to perform an out-of-bounds memory write through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Using “after free” in Dawn in Google Chrome before version 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Firefox and Thunderbird
A race condition could allow a cross-origin container to obtain permissions from the top-level origin. This vulnerability affects Firefox 128, Firefox ESR 115.13, Thunderbird 115.13, and Thunderbird 128...
Astra Linux – Vulnerability in bluez
BlueZ Audio Profile: Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected BlueZ installations. User interaction is required to exploit this vulnerability, as the target must...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in Extensions in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to bypass site isolation through a crafted Chrome Extension. Chromium security severity: High...
Astra Linux – Vulnerability in Firefox and Thunderbird
A permission leak could have occurred from a trusted site to an untrusted site through embed or object elements. This vulnerability affects Firefox 132, Firefox ESR 128.4, Firefox ESR 115.17, Thunderbird 128.4, and Thunderbird 132...
Astra Linux – Vulnerability in Firefox and Thunderbird
An attacker could exploit a “use-after-free” condition when accessibility is enabled, resulting in a potentially exploitable crash. This vulnerability affects Firefox 132, Firefox ESR 128.4, Firefox ESR 115.17, Thunderbird 128.4, and Thunderbird 132...
Astra Linux – Vulnerability in Firefox and Thunderbird
By sending a specially crafted push message, a remote server could have terminated the parent process, causing the browser to become unresponsive. This vulnerability affects Firefox 132, Firefox ESR 128.4, Thunderbird 128.4, and Thunderbird 132...
Astra Linux – Vulnerability in Firefox
Potential race conditions in IndexedDB could have caused memory corruption, resulting in a potentially exploitable crash. This vulnerability affects Firefox 132 and Thunderbird 132...
Astra Linux – Vulnerability in Chromium
Before version 130.0.6723.92, Dawn in Google Chrome allowed a remote attacker to perform out-of-bounds memory access through a crafted HTML page. Chromium security severity: Critical...
Astra Linux – Vulnerability in Chromium
The use of after-free in WebRTC in Google Chrome before version 130.0.6723.92 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in LibreOffice
Improper limitation of a pathname to a restricted directory “Path Traversal” vulnerability in The Document Foundation LibreOffice allows for absolute path traversal. An attacker can write to arbitrary locations, even those prefixed with “.ttf”, by providing a file in a format that supports embedd...
Astra Linux – Vulnerability in LibreOffice
The Document Foundation LibreOffice has a vulnerability where environmental variables and arbitrary INI file values may be exposed to unauthorized actors. URLs can be created that expand environmental variables or INI file values, allowing potentially sensitive information to be exfiltrated to a...
Astra Linux – Vulnerability in dovecot
Very large headers can cause resource exhaustion when parsing messages. The message parser usually reads relatively small chunks of the message. However, when these smaller chunks are fed into the message-header parser, the “fullvalue” buffer starts to grow excessively. The “fullvalue” buffer has...
Astra Linux – Vulnerability in ffmpeg, ffmpeg5
It was discovered that FFmpeg version n6.1.1 contains a heap use-after-free issue through the avhwframectxinit function...
Astra Linux – Vulnerability in ffmpeg5
It was discovered that FFmpeg versions n5.1 to n6.1 contain an Off-by-one Error vulnerability in the libavfilter/avfshowspectrum.c file. This vulnerability allows attackers to cause a Denial of Service DoS attack through crafted inputs...
Astra Linux – Vulnerability in Jinja2
Jinja is an extensible templating engine. The xmlattr filter in affected versions of Jinja accepts keys that contain non-attribute characters. XML/HTML attributes cannot contain spaces, /, , or =, as each of these characters would then be interpreted as starting a separate attribute. If an...
Astra Linux – Vulnerability in ffmpeg5, ffmpeg
FFmpeg n6.1.1 has an integer overflow vulnerability. The vulnerability resides in the parseoptions function in the sbgdec.c file, within the libavformat module. When parsing certain options, the software does not properly validate the input. This allows negative duration values to be accepted...
Astra Linux – Vulnerability in ffmpeg5, ffmpeg
An integer overflow in the component /libavformat/westwoodvqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application through a malicious VQA file...
Astra Linux – Vulnerability in Squid
Squid is a caching proxy for the web that supports HTTP, HTTPS, FTP, and other protocols. Due to an out-of-bounds write vulnerability when assigning ESI variables, Squid is susceptible to a memory corruption error. This error can lead to a denial-of-service attack...
Astra Linux – Vulnerability in wget
In GNU Wget version 1.24.5, url.c handles semicolons in the userinfo subcomponent of a URI incorrectly. As a result, there may be insecure behaviors where data that should be within the userinfo subcomponent is misinterpreted as being part of the host subcomponent...
Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: rcu-tasks: Fixed the buffer overflow in showrcutasksTracegpkthread. There is a possibility of buffer overflow in showrcutasksTracegpkthread if the counters passed to sprintf are very large. The counter values used for this functi...
Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fixed a potential use-after-free issue in irqprocessworklist. The listforeachentry Safe function was used to allow iterating through the list and deleting entries during the iteration process. The descriptors are...
Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: netns: Ensure that getnetns handles zero refcount nets properly. Syzkaller encountered a warning: refcountt: Addition on 0; use-after-free. WARNING: CPU: 3 PID: 7890 at lib/refcount.c:25 refcountwarnsaturate+0xdf/0x1d0 Linked...
Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: Net: Ethernet: lantiqetop: fixed a double-free condition in the “detach” operation. The number of descriptors that have been released so far is never incremented, which results in the same skb being released multiple times...
Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: net/iucv: Avoid explicit allocation of the cpumask variable on the stack. For the CONFIGCPUMASKOFFSTACK=y kernel, explicit allocation of the cpumask variable on the stack is not recommended, as it may cause a potential stack...
Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: wifi: mt76: replace skbput with skbputzero Avoid potentially reusing uninitialized data...
Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fixed a use-after-free issue related to the destruction of CM IDs. The function iwconnreqhandler associates a new struct rdmaidprivate named connid with an existing struct iwcmid named cmid as follows: c connid-cmid.iw...
Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: tipc: Returning a non-zero value from tipcudpaddr2str on error The tipcudpaddr2str function should return a non-zero value if the UDP media address is invalid. Otherwise, a buffer overflow attack may occur in tipcmediaaddrprintf...
Astra Linux – Vulnerability in GhostScript
A issue was discovered in psi/zcolor.c in Artifex Ghostscript prior to version 10.04.0. There is a buffer overflow vulnerability when reading colors from the indexed color space...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: A NULL pointer dereference issue was fixed in hnsrocemapmrsg. The function ibmapmrsg allows ULPs to specify NULL as the sgoffset argument. The driver needs to check whether the argument is a NULL pointer before...
Astra Linux – Vulnerability in ffmpeg5
A vulnerability, classified as critical, was discovered in FFmpeg up to version 5.1.5. This vulnerability affects the fillaudiodata function in the file /libswresample/swresample.c. The vulnerability leads to a heap-based buffer overflow. The attack can be initiated remotely. This issue was fixed...
Astra Linux – Vulnerability in Firefox
Incorrect garbage collection interactions could lead to a use-after-free vulnerability. This vulnerability affects Firefox versions earlier than 129...
Astra Linux – Vulnerability in Firefox, NSS
Calling PK11Encrypt in NSS using CKMCHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy Bridge processor. In Firefox, this only affects the QUIC header protection feature when the connection uses the ChaCha20-Poly1305 cipher suite. The most likely outcome i...
Astra Linux – Vulnerability in Chromium
Out-of-bounds memory access in ANGLE in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: Critical...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in V8 in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to potentially perform out-of-bounds memory access via a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Firefox and Thunderbird
A compromised content process could have allowed for the arbitrary loading of cross-origin pages. This vulnerability affects Firefox 131, Firefox ESR 128.3, Firefox ESR 115.16, Thunderbird 128.3, and Thunderbird 131...
Astra Linux – Vulnerability in Chromium
No description...
Astra Linux – Vulnerability in Firefox and Thunderbird
A potential memory corruption vulnerability could be triggered if an attacker had the ability to cause a “Out-of-Memory” exception at a specific moment during JIT compilation. This vulnerability affects Firefox 131, Firefox ESR 128.3, Thunderbird 128.3, and Thunderbird 131...
Astra Linux – Vulnerability in Firefox and Thunderbird
Memory safety bugs exist in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability...
Astra Linux – Vulnerability in Firefox and Thunderbird
An attacker was able to execute code in the content process by exploiting a use-after-free in Animation timelines. There have been reports of this vulnerability being exploited in real-world scenarios. This vulnerability affects Firefox 131.0.2, Firefox ESR 128.3.1, Firefox ESR 115.16.1,...
Astra Linux – Vulnerability in libxml2
It was discovered that Xmlsoft Libxml2 v2.11.0 contains an out-of-bounds read vulnerability through the xmlSAX2StartElement function located at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service DoS by providing a crafted XML file. NOTE: the vendor’s position is tha...
Astra Linux – Vulnerability in libstb
STBVorbis is a single-file library licensed under MIT that processes OGG Vorbis files. A maliciously crafted file may trigger an out-of-bounds write operation in f-vendori = get8packetf;. The root cause is an integer overflow in setupmalloc. A sufficiently large value in the variable sz causes an...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: Media: aspeed – Fixed memory overwriting issues when the resolution is 1600x900. When displaying at a resolution of 1600x900, the system may crash if the system’s memory usage is tight. How to reproduce this issue: 1. Use a...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in the FileSystem in Google Chrome prior to 131.0.6778.69 allowed a remote attacker to bypass filesystem restrictions through a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in Blink in Google Chrome prior to 131.0.6778.69 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Thunderbird
Using remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird versions earlier than 128.4.3 and Thunderbird version 132.0.1...
Astra Linux – Vulnerability in bind9
It is possible to create a zone such that certain queries to it will generate responses containing numerous records in the Additional section. An attacker sending multiple such queries can cause either the authoritative server or an independent resolver to use excessive resources to process the...
Astra Linux – Vulnerability in Firefox and Thunderbird
The Enhanced Tracking Protection’s Strict mode may have inadvertently allowed a CSP frame-src bypass and DOM-based XSS attacks through the Google SafeFrame shim in the Web Compatibility extension. This issue could have exposed users to malicious frames disguised as legitimate content. This...