Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 9 articles for you...
172
security advisorydenial of serviceaccess controlUbuntu 18.04 LTS USN-5339-1 Critical: Kernel Access Issues
Several security issues were fixed in the Linux kernel.. =========================================================================Ubuntu Security Notice USN-5339-1 March 22, 2022 linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-dell300x, linux-hwe, linux-gcp-4.15, linux-kvm, linux-oracle, linux-snapdragon vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS - Ubuntu 16.04 ESM - Ubuntu 14.04 ESM Summary: Several security issues were fixed in the Linux kernel. Software Description: - linux: Linux kernel - linux-aws: Linux kernel for Amazon Web Services (AWS) systems - linux-azure-4.15: Linux kernel for Microsoft Azure Cloud systems - linux-dell300x: Linux kernel for Dell 300x platforms - linux-gcp-4.15: Linux kernel for Google Cloud Platform (GCP) systems - linux-kvm: Linux kernel for cloud environments - linux-oracle: Linux kernel for Oracle Cloud systems - linux-snapdragon: Linux kernel for Qualcomm Snapdragon processors- linux-aws-hwe: Linux kernel for Amazon Web Services (AWS-HWE) systems - linux-hwe: Linux hardware enablement (HWE) kernel - linux-azure: Linux kernel for Microsoft Azure Cloud systems Details: Yiqi Sun and Kevin Wang discovered that the cgroups implementation in the Linux kernel did not properly restrict access to the cgroups v1 release_agent feature. A local attacker could use this to gain administrative privileges. (CVE-2022-0492) It was discovered that an out-of-bounds (OOB) memory access flaw existed in the f2fs module of the Linux kernel. A local attacker could use this issue to cause a denial of service (system crash). (CVE-2021-3506) Brendan Dolan-Gavitt discovered that the Marvell WiFi-Ex USB device driver in the Linux kernel did not properly handle some error conditions. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2021-43976) It was discovered that the ARM Trusted ExecutionEnvironment (TEE) subsystem in the Linux kernel contained a race condition leading to a use- after-free vulnerability. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2021-44733) It was discovered that the Phone Network protocol (PhoNet) implementation in the Linux kernel did not properly perform reference counting in some error conditions. A local attacker could possibly use this to cause a denial of service (memory exhaustion). (CVE-2021-45095) Samuel Page discovered that the Transparent Inter-Process Communication (TIPC) protocol implementation in the Linux kernel contained a stack-based buffer overflow. A remote attacker could use this to cause a denial of service (system crash) for systems that have a TIPC bearer configured. (CVE-2022-0435) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS: linux-image-4.15.0-1038-dell300x 4.15.0-1038.43 linux-image-4.15.0-1090-oracle 4.15.0-1090.99 linux-image-4.15.0-1110-kvm 4.15.0-1110.113 linux-image-4.15.0-1119-gcp 4.15.0-1119.133 linux-image-4.15.0-1123-snapdragon 4.15.0-1123.132 linux-image-4.15.0-1124-aws 4.15.0-1124.133 linux-image-4.15.0-1134-azure 4.15.0-1134.147 linux-image-4.15.0-173-generic 4.15.0-173.182 linux-image-4.15.0-173-generic-lpae 4.15.0-173.182 linux-image-4.15.0-173-lowlatency 4.15.0-173.182 linux-image-aws-lts-18.04 4.15.0.1124.127 linux-image-azure-lts-18.04 4.15.0.1134.107 linux-image-dell300x 4.15.0.1038.40 linux-image-gcp-lts-18.04 4.15.0.1119.138 linux-image-generic 4.15.0.173.162 linux-image-generic-lpae 4.15.0.173.162 linux-image-kvm 4.15.0.1110.106 linux-image-lowlatency 4.15.0.173.162 linux-image-oracle-lts-18.04 4.15.0.1090.100 linux-image-snapdragon 4.15.0.1123.126 linux-image-virtual 4.15.0.173.162 Ubuntu 16.04 ESM: linux-image-4.15.0-1090-oracle 4.15.0-1090.99~16.04.1 linux-image-4.15.0-1124-aws-hwe 4.15.0-1124.133~16.04.1 linux-image-4.15.0-173-generic 4.15.0-173.182~16.04.1 linux-image-4.15.0-173-lowlatency 4.15.0-173.182~16.04.1 linux-image-aws-hwe 4.15.0.1124.114 linux-image-generic-hwe-16.04 4.15.0.173.165 linux-image-lowlatency-hwe-16.04 4.15.0.173.165 linux-image-oem 4.15.0.173.165 linux-image-oracle 4.15.0.1090.78 linux-image-virtual-hwe-16.04 4.15.0.173.165 Ubuntu 14.04 ESM: linux-image-4.15.0-1134-azure 4.15.0-1134.147~14.04.1 linux-image-azure 4.15.0.1134.107 After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well. References: https://ubuntu.com/security/notices/USN-5339-1 CVE-2021-3506, CVE-2021-43976, CVE-2021-44733, CVE-2021-45095, CVE-2022-0435, CVE-2022-0492 Package Information: https://launchpad.net/ubuntu/+source/linux/4.15.0-173.182 https://launchpad.net/ubuntu/+source/linux-aws/4.15.0-1124.133 https://launchpad.net/ubuntu/+source/linux-azure-4.15/4.15.0-1134.147 https://launchpad.net/ubuntu/+source/linux-dell300x/4.15.0-1038.43 https://launchpad.net/ubuntu/+source/linux-gcp-4.15/4.15.0-1119.133 https://launchpad.net/ubuntu/+source/linux-kvm/4.15.0-1110.113 https://launchpad.net/ubuntu/+source/linux-oracle/4.15.0-1090.99 https://launchpad.net/ubuntu/+source/linux-snapdragon/4.15.0-1123.132 . Critical security patches for Ubuntu have addressed multiple severe vulnerabilities in the Linux kernel, enhancing system integrity and reliability.. Linux Kernel Fixes, UrgentSecurity Update, System Update Instructions, Administrative Access, Denial of Service. . Severity: Critical. LinuxSecurity.com Team
Mar 22, 2022
•Critical
Ubuntu
91
security advisorygentooemail serverGentoo: GLSA-202006-24 Normal: Postfix Security Issue Causes DoS Attack
An error in Cyrus IMAP Server allows mailboxes to be created with administrative privileges.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202006-23 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Cyrus IMAP Server: Access restriction bypass Date: June 15, 2020 Bugs: #703630 ID: 202006-23 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= An error in Cyrus IMAP Server allows mailboxes to be created with administrative privileges. Background ========= The Cyrus IMAP Server is an efficient, highly-scalable IMAP e-mail server. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-mail/cyrus-imapd < 3.0.13 > = 3.0.13 Description ========== An issue was discovered in Cyrus IMAP Server where sieve script uploading is excessively trusted. Impact ===== A user can use a sieve script to create any mailbox with administrator privileges. Workaround ========= Disable sieve script uploading until the upgrade is complete. Resolution ========= All Cyrus IMAP Server users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =net-mail/cyrus-imapd-3.0.13" References ========= [ 1 ] CVE-2019-19783 https://nvd.nist.gov/vuln/detail/CVE-2019-19783 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202006-23 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and securityof our users' machines is of utmost importance to us. Any security concerns should be addressed to
Jun 15, 2020
Gentoo
172
security advisorydenial of serviceUbuntuUbuntu 12.04 ESM USN-3717-2 Moderate: PolicyKit Denial of Service
Several security issues were fixed in PolicyKit.. =========================================================================Ubuntu Security Notice USN-3717-2 July 17, 2018 policykit-1 vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 12.04 ESM Summary: Several security issues were fixed in PolicyKit. Software Description: - policykit-1: framework for managing administrative policies and privileges Details: USN-3717-1 fixed a vulnerability in PolicyKit. This update provides the corresponding update for Ubuntu 12.04 ESM. Original advisory details: It was discovered that PolicyKit incorrectly handled certain duplicate action IDs. A local attacker could use this issue to cause PolicyKit to crash, resulting in a denial of service, or possibly escalate privileges. (CVE-2015-3255) Matthias Gerstner discovered that PolicyKit incorrectly checked users. A local attacker could possibly use this issue to cause authentication dialogs to show up for other users, leading to a denial of service or an information leak. (CVE-2018-1116) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 12.04 ESM: libpolkit-backend-1-0 0.104-1ubuntu1.2 After a standard system update you need to reboot your computer to make all the necessary changes. References: https://ubuntu.com/security/notices/USN-3717-2 https://ubuntu.com/security/notices/USN-3717-1 CVE-2015-3255, CVE-2018-1116 . Multiple vulnerabilities addressed in PolicyKit for Ubuntu 12.04 ESM. Please update promptly to mitigate denial of service and reduce potential exploitation.. PolicyKit Vulnerabilities, Ubuntu ESM, Denial Of Service Trouble. . LinuxSecurity.com Team
Jul 17, 2018
Ubuntu
172
security advisorydenial of serviceupdate instructionsUbuntu 16.04 LTS USN-3249-1 Critical: Kernel Crash Risk and Access Issues
The system could be made to crash or run programs as an administrator.. =========================================================================Ubuntu Security Notice USN-3249-1 March 29, 2017 linux, linux-aws, linux-gke, linux-raspi2, linux-snapdragon vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS Summary: The system could be made to crash or run programs as an administrator. Software Description: - linux: Linux kernel - linux-aws: Linux kernel for Amazon Web Services (AWS) systems - linux-gke: Linux kernel for Google Container Engine (GKE) systems - linux-raspi2: Linux kernel for Raspberry Pi 2 - linux-snapdragon: Linux kernel for Snapdragon Processors Details: It was discovered that the xfrm framework for transforming packets in the Linux kernel did not properly validate data received from user space. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code with administrative privileges. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS: linux-image-4.4.0-1009-gke 4.4.0-1009.9 linux-image-4.4.0-1012-aws 4.4.0-1012.21 linux-image-4.4.0-1051-raspi2 4.4.0-1051.58 linux-image-4.4.0-1054-snapdragon 4.4.0-1054.58 linux-image-4.4.0-71-generic 4.4.0-71.92 linux-image-4.4.0-71-generic-lpae 4.4.0-71.92 linux-image-4.4.0-71-lowlatency 4.4.0-71.92 linux-image-4.4.0-71-powerpc-e500mc 4.4.0-71.92 linux-image-4.4.0-71-powerpc-smp 4.4.0-71.92 linux-image-4.4.0-71-powerpc64-smp 4.4.0-71.92 linux-image-aws 4.4.0.1012.15 linux-image-generic 4.4.0.71.77 linux-image-generic-lpae 4.4.0.71.77 linux-image-gke 4.4.0.1009.11 linux-image-lowlatency 4.4.0.71.77 linux-image-powerpc-e500mc 4.4.0.71.77 linux-image-powerpc-smp 4.4.0.71.77 linux-image-powerpc64-smp 4.4.0.71.77 linux-image-raspi2 4.4.0.1051.52 linux-image-snapdragon 4.4.0.1054.47 After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well. References: https://ubuntu.com/security/notices/USN-3249-1 CVE-2017-7184 Package Information: https://launchpad.net/ubuntu/+source/linux/4.4.0-71.92 https://launchpad.net/ubuntu/+source/linux-aws/4.4.0-1012.21 https://launchpad.net/ubuntu/+source/linux-gke/4.4.0-1009.9 https://launchpad.net/ubuntu/+source/linux-raspi2/4.4.0-1051.58 https://launchpad.net/ubuntu/+source/linux-snapdragon/4.4.0-1054.58 . Debian DSA-4821-1 fixes a significant bug in the Linux kernel that permits system freezes or unauthorized program execution by elevated users.. linux kernel updates, ubuntu security, kernel crash prevention, administrative access, system integrity. . Severity: Critical. LinuxSecurity.com Team
Mar 30, 2017
•Critical
Ubuntu
89
security advisorymoderatefedoraFedora 24: FEDORA-2016-608be17784 Moderate Risk in python-wikitcms Code
This update contains a **SECURITY** fix for an issue with potentially serious consequences but very limited scope. If an administrator of a wiki you talked to using python-wikitcms were malicious, they could cause arbitrary code execution as the user running wikitcms. No-one besides a wiki administrator could do this, as it requires crafting the wiki's response to an edit request to include a. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2016-608be17784 2016-12-27 18:30:41.362689 -------------------------------------------------------------------------------- Name : python-wikitcms Product : Fedora 24 Version : 2.1.10 Release : 1.fc24 URL : https://pagure.io/fedora-qa/python-wikitcms Summary : Fedora QA wiki test management Python library Description : python-wikitcms is a library for interacting with Fedora's wiki-based 'test management' system. It can: * Create the pages for release validation test events * Find existing release validation event pages, in various ways * Report test results The wiki-based test management system itself is documented at: https://fedoraproject.org/wiki/Wikitcms -------------------------------------------------------------------------------- Update Information: This update contains a **SECURITY** fix for an issue with potentially serious consequences but very limited scope. If an administrator of a wiki you talked to using python-wikitcms were malicious, they could cause arbitrary code execution as the user running wikitcms. No-one besides a wiki administrator could do this, as it requires crafting the wiki's response to an edit request to include a malicious payload. It also drops some now useless or unneeded code (due to changes in mediawiki and mwclient). -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade python-wikitcms' at the command line. For moreinformation, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Dec 27, 2016
Fedora
172
security advisorydenial of servicevulnerabilityUbuntu 16.04 LTS USN-2979-1 Critical: Kernel DoS Risks and Fixes
Several security issues were fixed in the kernel.. =========================================================================Ubuntu Security Notice USN-2979-1 May 16, 2016 linux vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS Summary: Several security issues were fixed in the kernel. Software Description: - linux: Linux kernel Details: David Matlack discovered that the Kernel-based Virtual Machine (KVM) implementation in the Linux kernel did not properly restrict variable Memory Type Range Registers (MTRR) in KVM guests. A privileged user in a guest VM could use this to cause a denial of service (system crash) in the host, expose sensitive information from the host, or possibly gain administrative privileges in the host. (CVE-2016-3713) Philip Pettersson discovered that the Linux kernel's ASN.1 DER decoder did not properly process certificate files with tags of indefinite length. A local unprivileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code with administrative privileges. (CVE-2016-0758) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS: linux-image-4.4.0-22-generic 4.4.0-22.40 linux-image-4.4.0-22-generic-lpae 4.4.0-22.40 linux-image-4.4.0-22-lowlatency 4.4.0-22.40 linux-image-4.4.0-22-powerpc-e500mc 4.4.0-22.40 linux-image-4.4.0-22-powerpc-smp 4.4.0-22.40 linux-image-4.4.0-22-powerpc64-emb 4.4.0-22.40 linux-image-4.4.0-22-powerpc64-smp 4.4.0-22.40 After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernelmetapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well. References: https://ubuntu.com/security/notices/USN-2979-1 CVE-2016-0758, CVE-2016-3713 Package Information: https://launchpad.net/ubuntu/+source/linux/4.4.0-22.40 . =========================================================================Ubuntu Security Notice USN-. security, kernel, ==================================================. . Severity: Critical. LinuxSecurity.com Team
May 16, 2016
•Critical
Ubuntu
172
security advisorymoderatedenial of serviceUbuntu 14.04 LTS USN-2634-1 Moderate: Kernel Denial of Service Flaws
Several security issues were fixed in the kernel.. =========================================================================Ubuntu Security Notice USN-2634-1 June 10, 2015 linux vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 14.04 LTS Summary: Several security issues were fixed in the kernel. Software Description: - linux: Linux kernel Details: Wen Xu discovered a use-after-free flaw in the Linux kernel's ipv4 ping support. A local user could exploit this flaw to cause a denial of service (system crash) or gain administrative privileges on the system. (CVE-2015-3636) A memory corruption flaw was discovered in the Linux kernel's scsi subsystem. A local attacker could potentially exploit this flaw to cause a denial of service (system crash). (CVE-2015-4036) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 14.04 LTS: linux-image-3.13.0-54-generic 3.13.0-54.91 linux-image-3.13.0-54-generic-lpae 3.13.0-54.91 linux-image-3.13.0-54-lowlatency 3.13.0-54.91 linux-image-3.13.0-54-powerpc-e500 3.13.0-54.91 linux-image-3.13.0-54-powerpc-e500mc 3.13.0-54.91 linux-image-3.13.0-54-powerpc-smp 3.13.0-54.91 linux-image-3.13.0-54-powerpc64-emb 3.13.0-54.91 linux-image-3.13.0-54-powerpc64-smp 3.13.0-54.91 After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. If you use linux-restricted-modules, you have to update that package as well to get modules which work with the new kernel version. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-server, linux-powerpc), astandard system upgrade will automatically perform this as well. References: https://ubuntu.com/security/notices/USN-2634-1 CVE-2015-3636, CVE-2015-4036 Package Information: https://launchpad.net/ubuntu/+source/linux/3.13.0-54.91 . =========================================================================Ubuntu Security Notice USN-. security, kernel, ==================================================. . Severity: Important. LinuxSecurity.com Team
Jun 10, 2015
•Important
Ubuntu
172
security advisorymoderateupdateUbuntu 15.04 USN-2617-2 Moderate: NTFS-3G File Overwrite Risk
NTFS-3G could be made to overwrite files as the administrator.. =========================================================================Ubuntu Security Notice USN-2617-2 May 22, 2015 ntfs-3g vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 15.04 Summary: NTFS-3G could be made to overwrite files as the administrator. Software Description: - ntfs-3g: read/write NTFS driver for FUSE Details: USN-2617-1 fixed a vulnerability in FUSE. This update provides the corresponding fix for the embedded FUSE copy in NTFS-3G. Original advisory details: Tavis Ormandy discovered that FUSE incorrectly filtered environment variables. A local attacker could use this issue to gain administrative privileges. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 15.04: ntfs-3g 1:2014.2.15AR.3-1ubuntu0.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-2617-2 https://ubuntu.com/security/notices/USN-2617-1 CVE-2015-3202 Package Information: https://launchpad.net/ubuntu/+source/ntfs-3g/1:2014.2.15AR.3-1ubuntu0.1 . =========================================================================Ubuntu Security Notice USN-. ntfs-3g, overwrite, files, administrator, =====================================. . Severity: Important. LinuxSecurity.com Team
May 22, 2015
•Important
Ubuntu
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!