Explore top 10 tips to secure your open-source projects now. Read More
×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 483 articles for you...
198
security advisorysecurity issuecriticalArch Linux: 202403-1 Critical xz Arbitrary Code Execution
The package xz before version 5.6.1-2 is vulnerable to arbitrary code execution. . Arch Linux Security Advisory ASA-202403-1 ========================================= Severity: Critical Date : 2024-03-29 CVE-ID : CVE-2024-3094 Package : xz Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2851 Summary ======= The package xz before version 5.6.1-2 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 5.6.1-2. # pacman -Syu "xz> =5.6.1-2" The problem has been fixed upstream in version 5.6.1. Workaround ========== None. Description =========== Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. The tarballs included extra .m4 files, which contained instructions for building with automake that did not exist in the repository. These instructions, through a series of complex obfuscations, extract a prebuilt object file from one of the test archives, which is then used to modify specific functions in the code while building the liblzma package. This issue results in liblzma being used by additional software, like sshd, to provide functionality that will be interpreted by the modified functions. Impact ====== The malicious code path does not exist in the arch version of sshd, as it does not link to liblzma. However, out of an abundance of caution, we advise users to avoid the vulnerable code in their system as it is possible it could be triggered from other, un-identified vectors. References ========== https://www.redhat.com/en/blog/urgent-security-alert-fedora-40-and-rawhide-users https://security.archlinux.org/CVE-2024-3094 . The Arch Linux Security Advisory ASA-202403-1 highlights a critical vulnerability in xz software, risking arbitrary code execution and offering crucial mitigation steps.. Arbitrary Code Execution, Arch Linux, xz Update. . Severity: Critical. LinuxSecurity.com Team
Mar 29, 2024
•Critical
ArchLinux
198
security advisorydenial of servicehigh severityArch Linux: ASA-202204-6 High: libtiff Multiple Issues Alert
The package libtiff before version 4.3.0-2 is vulnerable to multiple issues including arbitrary code execution and denial of service. . Arch Linux Security Advisory ASA-202204-6 ======================================== Severity: High Date : 2022-04-05 CVE-ID : CVE-2022-0561 CVE-2022-0562 CVE-2022-0865 CVE-2022-0891 CVE-2022-0907 CVE-2022-0908 CVE-2022-0909 CVE-2022-0924 CVE-2022-22844 Package : libtiff Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2658 Summary ====== The package libtiff before version 4.3.0-2 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========= Upgrade to 4.3.0-2. # pacman -Syu "libtiff> =4.3.0-2" The problems have been fixed upstream but no release is available yet. Workaround ========= None. Description ========== - CVE-2022-0561 (denial of service) Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. - CVE-2022-0562 (denial of service) Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. - CVE-2022-0865 (denial of service) Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. - CVE-2022-0891 (arbitrary code execution) A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact. - CVE-2022-0907 (denial of service) Unchecked Return Value to NULL Pointer Dereference in tiffcrop in libtiff 4.3.0allows attackers to cause a denial-of-service via a crafted tiff file. - CVE-2022-0908 (denial of service) Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in tif_dirread.c in libtiff versions up to 4.3.0 could lead to Denial of Service via crafted TIFF file. - CVE-2022-0909 (denial of service) A division by zero error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. - CVE-2022-0924 (denial of service) Out-of-bounds Read error in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. - CVE-2022-22844 (denial of service) LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field. Impact ===== A remote attacker is able to crash the application or execute arbitrary code on the affected host via a crafted tifffile. References ========= https://bugs.archlinux.org/task/74229 https://gitlab.com/libtiff/libtiff/-/issues/362 https://gitlab.com/libtiff/libtiff/-/commit/eecb0712f4c3a5b449f70c57988260a667ddbdef https://gitlab.com/libtiff/libtiff/-/commit/561599c99f987dc32ae110370cfdd7df7975586b https://gitlab.com/libtiff/libtiff/-/issues/385 https://gitlab.com/libtiff/libtiff/-/merge_requests/306 https://gitlab.com/libtiff/libtiff/-/commit/a1c933dabd0e1c54a412f3f84ae0aa58115c6067 https://gitlab.com/libtiff/libtiff/-/issues/380 https://gitlab.com/libtiff/libtiff/-/issues/382 https://gitlab.com/libtiff/libtiff/-/commit/232282fd8f9c21eefe8d2d2b96cdbbb172fe7b7c https://gitlab.com/libtiff/libtiff/-/issues/392 https://gitlab.com/libtiff/libtiff/-/merge_requests/314 https://gitlab.com/libtiff/libtiff/-/commit/40b00cfb32256d377608b4d4cd30fac338d0a0bc https://gitlab.com/libtiff/libtiff/-/commit/a95b799f65064e4ba2e2dfc206808f86faf93e85 https://gitlab.com/libtiff/libtiff/-/issues/383 https://gitlab.com/libtiff/libtiff/-/issues/393 https://gitlab.com/libtiff/libtiff/-/merge_requests/310 https://gitlab.com/libtiff/libtiff/-/commit/32ea0722ee68f503b7a3f9b2d557acb293fc8cde https://gitlab.com/libtiff/libtiff/-/issues/278 https://gitlab.com/libtiff/libtiff/-/merge_requests/311 https://gitlab.com/libtiff/libtiff/-/commit/88d79a45a31c74cba98c697892fed5f7db8b963a https://gitlab.com/libtiff/libtiff/-/issues/355 https://gitlab.com/libtiff/libtiff/-/merge_requests/287 https://gitlab.com/libtiff/libtiff/-/commit/03047a26952a82daaa0792957ce211e0aa51bc64 https://security.archlinux.org/CVE-2022-0561 https://security.archlinux.org/CVE-2022-0562 https://security.archlinux.org/CVE-2022-0865 https://security.archlinux.org/CVE-2022-0891 https://security.archlinux.org/CVE-2022-0907 https://security.archlinux.org/CVE-2022-0908 https://security.archlinux.org/CVE-2022-0909 https://security.archlinux.org/CVE-2022-0924 https://security.archlinux.org/CVE-2022-22844 . The Arch Linux Security Notice ASA-202204-6 highlightscritical vulnerabilities in libtiff, which could lead to potential arbitrary code execution.. Arch Linux Security, LibTIFF Issues, High Severity Advisory. . LinuxSecurity.com Team
Apr 07, 2022
ArchLinux
198
security advisorydenial of servicehigh severityArch Linux Advisory ASA-202204-5 High: Bind Multiple Issues for DoS
The package bind before version 9.18.1-1 is vulnerable to multiple issues including denial of service and content spoofing. . Arch Linux Security Advisory ASA-202204-5 ======================================== Severity: High Date : 2022-04-04 CVE-ID : CVE-2021-25220 CVE-2022-0396 CVE-2022-0635 CVE-2022-0667 Package : bind Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2661 Summary ====== The package bind before version 9.18.1-1 is vulnerable to multiple issues including denial of service and content spoofing. Resolution ========= Upgrade to 9.18.1-1. # pacman -Syu "bind> =9.18.1-1" The problems have been fixed upstream in version 9.18.1. Workaround ========= - CVE-2021-25220 If applicable, modify your configuration to either remove all forwarding or all possibility of recursion. Depending on your use-case, it may be possible to use other zone types to replace forward zones. - CVE-2022-0396 use the default setting of keep-response-order { none; }. - CVE-2022-0635 The failure can be avoided by adding this option to named.conf: synth-from-dnssec no; However we do not recommend disabling this feature other than as a temporary workaround because it provides protection from pseudo-random-subdomain attacks against DNSSEC-signed zones. Description ========== - CVE-2021-25220 (content spoofing) When using forwarders in BIND, bogus NS records supplied by, or via, those forwarders may be cached and used by named if it needs to recurse for any reason, causing it to obtain and pass on potentially incorrect answers. The cache could become poisoned with incorrect records leading to queries being made to the wrong servers, which might also result in false information being returned to clients. Authoritative-only BIND 9 servers are not vulnerable to this flaw. - CVE-2022-0396 (denial of service) ISC recently discovered an issue in BIND that allows TCP connection slots to be consumed for an indefinite timeframe via a specifically crafted TCP stream sent from a client. This issue is present in BIND 9.16.11 to 9.16.26 (including S editions), and 9.18.0. This issue can only be triggered on BIND servers which have keep-response-order enabled, which is not the default configuration. The keep-response-order option is an ACL block; any hosts which are specified within it will be able to trigger this issue on affected versions. Specifically crafted TCP streams can cause connections to BIND to remain in CLOSE_WAIT status for an indefinite period of time, even after the client has terminated the connection. - CVE-2022-0635 (denial of service) BIND 9.18.0 stable release refactored the RFC 8198 Aggressive Use of DNSSEC-Validated Cache feature (synth-from-dnssec) and changed the default so that is now automatically enabled for dnssec-validating resolvers. Subsequently it was found that repeated patterns of specific queries to servers with this feature enabled could cause an INSIST failure in query.c:query_dname which causes named to terminate unexpectedly. The vulnerability affects BIND resolvers running 9.18.0 that have both dnssec-validation and synth-from-dnssec enabled. (Note that dnssec-validation auto; is the default setting unless configured otherwise in named.conf and that enabling dnssec-validation automatically enables synth-from-dnssec unless explicitly disabled) When a vulnerable version of named receives a series of specific queries, the named process will eventually terminate due to a failed assertion check. - CVE-2022-0667 (denial of service) In BIND 9.18.0 the recursive client code was refactored that introduced a "backstop lifetime timer". While BIND is processing a request for a DS record that needs to be forwarded, it waits until this processing is complete or until the backstop lifetime timer has timed out. When the resume_dslookup() function is called as a result of such a timeout, the function does not test whether the fetch has previously been shut down. Thisintroduces the possibility of triggering an assertion failure, which could cause the BIND process to terminate. Impact ===== A remote attacker is able to crash the application or force TCP connections to BIND to remain in CLOSE_WAIT status leading to denial of service on the affected host. Furthermore the cache could become poisoned leading to queries being made to the wrong servers, which might also result in false information being returned to clients. References ========= https://kb.isc.org/docs/cve-2021-25220 https://kb.isc.org/docs/cve-2022-0396 https://kb.isc.org/docs/cve-2022-0635 https://kb.isc.org/docs/cve-2022-0667 https://security.archlinux.org/CVE-2021-25220 https://security.archlinux.org/CVE-2022-0396 https://security.archlinux.org/CVE-2022-0635 https://security.archlinux.org/CVE-2022-0667 . Important security patch released for Arch Linux bind package resolving high-severity vulnerabilities linked to denial of service attacks and potential spoofing threats.. Bind Security Advisory, Arch Linux Security, Denial of Service, Content Spoofing. . LinuxSecurity.com Team
Apr 06, 2022
ArchLinux
198
security advisoryhigh severityman-in-the-middleArch Linux 202204-1 High Severity: PostgreSQL Man-In-The-Middle Attack
The package postgresql before version 13.5-1 is vulnerable to man-in- the-middle. . Arch Linux Security Advisory ASA-202204-1 ======================================== Severity: High Date : 2022-04-04 CVE-ID : CVE-2021-23214 Package : postgresql Type : man-in-the-middle Remote : Yes Link : https://security.archlinux.org/AVG-2546 Summary ====== The package postgresql before version 13.5-1 is vulnerable to man-in-the-middle. Resolution ========= Upgrade to 13.5-1. # pacman -Syu "postgresql> =13.5-1" The problem has been fixed upstream in version 13.5. Workaround ========= None. Description ========== A security issue has been found in PostgreSQL versions 9.6 up to 14. When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption. Impact ===== A man-in-the-middle attacker is able to inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption. References ========= https://www.postgresql.org/support/security/CVE-2021-23214/ https://security.archlinux.org/CVE-2021-23214 . Mitigate a severe man-in-the-middle vulnerability in PostgreSQL versions earlier than 13.5-1 on Arch Linux systems.. PostgreSQL Security, Arch Linux Advisory, Man-in-the-Middle Attack. . LinuxSecurity.com Team
Apr 04, 2022
ArchLinux
198
security advisoryhigh severityinformation disclosureArch Linux: ASA-202112-12 High: Information Disclosure in Grafana-Agent
The package grafana-agent before version 0.21.2-1 is vulnerable to information disclosure. . Arch Linux Security Advisory ASA-202112-12 ========================================= Severity: High Date : 2021-12-11 CVE-ID : CVE-2021-41090 Package : grafana-agent Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-2614 Summary ====== The package grafana-agent before version 0.21.2-1 is vulnerable to information disclosure. Resolution ========= Upgrade to 0.21.2-1. # pacman -Syu "grafana-agent> =0.21.2-1" The problem has been fixed upstream in version 0.21.2. Workaround ========= None. Description ========== A security issue has been found in Grafana Agent before version 0.21.2. Some inline secrets are exposed in plaintext over the Grafana Agent HTTP server: - Inline secrets for metrics instance configs in the base YAML file are exposed at /-/config - Inline secrets for integrations are exposed at /-/config - Inline secrets for Consul ACL tokens and ETCD basic auth when configured for the scraping service at /-/config. - Inline secrets for the Kafka receiver for OpenTelemetry-Collector tracing at /-/config. - Inline secrets for metrics instance configs loaded from the scraping service are exposed at /agent/api/v1/configs/{name}. Inline secrets will be exposed to anyone being able to reach these endpoints. Secrets found in these sections are used for: - Delivering metrics to a Prometheus Remote Write system - Authenticating against a system for discovering Prometheus targets - Authenticating against a system for collecting metrics (scrape_configs and integrations) - Authenticating against a Consul or ETCD for storing configurations to distribute in scraping service mode - Authenticating against Kafka for receiving traces Non-inlined secrets, such as *_file-based secrets, are not impacted by this vulnerability. Impact ===== A remote attacker could disclose inline secrets over the Grafana Agent HTTPserver. References ========= https://github.com/grafana/agent/security/advisories/GHSA-9c4x-5hgq-q3wh https://security.archlinux.org/CVE-2021-41090 . Security Alert: Arch Linux Advisory ASA-202112-15 points out a significant vulnerability in grafana-agent prior to version 0.23.1-1, which may lead to unauthorized information exposure.. Arch Linux, Grafana Agent, Information Disclosure, Security Advisory, High Severity. . LinuxSecurity.com Team
Dec 12, 2021
ArchLinux
198
security advisoryhigh severitycode executionArch Linux: 202112-7 High Severity Advisory for Vivaldi Security Risks
The package vivaldi before version 5.0.2497.28-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing and insufficient validation. . Arch Linux Security Advisory ASA-202112-7 ======================================== Severity: High Date : 2021-12-11 CVE-ID : CVE-2021-4052 CVE-2021-4053 CVE-2021-4054 CVE-2021-4055 CVE-2021-4056 CVE-2021-4057 CVE-2021-4058 CVE-2021-4059 CVE-2021-4061 CVE-2021-4062 CVE-2021-4063 CVE-2021-4064 CVE-2021-4065 CVE-2021-4066 CVE-2021-4067 CVE-2021-4068 Package : vivaldi Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2601 Summary ====== The package vivaldi before version 5.0.2497.28-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing and insufficient validation. Resolution ========= Upgrade to 5.0.2497.28-1. # pacman -Syu "vivaldi> =5.0.2497.28-1" The problems have been fixed upstream in version 5.0.2497.28. Workaround ========= None. Description ========== - CVE-2021-4052 (arbitrary code execution) A use after free security issue has been found in the web apps component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4053 (arbitrary code execution) A use after free security issue has been found in the UI component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4054 (content spoofing) An incorrect security UI security issue has been found in the autofill component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4055 (arbitrary code execution) A heap buffer overflow security issue has been found in the extensions component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4056 (arbitrary code execution) A type confusion security issue has been found in the loader component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4057 (arbitrary code execution) A use after free security issue has been found in the fileAPI component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4058 (arbitrary code execution) A heap buffer overflow security issue has been found in the ANGLE component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4059 (insufficient validation) An insufficient data validation security issue has been found in the loader component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4061 (arbitrary code execution) A type confusion security issue has been found in the V8 component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4062 (arbitrary code execution) A heap buffer overflow security issue has been found in the BFCache component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4063 (arbitrary code execution) A use after free security issue has been found in the developer tools component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4064 (arbitrary code execution) A use after free security issue has been found in the screen capture component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4065 (arbitrary code execution) A use after free security issue has been found in the autofill component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4066 (arbitrary code execution) An integer underflow security issue has been found in the ANGLE component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4067 (arbitrary code execution) A use after free security issue has been found in the window manager component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4068 (insufficient validation) An insufficient validation of untrusted input security issue has been found in the new tab page component of the Chromium browser engine before version 96.0.4664.93. Impact ===== A remote attacker could execute arbitrary code or spoof content through crafted webcontent. References ========= https://vivaldi.com/blog/desktop/further-updates-to-theme-sharing-vivaldi-browser-snapshot-2488-3/ https://vivaldi.com/blog/desktop/minor-update-5-0/ https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop.html https://security.archlinux.org/CVE-2021-4052 https://security.archlinux.org/CVE-2021-4053 https://security.archlinux.org/CVE-2021-4054 https://security.archlinux.org/CVE-2021-4055 https://security.archlinux.org/CVE-2021-4056 https://security.archlinux.org/CVE-2021-4057 https://security.archlinux.org/CVE-2021-4058 https://security.archlinux.org/CVE-2021-4059 https://security.archlinux.org/CVE-2021-4061 https://security.archlinux.org/CVE-2021-4062 https://security.archlinux.org/CVE-2021-4063 https://security.archlinux.org/CVE-2021-4064 https://security.archlinux.org/CVE-2021-4065 https://security.archlinux.org/CVE-2021-4066 https://security.archlinux.org/CVE-2021-4067 https://security.archlinux.org/CVE-2021-4068 . Preceding Vivaldi version 5.0.2497.28-1 encounters numerous critical vulnerabilities, posing risks of unauthorized code execution and identity deception.. Arch Linux Advisory,Vivaldi Security Issues,High Severity Risk. . LinuxSecurity.com Team
Dec 12, 2021
ArchLinux
198
security advisorysoftware updatemedium severityDebian GNU/Linux: 202205-8 High Risk: nmap Local Privilege Escalation
The package isync before version 1.4.4-1 is vulnerable to arbitrary code execution. . Arch Linux Security Advisory ASA-202112-5 ======================================== Severity: Medium Date : 2021-12-03 CVE-ID : CVE-2021-3657 CVE-2021-44143 Package : isync Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2579 Summary ====== The package isync before version 1.4.4-1 is vulnerable to arbitrary code execution. Resolution ========= Upgrade to 1.4.4-1. # pacman -Syu "isync> =1.4.4-1" The problems have been fixed upstream in version 1.4.4. Workaround ========= None. Description ========== - CVE-2021-3657 (arbitrary code execution) A security issue was found in mbsync in isync versions before 1.4.4. Due to inadequate handling of extremely large (> =2GiB) IMAP literals, malicious or compromised IMAP servers, and hypothetically even external email senders, could cause several different buffer overflows, which could conceivably be exploited for remote code execution. - CVE-2021-44143 (arbitrary code execution) A security issue was found in mbsync in isync 1.4.0 before version 1.4.4. Due to an unchecked condition, a malicious or compromised IMAP server could use a crafted mail message that lacks headers (i.e., one that starts with an empty line) to provoke a heap overflow, which could conceivably be exploited for remote code execution. Impact ===== A remote attacker could execute arbitrary code on the mbsync client through crafted email messages. References ========= https://www.openwall.com/lists/oss-security/2021/12/03/1 https://www.openwall.com/lists/oss-security/2021/12/03/1/1 https://www.openwall.com/lists/oss-security/2021/12/03/2 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=999804 https://www.openwall.com/lists/oss-security/2021/12/03/2/1 https://security.archlinux.org/CVE-2021-3657 https://security.archlinux.org/CVE-2021-44143 . Arch Linux Security Notice ASA-202112-5: Medium risk associated with isync's vulnerabilities permitting arbitrarycode execution.. isync security advisory, archlinux patch, arbitrary code fix, linux patch management. . Severity: Medium. LinuxSecurity.com Team
Dec 06, 2021
•Medium
ArchLinux
198
security advisoryhigh severitycode executionArch Linux ASA-202112-4 High: lib32-nss Code Execution Risk
The package lib32-nss before version 3.73-1 is vulnerable to arbitrary code execution. . Arch Linux Security Advisory ASA-202112-4 ======================================== Severity: High Date : 2021-12-03 CVE-ID : CVE-2021-43527 Package : lib32-nss Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2597 Summary ====== The package lib32-nss before version 3.73-1 is vulnerable to arbitrary code execution. Resolution ========= Upgrade to 3.73-1. # pacman -Syu "lib32-nss> =3.73-1" The problem has been fixed upstream in version 3.73. Workaround ========= None. Description ========== NSS (Network Security Services) versions prior to 3.73 are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS #7, or PKCS #12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. Note: This vulnerability does NOT impact Mozilla Firefox. However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted. Impact ===== A remote attacker could execute arbitrary code through crafted signatures. References ========= https://www.mozilla.org/en-US/security/advisories/mfsa2021-51/#CVE-2021-43527 https://bugs.chromium.org/p/project-zero/issues/detail?id=2237 https://bugzilla.mozilla.org/show_bug.cgi?id=1737470 https://security.archlinux.org/CVE-2021-43527 . Debian Security Advisory DSA-2021-006 warns of a critical privilege escalation vulnerability in lib32-glibc prior to 2.33-1.. Arch Linux, lib32-nss, security fix, code execution, high severity. . LinuxSecurity.com Team
Dec 06, 2021
ArchLinux
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!