Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 525
Alerts This Week
Warning Icon 1 525

Stay Secure with the Latest Linux Advisories

Debianlts Large Esm H800
Debian LTS

Debian DLA-4693-1 Roundcube High Cross-Site Scripting Denial of Service

Calendar White Jul 21, 2026
Important
Opensuse Large Esm H900
openSUSE

openSUSE go1.25-openssl Important Security Issues 2026-3151-1

Calendar White Jul 21, 2026
Important
Opensuse Large Esm H900
openSUSE

openSUSE aws-nitro-enclaves-cli Important Issues Advisory 2026-3152-1

Calendar White Jul 21, 2026
Important
Opensuse Large Esm H800
openSUSE

openSUSE nghttp2 Moderate HTTP Request Smuggling Issue 2026-3153-1

Calendar White Jul 21, 2026
moderate
Opensuse Large Esm H900
openSUSE

openSUSE python-tornado6 Moderate Credential Leak Vulnerability 2026-3155-1

Calendar White Jul 21, 2026
moderate
Opensuse Large Esm H900
openSUSE

openSUSE Kernel Important Security Update Vulnerability Fix 2026-3156-1

Calendar White Jul 21, 2026
Important
Opensuse Large Esm H800
openSUSE

openSUSE php7 Moderate Buffer Vulnerability Resolution SUSE-SU-2026-3165-1

Calendar White Jul 21, 2026
moderate
Opensuse Large Esm H900
openSUSE

openSUSE libkrun Important Patch 2026-0255-1 for 8 Issues

Calendar White Jul 21, 2026
Important
Rockylinux Esm H900
Rocky

Rocky Linux httpd Important Denial of Service Fix RLSA-2026-42828

Calendar White Jul 21, 2026
Important
Filter%20icon Refine advisories
X Clear Filters
X Clear Filters
View More

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

More Polls

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":1,"type":"x","order":4,"pct":100,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Loading...

Explore Latest Linux Security advisories

We found -6 articles for you...
87
Ls Advisories Debian Esm H240
Price Tag%201security advisoryremote accessDebian

Debian: DSA-2322-1 Critical: Bugzilla Remote Threats Identified

Several vulnerabilities were discovered in Bugzilla, a web-based bug tracking system. CVE-2010-4572 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2322-1 This email address is being protected from spambots. You need JavaScript enabled to view it. http://www.debian.org/security/ Jonathan Wiltshire October 10, 2011 http://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : bugzilla Vulnerability : several Problem type : remote Debian-specific: no CVE ID : CVE-201-2979 CVE-2010-4567 CVE-2010-4568 CVE-2010-4572 CVE-2011-0046 CVE-2011-0048 CVE-2011-2379 CVE-2011-2380 CVE-2011-2381 CVE-2011-2978 Several vulnerabilities were discovered in Bugzilla, a web-based bug tracking system. CVE-2010-4572 By inserting particular strings into certain URLs, it was possible to inject both headers and content to any browser. CVE-2010-4567, CVE-2011-0048 Bugzilla has a "URL" field that can contain several types of URL, including "javascript:" and "data:" URLs. However, it does not make "javascript:" and "data:" URLs into clickable links, to protect against cross-site scripting attacks or other attacks. It was possible to bypass this protection by adding spaces into the URL in places that Bugzilla did not expect them. Also, "javascript:" and "data:" links were *always* shown as clickable to logged-out users. CVE-2010-4568 It was possible for a user to gain unauthorized access to any Bugzilla account in a very short amount of time (short enough that the attack is highly effective). CVE-2011-0046 Various pages were vulnerable to Cross-Site Request Forgery attacks. Most of these issues are not as serious as previous CSRF vulnerabilities. CVE-2011-2978 When a user changes his email address, Bugzilla trusts a user-modifiable field for obtaining the current e-mail address tosend a confirmation message to. If an attacker has access to the session of another user (for example, if that user left their browser window open in a public place), the attacker could alter this field to cause the email-change notification to go to their own address. This means that the user would not be notified that his account had its email address changed by the attacker. CVE-2011-2381 For flagmails only, attachment descriptions with a newline in them could lead to the injection of crafted headers in email notifications when an attachment flag is edited. CVE-2011-2379 Bugzilla uses an alternate host for attachments when viewing them in raw format to prevent cross-site scripting attacks. This alternate host is now also used when viewing patches in "Raw Unified" mode because Internet Explorer 8 and older, and Safari before 5.0.6 do content sniffing, which could lead to the execution of malicious code. CVE-2011-2380 CVE-201-2979 Normally, a group name is confidential and is only visible to members of the group, and to non-members if the group is used in bugs. By crafting the URL when creating or editing a bug, it was possible to guess if a group existed or not, even for groups which weren't used in bugs and so which were supposed to remain confidential. For the oldstable distribution (lenny), it has not been practical to backport patches to fix these bugs. Users of bugzilla on lenny are strongly advised to upgrade to the version in the squeeze distribution. For the stable distribution (squeeze), these problems have been fixed in version 3.6.2.0-4.4. For the testing distribution (wheezy) and the unstable distribution (sid), the bugzilla packages have been removed. We recommend that you upgrade your bugzilla packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. .Uncover various vulnerabilities in Bugzilla alongside suggested solutions for the Debian DSA-2322-1 patch.. bugzilla security, Debian update, web application issues. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Oct 10, 2011 •Critical Debian
89
Ls Advisories Fedora Esm H240
Price Tag%201security advisorysoftware updateFedora

Fedora 9: 2009-3405 Moderate Update to Address Bugzilla CSRF Vulnerability

fix CVE-2009-1213. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2009-3405 2009-04-07 15:17:52 --------------------------------------------------------------------------------Name : bugzilla Product : Fedora 9 Version : 3.2.3 Release : 1.fc9 URL : https://www.bugzilla.org/ Summary : Bug tracking system Description : Bugzilla is a popular bug tracking system used by multiple open source projects It requires a database engine installed - either MySQL, PostgreSQL or Oracle. Without one of these database engines (local or remote), Bugzilla will not work - see the Release Notes for details. --------------------------------------------------------------------------------ChangeLog: * Mon Apr 6 2009 Itamar Reis Peixoto 3.2.3-1 - fix CVE-2009-1213 * Thu Mar 5 2009 Itamar Reis Peixoto 3.2.2-2 - fix from BZ #474250 Comment #16, from Chris Eveleigh --> - add python BR for contrib subpackage - fix description - change Requires perl-SOAP-Lite to perl(SOAP::Lite) according guidelines * Sun Mar 1 2009 Itamar Reis Peixoto 3.2.2-1 - thanks to Chris Eveleigh - for contributing with patches :-) - Upgrade to upstream 3.2.2 to fix multiple security vulns - Removed old perl_requires exclusions, added new ones for RADIUS, Oracle and sanitycheck.cgi - Added Oracle to supported DBs in description (and moved line breaks) - Include a patch to fix max_allowed_packet warnin when using with mysql * Sat Feb 28 2009 Itamar Reis Peixoto 3.0.8-1 - Upgrade to 3.0.8, fix #466077 #438080 - fix macro in changelog rpmlint warning - fix files-attr-not-set rpmlint warning for doc and contrib sub-packages * Mon Feb 23 2009 Fedora Release Engineering - 3.0.4-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild * Mon Feb 2 2009 Stepan Kasal - 3.0.4-3 - do not require perl-Email-Simple, it is (no longer) in use - remove several explicit perl-* requires; the automatic dependencies do handle them * Mon Jul 14 2008 Tom "spot" Callaway - 3.0.4-2 - fix license tag * Fri May 9 2008 John Berninger - 3.0.4-1 - Update to upstream 3.0.4 to fix multiple security vulns - Change perms on /etc/bugzilla for bz 427981 * Sun May 4 2008 John Berninger - 3.0.3-0 - Update to upstream 3.0.3 - bz 444669 --------------------------------------------------------------------------------References: [ 1 ] Bug #494398 - CVE-2009-1213 bugzilla: CSRF vulnerability in attachment editing https://bugzilla.redhat.com/show_bug.cgi?id=494398 --------------------------------------------------------------------------------This update can be installed with the "yum" update program. Use su -c 'yum update bugzilla' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ Fedora-package-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ . Update 9 from Fed: addressed CSRF security flaw in Bugzilla bug tracker version 3.2.3 to bolster protection.. Bugzilla Update, CSRF Fix, Fedora 9 Advisory. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Apr 07, 2009 •Important Fedora
Banner 2 1028x280 1708121730 1 1771599631
87
Ls Advisories Debian Esm H240
Price Tag%201security advisorymoderatedebian

Debian DSA 944-1 Moderate: Mantis Addressed Remote Security Issues

Several security related problems have been discovered in Mantis, a web-based bug tracking system. The Common Vulnerabilities and Exposures project identifies the following problems:. - --------------------------------------------------------------------------Debian Security Advisory DSA 944-1 This email address is being protected from spambots. You need JavaScript enabled to view it. http://www.debian.org/security/ Martin Schulze January 17th, 2006 http://www.debian.org/security/faq - --------------------------------------------------------------------------Package : mantis Vulnerability : several Problem type : remote Debian-specific: no CVE IDs : CVE-2005-4238 CVE-2005-4518 CVE-2005-4519 CVE-2005-4520 CVE-2005-4521 CVE-2005-4522 CVE-2005-4523 CVE-2005-4524 BugTraq IDs : 15842 16046 Debian Bug : 345288 Several security related problems have been discovered in Mantis, a web-based bug tracking system. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2005-4238 Missing input sanitising allows remote attackers to inject arbitrary web script or HTML. CVE-2005-4518 Tobias Klein discovered that Mantis allows remote attackers to bypass the file upload size restriction. CVE-2005-4519 Tobias Klein discovered several SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands. CVE-2005-4520 Tobias Klein discovered unspecified "port injection" vulnerabilities in filters. CVE-2005-4521 Tobias Klein discovered a CRLF injection vulnerability that allows remote attackers to modify HTTP headers and conduct HTTP response splitting attacks. CVE-2005-4522 Tobias Klein discovered several cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary web script or HTML. CVE-2005-4523 Tobias Klein discovered that Mantis discloses private bugs via public RSS feeds, which allows remoteattackers to obtain sensitive information. CVE-2005-4524 Tobias Klein discoverd that Mantis does not properly handle "Make note private" when a bug is being resolved, which has unknown impact and attack vectors, probably related to an information leak. The old stable distribution (woody) does not seem to be affected by these problems. For the stable distribution (sarge) these problems have been fixed in version 0.19.2-5sarge1. For the unstable distribution (sid) these problems have been fixed in version 0.19.4-1. We recommend that you upgrade your mantis package. Upgrade Instructions - --------------------wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 3.1 alias sarge - -------------------------------- Source archives: Size/MD5 checksum: 580 84bfa6cce4f41aebd7f7bdd810048504 Size/MD5 checksum: 39448 0c827e6e04027c31080de40d53930689 Size/MD5 checksum: 1298615 042c42c6de3bc536181391c1e9b25db3 Architecture independent components: Size/MD5 checksum: 897448 a5d28b04680faf1abbda95cc18b28bac These files will probably be moved into the stable distribution on its next update. - ---------------------------------------------------------------------------------For apt-get: deb https://www.debian.org/security/ stable/updates main For dpkg-ftp: dists/stable/updates/main Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . Debian Security Advisory DSA 944-1 http://www.debian.org/security/ Martin Schulze January 17th, 2006. security, related, problems, mantis, web-based, tracking, system. .LinuxSecurity.com Team

Calendar%202 Jan 27, 2006 Debian
News Add Esm H240

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

More Polls

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":1,"type":"x","order":4,"pct":100,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200

Search Topics