Alerts This Week
Warning Icon 1 525
Alerts This Week
Warning Icon 1 525

Stay Secure with the Latest Linux Advisories

Filter Icon Refine advisories
X Clear Filters
X Clear Filters
View More

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

What got you started with Linux?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/150-what-got-you-started-with-linux?task=poll.vote&format=json
150
radio
0
[{"id":483,"title":"Self-taught through trial and error","votes":545,"type":"x","order":1,"pct":78.42,"resources":[]},{"id":484,"title":"Formal training or courses","votes":30,"type":"x","order":2,"pct":4.32,"resources":[]},{"id":485,"title":"A job that required it","votes":34,"type":"x","order":3,"pct":4.89,"resources":[]},{"id":486,"title":"Other","votes":86,"type":"x","order":4,"pct":12.37,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Loading...

Explore Latest Linux Security advisories

We found -3 articles for you...
91

Gentoo: GLSA-201903-20 Normal: cabextract Denial of Service

Multiple vulnerabilities have been found in cabextract and libmspack, the worst of which could result in a Denial of Service.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201903-20 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: cabextract, libmspack: Multiple vulnerabilities Date: March 28, 2019 Bugs: #662874, #669280 ID: 201903-20 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities have been found in cabextract and libmspack, the worst of which could result in a Denial of Service. Background ========= cabextract is free software for extracting Microsoft cabinet files. libmspack is a portable library for some loosely related Microsoft compression formats Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-arch/cabextract < 1.8 > = 1.8 2 dev-libs/libmspack < 0.8_alpha > = 0.8_alpha ------------------------------------------------------------------- 2 affected packages Description ========== Multiple vulnerabilities have been discovered in cabextract and libmspack. Please review the CVE identifiers referenced below for details. Impact ===== Please review the referenced CVE's for details. Workaround ========= There is no known workaround at this time. Resolution ========= All cabextract users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =app-arch/cabextract-1.8" All libmspack users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =dev-libs/libmspack-0.8_alpha" References ========= [ 1 ] CVE-2018-14679 https://nvd.nist.gov/vuln/detail/CVE-2018-14679 [ 2 ] CVE-2018-14680 https://nvd.nist.gov/vuln/detail/CVE-2018-14680 [ 3 ] CVE-2018-14681 https://nvd.nist.gov/vuln/detail/CVE-2018-14681 [ 4 ] CVE-2018-14682 https://nvd.nist.gov/vuln/detail/CVE-2018-14682 [ 5 ] CVE-2018-18584 https://nvd.nist.gov/vuln/detail/CVE-2018-18584 [ 6 ] CVE-2018-18585 https://nvd.nist.gov/vuln/detail/CVE-2018-18585 [ 7 ] CVE-2018-18586 https://nvd.nist.gov/vuln/detail/CVE-2018-18586 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201903-20 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to This email address is being protected from spambots. You need JavaScript enabled to view it. or alternatively, you may file a bug at https://bugs.gentoo.org. License ====== Copyright 2019 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5/ . Several security flaws identified in cabextract and libmspack may result in Denial of Service. Users are advised to perform an upgrade.. cabextract vulnerabilities, libmspack issues, Gentoo advisory. . LinuxSecurity.com Team

Calendar 2 Mar 27, 2019 Gentoo
89

Fedora 27: FEDORA-2018-c73d257297 Moderate: cabextract Security Threat

Latest stable releases of libmspack and cabextract, includes security fixes for CVE-2018-14680, CVE-2018-14681, CVE-2018-14682, CVE-2018-18584, CVE-2018-18585. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2018-c73d257297 2018-11-17 02:07:42.735718 --------------------------------------------------------------------------------Name : cabextract Product : Fedora 27 Version : 1.9 Release : 1.fc27 URL : https://www.cabextract.org.uk/ Summary : Utility for extracting cabinet (.cab) archives Description : cabextract is a program which can extract files from cabinet (.cab) archives. --------------------------------------------------------------------------------Update Information: Latest stable releases of libmspack and cabextract, includes security fixes for CVE-2018-14680, CVE-2018-14681, CVE-2018-14682, CVE-2018-18584, CVE-2018-18585 --------------------------------------------------------------------------------ChangeLog: * Tue Nov 6 2018 Rex Dieter - 1.9-1 - 1.9 * Tue Oct 30 2018 Rex Dieter - 1.8-1 - 1.8 * Wed Jul 25 2018 Rex Dieter - 1.7-1 - 1.7 (#1186186) * Thu Jul 12 2018 Fedora Release Engineering - 1.5-9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild * Wed Feb 7 2018 Fedora Release Engineering - 1.5-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild --------------------------------------------------------------------------------References: [ 1 ] Bug #1610941 - CVE-2018-14682 libmspack: off-by-one error in the TOLOWER() macro for CHM decompression https://bugzilla.redhat.com/show_bug.cgi?id=1610941 [ 2 ] Bug #1610896 - CVE-2018-14681 libmspack: out-of-bounds write in kwajd_read_headers in mspack/kwajd.c https://bugzilla.redhat.com/show_bug.cgi?id=1610896 [ 3 ] Bug #1610934 - CVE-2018-14680 libmspack: off-by-one error in the CHM chunk number validity checks https://bugzilla.redhat.com/show_bug.cgi?id=1610934 [ 4 ] Bug #1644215 - CVE-2018-18585 libmspack: chmd_read_headers() fails to reject filenames containing NULL bytes https://bugzilla.redhat.com/show_bug.cgi?id=1644215 [ 5 ] Bug #1644214 - CVE-2018-18584 libmspack: Out-of-bounds write in mspack/cab.h https://bugzilla.redhat.com/show_bug.cgi?id=1644214 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2018-c73d257297' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ . The new stable versions of cabextract and libmspack feature important security patches addressing serious vulnerabilities that have been identified.. cabextract Security Update,Fedora 27,libmspack Fixes,Security Advisories. . LinuxSecurity.com Team

Calendar 2 Nov 17, 2018 Fedora
89

Fedora 28: 2018-Cb337Fb199 Critical: Cabextract Security Update

Latest stable releases of libmspack and cabextract, includes security fixes for CVE-2018-14680, CVE-2018-14681, CVE-2018-14682, CVE-2018-18584, CVE-2018-18585. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2018-cb337fb199 2018-11-13 02:25:35.636330 --------------------------------------------------------------------------------Name : cabextract Product : Fedora 28 Version : 1.9 Release : 1.fc28 URL : https://www.cabextract.org.uk/ Summary : Utility for extracting cabinet (.cab) archives Description : cabextract is a program which can extract files from cabinet (.cab) archives. --------------------------------------------------------------------------------Update Information: Latest stable releases of libmspack and cabextract, includes security fixes for CVE-2018-14680, CVE-2018-14681, CVE-2018-14682, CVE-2018-18584, CVE-2018-18585 --------------------------------------------------------------------------------ChangeLog: * Tue Nov 6 2018 Rex Dieter - 1.9-1 - 1.9 * Tue Oct 30 2018 Rex Dieter - 1.8-1 - 1.8 * Wed Jul 25 2018 Rex Dieter - 1.7-1 - 1.7 (#1186186) * Thu Jul 12 2018 Fedora Release Engineering - 1.5-9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild --------------------------------------------------------------------------------References: [ 1 ] Bug #1644215 - CVE-2018-18585 libmspack: chmd_read_headers() fails to reject filenames containing NULL bytes https://bugzilla.redhat.com/show_bug.cgi?id=1644215 [ 2 ] Bug #1644214 - CVE-2018-18584 libmspack: Out-of-bounds write in mspack/cab.h https://bugzilla.redhat.com/show_bug.cgi?id=1644214 [ 3 ] Bug #1610941 - CVE-2018-14682 libmspack: off-by-one error in the TOLOWER() macro for CHM decompression https://bugzilla.redhat.com/show_bug.cgi?id=1610941 [ 4 ] Bug #1610934 - CVE-2018-14680 libmspack: off-by-one error in the CHM chunk number validity checks https://bugzilla.redhat.com/show_bug.cgi?id=1610934 [ 5 ] Bug #1610896 - CVE-2018-14681 libmspack: out-of-bounds write in kwajd_read_headers in mspack/kwajd.c https://bugzilla.redhat.com/show_bug.cgi?id=1610896 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2018-cb337fb199' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ . Key elements of Fedora 28 are updated with essential security patches for cabextract, tackling various vulnerabilities related to libmspack.. cabextract updates,Fedora security,libmspack issues. . Severity: Critical. LinuxSecurity.com Team

Calendar 2 Nov 13, 2018 Critical Fedora
89

Fedora 29: Security Advisory for Cabextract Software Update

Latest stable releases of libmspack and cabextract, includes security fixes for CVE-2018-14680, CVE-2018-14681, CVE-2018-14682, CVE-2018-18584, CVE-2018-18585. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2018-a5953af115 2018-11-13 02:18:59.072814 --------------------------------------------------------------------------------Name : cabextract Product : Fedora 29 Version : 1.9 Release : 1.fc29 URL : https://www.cabextract.org.uk/ Summary : Utility for extracting cabinet (.cab) archives Description : cabextract is a program which can extract files from cabinet (.cab) archives. --------------------------------------------------------------------------------Update Information: Latest stable releases of libmspack and cabextract, includes security fixes for CVE-2018-14680, CVE-2018-14681, CVE-2018-14682, CVE-2018-18584, CVE-2018-18585 --------------------------------------------------------------------------------ChangeLog: * Tue Nov 6 2018 Rex Dieter - 1.9-1 - 1.9 * Tue Oct 30 2018 Rex Dieter - 1.8-1 - 1.8 --------------------------------------------------------------------------------References: [ 1 ] Bug #1644215 - CVE-2018-18585 libmspack: chmd_read_headers() fails to reject filenames containing NULL bytes https://bugzilla.redhat.com/show_bug.cgi?id=1644215 [ 2 ] Bug #1644214 - CVE-2018-18584 libmspack: Out-of-bounds write in mspack/cab.h https://bugzilla.redhat.com/show_bug.cgi?id=1644214 [ 3 ] Bug #1610896 - CVE-2018-14681 libmspack: out-of-bounds write in kwajd_read_headers in mspack/kwajd.c https://bugzilla.redhat.com/show_bug.cgi?id=1610896 [ 4 ] Bug #1610934 - CVE-2018-14680 libmspack: off-by-one error in the CHM chunk number validity checks https://bugzilla.redhat.com/show_bug.cgi?id=1610934 [ 5 ] Bug #1610941 - CVE-2018-14682 libmspack: off-by-one error in the TOLOWER() macro for CHM decompression https://bugzilla.redhat.com/show_bug.cgi?id=1610941 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2018-a5953af115' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ . System patch released for cabextract in Fedora, rectifying several security flaws to uphold system reliability.. cabextract security,Fedora updates,software safety,libmspack fixes. . Severity: Critical. LinuxSecurity.com Team

Calendar 2 Nov 13, 2018 Critical Fedora
91

Gentoo: GLSA-201401-15 Normal: unzip Local Privilege Escalation Flaw

Multiple vulnerabilities have been found in cabextract, allowing remote attackers to execute arbitrary code or cause a Denial of Service condition. [More...]. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201312-09 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: cabextract: Multiple vulnerabilities Date: December 14, 2013 Bugs: #329891 ID: 201312-09 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities have been found in cabextract, allowing remote attackers to execute arbitrary code or cause a Denial of Service condition. Background ========= cabextract is free software for extracting Microsoft cabinet files. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-arch/cabextract < 1.3 > = 1.3 Description ========== Multiple vulnerabilities have been discovered in cabextract. Please review the CVE identifiers referenced below for details. Impact ===== A remote attacker could entice a user to open a specially-crafted archive in a .cab file, related to the libmspack library, potentially resulting in arbitrary code execution or a Denial of Service condition. Workaround ========= There is no known workaround at this time. Resolution ========= All cabextract users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =app-arch/cabextract-1.3" NOTE: This is a legacy GLSA. Updates for all affected architectures are available since August 03, 2010. It is likely that your systemis already no longer affected by this issue. References ========= [ 1 ] CVE-2010-2800 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-2800 [ 2 ] CVE-2010-2801 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-2801 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201312-09 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to This email address is being protected from spambots. You need JavaScript enabled to view it. or alternatively, you may file a bug at https://bugs.gentoo.org. License ====== Copyright 2013 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5/ . Several security flaws in cabextract permit remote adversaries to run arbitrary code or trigger Denial of Service. Update is advised.. cabextract vulnerabilities,Gentoo security updates,remote code execution,Denial of Service. . LinuxSecurity.com Team

Calendar 2 Dec 14, 2013 Gentoo
87

Debian: DSA 574-1 Critical: Cabextract File Overwrite Risk

The upstream developers discovered a problem in cabextract, a tool to extract cabinet files. The program was able to overwrite files in upper directories. This could lead an attacker to overwrite arbitrary files.. -------------------------------------------------------------------------- Debian Security Advisory DSA 574-1 This email address is being protected from spambots. You need JavaScript enabled to view it. Debian -- Security Information Martin Schulze October 28th, 2004 Debian -- Debian security FAQ -------------------------------------------------------------------------- Package : cabextract Vulnerability : missing directory sanitising Problem-Type : remote Debian-specific: no CVE ID : CAN-2004-0916 Debian Bug : 277522 The upstream developers discovered a problem in cabextract, a tool to extract cabinet files. The program was able to overwrite files in upper directories. This could lead an attacker to overwrite arbitrary files. For the stable distribution (woody) this problem has been fixed in version 0.2-2b. For the unstable distribution (sid) this problem has been fixed in version 1.1-1. We recommend that you upgrade your cabextract package. Upgrade Instructions -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 3.0 alias woody -------------------------------- Source archives: Size/MD5 checksum: 568 72c81704917abe1f37ae4694392c97e3 Size/MD5 checksum: 2314 d31e74e1186f00a60dc944bec28829f9 Size/MD5 checksum: 66136 8f59514ec67cfb43658c57c67c864b74 Alpha architecture: Size/MD5 checksum: 203442eba57f87ea2348e3e0322eb5d7ce3a5 ARM architecture: Size/MD5 checksum: 16514 0c1b72dfef4454c9a4140d4728b6d56d Intel IA-32 architecture: Size/MD5 checksum: 15054 f0b5a915d31a51dbad5df5163c326204 Intel IA-64 architecture: Size/MD5 checksum: 23934 7a180cb2c7321533839d88edfde0664e HP Precision architecture: Size/MD5 checksum: 17784 50e507a1108c883a550f6b14b01238be Motorola 680x0 architecture: Size/MD5 checksum: 15034 e576be7c48a6217bc3d04f850b622ea9 Big endian MIPS architecture: Size/MD5 checksum: 17948 427396df5074b07059f35d1603512423 Little endian MIPS architecture: Size/MD5 checksum: 17884 de2d86ebeb9fdcaf58f99e403ca4ba86 PowerPC architecture: Size/MD5 checksum: 16572 f087bc23f1a5ff782ad4a15563482af0 IBM S/390 architecture: Size/MD5 checksum: 16658 44e78328ade15ef1b71fe5fec2738bc7 Sun Sparc architecture: Size/MD5 checksum: 18692 ad98229293a9a753db5d371cab657d06 These files will probably be moved into the stable distribution on its next update. --------------------------------------------------------------------------------- For apt-get: deb Debian -- Security Information stable/updates main For dpkg-ftp: dists/stable/updates/main Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. Package info: `apt-cache show ' and https://www.debian.org/distrib/packages . Debian Security Advisory DSA 583-2 outlines the resolution for zip utility path traversal vulnerability that permits unintentional file replacements.. cabextract Fix, Directory Traversal, Debian Advisory, File Overwrite, Security Alert. . Severity: Critical. LinuxSecurity.com Team

Calendar 2 Oct 28, 2004 Critical Debian
News Add Esm H240

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

What got you started with Linux?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/150-what-got-you-started-with-linux?task=poll.vote&format=json
150
radio
0
[{"id":483,"title":"Self-taught through trial and error","votes":545,"type":"x","order":1,"pct":78.42,"resources":[]},{"id":484,"title":"Formal training or courses","votes":30,"type":"x","order":2,"pct":4.32,"resources":[]},{"id":485,"title":"A job that required it","votes":34,"type":"x","order":3,"pct":4.89,"resources":[]},{"id":486,"title":"Other","votes":86,"type":"x","order":4,"pct":12.37,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Your message here