Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
PHP version 8.3.12 (26 Sep 2024) CGI: Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926) (nielsdos) Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2024-2b429e720e 2024-10-02 02:58:10.993110 -------------------------------------------------------------------------------- Name : php Product : Fedora 40 Version : 8.3.12 Release : 1.fc40 URL : http://www.php.net/ Summary : PHP scripting language for creating dynamic web sites Description : PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. -------------------------------------------------------------------------------- Update Information: PHP version 8.3.12 (26 Sep 2024) CGI: Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926) (nielsdos) Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927) (nielsdos) Core: Fixed bug GH-15408 (MSan false-positve on zend_max_execution_timer). (zeriyoshi) Fixed bug GH-15515 (Configure error grep illegal option q). (Peter Kokot) Fixed bug GH-15514 (Configure error: genif.sh: syntax error). (Peter Kokot) Fixed bug GH-15565 (--disable-ipv6 during compilation produces error EAI_SYSTEM not found). (nielsdos) Fixed bug GH-15587 (CRC32 API build error on arm 32-bit). (Bernd Kuhls, Thomas Petazzoni) Fixed bug GH-15330 (Do not scan generator frames more than once). (Arnaud) Fixed uninitializedlineno in constant AST of internal enums. (ilutov) Curl: FIxed bug GH-15547 (curl_multi_select overflow on timeout argument). (David Carlier) DOM: Fixed bug GH-15551 (Segmentation fault (access null pointer) in ext/dom/xml_common.h). (nielsdos) Fixed bug GH-15654 (Signed integer overflow in ext/dom/nodelist.c). (nielsdos) Fileinfo: Fixed bug GH-15752 (Incorrect error message for finfo_file with an empty filename argument). (DanielEScherzer) FPM: Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered). (CVE-2024-9026) (Jakub Zelenka) MySQLnd: Fixed bug GH-15432 (Heap corruption when querying a vector). (cmb, Kamil Tekiela) Opcache: Fixed bug GH-15661 (Access null pointer in Zend/Optimizer/zend_inference.c). (nielsdos) Fixed bug GH-15658 (Segmentation fault in Zend/zend_vm_execute.h). (nielsdos) SAPI: Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data). (CVE-2024-8925) (Arnaud) Standard: Fixed bug GH-15552 (Signed integer overflow in ext/standard/scanf.c). (cmb) Streams: Fixed bug GH-15628 (php_stream_memory_get_buffer() not zero-terminated). (cmb) -------------------------------------------------------------------------------- ChangeLog: * Wed Sep 25 2024 Remi Collet - 8.3.12-1 - Update to 8.3.12 - http://www.php.net/releases/8_3_12.php - enable command history in phpdbg -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-2b429e720e' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list
Several vulnerabilities have been discovered in mapserver, a CGI-based web framework to publish spatial data and interactive mapping applications. The Common Vulnerabilities and Exposures project identifies the following problems: . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA-1914-1
A denial of service vulnerability has been discovered in the CGI library included with Ruby, the intepreted scripting langauge for quick and easy object-orientated programming.. - ------------------------------------------------------------------------Debian Security Advisory DSA-1235-1
An updated ruby package that fixes a denial of service issue for the CGI instance is now available.. --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Updated ruby package fixes denial of service issue Advisory ID: RHSA-2004:635-01 Advisory URL: https://access.redhat.com/errata/RHSA-2004:635.html Issue date: 2004-12-13 Updated on: 2004-12-13 Product: Red Hat Enterprise Linux CVE Names: CAN-2004-0983 ---------------------------------------------------------------------1. Summary: An updated ruby package that fixes a denial of service issue for the CGI instance is now available. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386 Red Hat Enterprise Linux ES version 2.1 - i386 Red Hat Enterprise Linux WS version 2.1 - i386 Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 3. Problem description: Ruby is an interpreted scripting language for object-oriented programming. A flaw was dicovered in the CGI module of Ruby. If empty data is sent by the POST method to the CGI script which requires MIME type multipart/form-data, it can get stuck in a loop. A remote attacker could trigger this flaw and cause a denial of service. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0983 to this issue. Users are advised to upgrade to this erratum package, which contains a backported patch to cgi.rb. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command: up2date Forinformation on how to install packages manually, refer to the following Web page for the System Administration or Customization guide specific to your system: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/ 5. Bug IDs fixed (http://bugzilla.redhat.com/ for more info): 138362 - CAN-2004-0983 Denial of Service in Ruby 6. RPMs required: Red Hat Enterprise Linux AS (Advanced Server) version 2.1: SRPMS: 1c9c90f0ab2a2d99aacb3ca4b14868c2 ruby-1.6.4-2.AS21.1.src.rpm i386: 984de6c8bd15661642cf96852eec8594 irb-1.6.4-2.AS21.1.i386.rpm 228efa4a0710253ed381d0cb7288654b ruby-1.6.4-2.AS21.1.i386.rpm d45f217ef393decea4bfc43822fad7b3 ruby-devel-1.6.4-2.AS21.1.i386.rpm e2eb1318a5a5c800024859f2b8e0bf02 ruby-docs-1.6.4-2.AS21.1.i386.rpm edea06b8999c1710ba66d6c580636934 ruby-libs-1.6.4-2.AS21.1.i386.rpm 83393ce9d2ffcaa9159c85fe2ea877f8 ruby-tcltk-1.6.4-2.AS21.1.i386.rpm Red Hat Enterprise Linux ES version 2.1: SRPMS: 1c9c90f0ab2a2d99aacb3ca4b14868c2 ruby-1.6.4-2.AS21.1.src.rpm i386: 984de6c8bd15661642cf96852eec8594 irb-1.6.4-2.AS21.1.i386.rpm 228efa4a0710253ed381d0cb7288654b ruby-1.6.4-2.AS21.1.i386.rpm d45f217ef393decea4bfc43822fad7b3 ruby-devel-1.6.4-2.AS21.1.i386.rpm e2eb1318a5a5c800024859f2b8e0bf02 ruby-docs-1.6.4-2.AS21.1.i386.rpm edea06b8999c1710ba66d6c580636934 ruby-libs-1.6.4-2.AS21.1.i386.rpm 83393ce9d2ffcaa9159c85fe2ea877f8 ruby-tcltk-1.6.4-2.AS21.1.i386.rpm Red Hat Enterprise Linux WS version 2.1: SRPMS: 1c9c90f0ab2a2d99aacb3ca4b14868c2 ruby-1.6.4-2.AS21.1.src.rpm i386: 984de6c8bd15661642cf96852eec8594 irb-1.6.4-2.AS21.1.i386.rpm 228efa4a0710253ed381d0cb7288654b ruby-1.6.4-2.AS21.1.i386.rpm d45f217ef393decea4bfc43822fad7b3 ruby-devel-1.6.4-2.AS21.1.i386.rpm e2eb1318a5a5c800024859f2b8e0bf02 ruby-docs-1.6.4-2.AS21.1.i386.rpm edea06b8999c1710ba66d6c580636934 ruby-libs-1.6.4-2.AS21.1.i386.rpm 83393ce9d2ffcaa9159c85fe2ea877f8 ruby-tcltk-1.6.4-2.AS21.1.i386.rpm Red Hat Enterprise Linux AS version3: SRPMS: 2f01d4591ff0fc041a544a7903b1808d ruby-1.6.8-9.EL3.3.src.rpm i386: f408badb2510f463b5c7872e69a90efc irb-1.6.8-9.EL3.3.i386.rpm 28689571cc04893ae54659d3bd50600f ruby-1.6.8-9.EL3.3.i386.rpm 6f58c9789a0215e620b07761864d49e1 ruby-devel-1.6.8-9.EL3.3.i386.rpm f2989414a97a41d85efa0386cfd6e63d ruby-docs-1.6.8-9.EL3.3.i386.rpm 645e9618992229a97d7e1de2dbb5c691 ruby-libs-1.6.8-9.EL3.3.i386.rpm f39588cdce470d68cf022ef3d4b7c17d ruby-mode-1.6.8-9.EL3.3.i386.rpm 58f1aaa85a9bb7ab46a85dd339b57004 ruby-tcltk-1.6.8-9.EL3.3.i386.rpm ia64: c592891960b9b93d210b6a83811c847f irb-1.6.8-9.EL3.3.ia64.rpm 7ac0fee7db9ee459261c63e93546983e ruby-1.6.8-9.EL3.3.ia64.rpm 33cfff0cc59df6f4bb99c6f10f7cfe42 ruby-devel-1.6.8-9.EL3.3.ia64.rpm 9646d7fac418cec6cbe503f80d61c0c4 ruby-docs-1.6.8-9.EL3.3.ia64.rpm ac7060784a405a2f2d32c400f20981a9 ruby-libs-1.6.8-9.EL3.3.ia64.rpm 76f778eddc74e655d417cae54b6911ed ruby-mode-1.6.8-9.EL3.3.ia64.rpm 3a61c755364d2c2fc40235ca174c4109 ruby-tcltk-1.6.8-9.EL3.3.ia64.rpm ppc: 2e78623c3afa71514c422606dcea0eb8 irb-1.6.8-9.EL3.3.ppc.rpm 1b494554641426f9cc469bdea01b3de2 ruby-1.6.8-9.EL3.3.ppc.rpm c12cf463dda2389c1865643c04a2f200 ruby-devel-1.6.8-9.EL3.3.ppc.rpm 77ebb60cb2b619401afb643b0e417797 ruby-docs-1.6.8-9.EL3.3.ppc.rpm b20f57bfcdff1732a82a8e3d5f939d80 ruby-libs-1.6.8-9.EL3.3.ppc.rpm 481812301c538d031458b33ac45377ba ruby-mode-1.6.8-9.EL3.3.ppc.rpm 1e68c1c503209d0a00b1d6c49e6f1cc7 ruby-tcltk-1.6.8-9.EL3.3.ppc.rpm s390: 417a2dae8057853d95c01752b855a85b irb-1.6.8-9.EL3.3.s390.rpm fdcecea5dc82c81fa2def2dd6882be61 ruby-1.6.8-9.EL3.3.s390.rpm 101677cc586a6e0ffa2243f4d44e1690 ruby-devel-1.6.8-9.EL3.3.s390.rpm b9c6e991d23c84cf983c0dda0218b056 ruby-docs-1.6.8-9.EL3.3.s390.rpm 551748a998a181b7aa87d64d97e959b2 ruby-libs-1.6.8-9.EL3.3.s390.rpm 331c153e38936930ee94724649129d4e ruby-mode-1.6.8-9.EL3.3.s390.rpm a01479d847ef53fbad6b7878ace4c326 ruby-tcltk-1.6.8-9.EL3.3.s390.rpm s390x: dc524b6c4b51ceb1d09fb9aa8f50bfb5 irb-1.6.8-9.EL3.3.s390x.rpm d067c97c8f1b63216608df91b79f3346 ruby-1.6.8-9.EL3.3.s390x.rpm ca5f632329db91a7d8b0905dfa0c4b98 ruby-devel-1.6.8-9.EL3.3.s390x.rpm 5d54cbc527a849531713ec8569b0b02a ruby-docs-1.6.8-9.EL3.3.s390x.rpm f184c8c8d7c83527fdc981577050416e ruby-libs-1.6.8-9.EL3.3.s390x.rpm 77d175cda989287452933c0f419a2a1e ruby-mode-1.6.8-9.EL3.3.s390x.rpm 69b9dd6dcea803c1e83339fa220ef441 ruby-tcltk-1.6.8-9.EL3.3.s390x.rpm x86_64: 8ba124cf1c2c7afb3ad723a20b7d5c0d irb-1.6.8-9.EL3.3.x86_64.rpm 08fbcb3dbbcc4f6007ff5bb553101e3a ruby-1.6.8-9.EL3.3.x86_64.rpm f919fb4d57ac9007db765d15169bb448 ruby-devel-1.6.8-9.EL3.3.x86_64.rpm 9c878a656d96677a21eaeffc98445862 ruby-docs-1.6.8-9.EL3.3.x86_64.rpm f1b99550c731bb413f8f22bf2af6da95 ruby-libs-1.6.8-9.EL3.3.x86_64.rpm 4900c7792a3c986a8cfcb1ea78ce6045 ruby-mode-1.6.8-9.EL3.3.x86_64.rpm 81255d577d75df37f37461811121aa0e ruby-tcltk-1.6.8-9.EL3.3.x86_64.rpm Red Hat Desktop version 3: SRPMS: 2f01d4591ff0fc041a544a7903b1808d ruby-1.6.8-9.EL3.3.src.rpm i386: f408badb2510f463b5c7872e69a90efc irb-1.6.8-9.EL3.3.i386.rpm 28689571cc04893ae54659d3bd50600f ruby-1.6.8-9.EL3.3.i386.rpm 6f58c9789a0215e620b07761864d49e1 ruby-devel-1.6.8-9.EL3.3.i386.rpm f2989414a97a41d85efa0386cfd6e63d ruby-docs-1.6.8-9.EL3.3.i386.rpm 645e9618992229a97d7e1de2dbb5c691 ruby-libs-1.6.8-9.EL3.3.i386.rpm f39588cdce470d68cf022ef3d4b7c17d ruby-mode-1.6.8-9.EL3.3.i386.rpm 58f1aaa85a9bb7ab46a85dd339b57004 ruby-tcltk-1.6.8-9.EL3.3.i386.rpm x86_64: 8ba124cf1c2c7afb3ad723a20b7d5c0d irb-1.6.8-9.EL3.3.x86_64.rpm 08fbcb3dbbcc4f6007ff5bb553101e3a ruby-1.6.8-9.EL3.3.x86_64.rpm f919fb4d57ac9007db765d15169bb448 ruby-devel-1.6.8-9.EL3.3.x86_64.rpm 9c878a656d96677a21eaeffc98445862 ruby-docs-1.6.8-9.EL3.3.x86_64.rpm f1b99550c731bb413f8f22bf2af6da95 ruby-libs-1.6.8-9.EL3.3.x86_64.rpm 4900c7792a3c986a8cfcb1ea78ce6045 ruby-mode-1.6.8-9.EL3.3.x86_64.rpm 81255d577d75df37f37461811121aa0e ruby-tcltk-1.6.8-9.EL3.3.x86_64.rpm Red Hat Enterprise Linux ES version3: SRPMS: 2f01d4591ff0fc041a544a7903b1808d ruby-1.6.8-9.EL3.3.src.rpm i386: f408badb2510f463b5c7872e69a90efc irb-1.6.8-9.EL3.3.i386.rpm 28689571cc04893ae54659d3bd50600f ruby-1.6.8-9.EL3.3.i386.rpm 6f58c9789a0215e620b07761864d49e1 ruby-devel-1.6.8-9.EL3.3.i386.rpm f2989414a97a41d85efa0386cfd6e63d ruby-docs-1.6.8-9.EL3.3.i386.rpm 645e9618992229a97d7e1de2dbb5c691 ruby-libs-1.6.8-9.EL3.3.i386.rpm f39588cdce470d68cf022ef3d4b7c17d ruby-mode-1.6.8-9.EL3.3.i386.rpm 58f1aaa85a9bb7ab46a85dd339b57004 ruby-tcltk-1.6.8-9.EL3.3.i386.rpm ia64: c592891960b9b93d210b6a83811c847f irb-1.6.8-9.EL3.3.ia64.rpm 7ac0fee7db9ee459261c63e93546983e ruby-1.6.8-9.EL3.3.ia64.rpm 33cfff0cc59df6f4bb99c6f10f7cfe42 ruby-devel-1.6.8-9.EL3.3.ia64.rpm 9646d7fac418cec6cbe503f80d61c0c4 ruby-docs-1.6.8-9.EL3.3.ia64.rpm ac7060784a405a2f2d32c400f20981a9 ruby-libs-1.6.8-9.EL3.3.ia64.rpm 76f778eddc74e655d417cae54b6911ed ruby-mode-1.6.8-9.EL3.3.ia64.rpm 3a61c755364d2c2fc40235ca174c4109 ruby-tcltk-1.6.8-9.EL3.3.ia64.rpm x86_64: 8ba124cf1c2c7afb3ad723a20b7d5c0d irb-1.6.8-9.EL3.3.x86_64.rpm 08fbcb3dbbcc4f6007ff5bb553101e3a ruby-1.6.8-9.EL3.3.x86_64.rpm f919fb4d57ac9007db765d15169bb448 ruby-devel-1.6.8-9.EL3.3.x86_64.rpm 9c878a656d96677a21eaeffc98445862 ruby-docs-1.6.8-9.EL3.3.x86_64.rpm f1b99550c731bb413f8f22bf2af6da95 ruby-libs-1.6.8-9.EL3.3.x86_64.rpm 4900c7792a3c986a8cfcb1ea78ce6045 ruby-mode-1.6.8-9.EL3.3.x86_64.rpm 81255d577d75df37f37461811121aa0e ruby-tcltk-1.6.8-9.EL3.3.x86_64.rpm Red Hat Enterprise Linux WS version 3: SRPMS: 2f01d4591ff0fc041a544a7903b1808d ruby-1.6.8-9.EL3.3.src.rpm i386: f408badb2510f463b5c7872e69a90efc irb-1.6.8-9.EL3.3.i386.rpm 28689571cc04893ae54659d3bd50600f ruby-1.6.8-9.EL3.3.i386.rpm 6f58c9789a0215e620b07761864d49e1 ruby-devel-1.6.8-9.EL3.3.i386.rpm f2989414a97a41d85efa0386cfd6e63d ruby-docs-1.6.8-9.EL3.3.i386.rpm 645e9618992229a97d7e1de2dbb5c691 ruby-libs-1.6.8-9.EL3.3.i386.rpm f39588cdce470d68cf022ef3d4b7c17d ruby-mode-1.6.8-9.EL3.3.i386.rpm 58f1aaa85a9bb7ab46a85dd339b57004 ruby-tcltk-1.6.8-9.EL3.3.i386.rpm ia64: c592891960b9b93d210b6a83811c847f irb-1.6.8-9.EL3.3.ia64.rpm 7ac0fee7db9ee459261c63e93546983e ruby-1.6.8-9.EL3.3.ia64.rpm 33cfff0cc59df6f4bb99c6f10f7cfe42 ruby-devel-1.6.8-9.EL3.3.ia64.rpm 9646d7fac418cec6cbe503f80d61c0c4 ruby-docs-1.6.8-9.EL3.3.ia64.rpm ac7060784a405a2f2d32c400f20981a9 ruby-libs-1.6.8-9.EL3.3.ia64.rpm 76f778eddc74e655d417cae54b6911ed ruby-mode-1.6.8-9.EL3.3.ia64.rpm 3a61c755364d2c2fc40235ca174c4109 ruby-tcltk-1.6.8-9.EL3.3.ia64.rpm x86_64: 8ba124cf1c2c7afb3ad723a20b7d5c0d irb-1.6.8-9.EL3.3.x86_64.rpm 08fbcb3dbbcc4f6007ff5bb553101e3a ruby-1.6.8-9.EL3.3.x86_64.rpm f919fb4d57ac9007db765d15169bb448 ruby-devel-1.6.8-9.EL3.3.x86_64.rpm 9c878a656d96677a21eaeffc98445862 ruby-docs-1.6.8-9.EL3.3.x86_64.rpm f1b99550c731bb413f8f22bf2af6da95 ruby-libs-1.6.8-9.EL3.3.x86_64.rpm 4900c7792a3c986a8cfcb1ea78ce6045 ruby-mode-1.6.8-9.EL3.3.x86_64.rpm 81255d577d75df37f37461811121aa0e ruby-tcltk-1.6.8-9.EL3.3.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from 7. References: https://www.cve.org/CVERecord?id=CAN-2004-0983 8. Contact: The Red Hat security contact is . More contact details at Copyright 2004 Red Hat, Inc. . Enhanced Python library from CentOS addresses security vulnerability impacting web frameworks on various platforms.. RedHat Ruby DenialOfService CGI, Denial of Service Fix, Red Hat Security Update. . Severity: Important. LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.