Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found 0 articles for you...
202
security advisorymoderatesecurity updateopenSUSE: 2022:0074-1 Moderate: perl-App-cpanminus Checksum Issue
An update that fixes one vulnerability is now available. . openSUSE Security Update: Security update for perl-App-cpanminus ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0074-1 Rating: moderate References: Cross-References: CVE-2020-16154 CVSS scores: CVE-2020-16154 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for perl-App-cpanminus fixes the following issues: updated to 1.7045 see /usr/share/doc/packages/perl-App-cpanminus/Changes Security fixes: - [CVE-2020-16154] remove the functionality to verify CHECKSUMS signature updated to 1.7044 see /usr/share/doc/packages/perl-App-cpanminus/Changes Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-74=1 Package List: - openSUSE Backports SLE-15-SP3 (noarch): perl-App-cpanminus-1.7045-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-16154.html . To mitigate the moderate vulnerability in perl-App-cpanminus on openSUSE, follow these patch steps to ensure your system is secure and up to date. openSUSE Security, moderate patch, perl App cpanminus, checksum security issue. . LinuxSecurity.com Team
Mar 06, 2022
OpenSUSE
89
security advisoryFedorachecksum issueFedora: 2020-deff052e7a Critical: golang-github-ulikunitz-xz Input Loop Fix
* The `readUvarint` function would run infinitely given specific input. The function is now terminating if more than 10 bytes of input have been read. Fixes [issue #35](https://github.com/ulikunitz/xz/issues/35) (CVE-2020-16845). * Supports the check-ID None and fixes "Checksum None is invalid" [issue #27](https://github.com/ulikunitz/xz/issues/27).. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-deff052e7a 2020-08-28 14:57:45.933599 --------------------------------------------------------------------------------Name : golang-github-ulikunitz-xz Product : Fedora 31 Version : 0.5.8 Release : 1.fc31 URL : https://github.com/ulikunitz/xz Summary : Pure golang package for reading and writing xz-compressed files Description : This Go language package supports the reading and writing of xz compressed streams. It includes also a gxz command for compressing and decompressing data. The package is completely written in Go and doesn't have any dependency on any C code. --------------------------------------------------------------------------------Update Information: * The `readUvarint` function would run infinitely given specific input. The function is now terminating if more than 10 bytes of input have been read. Fixes [issue #35](https://github.com/ulikunitz/xz/issues/35) (CVE-2020-16845). * Supports the check-ID None and fixes "Checksum None is invalid" [issue #27](https://github.com/ulikunitz/xz/issues/27). --------------------------------------------------------------------------------ChangeLog: * Thu Aug 20 2020 Dominik Mierzejewski - 0.5.8-1 - Release 0.5.8 (#1870433) - fixes CVE-2020-16845 --------------------------------------------------------------------------------References: [ 1 ] Bug #1867099 - CVE-2020-16845 golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs https://bugzilla.redhat.com/show_bug.cgi?id=1867099 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-deff052e7a' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Aug 28, 2020
•Critical
Fedora
89
security advisoryupdateFedoraFedora 29: FEDORA-2018-2b7e72dc9f Moderate: Zchunk Integrity Enhancements
This update does sanity checking when an application passes in a checksum to verify. Before this release, applications could pass in non-hex values for the checksum, which could cause zchunk to crash. Now non-hex values will be rejected.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2018-1a6f41fc8f 2018-11-11 03:11:36.464795 --------------------------------------------------------------------------------Name : zchunk Product : Fedora 28 Version : 0.9.14 Release : 1.fc28 URL : https://github.com/zchunk/zchunk Summary : Compressed file format that allows easy deltas Description : zchunk is a compressed file format that splits the file into independent chunks. This allows you to only download the differences when downloading a new version of the file, and also makes zchunk files efficient over rsync. zchunk files are protected with strong checksums to verify that the file you downloaded is in fact the file you wanted. --------------------------------------------------------------------------------Update Information: This update does sanity checking when an application passes in a checksum to verify. Before this release, applications could pass in non-hex values for the checksum, which could cause zchunk to crash. Now non-hex values will be rejected. --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2018-1a6f41fc8f' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Nov 11, 2018
Fedora
89
security advisorymoderateFedoraFedora 25: 2017-7591a8e2c9 Moderate: Checksum Issues in Globus Gass Copy
globus-ftp-client * Adapt to Perl 5.26 - POSIX::tmpnam() no longer available * Remove some redundant tests to reduce test time globus-gass-cache-program * GT6 update globus-gass-copy * Don't attempt sshftp data protection without creds (9.24) * Checksum verification based on contribution from IBM (9.24) * Fix uninitialized field related crash (9.25) * Remove checksum data from public. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2017-7591a8e2c9 2017-07-03 18:56:35.537627 --------------------------------------------------------------------------------Name : globus-gass-copy Product : Fedora 25 Version : 9.27 Release : 1.fc25 URL : http://toolkit.globus.org/ Summary : Globus Toolkit - Globus Gass Copy Description : The Globus Toolkit is an open source software toolkit used for building Grid systems and applications. It is being developed by the Globus Alliance and many others all over the world. A growing number of projects and companies are using the Globus Toolkit to unlock the potential of grids for their cause. The globus-gass-copy package contains: Globus Gass Copy --------------------------------------------------------------------------------Update Information: globus-ftp-client * Adapt to Perl 5.26 - POSIX::tmpnam() no longer available * Remove some redundant tests to reduce test time globus-gass-cache-program * GT6 update globus-gass-copy * Don't attempt sshftp data protection without creds (9.24) * Checksum verification based on contribution from IBM (9.24) * Fix uninitialized field related crash (9.25) * Remove checksum data from public handle (9.26) * Prevent some race conditions (9.27) globus-gram-job-manager * Default to running personal gatekeeper on an ephemeral port globus-gridftp-server * New error message format (12.0) * Configuration database (12.0) * Better delay for end of session ref check (12.1) * Fix tests when getgroups() does not return effectivegid (12.2) globus-gssapi-gsi * Don't unlock unlocked mutex (12.14) * Remove legacy SSLv3 support (12.15) * Test fixes (12.16) * Drop patch globus-gssapi-gsi-mutex-unlock.patch (fixed upstream 12.14) globus-io * Remove legacy SSLv3 support globus-net-manager * Fix .pc typo * Drop patch globus-net-manager-pkgconfig.patch (fixed upstream) globus-xio * Don't rely on globus_error_put(NULL) to be GLOBUS_SUCCESS (5.15) * Fix crash in error handling in http driver (5.16) globus-xio-gsi-driver * Fix crash when checking for anonymous GSS name when name comparison fails globus-xio-pipe-driver * Fix .pc typo globus-xio-udt-driver * Don't force --static flag to pkg-config * Drop some BuildRequires no longer needed with above change * Fix undefined symbols during linking myproxy * Fix error check (6.1.26) * Remove legacy SSLv3 support (6.1.27) --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade globus-gass-copy' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Jul 04, 2017
Fedora
87
security advisorycriticaldebianDebian Security Announcement DSA-2129-1: Serious KRB5 Checksum Issue
A vulnerability has been found in krb5, the MIT implementation of Kerberos. MIT krb5 clients incorrectly accept an unkeyed checksums in the SAM-2 . - ------------------------------------------------------------------------ Debian Security Advisory DSA-2129-1
Dec 01, 2010
•Critical
Debian
98
security advisorynetwork securityRed HatRed Hat 2010:0926-01 Moderate: krb5 Authentication Flaw
Updated krb5 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having moderate [More...]. ==================================================================== Red Hat Security Advisory Synopsis: Moderate: krb5 security update Advisory ID: RHSA-2010:0926-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2010:0926.html Issue date: 2010-11-30 CVE Names: CVE-2010-1323 ==================================================================== 1. Summary: Updated krb5 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Description: Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third party, the Key Distribution Center (KDC). Multiple checksum validation flaws were discovered in the MIT Kerberos implementation. A remote attacker could use these flaws to tamper with certain Kerberos protocol packets and, possibly, bypass authentication mechanisms in certain configurations using Single-use Authentication Mechanisms. (CVE-2010-1323) Red Hat wouldlike to thank the MIT Kerberos Team for reporting these issues. All krb5 users should upgrade to these updated packages, which contain a backported patch to correct these issues. After installing the updated packages, the krb5kdc daemon will be restarted automatically. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at 5. Bugs fixed (http://bugzilla.redhat.com/): 648734 - CVE-2010-1323 krb5: incorrect acceptance of certain checksums (MITKRB5-SA-2010-007) 6. Package List: Red Hat Enterprise Linux AS version4: Source: i386: krb5-debuginfo-1.3.4-62.el4_8.3.i386.rpm krb5-devel-1.3.4-62.el4_8.3.i386.rpm krb5-libs-1.3.4-62.el4_8.3.i386.rpm krb5-server-1.3.4-62.el4_8.3.i386.rpm krb5-workstation-1.3.4-62.el4_8.3.i386.rpm ia64: krb5-debuginfo-1.3.4-62.el4_8.3.i386.rpm krb5-debuginfo-1.3.4-62.el4_8.3.ia64.rpm krb5-devel-1.3.4-62.el4_8.3.ia64.rpm krb5-libs-1.3.4-62.el4_8.3.i386.rpm krb5-libs-1.3.4-62.el4_8.3.ia64.rpm krb5-server-1.3.4-62.el4_8.3.ia64.rpm krb5-workstation-1.3.4-62.el4_8.3.ia64.rpm ppc: krb5-debuginfo-1.3.4-62.el4_8.3.ppc.rpm krb5-debuginfo-1.3.4-62.el4_8.3.ppc64.rpm krb5-devel-1.3.4-62.el4_8.3.ppc.rpm krb5-libs-1.3.4-62.el4_8.3.ppc.rpm krb5-libs-1.3.4-62.el4_8.3.ppc64.rpm krb5-server-1.3.4-62.el4_8.3.ppc.rpm krb5-workstation-1.3.4-62.el4_8.3.ppc.rpm s390: krb5-debuginfo-1.3.4-62.el4_8.3.s390.rpm krb5-devel-1.3.4-62.el4_8.3.s390.rpm krb5-libs-1.3.4-62.el4_8.3.s390.rpm krb5-server-1.3.4-62.el4_8.3.s390.rpm krb5-workstation-1.3.4-62.el4_8.3.s390.rpm s390x: krb5-debuginfo-1.3.4-62.el4_8.3.s390.rpm krb5-debuginfo-1.3.4-62.el4_8.3.s390x.rpm krb5-devel-1.3.4-62.el4_8.3.s390x.rpm krb5-libs-1.3.4-62.el4_8.3.s390.rpm krb5-libs-1.3.4-62.el4_8.3.s390x.rpm krb5-server-1.3.4-62.el4_8.3.s390x.rpm krb5-workstation-1.3.4-62.el4_8.3.s390x.rpm x86_64: krb5-debuginfo-1.3.4-62.el4_8.3.i386.rpm krb5-debuginfo-1.3.4-62.el4_8.3.x86_64.rpm krb5-devel-1.3.4-62.el4_8.3.x86_64.rpm krb5-libs-1.3.4-62.el4_8.3.i386.rpm krb5-libs-1.3.4-62.el4_8.3.x86_64.rpm krb5-server-1.3.4-62.el4_8.3.x86_64.rpm krb5-workstation-1.3.4-62.el4_8.3.x86_64.rpm Red Hat Enterprise Linux Desktop version4: Source: i386: krb5-debuginfo-1.3.4-62.el4_8.3.i386.rpm krb5-devel-1.3.4-62.el4_8.3.i386.rpm krb5-libs-1.3.4-62.el4_8.3.i386.rpm krb5-server-1.3.4-62.el4_8.3.i386.rpm krb5-workstation-1.3.4-62.el4_8.3.i386.rpm x86_64: krb5-debuginfo-1.3.4-62.el4_8.3.i386.rpm krb5-debuginfo-1.3.4-62.el4_8.3.x86_64.rpm krb5-devel-1.3.4-62.el4_8.3.x86_64.rpm krb5-libs-1.3.4-62.el4_8.3.i386.rpm krb5-libs-1.3.4-62.el4_8.3.x86_64.rpm krb5-server-1.3.4-62.el4_8.3.x86_64.rpm krb5-workstation-1.3.4-62.el4_8.3.x86_64.rpm Red Hat Enterprise Linux ES version 4: Source: i386: krb5-debuginfo-1.3.4-62.el4_8.3.i386.rpm krb5-devel-1.3.4-62.el4_8.3.i386.rpm krb5-libs-1.3.4-62.el4_8.3.i386.rpm krb5-server-1.3.4-62.el4_8.3.i386.rpm krb5-workstation-1.3.4-62.el4_8.3.i386.rpm ia64: krb5-debuginfo-1.3.4-62.el4_8.3.i386.rpm krb5-debuginfo-1.3.4-62.el4_8.3.ia64.rpm krb5-devel-1.3.4-62.el4_8.3.ia64.rpm krb5-libs-1.3.4-62.el4_8.3.i386.rpm krb5-libs-1.3.4-62.el4_8.3.ia64.rpm krb5-server-1.3.4-62.el4_8.3.ia64.rpm krb5-workstation-1.3.4-62.el4_8.3.ia64.rpm x86_64: krb5-debuginfo-1.3.4-62.el4_8.3.i386.rpm krb5-debuginfo-1.3.4-62.el4_8.3.x86_64.rpm krb5-devel-1.3.4-62.el4_8.3.x86_64.rpm krb5-libs-1.3.4-62.el4_8.3.i386.rpm krb5-libs-1.3.4-62.el4_8.3.x86_64.rpm krb5-server-1.3.4-62.el4_8.3.x86_64.rpm krb5-workstation-1.3.4-62.el4_8.3.x86_64.rpm Red Hat Enterprise Linux WS version4: Source: i386: krb5-debuginfo-1.3.4-62.el4_8.3.i386.rpm krb5-devel-1.3.4-62.el4_8.3.i386.rpm krb5-libs-1.3.4-62.el4_8.3.i386.rpm krb5-server-1.3.4-62.el4_8.3.i386.rpm krb5-workstation-1.3.4-62.el4_8.3.i386.rpm ia64: krb5-debuginfo-1.3.4-62.el4_8.3.i386.rpm krb5-debuginfo-1.3.4-62.el4_8.3.ia64.rpm krb5-devel-1.3.4-62.el4_8.3.ia64.rpm krb5-libs-1.3.4-62.el4_8.3.i386.rpm krb5-libs-1.3.4-62.el4_8.3.ia64.rpm krb5-server-1.3.4-62.el4_8.3.ia64.rpm krb5-workstation-1.3.4-62.el4_8.3.ia64.rpm x86_64: krb5-debuginfo-1.3.4-62.el4_8.3.i386.rpm krb5-debuginfo-1.3.4-62.el4_8.3.x86_64.rpm krb5-devel-1.3.4-62.el4_8.3.x86_64.rpm krb5-libs-1.3.4-62.el4_8.3.i386.rpm krb5-libs-1.3.4-62.el4_8.3.x86_64.rpm krb5-server-1.3.4-62.el4_8.3.x86_64.rpm krb5-workstation-1.3.4-62.el4_8.3.x86_64.rpm Red Hat Enterprise Linux Desktop (v. 5 client): Source: i386: krb5-debuginfo-1.6.1-36.el5_5.6.i386.rpm krb5-libs-1.6.1-36.el5_5.6.i386.rpm krb5-workstation-1.6.1-36.el5_5.6.i386.rpm x86_64: krb5-debuginfo-1.6.1-36.el5_5.6.i386.rpm krb5-debuginfo-1.6.1-36.el5_5.6.x86_64.rpm krb5-libs-1.6.1-36.el5_5.6.i386.rpm krb5-libs-1.6.1-36.el5_5.6.x86_64.rpm krb5-workstation-1.6.1-36.el5_5.6.x86_64.rpm RHEL Desktop Workstation (v. 5 client): Source: i386: krb5-debuginfo-1.6.1-36.el5_5.6.i386.rpm krb5-devel-1.6.1-36.el5_5.6.i386.rpm krb5-server-1.6.1-36.el5_5.6.i386.rpm x86_64: krb5-debuginfo-1.6.1-36.el5_5.6.i386.rpm krb5-debuginfo-1.6.1-36.el5_5.6.x86_64.rpm krb5-devel-1.6.1-36.el5_5.6.i386.rpm krb5-devel-1.6.1-36.el5_5.6.x86_64.rpm krb5-server-1.6.1-36.el5_5.6.x86_64.rpm Red Hat Enterprise Linux (v. 5server): Source: i386: krb5-debuginfo-1.6.1-36.el5_5.6.i386.rpm krb5-devel-1.6.1-36.el5_5.6.i386.rpm krb5-libs-1.6.1-36.el5_5.6.i386.rpm krb5-server-1.6.1-36.el5_5.6.i386.rpm krb5-workstation-1.6.1-36.el5_5.6.i386.rpm ia64: krb5-debuginfo-1.6.1-36.el5_5.6.i386.rpm krb5-debuginfo-1.6.1-36.el5_5.6.ia64.rpm krb5-devel-1.6.1-36.el5_5.6.ia64.rpm krb5-libs-1.6.1-36.el5_5.6.i386.rpm krb5-libs-1.6.1-36.el5_5.6.ia64.rpm krb5-server-1.6.1-36.el5_5.6.ia64.rpm krb5-workstation-1.6.1-36.el5_5.6.ia64.rpm ppc: krb5-debuginfo-1.6.1-36.el5_5.6.ppc.rpm krb5-debuginfo-1.6.1-36.el5_5.6.ppc64.rpm krb5-devel-1.6.1-36.el5_5.6.ppc.rpm krb5-devel-1.6.1-36.el5_5.6.ppc64.rpm krb5-libs-1.6.1-36.el5_5.6.ppc.rpm krb5-libs-1.6.1-36.el5_5.6.ppc64.rpm krb5-server-1.6.1-36.el5_5.6.ppc.rpm krb5-workstation-1.6.1-36.el5_5.6.ppc.rpm s390x: krb5-debuginfo-1.6.1-36.el5_5.6.s390.rpm krb5-debuginfo-1.6.1-36.el5_5.6.s390x.rpm krb5-devel-1.6.1-36.el5_5.6.s390.rpm krb5-devel-1.6.1-36.el5_5.6.s390x.rpm krb5-libs-1.6.1-36.el5_5.6.s390.rpm krb5-libs-1.6.1-36.el5_5.6.s390x.rpm krb5-server-1.6.1-36.el5_5.6.s390x.rpm krb5-workstation-1.6.1-36.el5_5.6.s390x.rpm x86_64: krb5-debuginfo-1.6.1-36.el5_5.6.i386.rpm krb5-debuginfo-1.6.1-36.el5_5.6.x86_64.rpm krb5-devel-1.6.1-36.el5_5.6.i386.rpm krb5-devel-1.6.1-36.el5_5.6.x86_64.rpm krb5-libs-1.6.1-36.el5_5.6.i386.rpm krb5-libs-1.6.1-36.el5_5.6.x86_64.rpm krb5-server-1.6.1-36.el5_5.6.x86_64.rpm krb5-workstation-1.6.1-36.el5_5.6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key#package 7. References: https://access.redhat.com/security/cve/CVE-2010-1323 https://access.redhat.com/security/updates/classification#moderate http://web.mit.edu/Kerberos/advisories/MITKRB5-SA-2010-007.txt 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2010 Red Hat, Inc. . Minor revision of krb5 tackles vulnerabilitiespresent in Red Hat Enterprise Linux versions 4 and 5. Discover additional details.. krb5 Update, Security Risk, Red Hat Security Advisory. . LinuxSecurity.com Team
Nov 30, 2010
Red Hat
172
security advisorymoderate threatpackage upgradeUbuntu 9.10 USN-927-2 Moderate: NSS Issue Affects Firefox Security
USN-927-1 fixed vulnerabilities in NSS. Upstream NSS 3.12.6 added anadditional checksum verification on libnssdbm3.so, but the Ubuntu packagingdid not create this checksum. As a result, Firefox could not initialize thesecurity component when the NSS Internal FIPS PKCS #11 Module was enabled.This update fixes the problem. [More...]. ==========================================================Ubuntu Security Notice USN-927-2 April 11, 2010 nss regression https://bugs.launchpad.net/ubuntu/+source/nss/+bug/559881 ========================================================== A security issue affects the following Ubuntu releases: Ubuntu 9.10 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 9.10: libnss3-1d 3.12.6-0ubuntu0.9.10.2 After a standard system upgrade you need to restart your session to effect the necessary changes. Details follow: USN-927-1 fixed vulnerabilities in NSS. Upstream NSS 3.12.6 added an additional checksum verification on libnssdbm3.so, but the Ubuntu packaging did not create this checksum. As a result, Firefox could not initialize the security component when the NSS Internal FIPS PKCS #11 Module was enabled. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Marsh Ray and Steve Dispensa discovered a flaw in the TLS and SSLv3 protocols. If an attacker could perform a man in the middle attack at the start of a TLS connection, the attacker could inject arbitrary content at the beginning of the user's session. This update adds support for the new new renegotiation extension and will use it when the server supports it. Updated packages for Ubuntu 9.10: Source archives: Size/MD5: 36659 1c82d002115ed4a76dc98d33ef5c839c Size/MD5: 1651 41544d2843858123ad5852de1587744c Size/MD5: 5947630 da42596665f226de5eb3ecfc1ec57cd1 amd64architecture (Athlon64, Opteron, EM64T Xeon): Size/MD5: 3235700 8227d9d710a9784750fc541f82d85101 Size/MD5: 1234558 f8db18eb4fec7df4387e5e546ea99871 Size/MD5: 263208 692167e64c00a9990af72a28299b4fbb Size/MD5: 17854 f9fa214108ab20d8fe4d61567a86d7c0 Size/MD5: 313212 4ae57dcb06572bcdc1e311977a965c55 i386 architecture (x86 compatible Intel/AMD): Size/MD5: 3178422 4a141b3f01631497184c0bb260a212f3 Size/MD5: 1119994 8e4bfbd067aa051603306ce57949ce51 Size/MD5: 260530 c61feb6f65d7419f93f355a5f0755917 Size/MD5: 17856 05ac21be0089e816c076f8707d41d21b Size/MD5: 299834 26d317dc29710b27dd0d0b7a36b6c2a1 lpia architecture (Low Power Intel Architecture): Size/MD5: 3216556 9230b137f92129c304dddfc5c67853fe Size/MD5: 1095892 9566ecb3416bd99ba0e6288505626fe9 Size/MD5: 259484 0236cb25267ac3ca1b3bfd586d14d26d Size/MD5: 17858 ecb362aec61c87f1cfc4e86cd2dec5cb Size/MD5: 298510 2977f41a1b2fcf7ca25b331336f7dc8f powerpc architecture (Apple Macintosh G3/G4/G5): Size/MD5: 3325490 ac9caf32bab4d4b911d1c54112583b65 Size/MD5: 1207122 99b17d40842c1804ee23d19e4a7ffaa0 Size/MD5: 261820 f46b59e90bf4ff07ca79b5d404f372ed Size/MD5: 17858 dca2efb9e1426ff39c55008eaf942926 Size/MD5: 311022 da3a483c19347cd667c11d8a989d15aa sparc architecture (Sun SPARC/UltraSPARC): Size/MD5: 2967780 e3456024e64ee1d14b5b754a93840ac7 Size/MD5: 1074620 202e630d20824b2d4e2614d11d86c2c4 Size/MD5: 257422 fa69b29c59fe334d65d433ab11febbed Size/MD5: 17856 287ae523a22a8049d3d1c802d5760b83 Size/MD5: 299970 ed1b8755bc1e9da16a08c82ebfecf0fd . Debian unveiled DSA-4793-1 resolving a libxml2 flaw, tackling XML parsing vulnerabilities affecting numerous applications.. NSS Update, Package Upgrade, Firefox Fix, Ubuntu Security, Security Module. . Severity: Important. LinuxSecurity.comTeam
Apr 11, 2010
•Important
Ubuntu
98
security advisorymoderateRed HatRed Hat: RHSA-2007:0539-01 Moderate: Aide File Checksum Issue
A flaw was discovered in the way file checksums were stored in the AIDE database. A packaging flaw in the Red Hat AIDE rpm resulted in the file database not containing any file checksum information. This could prevent AIDE from detecting certain file modifications. This update has been rated as having moderate security impact by the Red Hat Security Response Team.. - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Moderate: aide security update Advisory ID: RHSA-2007:0539-01 Advisory URL: https://access.redhat.com/errata/RHSA-2007:0539.html Issue date: 2007-09-04 Updated on: 2007-09-04 Product: Red Hat Enterprise Linux Keywords: aide CVE Names: CVE-2007-3849 - ---------------------------------------------------------------------1. Summary: An updated aide package that fixes various bugs is now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Problem description: Advanced Intrusion Detection Environment (AIDE) is a file integrity checker and intrusion detection program. A flaw was discovered in the way file checksums were stored in the AIDE database. A packaging flaw in the Red Hat AIDE rpm resulted in the file database not containing any file checksum information. This could prevent AIDE from detecting certain file modifications. (CVE-2007-3849) This update also fixes the following bugs: * certain configurations could result in a segmentation fault upon initialization. * AIDE was unable to open its log file in the LSPP evaluated configuration. * if AIDE found SELinux context differences, the changed files report it generated only included the first 32characters of the context. All users of AIDE are advised to upgrade to this updated package containing AIDE version 0.13.1 which is not vulnerable to these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at 5. Bug IDs fixed (http://bugzilla.redhat.com/): 225089 - aide Segmentation fault on initialization 236855 - LSPP: aide can't write its log file 236923 - CVE-2007-3849 Rebase aide to 0.13.1 240144 - [LSPP] aide report output limits context to 32char -- not evaluation blocking 6. RPMs required: Red Hat Enterprise Linux Desktop (v. 5 client): SRPMS: 5ae051f7cebfbef7ebf4829c41134b07 aide-0.13.1-2.0.4.el5.src.rpm i386: 63b364d7e2d356b0441ada657dd40312 aide-0.13.1-2.0.4.el5.i386.rpm 7eb96b96b84e9482583ae4afe2b614b0 aide-debuginfo-0.13.1-2.0.4.el5.i386.rpm x86_64: b5bb0f3be1d18d4dbd4784e9238b66b9 aide-0.13.1-2.0.4.el5.x86_64.rpm 5844acb1a87c4ffa36d97382b87f49f6 aide-debuginfo-0.13.1-2.0.4.el5.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): SRPMS: 5ae051f7cebfbef7ebf4829c41134b07 aide-0.13.1-2.0.4.el5.src.rpm i386: 63b364d7e2d356b0441ada657dd40312 aide-0.13.1-2.0.4.el5.i386.rpm 7eb96b96b84e9482583ae4afe2b614b0 aide-debuginfo-0.13.1-2.0.4.el5.i386.rpm ia64: b6981b6f0287f3a1d958f7627782f695 aide-0.13.1-2.0.4.el5.ia64.rpm c1244a0baa9901db07e39e4d2e697abf aide-debuginfo-0.13.1-2.0.4.el5.ia64.rpm ppc: 15d4fcbf6efdd60052f3258c0c95d5a1 aide-0.13.1-2.0.4.el5.ppc.rpm 4f106c80aa147f95e92b13dd18b7ed54 aide-debuginfo-0.13.1-2.0.4.el5.ppc.rpm s390x: e9df37b291bf6b7d0367d3d4fc966e52 aide-0.13.1-2.0.4.el5.s390x.rpm d0ea63d7118f3ffcedfdd6996b72d4cc aide-debuginfo-0.13.1-2.0.4.el5.s390x.rpm x86_64: b5bb0f3be1d18d4dbd4784e9238b66b9 aide-0.13.1-2.0.4.el5.x86_64.rpm 5844acb1a87c4ffa36d97382b87f49f6 aide-debuginfo-0.13.1-2.0.4.el5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key#package 7. References: https://www.cve.org/CVERecord?id=CVE-2007-3849 https://access.redhat.com/security/updates/classification#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2007 Red Hat, Inc. . Red Hat has published a significant security advisory (RHSA-2007:0540-01) tackling vulnerabilities related to package integrity verification.. Red Hat Security,AIDE Package,Checksum Fix,Moderate Advisory. . LinuxSecurity.com Team
Sep 04, 2007
Red Hat
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!