Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -6 articles for you...
172
security advisorysecurity issueDoSUbuntu 24.04 LTS USN-6860-1 Critical Security Advisory: OpenVPN DoS
Several security issues were fixed in OpenVPN.. ========================================================================== Ubuntu Security Notice USN-6860-1 July 02, 2024 openvpn vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.04 LTS - Ubuntu 23.10 - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS Summary: Several security issues were fixed in OpenVPN. Software Description: - openvpn: virtual private network software Details: Reynir Björnsson discovered that OpenVPN incorrectly handled terminating client connections. A remote authenticated client could possibly use this issue to keep the connection active, bypassing certain security policies. This issue only affected Ubuntu 23.10, and Ubuntu 24.04 LTS. (CVE-2024-28882) Reynir Björnsson discovered that OpenVPN incorrectly handled certain control channel messages with nonprintable characters. A remote attacker could possibly use this issue to cause OpenVPN to consume resources, or fill up log files with garbage, leading to a denial of service. (CVE-2024-5594) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 24.04 LTS openvpn 2.6.9-1ubuntu4.1 Ubuntu 23.10 openvpn 2.6.5-0ubuntu1.2 Ubuntu 22.04 LTS openvpn 2.5.9-0ubuntu0.22.04.3 Ubuntu 20.04 LTS openvpn 2.4.12-0ubuntu0.20.04.2 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6860-1 CVE-2024-28882, CVE-2024-5594 Package Information: https://launchpad.net/ubuntu/+source/openvpn/2.6.9-1ubuntu4.1 https://launchpad.net/ubuntu/+source/openvpn/2.6.5-0ubuntu1.2 https://launchpad.net/ubuntu/+source/openvpn/2.5.9-0ubuntu0.22.04.3 https://launchpad.net/ubuntu/+source/openvpn/2.4.12-0ubuntu0.20.04.2 . Ubuntu versions 24.04 and 23.10 are encountering critical OpenVPN vulnerabilities that necessitate immediate attention. Please update promptly to maintain security!. OpenVPN Security Updates, VPN Issues, Ubuntu Security Notice, System Vulnerabilities. . Severity: Critical. LinuxSecurity.com Team
Jul 02, 2024
•Critical
Ubuntu
98
security advisoryred hataccess controlRed Hat: RHSA-2016-0011-01 Moderate: Samba Access Flaws and Fixes
Updated samba packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: samba security update Advisory ID: RHSA-2016:0011-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2016:0011.html Issue date: 2016-01-07 CVE Names: CVE-2015-5252 CVE-2015-5296 CVE-2015-5299 ==================================================================== 1. Summary: Updated samba packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64 3. Description: Samba is an open-source implementation of the Server Message Block (SMB) or Common Internet File System (CIFS) protocol, which allows PC-compatible machines to share files, printers, and other information. A man-in-the-middle vulnerability was found in the way "connection signing" was implemented by Samba. A remoteattacker could use this flaw to downgrade an existing Samba client connection and force the use of plain text. (CVE-2015-5296) A missing access control flaw was found in Samba. A remote, authenticated attacker could use this flaw to view the current snapshot on a Samba share, despite not having DIRECTORY_LIST access rights. (CVE-2015-5299) An access flaw was found in the way Samba verified symbolic links when creating new files on a Samba share. A remote attacker could exploit this flaw to gain access to files outside of Samba's share path. (CVE-2015-5252) Red Hat would like to thank the Samba project for reporting these issues. Upstream acknowledges Stefan Metzmacher of the Samba Team and Sernet.de as the original reporters of CVE-2015-5296,
Jan 08, 2016
Red Hat
200
security advisorymoderatebug fixScientific Linux 6: 2012-09-19 Moderate: qpid Connection Limit Issue
Moderate: qpid security, bug fix, and enhancement update. Date: Thu, 20 Sep 2012 08:34:54 -0500 Reply-To: Pat Riehecky Sender: Security Errata for Scientific Linux From: Pat Riehecky Organization: Fermilab Subject: Security ERRATA Moderate: qpid on SL6.x i386/x86_64 MIME-Version: 1.0 Synopsis: Moderate: qpid security, bug fix, and enhancement update Issue Date: 2012-09-19 CVE Numbers: CVE-2012-2145 Apache Qpid is a reliable, cross-platform, asynchronous messaging system that supports the Advanced Message Queuing Protocol (AMQP) in several common programming languages. It was discovered that the Qpid daemon (qpidd) did not allow the number of connections from clients to be restricted. A malicious client could use this flaw to open an excessive amount of connections, preventing other legitimate clients from establishing a connection to qpidd. (CVE-2012-2145) To address CVE-2012-2145, new qpidd configuration options were introduced: max-negotiate-time defines the time during which initial protocol negotiation must succeed, connection-limit-per-user and connection-limit-per-ip can be used to limit the number of connections per user and client host IP. Refer to the qpidd manual page for additional details. In addition, the qpid-cpp, qpid-qmf, qpid-tools, and python-qpid packages have been upgraded to upstream version 0.14, which provides a number of bug fixes and enhancements over the previous version. All users of qpid are advised to upgrade to these updated packages, which fix these issues and add these enhancements. For dependency resolution saslwrapper, saslwrapper-devel, python-saslwrapper, and ruby-saslwrapper have been added to this update SL6 x86_64 python-qpid-qmf-0.14-14.el6_3.x86_64.rpm qpid-cpp-client-0.14-22.el6_3.i686.rpm qpid-cpp-client-0.14-22.el6_3.x86_64.rpm qpid-cpp-client-ssl-0.14-22.el6_3.i686.rpm qpid-cpp-client-ssl-0.14-22.el6_3.x86_64.rpm qpid-cpp-server-0.14-22.el6_3.i686.rpm qpid-cpp-server-0.14-22.el6_3.x86_64.rpm qpid-cpp-server-ssl-0.14-22.el6_3.x86_64.rpm qpid-qmf-0.14-14.el6_3.i686.rpm qpid-qmf-0.14-14.el6_3.x86_64.rpm ruby-qpid-qmf-0.14-14.el6_3.x86_64.rpm Dependencies: python-saslwrapper-0.14-1.el6.x86_64.rpm ruby-saslwrapper-0.14-1.el6.x86_64.rpm saslwrapper-0.14-1.el6.i686.rpm saslwrapper-0.14-1.el6.x86_64.rpm saslwrapper-devel-0.14-1.el6.i686.rpm saslwrapper-devel-0.14-1.el6.x86_64.rpm i386 python-qpid-qmf-0.14-14.el6_3.i686.rpm qpid-cpp-client-0.14-22.el6_3.i686.rpm qpid-cpp-client-ssl-0.14-22.el6_3.i686.rpm qpid-cpp-server-0.14-22.el6_3.i686.rpm qpid-cpp-server-ssl-0.14-22.el6_3.i686.rpm qpid-qmf-0.14-14.el6_3.i686.rpm ruby-qpid-qmf-0.14-14.el6_3.i686.rpm Dependencies: python-saslwrapper-0.14-1.el6.i686.rpm ruby-saslwrapper-0.14-1.el6.i686.rpm saslwrapper-0.14-1.el6.i686.rpm saslwrapper-devel-0.14-1.el6.i686.rpm noarch python-qpid-0.14-11.el6_3.noarch.rpm qpid-tools-0.14-6.el6_3.noarch.rpm - Scientific Linux Development Team . Recent improvements to qpid address connection restrictions and boost capabilities on Scientific Linux.. qpid Update, Client Connection Fix, Security Advisory, SL6 Enhancements, Moderate Vulnerabilities. . LinuxSecurity.com Team
Sep 20, 2012
Scientific Linux
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!