An issue has been found in sniproxy, a transparent TLS and HTTP layer 4 proxy with SNI support. Due to bad handling of wildcard backend hosts, a crafted HTTP or TLS packet might lead to remote arbitrary code execution. . - ------------------------------------------------------------------------- Debian Security Advisory DSA-5413-1
An update that fixes three vulnerabilities is now available. . SUSE Security Update: Security update for log4j ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:14881-1 Rating: important References: #1194842 #1194843 #1194844 Cross-References: CVE-2022-23302 CVE-2022-23305 CVE-2022-23307 CVSS scores: CVE-2022-23302 (SUSE): 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2022-23305 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-23307 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise Server 11-SP4-LTSS SUSE Linux Enterprise Point of Sale 11-SP3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for log4j fixes the following issues: - CVE-2022-23307: Fixed deserialization flaw in the chainsaw component of log4j leading to malicious code execution. (bsc#1194844) - CVE-2022-23305: Fixed SQL injection when application is configured to use JDBCAppender. (bsc#1194843) - CVE-2022-23302: Fixed remote code execution when application is configured to use JMSSink. (bsc#1194842) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP4-LTSS: zypper in -t patch slessp4-log4j-14881=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-log4j-14881=1 Package List: - SUSE Linux Enterprise Server 11-SP4-LTSS (noarch): log4j-1.2.15-26.32.20.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (noarch): log4j-1.2.15-26.32.20.1 References: https://www.suse.com/security/cve/CVE-2022-23302.html https://www.suse.com/security/cve/CVE-2022-23305.html https://www.suse.com/security/cve/CVE-2022-23307.html https://bugzilla.suse.com/1194842 https://bugzilla.suse.com/1194843 https://bugzilla.suse.com/1194844 . SUSE Security Patch for log4j addresses critical vulnerabilities, notably remote command execution and SQL injection flaws. Take action immediately.. SUSE Security Update, Log4j Patch, Remote Code Fix. . Severity: Important. LinuxSecurity.com Team
Important: thunderbird security update. Date: Tue, 14 Mar 2017 14:07:48 -0000 Reply-To: scientific-linux-users@ Sender: Security Errata for Scientific Linux From: Pat Riehecky Subject: Security ERRATA Important: thunderbird on SL5.x, SL6.x, SL7.x i386/x86_64 MIME-Version: 1.0 Message-ID: Synopsis: Important: thunderbird security update Advisory ID: SLSA-2017:0498-1 Issue Date: 2017-03-14 CVE Numbers: CVE-2017-5400 CVE-2017-5401 CVE-2017-5402 CVE-2017-5404 CVE-2017-5407 CVE-2017-5410 CVE-2017-5408 CVE-2017-5405 CVE-2017-5398 -- This update upgrades Thunderbird to version 45.8.0. Security Fix(es): * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2017-5398, CVE-2017-5400, CVE-2017-5401, CVE-2017-5402, CVE-2017-5404, CVE-2017-5407, CVE-2017-5408, CVE-2017-5410, CVE-2017-5405) -- SL5 x86_64 thunderbird-45.8.0-1.el5_11.x86_64.rpm thunderbird-debuginfo-45.8.0-1.el5_11.x86_64.rpm i386 thunderbird-45.8.0-1.el5_11.i386.rpm thunderbird-debuginfo-45.8.0-1.el5_11.i386.rpm SL6 x86_64 thunderbird-45.8.0-1.el6_8.x86_64.rpm thunderbird-debuginfo-45.8.0-1.el6_8.x86_64.rpm i386 thunderbird-45.8.0-1.el6_8.i686.rpm thunderbird-debuginfo-45.8.0-1.el6_8.i686.rpm SL7 x86_64 thunderbird-45.8.0-1.el7_3.x86_64.rpm thunderbird-debuginfo-45.8.0-1.el7_3.x86_64.rpm - Scientific Linux Development Team . The new Firefox patch resolves major vulnerabilities affecting platforms on SL5.x, SL6.x, and SL7.x iterations.. thunderbird security, Scientific Linux, security update, code execution issues, important advisory. . Severity: Important. LinuxSecurity.com Team
Dawid Golunski discovered that PHPMailer, a popular library to send email from PHP applications, allowed a remote attacker to execute code if they were able to provide a crafted Sender address. . - ------------------------------------------------------------------------- Debian Security Advisory DSA-3750-1
Get the latest Linux and open source security news straight to your inbox.