Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 0 articles for you...
172
security advisorycriticalremote code executionUbuntu 16.04 CUPS Critical Control Character Injection CVE-2026-34980
CUPS could be made to run programs as the lp user if it received specially crafted print job requests.. ========================================================================== Ubuntu Security Notice USN-8578-1 July 21, 2026 CUPS vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS Summary: CUPS could be made to run programs as the lp user if it received specially crafted print job requests. Software Description: - cups: Common UNIX Printing System(tm) Details: It was discovered that CUPS did not properly filter control characters in IPP string attributes and PPD keywords. An unauthenticated attacker could exploit this to execute arbitrary code as the lp user on systems with shared target queues. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS cups 2.1.3-4ubuntu0.11+esm13 Available with Ubuntu Pro cups-bsd 2.1.3-4ubuntu0.11+esm13 Available with Ubuntu Pro cups-client 2.1.3-4ubuntu0.11+esm13 Available with Ubuntu Pro cups-common 2.1.3-4ubuntu0.11+esm13 Available with Ubuntu Pro cups-core-drivers 2.1.3-4ubuntu0.11+esm13 Available with Ubuntu Pro cups-daemon 2.1.3-4ubuntu0.11+esm13 Available with Ubuntu Pro libcups2 2.1.3-4ubuntu0.11+esm13 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8578-1 CVE-2026-34980 . CUPS in Ubuntu could be exploited for remote code execution via crafted print jobrequests, update recommended immediately.. CUPS issue, Ubuntu 16.04, control character exploit, remote access threat, system update. . Severity: Critical. LinuxSecurity.com Team
Jul 21, 2026
•Critical
Ubuntu
197
security advisorymoderatesecurity updateDebian 10: DLA-3735-1 Moderate: Runc Control Character And Breakout
runc is a command line client for running applications packaged according to the Open Container Format (OCF) and is a compliant implementation of the Open Container Project specification. . ------------------------------------------------------------------------- Debian LTS Advisory DLA-3735-1
Feb 19, 2024
Debian LTS
217
security advisorymoderatesecurity updateOracle Linux 9 ELSA-2024-0811 Moderate: Sudo Control Character Update
The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: . Oracle Linux Security Advisory ELSA-2024-0811 https://linux.oracle.com/errata/ELSA-2024-0811.html The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: x86_64: sudo-1.9.5p2-10.el9_3.x86_64.rpm sudo-python-plugin-1.9.5p2-10.el9_3.x86_64.rpm aarch64: sudo-1.9.5p2-10.el9_3.aarch64.rpm sudo-python-plugin-1.9.5p2-10.el9_3.aarch64.rpm SRPMS: https://oss.oracle.com:443/ol9/SRPMS-updates//sudo-1.9.5p2-10.el9_3.src.rpm Related CVEs: CVE-2023-28486 CVE-2023-28487 CVE-2023-42465 Description of changes: RHEL 9.3.0.Z ERRATUM [1.9.5p2-10] - CVE-2023-28487 sudo: Sudo does not escape control characters in sudoreplay output Resolves: RHEL-21834 - CVE-2023-28486 sudo: Sudo does not escape control characters in log messages Resolves: RHEL-21828 - CVE-2023-42465 sudo: Targeted Corruption of Register and Stack Variables Resolves: RHEL-21821 RHEL 8.9.0.Z ERRATUM [1.9.5p2-1] - Rebase to 1.9.5p2 - CVE-2023-28486 sudo: Sudo does not escape control characters in log messages Resolves: RHEL-21825 - CVE-2023-28487 sudo: Sudo does not escape control characters in sudoreplay output Resolves: RHEL-21831 - CVE-2023-42465 sudo: Targeted Corruption of Register and Stack Variables Resolves: RHEL-21820 _______________________________________________ El-errata mailing list
Feb 16, 2024
Oracle
203
security advisorymoderatesecurity issueMageia 8: MGASA-2023-0133 Moderate: Sudo Control Character Escaping
Sudo before 1.9.13 does not escape control characters in log messages. (CVE-2023-28486) Sudo before 1.9.13 does not escape control characters in sudoreplay output. (CVE-2023-28487) . MGASA-2023-0133 - Updated sudo packages fix security vulnerability Publication date: 11 Apr 2023 URL: https://advisories.mageia.org/MGASA-2023-0133.html Type: security Affected Mageia releases: 8 CVE: CVE-2023-28486, CVE-2023-28487 Sudo before 1.9.13 does not escape control characters in log messages. (CVE-2023-28486) Sudo before 1.9.13 does not escape control characters in sudoreplay output. (CVE-2023-28487) References: - https://bugs.mageia.org/show_bug.cgi?id=31738 - https://lists.suse.com/pipermail/sle-security-updates/2023-March/014226.html - https://www.cve.org/CVERecord?id=CVE-2023-28486 - https://www.cve.org/CVERecord?id=CVE-2023-28487 SRPMS: - 8/core/sudo-1.9.5p2-2.3.mga8 . Recent updates to the sudo packages address security vulnerabilities within Mageia 8 related to the improper handling of control character escaping prior to version 1.9.13.. Sudo Security Update, Mageia Security Advisory, Control Characters, Security Vulnerability, Linux Update. . LinuxSecurity.com Team
Apr 11, 2023
Mageia
100
security advisorymoderatesudoSUSE: 2023:873-1 Moderate: Toolbox Security Update for Sudo
The container suse/sle-micro/5.4/toolbox was updated. The following patches have been included in this update:. SUSE Container Update Advisory: suse/sle-micro/5.4/toolbox ----------------------------------------------------------------- Container Advisory ID : SUSE-CU-2023:873-1 Container Tags : suse/sle-micro/5.4/toolbox:12.1 , suse/sle-micro/5.4/toolbox:12.1-3.2.83 , suse/sle-micro/5.4/toolbox:latest Container Release : 3.2.83 Severity : moderate Type : security References : 1203201 1206483 1206772 1207853 1208595 1209361 1209362 CVE-2023-27320 CVE-2023-28486 CVE-2023-28487 ----------------------------------------------------------------- The container suse/sle-micro/5.4/toolbox was updated. The following patches have been included in this update: ----------------------------------------------------------------- Advisory ID: SUSE-RU-2023:1636-1 Released: Tue Mar 28 13:26:02 2023 Summary: Recommended update for suse-module-tools Type: recommended Severity: moderate References: 1207853 This update for suse-module-tools fixes the following issues: - Update to version 15.4.16: * modprobe.conf: s390x: remove softdep on fbcon (bsc#1207853) ----------------------------------------------------------------- Advisory ID: SUSE-SU-2023:1665-1 Released: Wed Mar 29 12:55:13 2023 Summary: Security update for sudo Type: security Severity: moderate References: 1203201,1206483,1206772,1208595,1209361,1209362,CVE-2023-27320,CVE-2023-28486,CVE-2023-28487 This update for sudo fixes the following issue: Security issues: - CVE-2023-28486: Fixed sudo does not escape control characters in log messages. (bsc#1209362) - CVE-2023-28487: Fixed sudo does not escape control characters in sudoreplay output. (bsc#1209361) - CVE-2023-27320: Fixed a potential security issue with a double free with per-command chroot sudoers rules (bsc#1208595). Bug fixes: - Fix a situation where 'sudo -U otheruser -l' would dereference aNULL pointer (bsc#1206483) - If NOPASSWD is specified, don't ask for password if command is not found (bsc#1206772). - Do not re-enable the reader when flushing the buffers as part of pty_finish() (bsc#1203201). The following package changes have been done: - sudo-1.9.9-150400.4.26.1 updated - suse-module-tools-15.4.16-150400.3.8.1 updated . SUSE Container security enhancement introduces vital updates for toolbox and sudo, rectifying vulnerabilities related to control character management.. SUSE Security Update, Toolbox Security, Sudo Update. . LinuxSecurity.com Team
Mar 31, 2023
SuSE
100
security advisorylow severitySUSE LinuxSUSE: 2022:4004-2 Medium Risk: wget Command Line Injection
An update that fixes one vulnerability is now available. . SUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3003-1 Rating: low References: #1202593 Cross-References: CVE-2022-35252 CVSS scores: CVE-2022-35252 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for curl fixes the following issues: - CVE-2022-35252: Fixed a potential injection of control characters into cookies, which could be exploited by sister sites to cause a denial of service (bsc#1202593). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3003=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-3003=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): curl-7.79.1-150400.5.6.1 curl-debuginfo-7.79.1-150400.5.6.1 curl-debugsource-7.79.1-150400.5.6.1 libcurl-devel-7.79.1-150400.5.6.1 libcurl4-7.79.1-150400.5.6.1 libcurl4-debuginfo-7.79.1-150400.5.6.1 - openSUSE Leap 15.4 (x86_64): libcurl-devel-32bit-7.79.1-150400.5.6.1 libcurl4-32bit-7.79.1-150400.5.6.1 libcurl4-32bit-debuginfo-7.79.1-150400.5.6.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): curl-7.79.1-150400.5.6.1 curl-debuginfo-7.79.1-150400.5.6.1 curl-debugsource-7.79.1-150400.5.6.1 libcurl-devel-7.79.1-150400.5.6.1 libcurl4-7.79.1-150400.5.6.1 libcurl4-debuginfo-7.79.1-150400.5.6.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (x86_64): libcurl4-32bit-7.79.1-150400.5.6.1 libcurl4-32bit-debuginfo-7.79.1-150400.5.6.1 References: https://www.suse.com/security/cve/CVE-2022-35252.html https://bugzilla.suse.com/1202593 . SUSE has issued a Security Update for curl, addressing a minor severity issue related to control character injection, to improve application security and integrity. SUSE Updates, Curl Security, Linux Desktop Security, Denial of Service, Patch Management. . Severity: Low. LinuxSecurity.com Team
Sep 02, 2022
•Low
SuSE
100
security advisorysecurity updateSUSESUSE: 2021:0486-1 Moderate: Python-Urllib3 Control Character Injection
An update that fixes one vulnerability is now available. . SUSE Security Update: Security update for python-urllib3 ______________________________________________________________________________ Announcement ID: SUSE-SU-2021:0486-1 Rating: moderate References: #1177211 Cross-References: CVE-2020-26116 CVSS scores: CVE-2020-26116 (NVD) : 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CVE-2020-26116 (SUSE): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N Affected Products: SUSE OpenStack Cloud 7 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-urllib3 fixes the following issues: - CVE-2020-26116: Raise ValueError if method contains control characters and thus prevent CRLF injection into URLs (bsc#1177211). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 7: zypper in -t patch SUSE-OpenStack-Cloud-7-2021-486=1 Package List: - SUSE OpenStack Cloud 7 (noarch): python-urllib3-1.16-3.15.1 References: https://www.suse.com/security/cve/CVE-2020-26116.html https://bugzilla.suse.com/1177211 . New patch released for python-urllib3 mitigating control character injection threats. Resolve security issue in line with SUSE advisory.. SUSE Update, Python Urllib3, Security Patch, Moderate Risk, Control Characters Fix. . LinuxSecurity.com Team
Feb 16, 2021
SuSE
100
security advisorymoderateSUSE LinuxSUSE: 2021:0457-1 Important: python-requests Security Vulnerability Notice
An update that solves one vulnerability and has one errata is now available. . SUSE Security Update: Security update for python-urllib3 ______________________________________________________________________________ Announcement ID: SUSE-SU-2021:0341-1 Rating: moderate References: #1177211 #1181571 Cross-References: CVE-2020-26116 CVSS scores: CVE-2020-26116 (NVD) Base Score: 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CVE-2020-26116 (SUSE) Base Score: 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N Affected Products: SUSE Linux Enterprise Server for SAP 15 SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise High Performance Computing 15-ESPOS ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for python-urllib3 fixes the following issues: - CVE-2020-26116: Raise ValueError if method contains control characters and thus prevent CRLF injection into URLs (bsc#1177211). - Skip test for RECENT_DATE (bsc#1181571). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 15: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2021-341=1 - SUSE Linux Enterprise Server 15-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-2021-341=1 - SUSE Linux Enterprise High Performance Computing 15-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-2021-341=1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-2021-341=1 Package List: - SUSE Linux Enterprise Server for SAP 15 (noarch): python2-urllib3-1.22-6.12.1 python3-urllib3-1.22-6.12.1 - SUSE Linux Enterprise Server 15-LTSS (noarch): python2-urllib3-1.22-6.12.1 python3-urllib3-1.22-6.12.1 - SUSE Linux Enterprise High Performance Computing 15-LTSS (noarch): python2-urllib3-1.22-6.12.1 python3-urllib3-1.22-6.12.1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS (noarch): python2-urllib3-1.22-6.12.1 python3-urllib3-1.22-6.12.1 References: https://www.suse.com/security/cve/CVE-2020-26116.html https://bugzilla.suse.com/1177211 https://bugzilla.suse.com/1181571 . A recent update for python-urllib3 tackles a moderate severity issue, specifically addressing a critical control character injection vulnerability that has been resolved.. SUSE Linux Enterprise, Python Urllib3 Update, Security Fix, Information Disclosure. . Severity: Important. LinuxSecurity.com Team
Feb 08, 2021
•Important
SuSE
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!