Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 32 articles for you...
217
security advisorysoftware updatesecurity fixOracle Linux 9 ELSA-2024-3513 Critical: Fix for CVE-2024-32487
The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: . Oracle Linux Security Advisory ELSA-2024-3513 http://linux.oracle.com/errata/ELSA-2024-3513.html The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: x86_64: less-590-4.el9_4.x86_64.rpm aarch64: less-590-4.el9_4.aarch64.rpm SRPMS: http://oss.oracle.com/ol9/SRPMS-updates//less-590-4.el9_4.src.rpm Related CVEs: CVE-2024-32487 Description of changes: [590-4] - Fix CVE-2024-32487 - Resolves: RHEL-33773 _______________________________________________ El-errata mailing list
Jun 03, 2024
•Critical
Oracle
217
security advisoryDoS issuecritical advisoryOracle Linux 9 ELSA-2024-3307 Critical: Tomcat Denial Of Service Threat
The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: . Oracle Linux Security Advisory ELSA-2024-3307 http://linux.oracle.com/errata/ELSA-2024-3307.html The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: x86_64: tomcat-9.0.87-1.el9_4.1.noarch.rpm tomcat-admin-webapps-9.0.87-1.el9_4.1.noarch.rpm tomcat-docs-webapp-9.0.87-1.el9_4.1.noarch.rpm tomcat-el-3.0-api-9.0.87-1.el9_4.1.noarch.rpm tomcat-jsp-2.3-api-9.0.87-1.el9_4.1.noarch.rpm tomcat-lib-9.0.87-1.el9_4.1.noarch.rpm tomcat-servlet-4.0-api-9.0.87-1.el9_4.1.noarch.rpm tomcat-webapps-9.0.87-1.el9_4.1.noarch.rpm aarch64: tomcat-9.0.87-1.el9_4.1.noarch.rpm tomcat-admin-webapps-9.0.87-1.el9_4.1.noarch.rpm tomcat-docs-webapp-9.0.87-1.el9_4.1.noarch.rpm tomcat-el-3.0-api-9.0.87-1.el9_4.1.noarch.rpm tomcat-jsp-2.3-api-9.0.87-1.el9_4.1.noarch.rpm tomcat-lib-9.0.87-1.el9_4.1.noarch.rpm tomcat-servlet-4.0-api-9.0.87-1.el9_4.1.noarch.rpm tomcat-webapps-9.0.87-1.el9_4.1.noarch.rpm SRPMS: http://oss.oracle.com/ol9/SRPMS-updates//tomcat-9.0.87-1.el9_4.1.src.rpm Related CVEs: CVE-2024-23672 CVE-2024-24549 Description of changes: [1:9.0.87-1.el9_4.1] - Resolves: RHEL-34815 - Rebase tomcat to version 9.0.87 - Resolves: RHEL-31048 tomcat: Apache Tomcat: WebSocket DoS with incomplete closing handshake (CVE-2024-23672) - Resolves: RHEL-31032 tomcat: : Apache Tomcat: HTTP/2 header handling DoS (CVE-2024-24549) - Resolves: RHEL-35328 - Amend tomcat's changelog (CVE-2023-46589, CVE-2023-45648, CVE-2023-42795, CVE-2023-42794, CVE-2023-44487, CVE-2023-41080) _______________________________________________ El-errata mailing list
May 27, 2024
•Critical
Oracle
172
security advisorydenial of servicekernelUbuntu 22.04 LTS USN-6766-1 Critical: Linux Kernel Denial Of Service
Several security issues were fixed in the Linux kernel.. ========================================================================== Ubuntu Security Notice USN-6766-1 May 07, 2024 linux, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-gkeop-5.15, linux-ibm, linux-ibm-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS Summary: Several security issues were fixed in the Linux kernel. Software Description: - linux: Linux kernel - linux-azure: Linux kernel for Microsoft Azure Cloud systems - linux-azure-fde: Linux kernel for Microsoft Azure CVM cloud systems - linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems - linux-gke: Linux kernel for Google Container Engine (GKE) systems - linux-gkeop: Linux kernel for Google Container Engine (GKE) systems - linux-ibm: Linux kernel for IBM cloud systems - linux-kvm: Linux kernel for cloud environments - linux-lowlatency: Linux low latency kernel - linux-nvidia: Linux kernel for NVIDIA systems - linux-oracle: Linux kernel for Oracle Cloud systems - linux-azure-5.15: Linux kernel for Microsoft Azure cloud systems - linux-azure-fde-5.15: Linux kernel for Microsoft Azure CVM cloud systems - linux-gcp-5.15: Linux kernel for Google Cloud Platform (GCP) systems - linux-gkeop-5.15: Linux kernel for Google Container Engine (GKE) systems - linux-ibm-5.15: Linux kernel for IBM cloud systems - linux-lowlatency-hwe-5.15: Linux low latency kernel - linux-oracle-5.15: Linux kernel for Oracle Cloud systems Details: It was discovered that the Open vSwitch implementation in the Linux kernel could overflow its stack during recursive action operations under certain conditions. A local attacker could usethis to cause a denial of service (system crash). (CVE-2024-1151) Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida discovered that the Linux kernel mitigations for the initial Branch History Injection vulnerability (CVE-2022-0001) were insufficient for Intel processors. A local attacker could potentially use this to expose sensitive information. (CVE-2024-2201) Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - PowerPC architecture; - S390 architecture; - Core kernel; - Block layer subsystem; - Android drivers; - Power management core; - Bus devices; - Hardware random number generator core; - Cryptographic API; - Device frequency; - DMA engine subsystem; - ARM SCMI message protocol; - GPU drivers; - HID subsystem; - Hardware monitoring drivers; - I2C subsystem; - IIO ADC drivers; - IIO subsystem; - IIO Magnetometer sensors drivers; - InfiniBand drivers; - Media drivers; - Network drivers; - PCI driver for MicroSemi Switchtec; - PHY drivers; - SCSI drivers; - DesignWare USB3 driver; - BTRFS file system; - Ceph distributed file system; - Ext4 file system; - F2FS file system; - JFS file system; - NILFS2 file system; - NTFS3 file system; - Pstore file system; - SMB network file system; - Memory management; - CAN network layer; - Networking core; - HSR network protocol; - IPv4 networking; - IPv6 networking; - Logical Link layer; - Multipath TCP; - Netfilter; - NFC subsystem; - SMC sockets; - Sun RPC protocol; - TIPC protocol; -Unix domain sockets; - Realtek audio codecs; (CVE-2023-52594, CVE-2023-52601, CVE-2024-26826, CVE-2023-52622, CVE-2024-26665, CVE-2023-52493, CVE-2023-52633, CVE-2024-26684, CVE-2024-26663, CVE-2023-52618, CVE-2023-52588, CVE-2023-52637, CVE-2024-26825, CVE-2023-52606, CVE-2024-26594, CVE-2024-26625, CVE-2024-26720, CVE-2024-26614, CVE-2023-52627, CVE-2023-52602, CVE-2024-26673, CVE-2024-26685, CVE-2023-52638, CVE-2023-52498, CVE-2023-52619, CVE-2024-26910, CVE-2024-26689, CVE-2023-52583, CVE-2024-26676, CVE-2024-26671, CVE-2024-26704, CVE-2024-26608, CVE-2024-26610, CVE-2024-26592, CVE-2023-52599, CVE-2023-52595, CVE-2024-26660, CVE-2023-52617, CVE-2024-26645, CVE-2023-52486, CVE-2023-52631, CVE-2023-52607, CVE-2023-52608, CVE-2024-26722, CVE-2024-26615, CVE-2023-52615, CVE-2024-26636, CVE-2023-52642, CVE-2023-52587, CVE-2024-26712, CVE-2024-26675, CVE-2023-52614, CVE-2024-26606, CVE-2024-26916, CVE-2024-26600, CVE-2024-26679, CVE-2024-26829, CVE-2024-26641, CVE-2023-52623, CVE-2024-26627, CVE-2024-26696, CVE-2024-26640, CVE-2024-26635, CVE-2023-52491, CVE-2024-26664, CVE-2024-26602, CVE-2023-52604, CVE-2024-26717, CVE-2023-52643, CVE-2024-26593, CVE-2023-52598, CVE-2024-26668, CVE-2023-52435, CVE-2023-52597, CVE-2024-26715, CVE-2024-26707, CVE-2023-52635, CVE-2024-26695, CVE-2024-26698, CVE-2023-52494, CVE-2024-26920, CVE-2024-26808, CVE-2023-52616, CVE-2023-52492, CVE-2024-26702, CVE-2024-26644, CVE-2023-52489, CVE-2024-26697) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS linux-image-5.15.0-1044-gkeop 5.15.0-1044.51 linux-image-5.15.0-1054-ibm 5.15.0-1054.57 linux-image-5.15.0-1054-nvidia 5.15.0-1054.55 linux-image-5.15.0-1054-nvidia-lowlatency 5.15.0-1054.55 linux-image-5.15.0-1058-gke 5.15.0-1058.63 linux-image-5.15.0-1058-kvm 5.15.0-1058.63 linux-image-5.15.0-1059-gcp 5.15.0-1059.67 linux-image-5.15.0-1059-oracle 5.15.0-1059.65 linux-image-5.15.0-106-generic 5.15.0-106.116 linux-image-5.15.0-106-generic-64k 5.15.0-106.116 linux-image-5.15.0-106-generic-lpae 5.15.0-106.116 linux-image-5.15.0-106-lowlatency 5.15.0-106.116 linux-image-5.15.0-106-lowlatency-64k 5.15.0-106.116 linux-image-5.15.0-1063-azure 5.15.0-1063.72 linux-image-5.15.0-1063-azure-fde 5.15.0-1063.72.1 linux-image-azure-fde-lts-22.04 5.15.0.1063.72.41 linux-image-azure-lts-22.04 5.15.0.1063.61 linux-image-gcp-lts-22.04 5.15.0.1059.55 linux-image-generic 5.15.0.106.106 linux-image-generic-64k 5.15.0.106.106 linux-image-generic-lpae 5.15.0.106.106 linux-image-gke 5.15.0.1058.57 linux-image-gke-5.15 5.15.0.1058.57 linux-image-gkeop 5.15.0.1044.43 linux-image-gkeop-5.15 5.15.0.1044.43 linux-image-ibm 5.15.0.1054.50 linux-image-kvm 5.15.0.1058.54 linux-image-lowlatency 5.15.0.106.101 linux-image-lowlatency-64k 5.15.0.106.101 linux-image-nvidia 5.15.0.1054.54 linux-image-nvidia-lowlatency 5.15.0.1054.54 linux-image-oracle-lts-22.04 5.15.0.1059.55 linux-image-virtual 5.15.0.106.106 Ubuntu 20.04 LTS linux-image-5.15.0-1044-gkeop 5.15.0-1044.51~20.04.1 linux-image-5.15.0-1054-ibm 5.15.0-1054.57~20.04.1 linux-image-5.15.0-1059-gcp 5.15.0-1059.67~20.04.1 linux-image-5.15.0-1059-oracle 5.15.0-1059.65~20.04.1 linux-image-5.15.0-106-lowlatency 5.15.0-106.116~20.04.1 linux-image-5.15.0-106-lowlatency-64k 5.15.0-106.116~20.04.1 linux-image-5.15.0-1063-azure 5.15.0-1063.72~20.04.1 linux-image-5.15.0-1063-azure-fde 5.15.0-1063.72~20.04.1.1 linux-image-azure 5.15.0.1063.72~20.04.1 linux-image-azure-cvm 5.15.0.1063.72~20.04.1 linux-image-azure-fde 5.15.0.1063.72~20.04.1.41 linux-image-gcp 5.15.0.1059.67~20.04.1 linux-image-gkeop-5.15 5.15.0.1044.51~20.04.1 linux-image-ibm 5.15.0.1054.57~20.04.1 linux-image-lowlatency-64k-hwe-20.04 5.15.0.106.116~20.04.1 linux-image-lowlatency-hwe-20.04 5.15.0.106.116~20.04.1 linux-image-oracle 5.15.0.1059.65~20.04.1 After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well. References: https://ubuntu.com/security/notices/USN-6766-1 CVE-2023-52435, CVE-2023-52486, CVE-2023-52489, CVE-2023-52491, CVE-2023-52492, CVE-2023-52493, CVE-2023-52494, CVE-2023-52498, CVE-2023-52583, CVE-2023-52587, CVE-2023-52588, CVE-2023-52594, CVE-2023-52595, CVE-2023-52597, CVE-2023-52598, CVE-2023-52599, CVE-2023-52601, CVE-2023-52602, CVE-2023-52604, CVE-2023-52606, CVE-2023-52607, CVE-2023-52608, CVE-2023-52614, CVE-2023-52615, CVE-2023-52616, CVE-2023-52617, CVE-2023-52618, CVE-2023-52619, CVE-2023-52622, CVE-2023-52623, CVE-2023-52627, CVE-2023-52631, CVE-2023-52633, CVE-2023-52635, CVE-2023-52637, CVE-2023-52638, CVE-2023-52642, CVE-2023-52643, CVE-2024-1151, CVE-2024-2201, CVE-2024-23849, CVE-2024-26592, CVE-2024-26593, CVE-2024-26594, CVE-2024-26600, CVE-2024-26602, CVE-2024-26606, CVE-2024-26608, CVE-2024-26610, CVE-2024-26614, CVE-2024-26615, CVE-2024-26625, CVE-2024-26627, CVE-2024-26635, CVE-2024-26636, CVE-2024-26640, CVE-2024-26641, CVE-2024-26644, CVE-2024-26645, CVE-2024-26660, CVE-2024-26663, CVE-2024-26664, CVE-2024-26665, CVE-2024-26668, CVE-2024-26671, CVE-2024-26673, CVE-2024-26675,CVE-2024-26676, CVE-2024-26679, CVE-2024-26684, CVE-2024-26685, CVE-2024-26689, CVE-2024-26695, CVE-2024-26696, CVE-2024-26697, CVE-2024-26698, CVE-2024-26702, CVE-2024-26704, CVE-2024-26707, CVE-2024-26712, CVE-2024-26715, CVE-2024-26717, CVE-2024-26720, CVE-2024-26722, CVE-2024-26808, CVE-2024-26825, CVE-2024-26826, CVE-2024-26829, CVE-2024-26910, CVE-2024-26916, CVE-2024-26920 Package Information: https://launchpad.net/ubuntu/+source/linux/5.15.0-106.116 https://launchpad.net/ubuntu/+source/linux-azure/5.15.0-1063.72 https://launchpad.net/ubuntu/+source/linux-azure-fde/5.15.0-1063.72.1 https://launchpad.net/ubuntu/+source/linux-gcp/5.15.0-1059.67 https://launchpad.net/ubuntu/+source/linux-gke/5.15.0-1058.63 https://launchpad.net/ubuntu/+source/linux-gkeop/5.15.0-1044.51 https://launchpad.net/ubuntu/+source/linux-ibm/5.15.0-1054.57 https://launchpad.net/ubuntu/+source/linux-kvm/5.15.0-1058.63 https://launchpad.net/ubuntu/+source/linux-lowlatency/5.15.0-106.116 https://launchpad.net/ubuntu/+source/linux-nvidia/5.15.0-1054.55 https://launchpad.net/ubuntu/+source/linux-oracle/5.15.0-1059.65 https://launchpad.net/ubuntu/+source/linux-azure-5.15/5.15.0-1063.72~20.04.1 https://launchpad.net/ubuntu/+source/linux-azure-fde-5.15/5.15.0-1063.72~20.04.1.1 https://launchpad.net/ubuntu/+source/linux-gcp-5.15/5.15.0-1059.67~20.04.1 https://launchpad.net/ubuntu/+source/linux-gkeop-5.15/5.15.0-1044.51~20.04.1 https://launchpad.net/ubuntu/+source/linux-ibm-5.15/5.15.0-1054.57~20.04.1 https://launchpad.net/ubuntu/+source/linux-lowlatency-hwe-5.15/5.15.0-106.116~20.04.1 https://launchpad.net/ubuntu/+source/linux-oracle-5.15/5.15.0-1059.65~20.04.1 . Uncover resolutions for various Linux kernel vulnerabilities highlighted in Ubuntu's recent security alert addressing potential denial of service attacks.. Ubuntu Kernel Update, Linux Kernel Security, Ubuntu Advisory. . Severity: Critical. LinuxSecurity.com Team
May 07, 2024
•Critical
Ubuntu
100
security advisorybuffer overflowcritical advisorySuSE: 2002:033 Critical Advisory: OpenSSL Buffer Overflow by Slapper Worm
On July 30, we (SuSe) released a security advisory concerning vulnerabilities in OpenSSL, including a buffer overflow in the SSL code. This vulnerability is currently being exploited by a worm called Slapper, propagating through Apache's mod_ssl module. . ______________________________________________________________________________ SuSE Security Announcement Package: openssl/Slapper worm Announcement-ID: SuSE-SA:2002:033 Date: Thu Sep 19 2002 Affected products: 7.0, 7.1, 7.2, 7.3, 8.0 SuSE Linux Database Server, SuSE eMail Server III, SuSE eMail Server 3.1, SuSE Linux Enterprise Server, SuSE Linux Firewall on CD, SuSE Linux Enterprise Server 7 SuSE Linux Office Server Vulnerability Type: buffer overflow Severity (1-10): 9 SuSE default package: yes Cross References: CVE CAN-2002-0655, CAN-2002-0656, CAN-2002-0659, SuSE-SA:2002:027 Content of this advisory: 1) vulnerabilities in openssl libraries; Slapper worm 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information This advisory is issued in an attempt to clarify any issues surrounding the recently discovered Apache/mod_ssl worm. On July 30, we released a security advisory concerning vulnerabilities in OpenSSL, including a buffer overflow in the SSL code. This vulnerability (CVE CAN-2002-0656, also discussed in CERT Advisory is currently being exploited by a worm calledSlapper, propagating through Apache's mod_ssl module. It is worth noting that even though the worm infects Apache through mod_ssl, this is not a vulnerability in mod_ssl or Apache, but in the OpenSSL library used by mod_ssl. This also means that Apache may not be the only service vulnerable to an attack via the SSL bug. Similar exploits may be possible against cyrus-imapd, sendmail with TLS support, or sslwrap-enabled services. As a workaround, it is also possible to disable SSLv2 in mod_ssl (as described in our previous advisory SuSE-SA:2002:027; SUSE – Open-Source-Lösungen für Enterprise Server und Cloud | SUSE but you should be aware that this does not protect other SSL based servers that may be running on your machine. We have received numerous inquiries from SuSE users on whether the update packages provided by SuSE as part of SA:2002:027 fix this bug even though they do not contain the latest OpenSSL version recommended in various advisories. To clarify this, we would like to state that these packages DO FIX the bug exploited by the Slapper worm. Following established policy, we did this by applying a source code patch instead of upgrading to a newer version, because the latter usually causes serious problems for many users (in particular, different versions of OpenSSL libraries are not always API compatible). However, it turns out that a number of packages were statically linked against OpenSSL libraries: mod_ssl (SuSE Linux 7.0): We have released rebuilt mod_ssl packages linked against the most recent OpenSSL libraries. If you run mod_ssl on SuSE Linux 7.0, you must upgrade mod_ssl, too. sendmail-tls (SuSE Linux 7.1, 7.2, 7.3): Sendmail-tls, the SSL enabled version of sendmail, was linked statically against OpenSSL on SuSE 7.1, 7.2 and 7.3. The security impact of this problem is probablythe same as with Apache and mod_ssl. We are releasing rebuilt packages linked against the most OpenSSL libraries. Sendmail-tls is not part of the default installation profile. If you are using sendmail-tls, we strongly recommend you upgrade to the latest packages provided on our FTP servers. openssh (SuSE Linux 7.1, 7.2 and 7.3): Ssh and sshd do not use any SSL functionality, and thus are not susceptible to the type of attack carried out by the Slapper worm. To date, we are not aware of any way to exploit them. We nevertheless recommend to upgrade to the latest versions provided on our FTP site. freeswan (SuSE Linux 7.1, 7.2): FreeSWAN includes a utility named fswcert for creating and manipulating X.509 certificates, which is also linked statically against libcrypto. To date, we are not aware of any way to exploit them. We nevertheless recommend to upgrade to the latest versions provided on our FTP site as soon as they become available (2002 Sep 20). ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: mod_php4: we are preparing an update of mod_php4 addressing various vulnerabilities that have been published recently. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other toprove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key
Apr 06, 2024
•Critical
SuSE
197
security advisoryremote code executiondebianDebian 10: DLA-3706-1 Critical: Netatalk Symlink Exposure
Corentin BAYET, Etienne HELLUY-LAFONT and Luca MORO of Synacktiv discovered a symlink redirection vulnerability in Netatalk, the Apple Filing Protocol service. The create_appledesktop_folder function of netatalk can be used to unsafely move files outside the shared volume using the "mv" system utility. . ------------------------------------------------------------------------- Debian LTS Advisory DLA-3706-1
Jan 04, 2024
•Critical
Debian LTS
89
security advisorybuffer overflowFedoraFedora 38 Critical Advisory FEDORA-2023-0e68827d36: Buffer Overflow
Backport fix for CVE-2023-37369.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2023-0e68827d36 2023-08-30 01:35:03.119188 -------------------------------------------------------------------------------- Name : mingw-qt5-qtbase Product : Fedora 38 Version : 5.15.10 Release : 4.fc38 URL : https://www.qt.io/ Summary : Qt5 for Windows - QtBase component Description : This package contains the Qt software toolkit for developing cross-platform applications. This is the Windows version of Qt, for use in conjunction with the Fedora Windows cross-compiler. -------------------------------------------------------------------------------- Update Information: Backport fix for CVE-2023-37369. -------------------------------------------------------------------------------- ChangeLog: * Wed Aug 16 2023 Sandro Mani - 5.15.10-4 - Backport fix for CVE-2023-37369 * Thu Jul 20 2023 Fedora Release Engineering - 5.15.10-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2232357 - CVE-2023-37369 mingw-qt5-qtbase: qtbase: buffer overflow in QXmlStreamReader [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2232357 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-0e68827d36' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Aug 30, 2023
•Critical
Fedora
217
security advisorysecurity updatecritical advisoryOracle Linux 8 ELSA-2023-3220 Critical: Firefox Security Update
The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network: . Oracle Linux Security Advisory ELSA-2023-3220 https://linux.oracle.com/errata/ELSA-2023-3220.html The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network: x86_64: firefox-102.11.0-2.0.1.el8_7.x86_64.rpm aarch64: firefox-102.11.0-2.0.1.el8_7.aarch64.rpm SRPMS: https://oss.oracle.com:443/ol8/SRPMS-updates//firefox-102.11.0-2.0.1.el8_7.src.rpm Related CVEs: CVE-2023-32205 CVE-2023-32206 CVE-2023-32207 CVE-2023-32211 CVE-2023-32212 CVE-2023-32213 CVE-2023-32215 Description of changes: [102.11.0-2.0.1] - Updated homepages to use https [Orabug: 34648274] - Removed Upstream references - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [102.11.0-2] - Update to 102.11.0 build2 [102.11.0-1] - Update to 102.11.0 build1 _______________________________________________ El-errata mailing list
Jun 12, 2023
•Critical
Oracle
172
security advisorydenial of servicebuffer overflowUbuntu 20.04 ESM USN-5971-1 Critical: Graphviz Denial Of Service
Several security issues were fixed in graphviz.. =========================================================================Ubuntu Security Notice USN-5971-1 March 24, 2023 graphviz vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.04 ESM - Ubuntu 18.04 ESM - Ubuntu 14.04 ESM Summary: Several security issues were fixed in graphviz. Software Description: - graphviz: rich set of graph drawing tools Details: It was discovered that graphviz contains null pointer dereference vulnerabilities. Exploitation via a specially crafted input file can cause a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-10196) It was discovered that graphviz contains null pointer dereference vulnerabilities. Exploitation via a specially crafted input file can cause a denial of service. These issues only affected Ubuntu 14.04 ESM and Ubuntu 18.04 LTS. (CVE-2019-11023) It was discovered that graphviz contains a buffer overflow vulnerability. Exploitation via a specially crafted input file can cause a denial of service or possibly allow for arbitrary code execution. These issues only affected Ubuntu 14.04 ESM, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-18032) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 20.04 ESM: graphviz 2.42.2-3ubuntu0.1~esm1 Ubuntu 18.04 ESM: graphviz 2.40.1-2ubuntu0.1~esm1 Ubuntu 14.04 ESM: graphviz 2.36.0-0ubuntu3.2+esm1 The problem can be corrected by updating your system to the following package versions: References: https://ubuntu.com/security/notices/USN-5971-1 CVE-2018-10196, CVE-2019-11023, CVE-2020-18032 . Various flaws addressed in Graphviz for Ubuntu users to mitigate denial of service and security risks.. Graphviz Vulnerabilities, Denial of Service, Software Fixes, Security Update. . Severity: Critical.LinuxSecurity.com Team
Mar 24, 2023
•Critical
Ubuntu
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!