Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found -3 articles for you...
87
security advisorycriticalmailmanDebian: DSA-4991-1 Critical: Mailman CSRF Threats and Escalation
Several vulnerabilities were discovered in mailman, a web-based mailing list manager, which could result in arbitrary content injection via the options and private archive login pages, and CSRF attacks or privilege escalation via the user options page. . - ------------------------------------------------------------------------- Debian Security Advisory DSA-4991-1
Oct 22, 2021
•Critical
Debian
172
security advisorymoderatesoftware updateUbuntu 18.04 LTS: USN-3842-1 Moderate: CUPS Information Exposure
CUPS could be made to expose sensitive information.. =========================================================================Ubuntu Security Notice USN-3842-1 December 10, 2018 cups vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.10 - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: CUPS could be made to expose sensitive information. Software Description: - cups: Common UNIX Printing System(tm) Details: Jann Horn discovered that CUPS incorrectly handled session cookie randomness. A remote attacker could possibly use this issue to perform cross-site request forgery (CSRF) attacks. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 18.10: cups 2.2.8-5ubuntu1.1 Ubuntu 18.04 LTS: cups 2.2.7-1ubuntu2.2 Ubuntu 16.04 LTS: cups 2.1.3-4ubuntu0.6 Ubuntu 14.04 LTS: cups 1.7.2-0ubuntu1.11 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-3842-1 CVE-2018-4700 Package Information: https://launchpad.net/ubuntu/+source/cups/2.2.8-5ubuntu1.1 https://launchpad.net/ubuntu/+source/cups/2.2.7-1ubuntu2.2 https://launchpad.net/ubuntu/+source/cups/2.1.3-4ubuntu0.6 https://launchpad.net/ubuntu/+source/cups/1.7.2-0ubuntu1.11 . Critical CUPS flaw in Ubuntu may reveal confidential data. Security patches released to address vulnerabilities.. CUPS Vulnerability, Information Exposure, CSRF Attack Prevention. . LinuxSecurity.com Team
Dec 10, 2018
Ubuntu
98
security advisorymoderatered hatRed Hat: RHSA-2017:2905-01 Moderate: Keycloak Security Flaws Addressed
An update for rh-sso7-keycloak is now available for Red Hat Single Sign-On 7.1 for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: rh-sso7-keycloak security update Advisory ID: RHSA-2017:2905-01 Product: Red Hat Single Sign-On Advisory URL: https://access.redhat.com/errata/RHSA-2017:2905 Issue date: 2017-10-17 CVE Names: CVE-2017-12158 CVE-2017-12159 CVE-2017-12160 CVE-2017-12197 ==================================================================== 1. Summary: An update for rh-sso7-keycloak is now available for Red Hat Single Sign-On 7.1 for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Single Sign-On 7.1 for RHEL 7 Server - noarch 3. Description: Red Hat Single Sign-On is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat Single Sign-On 7.1.3 serves as a replacement for Red Hat Single Sign-On 7.1.2, and includes several bug fixes and enhancements. For further information, refer to the Release Notes linked to in the References section. Security Fix(es): * It was found that keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authenticated user to attain reflected XSS via a malicious server. (CVE-2017-12158) * It was found that the cookie used forCSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks. (CVE-2017-12159) * It was found that libpam4j did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information. (CVE-2017-12197) * It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks. (CVE-2017-12160) Red Hat would like to thank Mykhailo Stadnyk (Playtech) for reporting CVE-2017-12158; Prapti Mittal for reporting CVE-2017-12159; and Bart Toersche (Simacan) for reporting CVE-2017-12160. The CVE-2017-12197 issue was discovered by Christian Heimes (Red Hat). 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1484111 - CVE-2017-12159 keycloak: CSRF token fixation 1484154 - CVE-2017-12160 keycloak: resource privilege extension via access token in oauth 1489161 - CVE-2017-12158 keycloak: reflected XSS using HOST header 1503103 - CVE-2017-12197 libpam4j: Account check bypass 6. JIRA issues fixed (https://redhat.atlassian.net/jira/projects): RHSSO-1122 - Tracker bug for the RH-SSO 7.1.3 release for RHEL-7 7. Package List: Red Hat Single Sign-On 7.1 for RHEL 7 Server: Source: rh-sso7-keycloak-2.5.14-1.Final_redhat_1.1.jbcs.el7.src.rpm noarch: rh-sso7-keycloak-2.5.14-1.Final_redhat_1.1.jbcs.el7.noarch.rpm rh-sso7-keycloak-server-2.5.14-1.Final_redhat_1.1.jbcs.el7.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 8. References: https://access.redhat.com/security/cve/CVE-2017-12158 https://access.redhat.com/security/cve/CVE-2017-12159 https://access.redhat.com/security/cve/CVE-2017-12160 https://access.redhat.com/security/cve/CVE-2017-12197 https://access.redhat.com/security/updates/classification#moderate https://docs.redhat.com/en/documentation/red_hat_single_sign-on/7.1/html/release_notes/index 9. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2017 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFZ5mAGXlSAg2UNWIIRAieAAJ97xK8oXjWHhinik9vA5wl1vjHEKwCgsVT5 PjVXchgkKjetG+DUUT080XM=IlGm -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Oct 17, 2017
Red Hat
172
security advisorysoftware updateubuntuUbuntu 16.04 LTS: USN-3118-1 Moderate: Mailman CSRF Flaws
Several security issues were fixed in Mailman.. =========================================================================Ubuntu Security Notice USN-3118-1 November 01, 2016 mailman vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.10 - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS Summary: Several security issues were fixed in Mailman. Software Description: - mailman: Powerful, web-based mailing list manager Details: It was discovered that the Mailman administrative web interface did not protect against cross-site request forgery (CSRF) attacks. If an authenticated user were tricked into visiting a malicious website while logged into Mailman, a remote attacker could perform administrative actions. This issue only affected Ubuntu 12.04 LTS. (CVE-2016-7123) Nishant Agarwala discovered that the Mailman user options page did not protect against cross-site request forgery (CSRF) attacks. If an authenticated user were tricked into visiting a malicious website while logged into Mailman, a remote attacker could modify user options. (CVE-2016-6893) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.10: mailman 1:2.1.22-1ubuntu0.1 Ubuntu 16.04 LTS: mailman 1:2.1.20-1ubuntu0.1 Ubuntu 14.04 LTS: mailman 1:2.1.16-2ubuntu0.2 Ubuntu 12.04 LTS: mailman 1:2.1.14-3ubuntu0.4 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-3118-1 CVE-2016-6893, CVE-2016-7123 Package Information: https://launchpad.net/ubuntu/+source/mailman/1:2.1.22-1ubuntu0.1 https://launchpad.net/ubuntu/+source/mailman/1:2.1.20-1ubuntu0.1 https://launchpad.net/ubuntu/+source/mailman/1:2.1.16-2ubuntu0.2 https://launchpad.net/ubuntu/+source/mailman/1:2.1.14-3ubuntu0.4 . Multiple Mailman vulnerabilities addressed in Ubuntu update: CSRF vulnerabilities affecting admin controls. Ensure safety with the newest updates.. Mailman Security, CSRF Protection, Ubuntu Patching, Software Security. . Severity: Important. LinuxSecurity.com Team
Nov 01, 2016
•Important
Ubuntu
87
security advisorydebianmoderate issueDebian: DSA-3391-1 Moderate: php-horde CSRF Attack Mitigation
It was discovered that the web-based administration interface in the Horde Application Framework did not guard against Cross-Site Request Forgery (CSRF) attacks. As a result, other, malicious web pages could cause Horde applications to perform actions as the Horde user. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3391-1
Nov 03, 2015
Debian
98
security advisoryred hatimportant updateOpenShift Enterprise RHSA-2012:1555-01 Critical CSRF Security Update
An updated openshift-console package that fixes one security issue is now available for OpenShift Enterprise. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS). -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Important: openshift-console security update Advisory ID: RHSA-2012:1555-01 Product: Red Hat OpenShift Enterprise Advisory URL: https://access.redhat.com/errata/RHSA-2012:1555.html Issue date: 2012-12-10 CVE Names: CVE-2012-5622 ==================================================================== 1. Summary: An updated openshift-console package that fixes one security issue is now available for OpenShift Enterprise. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: RedHat OpenShift Enterprise Infrastructure - noarch 3. Description: The OpenShift Management Console provides a web interface for managing OpenShift Enterprise. It was found that the OpenShift Management Console did not protect against Cross-Site Request Forgery (CSRF) attacks. If a remote attacker could trick a user, who was logged into the OpenShift Management Console, into visiting an attacker controlled web page, the attacker could make changes to applications hosted within OpenShift Enterprise with the privileges of the victim which may lead to arbitrary code execution in the OpenShift Enterprise hosted applications. (CVE-2012-5622) This issue was discovered by Red Hat. All users of the OpenShift Management Console are advised to upgrade to this updated package, which corrects this issue. Before installing the updated package, stop theopenshift-console service. After the package has been installed, start the openshift-console service. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 5. Bugs fixed (http://bugzilla.redhat.com/): 883227 - CVE-2012-5622 OpenShift-Enterprise: openshift-console CSRF attack 6. Package List: RedHat OpenShift Enterprise Infrastructure: Source: noarch: openshift-console-0.0.5-3.el6.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://access.redhat.com/security/cve/CVE-2012-5622 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2012 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFQxk7lXlSAg2UNWIIRAo/wAKCJYt+EDRH/PsMxTj0ENJLK0DS2NgCeIVbp MS44+5biCgUr4NuSG2AJFUg=g1f3 -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list
Dec 10, 2012
•Important
Red Hat
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!