Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -4 articles for you...
203
security advisorylocal attackdata overwriteMageia: 2020-0048 Moderate: libqb IPC File Overwrite Risk
Insecure treatment of IPC temporary files which could allow a local attacker to overwrite privileged system files (CVE-2019-12779). References: - https://bugs.mageia.org/show_bug.cgi?id=25751 . MGASA-2020-0048 - Updated libqb packages fix security vulnerability Publication date: 28 Jan 2020 URL: https://advisories.mageia.org/MGASA-2020-0048.html Type: security Affected Mageia releases: 7 CVE: CVE-2019-12779 Insecure treatment of IPC temporary files which could allow a local attacker to overwrite privileged system files (CVE-2019-12779). References: - https://bugs.mageia.org/show_bug.cgi?id=25751 - - https://www.cve.org/CVERecord?id=CVE-2019-12779 SRPMS: - 7/core/libqb-1.0.5-1.mga7 . Recent libqb updates rectify critical IPC management vulnerabilities that enable unauthorized local file access by malicious actors in Mageia.. Mageia Security Update, IPC Vulnerability, libqb Advisory. . Severity: Important. LinuxSecurity.com Team
Jan 28, 2020
•Important
Mageia
202
security advisorymoderatesecurity updateopenSUSE Leap 15.0: Security Update for u-boot via openSUSE-SU-2019:2235-1
An update that fixes two vulnerabilities is now available.. openSUSE Security Update: Security update for u-boot ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2235-1 Rating: moderate References: #1144656 #1144675 Cross-References: CVE-2019-13104 CVE-2019-13106 Affected Products: openSUSE Leap 15.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for u-boot fixes the following issues: Security issues fixed: - CVE-2019-13106: Fixed stack buffer overflow via a crafted ext4 filesystem that may lead to code execution (bsc#1144656). - CVE-2019-13104: Fixed an underflow that could cause memcpy() to overwrite a very large amount of data via a crafted ext4 filesystem (bsc#1144675). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2019-2235=1 Package List: - openSUSE Leap 15.0 (x86_64): u-boot-tools-2018.03-lp150.4.3.1 u-boot-tools-debuginfo-2018.03-lp150.4.3.1 References: https://www.suse.com/security/cve/CVE-2019-13104.html https://www.suse.com/security/cve/CVE-2019-13106.html https://bugzilla.suse.com/1144656 https://bugzilla.suse.com/1144675 -- . The latest security patch for openSUSE addresses moderate vulnerabilities in u-boot pertaining to buffer overflow and potential data corruption issues.. openSUSE Security Update, u-boot vulnerabilities, stack overflow fix, data overwrite fix, security patch. . Severity: Important. LinuxSecurity.com Team
Oct 01, 2019
•Important
OpenSUSE
100
security advisorymoderatebuffer overflowSUSE: 2019:2475-1 Moderate: u-boot Buffer Overflow Threat
An update that fixes two vulnerabilities is now available. . SUSE Security Update: Security update for u-boot ______________________________________________________________________________ Announcement ID: SUSE-SU-2019:2475-1 Rating: moderate References: #1144656 #1144675 Cross-References: CVE-2019-13104 CVE-2019-13106 Affected Products: SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 SUSE Linux Enterprise Module for Basesystem 15-SP1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for u-boot fixes the following issues: Security issues fixed: - CVE-2019-13106: Fixed stack buffer overflow via a crafted ext4 filesystem that may lead to code execution (bsc#1144656). - CVE-2019-13104: Fixed an underflow that could cause memcpy() to overwrite a very large amount of data via a crafted ext4 filesystem (bsc#1144675). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1: zypper in -t patch SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2019-2475=1 - SUSE Linux Enterprise Module for Basesystem 15-SP1: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP1-2019-2475=1 Package List: - SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (aarch64): u-boot-bananapim64-2019.01-7.3.1 u-boot-bananapim64-doc-2019.01-7.3.1 u-boot-dragonboard410c-2019.01-7.3.1 u-boot-dragonboard410c-doc-2019.01-7.3.1 u-boot-dragonboard820c-2019.01-7.3.1 u-boot-dragonboard820c-doc-2019.01-7.3.1 u-boot-evb-rk3399-2019.01-7.3.1 u-boot-evb-rk3399-doc-2019.01-7.3.1 u-boot-firefly-rk3399-2019.01-7.3.1 u-boot-firefly-rk3399-doc-2019.01-7.3.1 u-boot-geekbox-2019.01-7.3.1 u-boot-geekbox-doc-2019.01-7.3.1 u-boot-hikey-2019.01-7.3.1 u-boot-hikey-doc-2019.01-7.3.1 u-boot-khadas-vim-2019.01-7.3.1 u-boot-khadas-vim-doc-2019.01-7.3.1 u-boot-khadas-vim2-2019.01-7.3.1 u-boot-khadas-vim2-doc-2019.01-7.3.1 u-boot-ls1012afrdmqspi-2019.01-7.3.1 u-boot-ls1012afrdmqspi-doc-2019.01-7.3.1 u-boot-mvebudb-88f3720-2019.01-7.3.1 u-boot-mvebudb-88f3720-doc-2019.01-7.3.1 u-boot-mvebudbarmada8k-2019.01-7.3.1 u-boot-mvebudbarmada8k-doc-2019.01-7.3.1 u-boot-mvebuespressobin-88f3720-2019.01-7.3.1 u-boot-mvebuespressobin-88f3720-doc-2019.01-7.3.1 u-boot-mvebumcbin-88f8040-2019.01-7.3.1 u-boot-mvebumcbin-88f8040-doc-2019.01-7.3.1 u-boot-nanopia64-2019.01-7.3.1 u-boot-nanopia64-doc-2019.01-7.3.1 u-boot-odroid-c2-2019.01-7.3.1 u-boot-odroid-c2-doc-2019.01-7.3.1 u-boot-orangepipc2-2019.01-7.3.1 u-boot-orangepipc2-doc-2019.01-7.3.1 u-boot-p2371-2180-2019.01-7.3.1 u-boot-p2371-2180-doc-2019.01-7.3.1 u-boot-p2771-0000-500-2019.01-7.3.1 u-boot-p2771-0000-500-doc-2019.01-7.3.1 u-boot-pine64plus-2019.01-7.3.1 u-boot-pine64plus-doc-2019.01-7.3.1 u-boot-pinebook-2019.01-7.3.1 u-boot-pinebook-doc-2019.01-7.3.1 u-boot-pineh64-2019.01-7.3.1 u-boot-pineh64-doc-2019.01-7.3.1 u-boot-poplar-2019.01-7.3.1 u-boot-poplar-doc-2019.01-7.3.1 u-boot-rock960-rk3399-2019.01-7.3.1 u-boot-rock960-rk3399-doc-2019.01-7.3.1 u-boot-rpi3-doc-2019.01-7.3.1 u-boot-xilinxzynqmpgeneric-2019.01-7.3.1 u-boot-xilinxzynqmpgeneric-doc-2019.01-7.3.1 u-boot-xilinxzynqmpzcu102rev10-2019.01-7.3.1 u-boot-xilinxzynqmpzcu102rev10-doc-2019.01-7.3.1 - SUSE Linux Enterprise Module for Basesystem 15-SP1 (aarch64 ppc64le s390x x86_64): u-boot-tools-2019.01-7.3.1 u-boot-tools-debuginfo-2019.01-7.3.1 - SUSE Linux Enterprise Module for Basesystem 15-SP1 (aarch64): u-boot-rpi3-2019.01-7.3.1 References: https://www.suse.com/security/cve/CVE-2019-13104.html https://www.suse.com/security/cve/CVE-2019-13106.html https://bugzilla.suse.com/1144656 https://bugzilla.suse.com/1144675 _______________________________________________ sle-security-updates mailing list
Sep 26, 2019
SuSE
100
security advisorymoderateSUSESUSE: 2019:2474-1 Moderate: u-boot Stack Overflow and Data Overwrite
An update that fixes two vulnerabilities is now available. . SUSE Security Update: Security update for u-boot ______________________________________________________________________________ Announcement ID: SUSE-SU-2019:2474-1 Rating: moderate References: #1144656 #1144675 Cross-References: CVE-2019-13104 CVE-2019-13106 Affected Products: SUSE Linux Enterprise Module for Basesystem 15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for u-boot fixes the following issues: Security issues fixed: - CVE-2019-13106: Fixed stack buffer overflow via a crafted ext4 filesystem that may lead to code execution (bsc#1144656). - CVE-2019-13104: Fixed an underflow that could cause memcpy() to overwrite a very large amount of data via a crafted ext4 filesystem (bsc#1144675). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Basesystem 15: zypper in -t patch SUSE-SLE-Module-Basesystem-15-2019-2474=1 Package List: - SUSE Linux Enterprise Module for Basesystem 15 (aarch64 ppc64le s390x x86_64): u-boot-tools-2018.03-4.3.1 u-boot-tools-debuginfo-2018.03-4.3.1 - SUSE Linux Enterprise Module for Basesystem 15 (aarch64): u-boot-rpi3-2018.03-4.3.1 References: https://www.suse.com/security/cve/CVE-2019-13104.html https://www.suse.com/security/cve/CVE-2019-13106.html https://bugzilla.suse.com/1144656 https://bugzilla.suse.com/1144675 _______________________________________________ sle-security-updates mailing list
Sep 26, 2019
•Important
SuSE
91
security advisorygentoomysqlGentoo: GLSA-200405-20 Normal: MySQL Insecure Temporary File Creation
Two MySQL utilities create temporary files with hardcoded paths, allowing an attacker to use a symlink to trick MySQL into overwriting important data. [More...]. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200405-20 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Insecure Temporary File Creation In MySQL Date: May 25, 2004 Bugs: #46242 ID: 200405-20 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Two MySQL utilities create temporary files with hardcoded paths, allowing an attacker to use a symlink to trick MySQL into overwriting important data. Background ========= MySQL is a popular open-source multi-threaded, multi-user SQL database server. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-db/mysql < 4.0.18-r2 > = 4.0.18-r2 Description ========== The MySQL bug reporting utility (mysqlbug) creates a temporary file to log bug reports to. A malicious local user with write access to the /tmp directory could create a symbolic link of the name mysqlbug-N pointing to a protected file, such as /etc/passwd, such that when mysqlbug creates the Nth log file, it would end up overwriting the target file. A similar vulnerability exists with the mysql_multi utility, which creates a temporary file called mysql_multi.log. Impact ===== Since mysql_multi runs as root, a local attacker could use this to destroy any other users' data or corrupt and destroy systemfiles. Workaround ========= One could modify both scripts to log to a directory that users do not have write permission to, such as /var/log/mysql/. Resolution ========= All users should upgrade to the latest stable version of MySQL. # emerge sync # emerge -pv "> =dev-db/mysql-4.0.18-r2" # emerge "> =dev-db/mysql-4.0.18-r2" References ========= [ 1 ] CAN-2004-0381 https://www.cve.org/CVERecord?id=CVE-CAN-2004-0381 [ 2 ] CAN-2004-0388 https://www.cve.org/CVERecord?id=CVE-CAN-2004-0388 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200405-20 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
May 25, 2004
Gentoo
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!