Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -5 articles for you...
197
security advisorydebianpostgresqlDebian Jessie: DLA-1642-1 Postgresql 9.4 New Minor Release
The PostgreSQL project has release a new minor release of the 9.4 branch. For Debian 8 "Jessie", this has been uploaded as version . Package : postgresql-9.4 Version : 9.4.20-0+deb8u1 The PostgreSQL project has release a new minor release of the 9.4 branch. For Debian 8 "Jessie", this has been uploaded as version 9.4.20-0+deb8u1. We recommend that you upgrade your postgresql-9.4 packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Elevate your postgresql-9.4 components to the latest minor version 9.4.20-0+deb8u1 to maintain system coherence.. Debian LTS, PostgreSQL 9.4, Minor Release, Security Advisory. . Severity: Informational. LinuxSecurity.com Team
Jan 25, 2019
•Informational
Debian LTS
197
security advisoryaccess controlremote attackDebian Jessie: DLA-1500-1 Critical OpenSSH Access Control Flaws
Several vulnerabilities have been found in OpenSSH, a free implementation of the SSH protocol suite: . Package : openssh Version : 1:6.7p1-5+deb8u6 CVE ID : CVE-2015-5352 CVE-2015-5600 CVE-2015-6563 CVE-2015-6564 CVE-2016-1908 CVE-2016-3115 CVE-2016-6515 CVE-2016-10009 CVE-2016-10011 CVE-2016-10012 CVE-2016-10708 CVE-2017-15906 Debian Bug : 790798 793616 795711 848716 848717 Several vulnerabilities have been found in OpenSSH, a free implementation of the SSH protocol suite: CVE-2015-5352 OpenSSH incorrectly verified time window deadlines for X connections. Remote attackers could take advantage of this flaw to bypass intended access restrictions. Reported by Jann Horn. CVE-2015-5600 OpenSSH improperly restricted the processing of keyboard-interactive devices within a single connection, which could allow remote attackers to perform brute-force attacks or cause a denial of service, in a non-default configuration. CVE-2015-6563 OpenSSH incorrectly handled usernames during PAM authentication. In conjunction with an additional flaw in the OpenSSH unprivileged child process, remote attackers could make use if this issue to perform user impersonation. Discovered by Moritz Jodeit. CVE-2015-6564 Moritz Jodeit discovered a use-after-free flaw in PAM support in OpenSSH, that could be used by remote attackers to bypass authentication or possibly execute arbitrary code. CVE-2016-1908 OpenSSH mishandled untrusted X11 forwarding when the X server disables the SECURITY extension. Untrusted connections could obtain trusted X11 forwarding privileges. Reported by Thomas Hoger. CVE-2016-3115 OpenSSH improperly handled X11 forwarding data related to authentication credentials. Remote authenticated users could make use of this flaw to bypass intended shell-command restrictions. Identified by github.com/tintinweb. CVE-2016-6515 OpenSSH did not limitpassword lengths for password authentication. Remote attackers could make use of this flaw to cause a denial of service via long strings. CVE-2016-10009 Jann Horn discovered an untrusted search path vulnerability in ssh-agent allowing remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket. CVE-2016-10011 Jann Horn discovered that OpenSSH did not properly consider the effects of realloc on buffer contents. This may allow local users to obtain sensitive private-key information by leveraging access to a privilege-separated child process. CVE-2016-10012 Guido Vranken discovered that the OpenSSH shared memory manager did not ensure that a bounds check was enforced by all compilers, which could allow local users to gain privileges by leveraging access to a sandboxed privilege-separation process. CVE-2016-10708 NULL pointer dereference and daemon crash via an out-of-sequence NEWKEYS message. CVE-2017-15906 Michal Zalewski reported that OpenSSH improperly prevent write operations in readonly mode, allowing attackers to create zero-length files. For Debian 8 "Jessie", these problems have been fixed in version 1:6.7p1-5+deb8u6. We recommend that you upgrade your openssh packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Multiple vulnerabilities detected in OpenSSH for Debian Jessie, necessitating urgent package upgrades to safeguard systems.. openssh security,debian jessie update,openssh patch. . Severity: Critical. LinuxSecurity.com Team
Sep 10, 2018
•Critical
Debian LTS
197
security advisorycritical fixmailmanDebian Jessie: DLA-1442-2 Critical Fix for Mailman Admin Page Error
The security update of mailman announced as DLA-1442-1 introduced a regression due to an incomplete fix for CVE-2018-13796 that broke the admin and listinfo overview pages. . Package : mailman Version : 1:2.1.18-2+deb8u4 Debian Bug : 904680 The security update of mailman announced as DLA-1442-1 introduced a regression due to an incomplete fix for CVE-2018-13796 that broke the admin and listinfo overview pages. For Debian 8 "Jessie", this problem has been fixed in version 1:2.1.18-2+deb8u4. We recommend that you upgrade your mailman packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . The recent security patch DLA-1442-2 for Mailman addresses a regression that emerged from the last update, impacting both admin and listinfo interfaces.. Mailman Update, Debian LTS Advisory, Security Patches, Regression Fixes. . Severity: Critical. LinuxSecurity.com Team
Jul 27, 2018
•Critical
Debian LTS
87
security advisorybind9dns exploitDebian 8: DSA-3795-1 Moderate: Bind9 Crash Risk from Crafted DNS Queries
It was discovered that a maliciously crafted query can cause ISC's BIND DNS server (named) to crash if both Response Policy Zones (RPZ) and DNS64 (a bridge between IPv4 and IPv6 networks) are enabled. It is uncommon for both of these options to be used in combination, so . - ------------------------------------------------------------------------- Debian Security Advisory DSA-3795-1
Feb 26, 2017
•Important
Debian
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!