Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found -2 articles for you...
98
security advisorysecurity updateRed Hat Enterprise LinuxRed Hat Enterprise Linux 7: RHSA-2022-0621-02 Moderate OpenSSH Update
An update for openldap is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: openldap security update Advisory ID: RHSA-2022:0621-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2022:0621 Issue date: 2022-02-22 CVE Names: CVE-2020-25709 CVE-2020-25710 ==================================================================== 1. Summary: An update for openldap is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 3. Description: OpenLDAP is an open-source suite of Lightweight Directory Access Protocol (LDAP) applications and development tools. LDAP is a set of protocols used to access and maintain distributed directory information services over an IP network. Security Fix(es): * openldap: assertion failure in Certificate List syntaxvalidation (CVE-2020-25709) * openldap: assertion failure in CSN normalization with invalid input (CVE-2020-25710) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1899675 - CVE-2020-25709 openldap: assertion failure in Certificate List syntax validation 1899678 - CVE-2020-25710 openldap: assertion failure in CSN normalization with invalid input 6. Package List: Red Hat Enterprise Linux Client (v. 7): Source: openldap-2.4.44-25.el7_9.src.rpm x86_64: openldap-2.4.44-25.el7_9.i686.rpm openldap-2.4.44-25.el7_9.x86_64.rpm openldap-clients-2.4.44-25.el7_9.x86_64.rpm openldap-debuginfo-2.4.44-25.el7_9.i686.rpm openldap-debuginfo-2.4.44-25.el7_9.x86_64.rpm Red Hat Enterprise Linux Client Optional (v. 7): x86_64: openldap-debuginfo-2.4.44-25.el7_9.i686.rpm openldap-debuginfo-2.4.44-25.el7_9.x86_64.rpm openldap-devel-2.4.44-25.el7_9.i686.rpm openldap-devel-2.4.44-25.el7_9.x86_64.rpm openldap-servers-2.4.44-25.el7_9.x86_64.rpm openldap-servers-sql-2.4.44-25.el7_9.x86_64.rpm Red Hat Enterprise Linux ComputeNode (v. 7): Source: openldap-2.4.44-25.el7_9.src.rpm x86_64: openldap-2.4.44-25.el7_9.i686.rpm openldap-2.4.44-25.el7_9.x86_64.rpm openldap-clients-2.4.44-25.el7_9.x86_64.rpm openldap-debuginfo-2.4.44-25.el7_9.i686.rpm openldap-debuginfo-2.4.44-25.el7_9.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): x86_64: openldap-debuginfo-2.4.44-25.el7_9.i686.rpm openldap-debuginfo-2.4.44-25.el7_9.x86_64.rpm openldap-devel-2.4.44-25.el7_9.i686.rpm openldap-devel-2.4.44-25.el7_9.x86_64.rpm openldap-servers-2.4.44-25.el7_9.x86_64.rpm openldap-servers-sql-2.4.44-25.el7_9.x86_64.rpm Red Hat Enterprise Linux Server (v.7): Source: openldap-2.4.44-25.el7_9.src.rpm ppc64: openldap-2.4.44-25.el7_9.ppc.rpm openldap-2.4.44-25.el7_9.ppc64.rpm openldap-clients-2.4.44-25.el7_9.ppc64.rpm openldap-debuginfo-2.4.44-25.el7_9.ppc.rpm openldap-debuginfo-2.4.44-25.el7_9.ppc64.rpm openldap-devel-2.4.44-25.el7_9.ppc.rpm openldap-devel-2.4.44-25.el7_9.ppc64.rpm openldap-servers-2.4.44-25.el7_9.ppc64.rpm ppc64le: openldap-2.4.44-25.el7_9.ppc64le.rpm openldap-clients-2.4.44-25.el7_9.ppc64le.rpm openldap-debuginfo-2.4.44-25.el7_9.ppc64le.rpm openldap-devel-2.4.44-25.el7_9.ppc64le.rpm openldap-servers-2.4.44-25.el7_9.ppc64le.rpm s390x: openldap-2.4.44-25.el7_9.s390.rpm openldap-2.4.44-25.el7_9.s390x.rpm openldap-clients-2.4.44-25.el7_9.s390x.rpm openldap-debuginfo-2.4.44-25.el7_9.s390.rpm openldap-debuginfo-2.4.44-25.el7_9.s390x.rpm openldap-devel-2.4.44-25.el7_9.s390.rpm openldap-devel-2.4.44-25.el7_9.s390x.rpm openldap-servers-2.4.44-25.el7_9.s390x.rpm x86_64: openldap-2.4.44-25.el7_9.i686.rpm openldap-2.4.44-25.el7_9.x86_64.rpm openldap-clients-2.4.44-25.el7_9.x86_64.rpm openldap-debuginfo-2.4.44-25.el7_9.i686.rpm openldap-debuginfo-2.4.44-25.el7_9.x86_64.rpm openldap-devel-2.4.44-25.el7_9.i686.rpm openldap-devel-2.4.44-25.el7_9.x86_64.rpm openldap-servers-2.4.44-25.el7_9.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): ppc64: openldap-debuginfo-2.4.44-25.el7_9.ppc64.rpm openldap-servers-sql-2.4.44-25.el7_9.ppc64.rpm ppc64le: openldap-debuginfo-2.4.44-25.el7_9.ppc64le.rpm openldap-servers-sql-2.4.44-25.el7_9.ppc64le.rpm s390x: openldap-debuginfo-2.4.44-25.el7_9.s390x.rpm openldap-servers-sql-2.4.44-25.el7_9.s390x.rpm x86_64: openldap-debuginfo-2.4.44-25.el7_9.x86_64.rpm openldap-servers-sql-2.4.44-25.el7_9.x86_64.rpm Red Hat Enterprise Linux Workstation (v.7): Source: openldap-2.4.44-25.el7_9.src.rpm x86_64: openldap-2.4.44-25.el7_9.i686.rpm openldap-2.4.44-25.el7_9.x86_64.rpm openldap-clients-2.4.44-25.el7_9.x86_64.rpm openldap-debuginfo-2.4.44-25.el7_9.i686.rpm openldap-debuginfo-2.4.44-25.el7_9.x86_64.rpm openldap-devel-2.4.44-25.el7_9.i686.rpm openldap-devel-2.4.44-25.el7_9.x86_64.rpm openldap-servers-2.4.44-25.el7_9.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): x86_64: openldap-debuginfo-2.4.44-25.el7_9.x86_64.rpm openldap-servers-sql-2.4.44-25.el7_9.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2020-25709 https://access.redhat.com/security/cve/CVE-2020-25710 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYhVgl9zjgjWX9erEAQizoA//Z1eRFFiALCnBNdscadCiTK27uxUBYwiE mazVTDFOQUIzF2+hpruaDD0RJoIuZL8JwTPviUZJbB21G8NIF5T09eP00ErioZEN WMeccz1GyZlUXWZXBvf3v5QOMOmhBK3vw80X6oVCzGZbzMynCtPI8+jCt/MmzA0y fpLghp4rd7o56kF3ccb3ZbLREFNYFwyNqzVT79LA0KdA2KnMY/pFBTSmY8ihiTTJ qvIekeg+Xj5t85JObesMRwM1yrEG+joYcXe9uqRjOLvCGPdXSM5YMcOxNyNynjnI EGIqGr9/+2OVxhHCLaITvuBaqPeIgCZxO9yvKgoNDsuBpDUEKgv+iQ1l0DnfIThr ppeoo+MeNMB54Qw+qf9MQblhLFFS08zUNXq7YsJi58kIp6PEtj2Q/7DvVMY6GcPN 3hltIwlWAY4+PToSbt9UvJEmAdH1ApN0XSiBva6e295C92v1IvDYN0BkD8XouOAH 5tKXXheyJfoN6vjJG89halj6gzy4IcPU5KkfJuJO3vKJeDkG3vRoySIxW0SDrdS8 +4XGwe6e00D/Kd1t9yXIeITCCtiK3NZS5bMsOHclxzbrGeWj4YK/jK7CfK5g+Zt0 0PKI5pZqGdc3SwDNo165BVDChTc7HZqjmp6LFYzKyBSkwgdHzGG/soj51hWqyVui UnjGg9lAM38=OWtf -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Feb 22, 2022
•Important
Red Hat
89
security advisorymoderateupdateFedora 34: 2021-303f6623fa Moderate: Gnome-Settings-Daemon Directory Access
GNOME 40.rc. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2021-303f6623fa 2021-03-20 00:16:30.596999 --------------------------------------------------------------------------------Name : gnome-settings-daemon Product : Fedora 34 Version : 40~rc Release : 1.fc34 URL : https://download.gnome.org/sources/gnome-settings-daemon/ Summary : The daemon sharing settings from GNOME to GTK+/KDE applications Description : A daemon to share settings from GNOME to other applications. It also handles global keybindings, as well as a number of desktop-wide settings. --------------------------------------------------------------------------------Update Information: GNOME 40.rc --------------------------------------------------------------------------------ChangeLog: * Mon Mar 15 2021 Kalev Lember - 40~rc-1 - Update to 40.rc --------------------------------------------------------------------------------References: [ 1 ] Bug #1925640 - CVE-2020-36241 gnome-autoar: directory traversal via a malicious archive that contains a file whose parent is a symbolic link which points outside of the destination directory https://bugzilla.redhat.com/show_bug.cgi?id=1925640 [ 2 ] Bug #1940026 - CVE-2021-28650 gnome-autoar: directory traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations https://bugzilla.redhat.com/show_bug.cgi?id=1940026 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2021-303f6623fa' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Mar 19, 2021
Fedora
87
security advisorycriticaldebianDebian DSA-4825-1: Critical Dovecot Update on Email Server Security
Several vulnerabilities have been discovered in the Dovecot email server. CVE-2020-24386 . - ------------------------------------------------------------------------- Debian Security Advisory DSA-4825-1
Jan 04, 2021
•Critical
Debian
202
security advisoryupdaterace conditionopenSUSE: 2018:1969-1 Moderate: Singularity Race Condition Risk
An update that fixes one vulnerability is now available.. openSUSE Security Update: Security update for singularity ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:1969-1 Rating: moderate References: #1100333 Cross-References: CVE-2018-12021 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for singularity fixes the following issues: - CVE-2018-12021: A race condition might have allowed malicious users to bypass directory image restrictions, like mounting the host root filesystem as a container image (boo#1100333) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2018-730=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): libsingularity1-2.3.2-11.1 libsingularity1-debuginfo-2.3.2-11.1 singularity-2.3.2-11.1 singularity-debuginfo-2.3.2-11.1 singularity-debugsource-2.3.2-11.1 singularity-devel-2.3.2-11.1 References: https://www.suse.com/security/cve/CVE-2018-12021.html https://bugzilla.suse.com/1100333 -- . New patch for singularity addresses a security flaw, allowing unauthorized access to directory images. Discover the specifics today.. openSUSE Security, Singularity Update, Linux Patch, Directory Image Access. . LinuxSecurity.com Team
Jul 16, 2018
OpenSUSE
200
security advisorymoderatebug fixSciLinux SL7: SLSA-2017-1852-1 Moderate: OpenLDAP Double-Free Issue
A double-free flaw was found in the way OpenLDAP's slapd server using the MDB backend handled LDAP searches. A remote attacker with access to search the directory could potentially use this flaw to crash slapd by issuing a specially crafted LDAP search query. (CVE-2017-9287) SL7 x86_64 openldap-2.4.44-5.el7.i686.rpm openldap-2.4.44-5.el7.x86_64.rpm openldap-clients-2.4.44-5.el7. [More...]. Synopsis: Moderate: openldap security, bug fix, and enhancement Advisory ID: SLSA-2017:1852-1 Issue Date: 2017-08-01 CVE Numbers: CVE-2017-9287 -- The following packages have been upgraded to a later upstream version: openldap (2.4.44). Security Fix(es): * A double-free flaw was found in the way OpenLDAP's slapd server using the MDB backend handled LDAP searches. A remote attacker with access to search the directory could potentially use this flaw to crash slapd by issuing a specially crafted LDAP search query. (CVE-2017-9287) -- SL7 x86_64 openldap-2.4.44-5.el7.i686.rpm openldap-2.4.44-5.el7.x86_64.rpm openldap-clients-2.4.44-5.el7.x86_64.rpm openldap-debuginfo-2.4.44-5.el7.i686.rpm openldap-debuginfo-2.4.44-5.el7.x86_64.rpm openldap-devel-2.4.44-5.el7.i686.rpm openldap-devel-2.4.44-5.el7.x86_64.rpm openldap-servers-2.4.44-5.el7.x86_64.rpm openldap-servers-sql-2.4.44-5.el7.x86_64.rpm - Scientific Linux Development Team . The latest OpenLDAP release fixes a critical bug and addresses a potential crash vulnerability to enhance stability and security of the application. OpenLDAP Bug Fix, SL7 Security Update, Double-Free Issue, Remote Access Vulnerability. . LinuxSecurity.com Team
Aug 21, 2017
Scientific Linux
91
security advisoryunauthorized accesslow severityGentoo: GLSA-200409-33 Low: Apache Protected Directory Access Risk
A bug in the way Apache handles the Satisfy directive can lead to the exposure of protected directories to unauthorized users.. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200409-33 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Low Title: Apache: Exposure of protected directories Date: September 24, 2004 Bugs: #64804 ID: 200409-33 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= A bug in the way Apache handles the Satisfy directive can lead to the exposure of protected directories to unauthorized users. Background ========= The Apache HTTP server is one of most popular web servers on the Internet. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-www/apache == 2.0.51 > = 2.0.51-r1 < 2.0.51 Description ========== A bug in the way Apache handles the Satisfy directive, which is used to require that certain conditions (client host, client authentication, etc) be met before access to a certain directory is granted, could allow the exposure of protected directories to unauthorized clients. Impact ===== Directories containing protected data could be exposed to all visitorsto the webserver. Workaround ========= There is no known workaround at this time. Resolution ========= All Apache users should upgrade to the latest version: # emerge sync # emerge -pv "> =net-www/apache-2.0.51-r1" # emerge ">=net-www/apache-2.0.51-r1" References ========= [ 1 ] Apache Bug #31315 https://bz.apache.org/bugzilla/show_bug.cgi [ 2 ] CAN-2004-0811 https://www.cve.org/CVERecord?id=CAN-2004-0811 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200409-33 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Sep 24, 2004
•Low
Gentoo
91
security advisorygentoolocal exploitGentoo: 200306-01 Moderate: Tomcat Insecure Directory Access Exploit
Versions prior to tomcat-4.1.24 created /opt/tomcat with a directory mode which allowed users to access files containing passwords.. - - - --------------------------------------------------------------------- GENTOO LINUX SECURITY ANNOUNCEMENT 200306-01 - - - --------------------------------------------------------------------- PACKAGE : tomcat SUMMARY : insecure directory mode DATE : 2003-06-01 12:08 UTC EXPLOIT : local VERSIONS AFFECTED : =tomcat-4.1.24-r1 CVE : - - - --------------------------------------------------------------------- Versions prior to tomcat-4.1.24 created /opt/tomcat with a directory mode which allowed users to access files containing passwords. SOLUTION Either upgrade to tomcat-4.1.24-r1 by running emerge sync emerge tomcat emerge clean or execute the following: /etc/init.d/tomcat stop chmod -R 750 /opt/tomcat/ /etc/init.d/tomcat start - - - ---------------------------------------------------------------------
Jun 02, 2003
•Important
Gentoo
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!