Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -5 articles for you...
203
security advisorydenial of servicemalicious codeMageia 9 nano Security Fix 2026-0121 Local Attack DoS Risks
MGASA-2026-0121 - Updated nano packages fix security vulnerabilities. MGASA-2026-0121 - Updated nano packages fix security vulnerabilities Publication date: 07 May 2026 URL: https://advisories.mageia.org/MGASA-2026-0121.html Type: security Affected Mageia releases: 9 CVE: CVE-2026-6842, CVE-2026-6843 Description: Local attacker can inject malicious .desktop launcher due to insecure directory permissions. (CVE-2026-6842) Format string vulnerability leads to denial of service. (CVE-2026-6843) References: - https://bugs.mageia.org/show_bug.cgi?id=35466 - https://lists.fedoraproject.org/archives/list/
May 07, 2026
•Important
Mageia
203
security advisorydenial of servicecriticalMageia 9 MGASA-2025-0204 critical: dpkg directory permissions DoS
It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data. This may result in leaving temporary files behind on cleanup. Given automated and repeated execution of dpkg-deb commands on adversarial . MGASA-2025-0204 - Updated dpkg packages fix security vulnerabilities Publication date: 11 Jul 2025 URL: https://advisories.mageia.org/MGASA-2025-0204.html Type: security Affected Mageia releases: 9 CVE: CVE-2025-6297 It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data. This may result in leaving temporary files behind on cleanup. Given automated and repeated execution of dpkg-deb commands on adversarial .deb packages or with well compressible files, placed inside a directory with permissions not allowing removal by a non-root user, this can end up in a DoS scenario due to causing disk quota exhaustion or disk full conditions. References: - https://bugs.mageia.org/show_bug.cgi?id=34441 - - https://www.cve.org/CVERecord?id=CVE-2025-6297 SRPMS: - 9/core/dpkg-1.22.21-1.mga9 . Mageia's package management system has a significant vulnerability; lack of proper file access controls could lead to a potential service interruption. Update urgently!. Mageia Security, dpkg Risk, Critical Update, DoS Prevention, Directory Permissions. . Severity: Critical. LinuxSecurity.com Team
Jul 11, 2025
•Critical
Mageia
89
security advisoryFedoracritical patchFedora 23 ZF2015-07 Critical: php-ZendFramework2 Local Escalation Risk
**Zend Framework 2.4.8** **Security Update** * **ZF2015-07**: The filesystem storage adapter of Zend\Cache was creating directories with a liberal umask that could lead to local arbitrary code execution and/or local privilege escalation. This release contains a patch that ensures the directories are created using permissions of 0775 and files using 0664 (essentially umask 0002). **Bug. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2015-16033 2015-09-25 07:56:18.561837 -------------------------------------------------------------------------------- Name : php-ZendFramework2 Product : Fedora 23 Version : 2.4.8 Release : 1.fc23 URL : https://framework.zend.com/ Summary : Zend Framework 2 Description : Zend Framework 2 is an open source framework for developing web applications and services using PHP 5.3+. Zend Framework 2 uses 100% object-oriented code and utilizes most of the new features of PHP 5.3, namely namespaces, late static binding, lambda functions and closures. Zend Framework 2 evolved from Zend Framework 1, a successful PHP framework with over 15 million downloads. Note: This meta package installs all base Zend Framework component packages (Authentication, Barcode, Cache, Captcha, Code, Config, Console, Crypt, Db, Debug, Di, Dom, Escaper, EventManager, Feed, File, Filter, Form, Http, I18n, InputFilter, Json, Ldap, Loader, Log, Mail, Math, Memory, Mime, ModuleManager, Mvc, Navigation, Paginator, Permissions-Acl, Permissions-Rbac, ProgressBar, Serializer, Server, ServiceManager, Session, Soap, Stdlib, Tag, Test, Text, Uri, Validator, Version, View, XmlRpc) except the optional Cache-apc and Cache-memcached packages. -------------------------------------------------------------------------------- Update Information: **Zend Framework 2.4.8** **Security Update** * **ZF2015-07**: The filesystem storage adapter of Zend\Cache was creating directories with a liberal umask that could lead to local arbitrarycode execution and/or local privilege escalation. This release contains a patch that ensures the directories are created using permissions of 0775 and files using 0664 (essentially umask 0002). **Bug fixed** from upstream [Changelog]() * validate against DateTimeImmutable instead of DateTimeInterface * treat 0.0 as non-empty, restoring pre-2.4 behavior * deprecate "magic" logic for auto- attaching NonEmpty validators in favor of explicit attachment * ensure fallback values work as per pre-2.4 behavior * update the InputFilterInterface::add() docblock to match implementations * Fix how missing optoinal fields are validated to match pre 2.4.0 behavior * deprecate AllowEmpty and ContinueIfEmpty annotations, per zend-inputfilter#26 * fix typos in aria attribute names of AbstractHelper * fixes the ContentType header to properly handle encoded parameter values * fixes the Sender header to allow mailbox addresses without TLDs * fixes parsing of messages that contain an initial blank line before headers * fixes the SetCookie header to allow multiline values (as they are always encoded * fixes DefaultRenderingStrategy errors due to controllersreturning non-view model results -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update php-ZendFramework2' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Sep 25, 2015
•Critical
Fedora
200
security advisorylow severityautomakeScientific Linux: Automake Low Severity Advisory CVE-2009-4029
Low: automake security update. Date: Tue, 27 Apr 2010 10:56:20 -0500 Reply-To: Troy Dawson Sender: Security Errata for Scientific Linux From: Troy Dawson Subject: Security ERRATA Low: automake on SL5.x i386/x86_64 Comments: To: "
Apr 27, 2010
•Low
Scientific Linux
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!