Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -6 articles for you...
89
security advisorycriticalFedoraFedora 30: FEDORA-2019-17f42f585a Critical: Ghostscript CVE-2019-14869
Security fix for CVE-2019-14869. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2019-17f42f585a 2019-11-18 01:17:12.296718 --------------------------------------------------------------------------------Name : ghostscript Product : Fedora 30 Version : 9.27 Release : 2.fc30 URL : https://ghostscript.com/ Summary : Interpreter for PostScript language & PDF Description : This package provides useful conversion utilities based on Ghostscript software, for converting PS, PDF and other document formats between each other. Ghostscript is a suite of software providing an interpreter for Adobe Systems' PostScript (PS) and Portable Document Format (PDF) page description languages. Its primary purpose includes displaying (rasterization & rendering) and printing of document pages, as well as conversions between different document formats. --------------------------------------------------------------------------------Update Information: Security fix for CVE-2019-14869 --------------------------------------------------------------------------------ChangeLog: * Thu Nov 14 2019 Zdenek Dohnal - 9.27-2 - 1772486 - ghostscript: -dSAFER escape in .charkeys (701841) * Fri Sep 6 2019 Martin Osvald - 9.27-1 - rebase to latest upstream version 9.27 - security fixes added for: - CVE-2019-14811 (bug #1747908) - CVE-2019-14812 (bug #1747907) - CVE-2019-14813 (bug #1747906) - CVE-2019-14817 (bug #1747909) * Mon Aug 12 2019 Martin Osvald - 9.26-6 - Fix for CVE-2019-10216 added * Thu Jul 25 2019 Fedora Release Engineering - 9.26-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - Fix for CVE-2019-10216 added --------------------------------------------------------------------------------References: [ 1 ] Bug #1768911 - CVE-2019-14869 ghostscript: -dSAFER escape in .charkeys (701841) https://bugzilla.redhat.com/show_bug.cgi?id=1768911 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2019-17f42f585a' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Nov 17, 2019
•Critical
Fedora
98
security advisorysecurity fixmoderate impactCentOS Linux 6: CESA-2011:1234 Important OpenSSH Vulnerability Patch
Updated tetex packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: tetex security update Advisory ID: RHSA-2010:0400-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2010:0400.html Issue date: 2010-05-06 CVE Names: CVE-2009-0146 CVE-2009-0147 CVE-2009-0166 CVE-2009-0195 CVE-2009-0791 CVE-2009-0799 CVE-2009-0800 CVE-2009-1179 CVE-2009-1180 CVE-2009-1181 CVE-2009-1182 CVE-2009-1183 CVE-2009-3608 CVE-2009-3609 CVE-2010-0739 CVE-2010-0829 CVE-2010-1440 ==================================================================== 1. Summary: Updated tetex packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 3. Description: teTeX is an implementation of TeX. TeX takes a text file and a set of formatting commands as input, and creates a typesetter-independent DeVice Independent (DVI) file as output. Multiple integer overflow flaws were found in the way teTeX processed special commands when converting DVI files into PostScript. An attacker could create a malicious DVI file that would cause the dvipsexecutable to crash or, potentially, execute arbitrary code. (CVE-2010-0739, CVE-2010-1440) Multiple array index errors were found in the way teTeX converted DVI files into the Portable Network Graphics (PNG) format. An attacker could create a malicious DVI file that would cause the dvipng executable to crash. (CVE-2010-0829) teTeX embeds a copy of Xpdf, an open source Portable Document Format (PDF) file viewer, to allow adding images in PDF format to the generated PDF documents. The following issues affect Xpdf code: Multiple integer overflow flaws were found in Xpdf's JBIG2 decoder. If a local user generated a PDF file from a TeX document, referencing a specially-crafted PDF file, it would cause Xpdf to crash or, potentially, execute arbitrary code with the privileges of the user running pdflatex. (CVE-2009-0147, CVE-2009-1179) Multiple integer overflow flaws were found in Xpdf. If a local user generated a PDF file from a TeX document, referencing a specially-crafted PDF file, it would cause Xpdf to crash or, potentially, execute arbitrary code with the privileges of the user running pdflatex. (CVE-2009-0791, CVE-2009-3608, CVE-2009-3609) A heap-based buffer overflow flaw was found in Xpdf's JBIG2 decoder. If a local user generated a PDF file from a TeX document, referencing a specially-crafted PDF file, it would cause Xpdf to crash or, potentially, execute arbitrary code with the privileges of the user running pdflatex. (CVE-2009-0195) Multiple buffer overflow flaws were found in Xpdf's JBIG2 decoder. If a local user generated a PDF file from a TeX document, referencing a specially-crafted PDF file, it would cause Xpdf to crash or, potentially, execute arbitrary code with the privileges of the user running pdflatex. (CVE-2009-0146, CVE-2009-1182) Multiple flaws were found in Xpdf's JBIG2 decoder that could lead to the freeing of arbitrary memory. If a local user generated a PDF file from a TeX document, referencing a specially-crafted PDF file, it would cause Xpdf to crash or, potentially, executearbitrary code with the privileges of the user running pdflatex. (CVE-2009-0166, CVE-2009-1180) Multiple input validation flaws were found in Xpdf's JBIG2 decoder. If a local user generated a PDF file from a TeX document, referencing a specially-crafted PDF file, it would cause Xpdf to crash or, potentially, execute arbitrary code with the privileges of the user running pdflatex. (CVE-2009-0800) Multiple denial of service flaws were found in Xpdf's JBIG2 decoder. If a local user generated a PDF file from a TeX document, referencing a specially-crafted PDF file, it would cause Xpdf to crash. (CVE-2009-0799, CVE-2009-1181, CVE-2009-1183) Red Hat would like to thank Braden Thomas and Drew Yao of the Apple Product Security team, Will Dormann of the CERT/CC, Alin Rad Pop of Secunia Research, and Chris Rohlf, for responsibly reporting the Xpdf flaws. All users of tetex are advised to upgrade to these updated packages, which contain backported patches to correct these issues. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at 5. Bugs fixed (https://bugzilla.redhat.com/): 490612 - CVE-2009-0146 xpdf: Multiple buffer overflows in JBIG2 decoder (setBitmap, readSymbolDictSeg) (CVE-2009-0195) 490614 - CVE-2009-0147 xpdf: Multiple integer overflows in JBIG2 decoder 490625 - CVE-2009-0166 xpdf: Freeing of potentially uninitialized memory in JBIG2 decoder 491840 - CVE-2009-0791 xpdf: multiple integer overflows 495886 - CVE-2009-0799 PDF JBIG2 decoder OOB read 495887 - CVE-2009-0800 PDF JBIG2 multiple input validation flaws 495889 - CVE-2009-1179 PDF JBIG2 integer overflow 495892 - CVE-2009-1180 PDF JBIG2 invalid free() 495894 - CVE-2009-1181 PDF JBIG2 NULL dereference 495896 - CVE-2009-1182 PDF JBIG2 MMR decoder buffer overflows 495899 - CVE-2009-1183 PDF JBIG2 MMR infinite loop DoS 526637 - CVE-2009-3608xpdf/poppler: integer overflow in ObjectStream::ObjectStream (oCERT-2009-016) 526893 - CVE-2009-3609 xpdf/poppler: ImageStream::ImageStream integer overflow 572941 - CVE-2010-0739 tetex, texlive: Integer overflow by processing special commands 573999 - CVE-2010-0829 tetex, dvipng: Multiple array index errors during DVI-to-PNG translation 586819 - CVE-2010-1440 tetex, texlive: Integer overflow by processing special commands 6. Package List: Red Hat Enterprise Linux Desktop (v. 5 client): Source: i386: tetex-3.0-33.8.el5_5.5.i386.rpm tetex-afm-3.0-33.8.el5_5.5.i386.rpm tetex-debuginfo-3.0-33.8.el5_5.5.i386.rpm tetex-doc-3.0-33.8.el5_5.5.i386.rpm tetex-dvips-3.0-33.8.el5_5.5.i386.rpm tetex-fonts-3.0-33.8.el5_5.5.i386.rpm tetex-latex-3.0-33.8.el5_5.5.i386.rpm tetex-xdvi-3.0-33.8.el5_5.5.i386.rpm x86_64: tetex-3.0-33.8.el5_5.5.x86_64.rpm tetex-afm-3.0-33.8.el5_5.5.x86_64.rpm tetex-debuginfo-3.0-33.8.el5_5.5.x86_64.rpm tetex-doc-3.0-33.8.el5_5.5.x86_64.rpm tetex-dvips-3.0-33.8.el5_5.5.x86_64.rpm tetex-fonts-3.0-33.8.el5_5.5.x86_64.rpm tetex-latex-3.0-33.8.el5_5.5.x86_64.rpm tetex-xdvi-3.0-33.8.el5_5.5.x86_64.rpm Red Hat Enterprise Linux (v. 5server): Source: i386: tetex-3.0-33.8.el5_5.5.i386.rpm tetex-afm-3.0-33.8.el5_5.5.i386.rpm tetex-debuginfo-3.0-33.8.el5_5.5.i386.rpm tetex-doc-3.0-33.8.el5_5.5.i386.rpm tetex-dvips-3.0-33.8.el5_5.5.i386.rpm tetex-fonts-3.0-33.8.el5_5.5.i386.rpm tetex-latex-3.0-33.8.el5_5.5.i386.rpm tetex-xdvi-3.0-33.8.el5_5.5.i386.rpm ia64: tetex-3.0-33.8.el5_5.5.ia64.rpm tetex-afm-3.0-33.8.el5_5.5.ia64.rpm tetex-debuginfo-3.0-33.8.el5_5.5.ia64.rpm tetex-doc-3.0-33.8.el5_5.5.ia64.rpm tetex-dvips-3.0-33.8.el5_5.5.ia64.rpm tetex-fonts-3.0-33.8.el5_5.5.ia64.rpm tetex-latex-3.0-33.8.el5_5.5.ia64.rpm tetex-xdvi-3.0-33.8.el5_5.5.ia64.rpm ppc: tetex-3.0-33.8.el5_5.5.ppc.rpm tetex-afm-3.0-33.8.el5_5.5.ppc.rpm tetex-debuginfo-3.0-33.8.el5_5.5.ppc.rpm tetex-doc-3.0-33.8.el5_5.5.ppc.rpm tetex-dvips-3.0-33.8.el5_5.5.ppc.rpm tetex-fonts-3.0-33.8.el5_5.5.ppc.rpm tetex-latex-3.0-33.8.el5_5.5.ppc.rpm tetex-xdvi-3.0-33.8.el5_5.5.ppc.rpm s390x: tetex-3.0-33.8.el5_5.5.s390x.rpm tetex-afm-3.0-33.8.el5_5.5.s390x.rpm tetex-debuginfo-3.0-33.8.el5_5.5.s390x.rpm tetex-doc-3.0-33.8.el5_5.5.s390x.rpm tetex-dvips-3.0-33.8.el5_5.5.s390x.rpm tetex-fonts-3.0-33.8.el5_5.5.s390x.rpm tetex-latex-3.0-33.8.el5_5.5.s390x.rpm tetex-xdvi-3.0-33.8.el5_5.5.s390x.rpm x86_64: tetex-3.0-33.8.el5_5.5.x86_64.rpm tetex-afm-3.0-33.8.el5_5.5.x86_64.rpm tetex-debuginfo-3.0-33.8.el5_5.5.x86_64.rpm tetex-doc-3.0-33.8.el5_5.5.x86_64.rpm tetex-dvips-3.0-33.8.el5_5.5.x86_64.rpm tetex-fonts-3.0-33.8.el5_5.5.x86_64.rpm tetex-latex-3.0-33.8.el5_5.5.x86_64.rpm tetex-xdvi-3.0-33.8.el5_5.5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key#package 7.References: https://access.redhat.com/security/cve/CVE-2009-0146 https://access.redhat.com/security/cve/CVE-2009-0147 https://access.redhat.com/security/cve/CVE-2009-0166 https://access.redhat.com/security/cve/CVE-2009-0195 https://access.redhat.com/security/cve/CVE-2009-0791 https://access.redhat.com/security/cve/CVE-2009-0799 https://access.redhat.com/security/cve/CVE-2009-0800 https://access.redhat.com/security/cve/CVE-2009-1179 https://access.redhat.com/security/cve/CVE-2009-1180 https://access.redhat.com/security/cve/CVE-2009-1181 https://access.redhat.com/security/cve/CVE-2009-1182 https://access.redhat.com/security/cve/CVE-2009-1183 https://access.redhat.com/security/cve/CVE-2009-3608 https://access.redhat.com/security/cve/CVE-2009-3609 https://access.redhat.com/security/cve/CVE-2010-0739 https://access.redhat.com/security/cve/CVE-2010-0829 https://access.redhat.com/security/cve/CVE-2010-1440 https://access.redhat.com/security/updates/classification#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2010 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFL4xcAXlSAg2UNWIIRArpMAKCWHT8ws6Hsmovk7jFwBdaltX0T9gCeJ8TB C0tr7TrImttZu0Al9fjlmoo=Bb7o -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list
May 06, 2010
•Important
Red Hat
172
security advisoryremote accessubuntuUbuntu 9.04 Security Update: CVE-2009-1171 Moodle TeX Filter Alert
Christian Eibl discovered that the TeX filter in Moodle allowed anyfunction to be used. An authenticated remote attacker could posta specially crafted TeX formula to execute arbitrary TeX functions,potentially reading any file accessible to the web server user, leadingto a loss of privacy. (CVE-2009-1171, MSA-09-0009) [More...]. ==========================================================Ubuntu Security Notice USN-791-2 June 24, 2009 moodle vulnerability CVE-2009-1171 ========================================================== A security issue affects the following Ubuntu releases: Ubuntu 9.04 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 9.04: moodle 1.9.4.dfsg-0ubuntu1.1 After a standard system upgrade you need to access the Moodle instance and accept the database update to clear any invalid cached data. Details follow: Christian Eibl discovered that the TeX filter in Moodle allowed any function to be used. An authenticated remote attacker could post a specially crafted TeX formula to execute arbitrary TeX functions, potentially reading any file accessible to the web server user, leading to a loss of privacy. (CVE-2009-1171, MSA-09-0009) Updated packages for Ubuntu 9.04: Source archives: Size/MD5: 37358 a51bee20ca3560c1b390b1e12e42c5f1 Size/MD5: 1477 a842e53d8330a56f47d09a1c19f78f11 Size/MD5: 12969234 6263f780d52114c8d6eced8308b66aa7 Architecture independent packages: Size/MD5: 9663672 12cd163fe02d67cda7f972bb5744e3e1 . Vulnerabilities in Moodle's TeX processing on Ubuntu 9.04 could expose sensitive files, endangering user data. Urgent patches necessary.. Moodle Vulnerability, Remote Access Risk, Ubuntu Security Notice, TeX Filter Issue, Database Update. . Severity: Critical. LinuxSecurity.com Team
Jun 24, 2009
•Critical
Ubuntu
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!