Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 7 articles for you...
89
security advisorysoftware updateFedoraFedora 33: 2021-8015a8cdc4 Critical: dom4j XML Injection Security Fix
- Security fix for CVE-2018-1000632 - Update to upstream 2.0.3 bugfix release - Fix Fedora 34 FTBFS. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2021-8015a8cdc4 2021-05-12 16:12:14.610341 --------------------------------------------------------------------------------Name : dom4j Product : Fedora 33 Version : 2.0.3 Release : 1.fc33 URL : https://dom4j.github.io/ Summary : Open Source XML framework for Java Description : dom4j is an Open Source XML framework for Java. dom4j allows you to read, write, navigate, create and modify XML documents. dom4j integrates with DOM and SAX and is seamlessly integrated with full XPath support. --------------------------------------------------------------------------------Update Information: - Security fix for CVE-2018-1000632 - Update to upstream 2.0.3 bugfix release -Fix Fedora 34 FTBFS --------------------------------------------------------------------------------ChangeLog: * Thu Apr 29 2021 Hans de Goede - 0:2.0.3-1 - New upstream version 2.0.3 - Fix CVE-2018-1000632 (rhbz#1620535) * Thu Apr 29 2021 Hans de Goede - 0:2.0.0-14 - Drop the org.dom4j.datatype bits, these depend on the obsolete msv project and no Fedora packages runtime require msv, so no package seem to need these bits. - Drop dom4j-demo and dom4j-manual Obsoletes, these no longer exist since F27. - Fix FTBFS (rhbz#1923601) * Tue Jan 26 2021 Fedora Release Engineering - 0:2.0.0-13 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild --------------------------------------------------------------------------------References: [ 1 ] Bug #1620529 - CVE-2018-1000632 dom4j: XML Injection in Class: Element. Methods: addElement, addAttribute which can impact the integrity of XML documents https://bugzilla.redhat.com/show_bug.cgi?id=1620529 --------------------------------------------------------------------------------This update can be installedwith the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2021-8015a8cdc4' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
May 12, 2021
•Critical
Fedora
89
security advisoryFedoraOpenSSLFedora 34: 2021-d5f8e3a7b2 Low: OpenSSL XML Injection Fix
- Security fix for CVE-2018-1000632 - Update to upstream 2.0.3 bugfix release - Fix Fedora 34 FTBFS. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2021-f28c870528 2021-05-12 05:41:31.252024 --------------------------------------------------------------------------------Name : dom4j Product : Fedora 34 Version : 2.0.3 Release : 1.fc34 URL : https://dom4j.github.io/ Summary : Open Source XML framework for Java Description : dom4j is an Open Source XML framework for Java. dom4j allows you to read, write, navigate, create and modify XML documents. dom4j integrates with DOM and SAX and is seamlessly integrated with full XPath support. --------------------------------------------------------------------------------Update Information: - Security fix for CVE-2018-1000632 - Update to upstream 2.0.3 bugfix release -Fix Fedora 34 FTBFS --------------------------------------------------------------------------------ChangeLog: * Thu Apr 29 2021 Hans de Goede - 0:2.0.3-1 - New upstream version 2.0.3 - Fix CVE-2018-1000632 (rhbz#1620535) * Thu Apr 29 2021 Hans de Goede - 0:2.0.0-14 - Drop the org.dom4j.datatype bits, these depend on the obsolete msv project and no Fedora packages runtime require msv, so no package seem to need these bits. - Drop dom4j-demo and dom4j-manual Obsoletes, these no longer exist since F27. - Fix FTBFS (rhbz#1923601) * Tue Jan 26 2021 Fedora Release Engineering - 0:2.0.0-13 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild --------------------------------------------------------------------------------References: [ 1 ] Bug #1620529 - CVE-2018-1000632 dom4j: XML Injection in Class: Element. Methods: addElement, addAttribute which can impact the integrity of XML documents https://bugzilla.redhat.com/show_bug.cgi?id=1620529 --------------------------------------------------------------------------------This update can be installedwith the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2021-f28c870528' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
May 12, 2021
•Low
Fedora
203
security advisorymoderatesecurity issueMageia 7 MGASA-2021-0034: Dom4J XXE Moderate Security Advisory
A flaw was found in the dom4j library. By using the default SaxReader() provided by Dom4J, external DTDs and External Entities are allowed, resulting in a possible XXE (CVE-2020-10683). References: . MGASA-2021-0034 - Updated dom4j packages fix a security vulnerability Publication date: 17 Jan 2021 URL: https://advisories.mageia.org/MGASA-2021-0034.html Type: security Affected Mageia releases: 7 CVE: CVE-2020-10683 A flaw was found in the dom4j library. By using the default SaxReader() provided by Dom4J, external DTDs and External Entities are allowed, resulting in a possible XXE (CVE-2020-10683). References: - https://bugs.mageia.org/show_bug.cgi?id=25596 - https://lists.debian.org/debian-lts-announce/2020/04/msg00029.html - https://www.cve.org/CVERecord?id=CVE-2020-10683 SRPMS: - 7/core/dom4j-2.0.0-4.1.mga7 . Revised dom4j versions address a possible XXE vulnerability for Mageia 7 users along with available patches and citations.. dom4j, Mageia Security, XXE Risk Mitigation, Software Patch. . Severity: Medium. LinuxSecurity.com Team
Jan 17, 2021
•Medium
Mageia
172
security advisorydenial of servicecode executionUbuntu 16.04 LTS USN-4619-1: Dom4j Critical Denial Of Service Risk
dom4j could be made to crash or run programs if it received a specially crafted file.. =========================================================================Ubuntu Security Notice USN-4619-1 November 05, 2020 dom4j vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS Summary: dom4j could be made to crash or run programs if it received a specially crafted file. Software Description: - dom4j: Flexible XML framework for Java Details: Mário Areias discovered that dom4j did not properly validate XML document elements. An attacker could exploit this with a crafted XML file to cause dom4j to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2018-1000632) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS: libdom4j-java 1.6.1+dfsg.3-2ubuntu1.2 In general, a standard system update will make all the necessary changes. References: CVE-2018-1000632 Package Information: https://launchpad.net/ubuntu/+source/dom4j/1.6.1+dfsg.3-2ubuntu1.2 . Ubuntu Security Notice USN-4620-1 highlights a vulnerability in OpenSSL that may lead to data leakage or remote access through compromised connections.. dom4j Vulnerability, Ubuntu Security Notice, Denial of Service, Java XML Framework. . Severity: Critical. LinuxSecurity.com Team
Nov 05, 2020
•Critical
Ubuntu
172
security advisoryarbitrary code executionUbuntuUbuntu 16.04 LTS: USN-4575-1 Critical: dom4j Information Exposure
dom4j could be made to expose sensitive information or run programs if it received specially crafted input.. =========================================================================Ubuntu Security Notice USN-4575-1 October 13, 2020 dom4j vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS Summary: dom4j could be made to expose sensitive information or run programs if it received specially crafted input. Software Description: - dom4j: Flexible XML framework for Java Details: It was discovered that dom4j incorrectly handled reading XML data. A remote attacker could exploit this with a crafted XML file to expose sensitive data or possibly execute arbitrary code. (CVE-2020-10683) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS: libdom4j-java 1.6.1+dfsg.3-2ubuntu1.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-4575-1 CVE-2020-10683 Package Information: https://launchpad.net/ubuntu/+source/dom4j/1.6.1+dfsg.3-2ubuntu1.1 . Debian Security Bulletin DSA-4962-1 addresses a vulnerability in libxml2 that could lead to leakage of confidential information or enable unauthorized command execution.. dom4j Vulnerability, Arbitrary Code Execution, Information Exposure. . Severity: Critical. LinuxSecurity.com Team
Oct 13, 2020
•Critical
Ubuntu
202
security advisoryimportant updateopenSUSEopenSUSE: 2020:0719-1 Important: dom4j XML External Entity Issue
An update that fixes one vulnerability is now available.. openSUSE Security Update: Security update for dom4j ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0719-1 Rating: important References: #1169760 Cross-References: CVE-2020-10683 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for dom4j fixes the following issues: - CVE-2020-10683: Fixed an XML External Entity vulnerability in default SAX parser (bsc#1169760). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-719=1 Package List: - openSUSE Leap 15.1 (noarch): dom4j-1.6.1-lp151.6.3.1 dom4j-demo-1.6.1-lp151.6.3.1 dom4j-javadoc-1.6.1-lp151.6.3.1 dom4j-manual-1.6.1-lp151.6.3.1 References: https://www.suse.com/security/cve/CVE-2020-10683.html https://bugzilla.suse.com/1169760 -- . Important openSUSE patch for dom4j addresses XML External Entity weakness. Discover further details!. openSUSE Update, dom4j patch, XML Security Fix, Security Update, openSUSE Vulnerability. . Severity: Important. LinuxSecurity.com Team
May 26, 2020
•Important
OpenSUSE
100
security advisoryimportantSUSESUSE: 2020:1382-1 Important: dom4j XML External Entity Fix
An update that fixes one vulnerability is now available. . SUSE Security Update: Security update for dom4j ______________________________________________________________________________ Announcement ID: SUSE-SU-2020:1382-1 Rating: important References: #1169760 Cross-References: CVE-2020-10683 Affected Products: SUSE Manager Server 3.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for dom4j fixes the following issues: - CVE-2020-10683: Fixed an XML External Entity vulnerability in default SAX parser (bsc#1169760). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Manager Server 3.2: zypper in -t patch SUSE-SUSE-Manager-Server-3.2-2020-1382=1 Package List: - SUSE Manager Server 3.2 (noarch): dom4j-1.6.1-27.7.2 References: https://www.suse.com/security/cve/CVE-2020-10683.html https://bugzilla.suse.com/1169760 _______________________________________________ sle-security-updates mailing list
May 22, 2020
•Important
SuSE
100
security advisoryupdateimportantSUSE: 2020:1383-1 Important: dom4j XML External Entity Issue
An update that fixes one vulnerability is now available. . SUSE Security Update: Security update for dom4j ______________________________________________________________________________ Announcement ID: SUSE-SU-2020:1383-1 Rating: important References: #1169760 Cross-References: CVE-2020-10683 Affected Products: SUSE Linux Enterprise Module for SUSE Manager Server 4.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for dom4j fixes the following issues: - CVE-2020-10683: Fixed an XML External Entity vulnerability in default SAX parser (bsc#1169760). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for SUSE Manager Server 4.0: zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Server-4.0-2020-1383=1 Package List: - SUSE Linux Enterprise Module for SUSE Manager Server 4.0 (noarch): dom4j-1.6.1-4.9.4 References: https://www.suse.com/security/cve/CVE-2020-10683.html https://bugzilla.suse.com/1169760 _______________________________________________ sle-security-updates mailing list
May 22, 2020
•Important
SuSE
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!