Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found 2 articles for you...
197
security advisoryupdateDebianDebian 11: DLA-4042-1 critical: asterisk CVE-2024-53566 path traversal
An issue has been found in asterisk, an Open Source Private Branch Exchange. CVE-2024-53566 . ------------------------------------------------------------------------- Debian LTS Advisory DLA-4042-1
Feb 06, 2025
•Critical
Debian LTS
89
security advisoryfedorasecurity fixFedora 37: 2023-9078f609e6 Critical: Sudo File Access Issue Fix
Rebase to sudo-1.9.12p2 - security fix for CVE-2023-22809. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2023-9078f609e6 2023-01-22 01:40:20.174396 --------------------------------------------------------------------------------Name : sudo Product : Fedora 37 Version : 1.9.12 Release : 1.p2.fc37 URL : Summary : Allows restricted root access for specified users Description : Sudo (superuser do) allows a system administrator to give certain users (or groups of users) the ability to run some (or all) commands as root while logging all commands and arguments. Sudo operates on a per-command basis. It is not a replacement for the shell. Features include: the ability to restrict what commands a user may run on a per-host basis, copious logging of each command (providing a clear audit trail of who did what), a configurable timeout of the sudo command, and the ability to use the same configuration file (sudoers) on many different machines. --------------------------------------------------------------------------------Update Information: Rebase to sudo-1.9.12p2 - security fix for CVE-2023-22809 --------------------------------------------------------------------------------ChangeLog: * Thu Jan 19 2023 Radovan Sroka - 1.9.12-1.p2 - Rebase to sudo 1.9.12p2 - sudo-1.9.12p2 is available Resolves: rhbz#2137775 - sudo: arbitrary file write with privileges of the RunAs user CVE-2023-22809 Resolves: rhbz#2162042 --------------------------------------------------------------------------------References: [ 1 ] Bug #2137775 - sudo-1.9.12p2 is available https://bugzilla.redhat.com/show_bug.cgi?id=2137775 [ 2 ] Bug #2162042 - CVE-2023-22809 sudo: arbitrary file write with privileges of the RunAs user [fedora-37] https://bugzilla.redhat.com/show_bug.cgi?id=2162042 --------------------------------------------------------------------------------This update can be installedwith the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-9078f609e6' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Jan 22, 2023
•Critical
Fedora
100
security advisorybuffer overflowlow severitySUSE: 2021:0430-1 Low Severity MozillaFirefox Buffer Overflow Fix
An update that contains security fixes can now be installed. . SUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2021:0430-1 Rating: low References: #1181848 Affected Products: SUSE Linux Enterprise Module for Desktop Applications 15-SP2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 78.7.1 ESR (bsc#1181848) - Fixed: Prevent access to NTFS special paths that could lead to filesystem corruption. - Buffer overflow in depth pitch calculations for compressed textures Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Desktop Applications 15-SP2: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP2-2021-430=1 Package List: - SUSE Linux Enterprise Module for Desktop Applications 15-SP2 (aarch64 ppc64le s390x x86_64): MozillaFirefox-78.7.1-8.29.1 MozillaFirefox-debuginfo-78.7.1-8.29.1 MozillaFirefox-debugsource-78.7.1-8.29.1 MozillaFirefox-devel-78.7.1-8.29.1 MozillaFirefox-translations-common-78.7.1-8.29.1 MozillaFirefox-translations-other-78.7.1-8.29.1 References: https://bugzilla.suse.com/1181848 . The latest SUSE Security Update brings essential patches for MozillaFirefox, addressing severe file permissions vulnerabilities and mitigating potential buffer overflow threats.. MozillaFirefox Update, SUSE Security Fixes, File Access Issue, Buffer Overflow Patch, SUSE Linux Enterprise. . Severity: Low. LinuxSecurity.com Team
Feb 10, 2021
•Low
SuSE
203
security advisorymedium severityfile access issueMageia 7 MGASA-2020-0257 Medium: xawtv File Access Issue
Updated xawtv packages fix security vulnerability: The v4l-conf program in xawtv allows users to determine the existence of file names in directories they do not have access to, and allows a user to have the system open files they do not have access to, though it does . MGASA-2020-0257 - Updated xawtv packages fix security vulnerability Publication date: 10 Jun 2020 URL: https://advisories.mageia.org/MGASA-2020-0257.html Type: security Affected Mageia releases: 7 CVE: CVE-2020-13696 Updated xawtv packages fix security vulnerability: The v4l-conf program in xawtv allows users to determine the existence of file names in directories they do not have access to, and allows a user to have the system open files they do not have access to, though it does not provide the user access to the file contents (CVE-2020-13696). References: - https://bugs.mageia.org/show_bug.cgi?id=26736 - https://www.openwall.com/lists/oss-security/2020/06/04/6 - https://www.cve.org/CVERecord?id=CVE-2020-13696 SRPMS: - 7/core/xawtv-3.107-1.1.mga7 . Mageia 2020-0257 upgrades xawtv to address file access risks, enhancing overall system protection.. xawtv update,Mageia security,xawtv vulnerability,file access issue. . Severity: Medium. LinuxSecurity.com Team
Jun 10, 2020
•Medium
Mageia
203
security advisoryupdatecriticalMageia: MGASA-2020-0145 High: ImageMagick Security Vulnerability Detected
It was found that the superexec operator was available in the internal dictionary. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. (CVE-2019-3835) . MGASA-2019-0130 - Updated ghostscript packages fix security vulnerability Publication date: 05 Apr 2019 URL: https://advisories.mageia.org/MGASA-2019-0130.html Type: security Affected Mageia releases: 6 CVE: CVE-2019-3835, CVE-2019-3838 It was found that the superexec operator was available in the internal dictionary. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. (CVE-2019-3835) It was found that the forceput operator could be extracted from the DefineResource method using methods similar to the ones described in CVE-2019-6116. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constraints imposed by -dSAFER. (CVE-2019-3838) References: - https://bugs.mageia.org/show_bug.cgi?id=24548 - https://www.openwall.com/lists/oss-security/2019/03/21/1 - https://access.redhat.com/errata/RHSA-2019:0633 - https://www.cve.org/CVERecord?id=CVE-2019-3835 - https://www.cve.org/CVERecord?id=CVE-2019-3838 SRPMS: - 6/core/ghostscript-9.26-1.3.mga6 . The latest ghostscript updates tackle a significant access vulnerability affecting Mageia systems. Discover the specifics of this urgent security patch.. ghostscript security patch, Mageia updates, PostScript threat. . Severity: Important. LinuxSecurity.com Team
Apr 05, 2019
•Important
Mageia
89
security advisorymoderatefedoraFedora 26: 2017-6874606e19 Moderate: Drupal 7.56 File Access Issue
* [7.56]() * [SA-CORE-2017-003](). --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2017-6874606e19 2017-07-07 22:40:59.824375 --------------------------------------------------------------------------------Name : drupal7 Product : Fedora 26 Version : 7.56 Release : 1.fc26 URL : Summary : An open-source content-management platform Description : Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure. --------------------------------------------------------------------------------Update Information: * [7.56]() * [SA-CORE-2017-003]() --------------------------------------------------------------------------------References: [ 1 ] Bug #1464008 - CVE-2017-6922 drupal7: Files uploaded by anonymous users into a private file system can be accessed by other anonymous users [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=1464008 [ 2 ] Bug #1464007 - CVE-2017-6922 drupal7: Files uploaded by anonymous users into a private file system can be accessed by other anonymous users [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1464007 [ 3 ] Bug #1463856 - drupal7-7.56 is available https://bugzilla.redhat.com/show_bug.cgi?id=1463856 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade drupal7' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Jul 07, 2017
•Important
Fedora
100
security advisoryupdateremote exploitSUSE: 2016:0164-1 Important: Samba Remote Exploit Threats Resolved
An update that solves four vulnerabilities and has 7 fixes An update that solves four vulnerabilities and has 7 fixes An update that solves four vulnerabilities and has 7 fixes is now available. is now available.. SUSE Security Update: Security update for samba ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0164-1 Rating: important References: #295284 #912457 #934299 #936909 #948244 #949022 #953382 #958582 #958583 #958584 #958586 Cross-References: CVE-2015-5252 CVE-2015-5296 CVE-2015-5299 CVE-2015-5330 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Software Development Kit 11-SP3 SUSE Linux Enterprise Server for VMWare 11-SP3 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3 SUSE Linux Enterprise Desktop 11-SP4 SUSE Linux Enterprise Desktop 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that solves four vulnerabilities and has 7 fixes is now available. Description: This update for Samba fixes the following security issues: - CVE-2015-5330: Remote read memory exploit in LDB (bnc#958586) - CVE-2015-5252: Insufficient symlink verification (file access outside the share) (bnc#958582) - CVE-2015-5296: No man in the middle protection when forcing smb encryption on the client side (bnc#958584) - CVE-2015-5299: Currently the snapshot browsing is not secure thru windows previous version (shadow_copy2) (bnc#958583) Non-security issues fixed: - Prevent null pointer access in samlogon fallback when security credentials are null (bnc#949022) - Ensure samlogonfall-back requests are rerouted after kerberos failure (bnc#953382) - Ensure "Your account is disabled" message is displayed when attempting to ssh into locked account (bnc#953382) - Address unrecoverable winbind failure: "key length too large" (bnc#934299) - Take resource group sids into account when caching netsamlogon data (bnc#912457) - Fix lookup of groups with "Local Domain" scope from Active Directory (bnc#948244) - dependency issue with samba-winbind (bnc#936909) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-samba-20160113-12338=1 - SUSE Linux Enterprise Software Development Kit 11-SP3: zypper in -t patch sdksp3-samba-20160113-12338=1 - SUSE Linux Enterprise Server for VMWare 11-SP3: zypper in -t patch slessp3-samba-20160113-12338=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-samba-20160113-12338=1 - SUSE Linux Enterprise Server 11-SP3: zypper in -t patch slessp3-samba-20160113-12338=1 - SUSE Linux Enterprise Desktop 11-SP4: zypper in -t patch sledsp4-samba-20160113-12338=1 - SUSE Linux Enterprise Desktop 11-SP3: zypper in -t patch sledsp3-samba-20160113-12338=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-samba-20160113-12338=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-samba-20160113-12338=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): libldb-devel-3.6.3-64.1 libnetapi-devel-3.6.3-64.1 libnetapi0-3.6.3-64.1 libsmbclient-devel-3.6.3-64.1 libsmbsharemodes-devel-3.6.3-64.1 libsmbsharemodes0-3.6.3-64.1 libtalloc-devel-3.6.3-64.1 libtdb-devel-3.6.3-64.1 libtevent-devel-3.6.3-64.1 libwbclient-devel-3.6.3-64.1 samba-devel-3.6.3-64.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (ia64 ppc64 s390x x86_64): samba-test-3.6.3-64.1 - SUSE Linux Enterprise Software Development Kit 11-SP3 (i586 ia64 ppc64 s390x x86_64): libldb-devel-3.6.3-64.1 libnetapi-devel-3.6.3-64.1 libnetapi0-3.6.3-64.1 libsmbclient-devel-3.6.3-64.1 libsmbsharemodes-devel-3.6.3-64.1 libsmbsharemodes0-3.6.3-64.1 libtalloc-devel-3.6.3-64.1 libtdb-devel-3.6.3-64.1 libtevent-devel-3.6.3-64.1 libwbclient-devel-3.6.3-64.1 samba-devel-3.6.3-64.1 samba-test-3.6.3-64.1 - SUSE Linux Enterprise Server for VMWare 11-SP3 (i586 x86_64): ldapsmb-1.34b-64.1 libldb1-3.6.3-64.1 libsmbclient0-3.6.3-64.1 libtalloc2-3.6.3-64.1 libtdb1-3.6.3-64.1 libtevent0-3.6.3-64.1 libwbclient0-3.6.3-64.1 samba-3.6.3-64.1 samba-client-3.6.3-64.1 samba-krb-printing-3.6.3-64.1 samba-winbind-3.6.3-64.1 - SUSE Linux Enterprise Server for VMWare 11-SP3 (x86_64): libsmbclient0-32bit-3.6.3-64.1 libtalloc2-32bit-3.6.3-64.1 libtdb1-32bit-3.6.3-64.1 libtevent0-32bit-3.6.3-64.1 libwbclient0-32bit-3.6.3-64.1 samba-32bit-3.6.3-64.1 samba-client-32bit-3.6.3-64.1 samba-winbind-32bit-3.6.3-64.1 - SUSE Linux Enterprise Server for VMWare 11-SP3 (noarch): samba-doc-3.6.3-64.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): ldapsmb-1.34b-64.1 libldb1-3.6.3-64.1 libsmbclient0-3.6.3-64.1 libtalloc2-3.6.3-64.1 libtdb1-3.6.3-64.1 libtevent0-3.6.3-64.1 libwbclient0-3.6.3-64.1 samba-3.6.3-64.1 samba-client-3.6.3-64.1 samba-krb-printing-3.6.3-64.1 samba-winbind-3.6.3-64.1 - SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64): libsmbclient0-32bit-3.6.3-64.1 libtalloc2-32bit-3.6.3-64.1 libtdb1-32bit-3.6.3-64.1 libtevent0-32bit-3.6.3-64.1 libwbclient0-32bit-3.6.3-64.1 samba-32bit-3.6.3-64.1 samba-client-32bit-3.6.3-64.1 samba-winbind-32bit-3.6.3-64.1 - SUSE Linux Enterprise Server 11-SP4 (noarch): samba-doc-3.6.3-64.1 - SUSE Linux Enterprise Server 11-SP4 (ia64): libsmbclient0-x86-3.6.3-64.1 libtalloc2-x86-3.6.3-64.1 libtdb1-x86-3.6.3-64.1 libtevent0-x86-3.6.3-64.1 libwbclient0-x86-3.6.3-64.1 samba-client-x86-3.6.3-64.1 samba-winbind-x86-3.6.3-64.1 samba-x86-3.6.3-64.1 - SUSE Linux Enterprise Server 11-SP3 (i586 ia64 ppc64 s390x x86_64): ldapsmb-1.34b-64.1 libldb1-3.6.3-64.1 libsmbclient0-3.6.3-64.1 libtalloc2-3.6.3-64.1 libtdb1-3.6.3-64.1 libtevent0-3.6.3-64.1 libwbclient0-3.6.3-64.1 samba-3.6.3-64.1 samba-client-3.6.3-64.1 samba-krb-printing-3.6.3-64.1 samba-winbind-3.6.3-64.1 - SUSE Linux Enterprise Server 11-SP3 (ppc64 s390x x86_64): libsmbclient0-32bit-3.6.3-64.1 libtalloc2-32bit-3.6.3-64.1 libtdb1-32bit-3.6.3-64.1 libtevent0-32bit-3.6.3-64.1 libwbclient0-32bit-3.6.3-64.1 samba-32bit-3.6.3-64.1 samba-client-32bit-3.6.3-64.1 samba-winbind-32bit-3.6.3-64.1 - SUSE Linux Enterprise Server 11-SP3 (noarch): samba-doc-3.6.3-64.1 - SUSE Linux Enterprise Server 11-SP3 (ia64): libsmbclient0-x86-3.6.3-64.1 libtalloc2-x86-3.6.3-64.1 libtdb1-x86-3.6.3-64.1 libwbclient0-x86-3.6.3-64.1 samba-client-x86-3.6.3-64.1 samba-winbind-x86-3.6.3-64.1 samba-x86-3.6.3-64.1 - SUSE Linux Enterprise Desktop 11-SP4 (i586 x86_64): libldb1-3.6.3-64.1 libsmbclient0-3.6.3-64.1 libtalloc2-3.6.3-64.1 libtdb1-3.6.3-64.1 libtevent0-3.6.3-64.1 libwbclient0-3.6.3-64.1 samba-3.6.3-64.1 samba-client-3.6.3-64.1 samba-krb-printing-3.6.3-64.1 samba-winbind-3.6.3-64.1 - SUSE Linux Enterprise Desktop 11-SP4 (x86_64): libldb1-32bit-3.6.3-64.1 libsmbclient0-32bit-3.6.3-64.1 libtalloc2-32bit-3.6.3-64.1 libtdb1-32bit-3.6.3-64.1 libtevent0-32bit-3.6.3-64.1 libwbclient0-32bit-3.6.3-64.1 samba-32bit-3.6.3-64.1 samba-client-32bit-3.6.3-64.1 samba-winbind-32bit-3.6.3-64.1 - SUSE Linux Enterprise Desktop 11-SP4 (noarch): samba-doc-3.6.3-64.1 - SUSE Linux Enterprise Desktop 11-SP3 (i586 x86_64): libldb1-3.6.3-64.1 libsmbclient0-3.6.3-64.1 libtalloc2-3.6.3-64.1 libtdb1-3.6.3-64.1 libtevent0-3.6.3-64.1 libwbclient0-3.6.3-64.1 samba-3.6.3-64.1 samba-client-3.6.3-64.1 samba-krb-printing-3.6.3-64.1 samba-winbind-3.6.3-64.1 - SUSE Linux Enterprise Desktop 11-SP3 (x86_64): libldb1-32bit-3.6.3-64.1 libsmbclient0-32bit-3.6.3-64.1 libtalloc2-32bit-3.6.3-64.1 libtdb1-32bit-3.6.3-64.1 libtevent0-32bit-3.6.3-64.1 libwbclient0-32bit-3.6.3-64.1 samba-32bit-3.6.3-64.1 samba-client-32bit-3.6.3-64.1 samba-winbind-32bit-3.6.3-64.1 - SUSE Linux Enterprise Desktop 11-SP3 (noarch): samba-doc-3.6.3-64.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): samba-debuginfo-3.6.3-64.1 samba-debugsource-3.6.3-64.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (ppc64 s390x x86_64): samba-debuginfo-32bit-3.6.3-64.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (ia64): samba-debuginfo-x86-3.6.3-64.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 ia64 ppc64 s390x x86_64): samba-debuginfo-3.6.3-64.1 samba-debugsource-3.6.3-64.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (ppc64 s390x): samba-debuginfo-32bit-3.6.3-64.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (ia64): samba-debuginfo-x86-3.6.3-64.1 References: https://www.suse.com/security/cve/CVE-2015-5252.html https://www.suse.com/security/cve/CVE-2015-5296.html https://www.suse.com/security/cve/CVE-2015-5299.html https://www.suse.com/security/cve/CVE-2015-5330.html https://bugzilla.suse.com/show_bug.cgi?id=295284 https://bugzilla.suse.com/show_bug.cgi?id=912457 https://bugzilla.suse.com/show_bug.cgi?id=934299 https://bugzilla.suse.com/show_bug.cgi?id=936909 https://bugzilla.suse.com/show_bug.cgi?id=948244 https://bugzilla.suse.com/show_bug.cgi?id=949022 https://bugzilla.suse.com/show_bug.cgi?id=953382 https://bugzilla.suse.com/show_bug.cgi?id=958582 https://bugzilla.suse.com/show_bug.cgi?id=958583 https://bugzilla.suse.com/show_bug.cgi?id=958584 https://bugzilla.suse.com/show_bug.cgi?id=958586 . The newest Samba patch resolves several security flaws, providing updates for various SUSE operating systems.. Samba Security Update, SUSE Samba Fixes, Remote Exploit Issues. . Severity: Important. LinuxSecurity.com Team
Jan 19, 2016
•Important
SuSE
98
security advisoryRed Hat Enterprise LinuximportantRed Hat: RHSA-2015:0840-01 Important: Access Plugin File Access
An updated redhat-access-plugin-openstack package that fixes one security issue is now available for Red Hat Enterprise Linux OpenStack Platform 5.0 for Red Hat Enterprise Linux 7. [More...]. ==================================================================== Red Hat Security Advisory Synopsis: Important: redhat-access-plugin security update Advisory ID: RHSA-2015:0840-01 Product: Red Hat Enterprise Linux OpenStack Platform Advisory URL: https://access.redhat.com/errata/RHSA-2015:0840.html Issue date: 2015-04-16 CVE Names: CVE-2015-0271 ==================================================================== 1. Summary: An updated redhat-access-plugin-openstack package that fixes one security issue is now available for Red Hat Enterprise Linux OpenStack Platform 5.0 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux OpenStack Platform 5.0 for RHEL 7 - noarch 3. Description: The Red Hat Support plug-in for Red Hat OpenStack is a Technology Preview feature which offers seamless integrated access to Red Hat subscription services from the Red Hat OpenStack administration portal. The plug-in provides automated functionality that enables quicker help, answers, and proactive services. It offers easy and instant access to Red Hat exclusive knowledge, resources, engagement, and diagnostic features. It was found that the local log-viewing function of the redhat-access-plugin for OpenStack Dashboard (horizon) did not sanitize user input. An authenticated user could use this flaw to read an arbitrary file with the permissions of the web server. (CVE-2015-0271) Red Hat would like to thank Sara Perez Merino of SensePost for reporting this issue. Allredhat-access-plugin-openstack users are advised to upgrade to this updated package, which contains a backported patch to correct this issue. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1193638 - CVE-2015-0271 OpenStack dashboard: log file arbitrary file retrieval 6. Package List: Red Hat Enterprise Linux OpenStack Platform 5.0 for RHEL 7: Source: redhat-access-plugin-openstack-5.0.1-0.el7ost.src.rpm noarch: redhat-access-plugin-openstack-5.0.1-0.el7ost.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2015-0271 https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2015 Red Hat, Inc. . A significant announcement regarding the access plugin from Red Hat addresses a security vulnerability that permits file access for authenticated users.. Red Hat Access Plugin, OpenStack Security, File Access Update. . Severity: Important. LinuxSecurity.com Team
Apr 16, 2015
•Important
Red Hat
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!