Explore top 10 tips to secure your open-source projects now. Read More
×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 9 articles for you...
100
security advisorysecurity fixlow severitySUSE: 2025:1374-1 low severity runc file creation issue resolved
* bsc#1230092 Cross-References: * CVE-2024-45310 . # Security update for runc Announcement ID: SUSE-SU-2025:1374-1 Release Date: 2025-04-25T12:39:30Z Rating: low References: * bsc#1230092 Cross-References: * CVE-2024-45310 CVSS scores: * CVE-2024-45310 ( SUSE ): 3.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N * CVE-2024-45310 ( NVD ): 3.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N Affected Products: * SUSE Linux Enterprise High Performance Computing 12 SP5 * SUSE Linux Enterprise Server 12 SP5 * SUSE Linux Enterprise Server 12 SP5 LTSS * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security * SUSE Linux Enterprise Server for SAP Applications 12 SP5 An update that solves one vulnerability can now be installed. ## Description: This update for runc fixes the following issues: * CVE-2024-45310: Fixed unintentional creation of empty files/directories on host (bsc#1230092) Other fixes: * Update to runc v1.2.6. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server 12 SP5 LTSS zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-2025-1374=1 * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2025-1374=1 ## Package List: * SUSE Linux Enterprise Server 12 SP5 LTSS (aarch64 ppc64le s390x x86_64) * runc-1.2.6-16.60.2 * runc-debuginfo-1.2.6-16.60.2 * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (x86_64) * runc-1.2.6-16.60.2 * runc-debuginfo-1.2.6-16.60.2 ## References: * https://www.suse.com/security/cve/CVE-2024-45310.html * https://bugzilla.suse.com/show_bug.cgi?id=1230092 . To combat the runc security issue in SUSE, apply the latest patch for version 12 SP5 to prevent empty file creation. Follow these steps:. SUSE Linux Enterprise, runcsecurity, low severity issue, Linux patching. . Severity: Low. LinuxSecurity.com Team
Apr 25, 2025
•Low
SuSE
200
security advisorycriticalfile creationSciLinux: SLSA-2023:6886 Critical: Plexus-Archiver File Creation Risk
plexus-archiver: Arbitrary File Creation in AbstractUnArchiver (CVE-2023-37460) --- This content is derived from https://access.redhat.com/errata/RHSA-2023:6886 SL7 srpm plexus-archiver-0:2.4.2-6.el7_9.src noarch plexus-archiver-0:2.4.2-6.el7_9.noarch - Scientific Linux Development Team . Red Hat Security Advisory: plexus-archiver security update Advisory ID: SLSA-2023:6886 Issue Date: 2023-11-13 CVE Numbers: CVE-2023-37460 -- The Plexus project provides a full software stack for creating and executing software projects. Based on the Plexus container, the applications can utilise component-oriented programming to build modular, reusable components that can easily be assembled and reused. The plexus-archiver component provides functions to create and extract archives. Security Fix(es): * plexus-archiver: Arbitrary File Creation in AbstractUnArchiver (CVE-2023-37460) --- This content is derived from https://access.redhat.com/errata/RHSA-2023:6886 -- SL7 srpm plexus-archiver-0:2.4.2-6.el7_9.src noarch plexus-archiver-0:2.4.2-6.el7_9.noarch - Scientific Linux Development Team . Plexus-archiver vulnerability patch for Uncontrolled File Creation in AbstractUnArchiver (SLSA-2023:6886).. Plexus Archiver Update, Security Fix, File Creation Risk. . Severity: Critical. LinuxSecurity.com Team
Nov 13, 2023
•Critical
Scientific Linux
100
security advisoryupdateimportantSUSE: 2022:1510-1 Important: amazon-ssm-agent Critical Security Issue
An update that fixes one vulnerability is now available. . SUSE Security Update: Security update for amazon-ssm-agent ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1510-1 Rating: important References: #1196556 Cross-References: CVE-2022-29527 CVSS scores: CVE-2022-29527 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 15 SUSE Linux Enterprise High Performance Computing 15-SP1 SUSE Linux Enterprise High Performance Computing 15-SP2 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Public Cloud 15 SUSE Linux Enterprise Module for Public Cloud 15-SP1 SUSE Linux Enterprise Module for Public Cloud 15-SP2 SUSE Linux Enterprise Module for Public Cloud 15-SP3 SUSE Linux Enterprise Module for Public Cloud 15-SP4 SUSE Linux Enterprise Server 15 SUSE Linux Enterprise Server 15-SP1 SUSE Linux Enterprise Server 15-SP2 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15 SUSE Linux Enterprise Server for SAP Applications 15-SP1 SUSE Linux Enterprise Server for SAP Applications 15-SP2 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 6 SUSE Linux Enterprise Storage 7 SUSE Manager Proxy 4.0 SUSE Manager Proxy4.1 SUSE Manager Proxy 4.2 SUSE Manager Server 4.0 SUSE Manager Server 4.1 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for amazon-ssm-agent fixes the following issues: - CVE-2022-29527: Fixed unsafe file creation mode of ssm-agent-users sudoer file (bsc#1196556). Update to version 3.1.1260.0 Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1510=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1510=1 - SUSE Linux Enterprise Module for Public Cloud 15-SP4: zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP4-2022-1510=1 - SUSE Linux Enterprise Module for Public Cloud 15-SP3: zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP3-2022-1510=1 - SUSE Linux Enterprise Module for Public Cloud 15-SP2: zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP2-2022-1510=1 - SUSE Linux Enterprise Module for Public Cloud 15-SP1: zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP1-2022-1510=1 - SUSE Linux Enterprise Module for Public Cloud 15: zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-2022-1510=1 Package List: - openSUSE Leap 15.4 (aarch64 x86_64): amazon-ssm-agent-3.1.1260.0-150000.5.9.2 - openSUSE Leap 15.3 (aarch64 x86_64): amazon-ssm-agent-3.1.1260.0-150000.5.9.2 - SUSE Linux Enterprise Module for Public Cloud 15-SP4 (aarch64 x86_64): amazon-ssm-agent-3.1.1260.0-150000.5.9.2 - SUSE Linux Enterprise Module for Public Cloud 15-SP3(aarch64 x86_64): amazon-ssm-agent-3.1.1260.0-150000.5.9.2 - SUSE Linux Enterprise Module for Public Cloud 15-SP2 (aarch64 x86_64): amazon-ssm-agent-3.1.1260.0-150000.5.9.2 - SUSE Linux Enterprise Module for Public Cloud 15-SP1 (aarch64 x86_64): amazon-ssm-agent-3.1.1260.0-150000.5.9.2 - SUSE Linux Enterprise Module for Public Cloud 15 (aarch64 x86_64): amazon-ssm-agent-3.1.1260.0-150000.5.9.2 References: https://www.suse.com/security/cve/CVE-2022-29527.html https://bugzilla.suse.com/1196556 . Addresses weakness in amazon-ssm-agent for several SUSE versions, improving overall defense protocols against potential risks.. SUSE Security Update, amazon-ssm-agent, security measures. . Severity: Important. LinuxSecurity.com Team
May 03, 2022
•Important
SuSE
100
security advisoryupdateimportantSUSE: 2022:0705-2 Critical Update for Nodejs10 Security Vulnerabilities
An update that fixes 5 vulnerabilities is now available. . SUSE Security Update: Security update for nodejs8 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:0704-1 Rating: important References: #1191962 #1191963 #1192153 #1192154 #1192696 Cross-References: CVE-2021-23343 CVE-2021-32803 CVE-2021-32804 CVE-2021-3807 CVE-2021-3918 CVSS scores: CVE-2021-23343 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-23343 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-32803 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-32803 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-32804 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-32804 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-3807 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-3918 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE CaaS Platform 4.0 SUSE Enterprise Storage 6 SUSE Enterprise Storage 7 SUSE Linux Enterprise High Performance Computing 15-ESPOS SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server 15-SP1-BCL SUSE Linux Enterprise Server 15-SP1-LTSS SUSE Linux Enterprise Server 15-SP2-BCL SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server for SAP 15 SUSE Linux Enterprise Server for SAP 15-SP1 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Manager Proxy 4.1 SUSE Manager Retail Branch Server 4.1 SUSE Manager Server 4.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for nodejs8 fixes the following issues: - CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153). - CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963). - CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962). - CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696). - CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-704=1 - SUSE Manager Retail Branch Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-704=1 - SUSE Manager Proxy 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-704=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-704=1 - SUSE Linux Enterprise Server for SAP 15-SP1: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2022-704=1 - SUSE Linux Enterprise Server for SAP 15: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2022-704=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-704=1 - SUSE Linux Enterprise Server 15-SP2-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-704=1 - SUSE Linux Enterprise Server 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-704=1 - SUSE Linux Enterprise Server 15-SP1-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-BCL-2022-704=1 - SUSE Linux Enterprise Server 15-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-2022-704=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-704=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-704=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-704=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-704=1 - SUSE Linux Enterprise High Performance Computing 15-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-2022-704=1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-2022-704=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2022-704=1 - SUSE Enterprise Storage 6: zypper in -t patch SUSE-Storage-6-2022-704=1 - SUSE CaaS Platform 4.0: To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. Package List: - SUSE Manager Server 4.1 (ppc64le s390x x86_64): nodejs8-8.17.0-10.19.2 nodejs8-debuginfo-8.17.0-10.19.2 nodejs8-debugsource-8.17.0-10.19.2 nodejs8-devel-8.17.0-10.19.2 npm8-8.17.0-10.19.2 - SUSE Manager Server 4.1 (noarch): nodejs-common-2.0-3.4.1 nodejs8-docs-8.17.0-10.19.2 - SUSE Manager Retail Branch Server 4.1 (noarch): nodejs-common-2.0-3.4.1 nodejs8-docs-8.17.0-10.19.2 - SUSE Manager Retail Branch Server 4.1 (x86_64): nodejs8-8.17.0-10.19.2 nodejs8-debuginfo-8.17.0-10.19.2 nodejs8-debugsource-8.17.0-10.19.2 nodejs8-devel-8.17.0-10.19.2 npm8-8.17.0-10.19.2 - SUSE Manager Proxy 4.1 (x86_64): nodejs8-8.17.0-10.19.2 nodejs8-debuginfo-8.17.0-10.19.2 nodejs8-debugsource-8.17.0-10.19.2 nodejs8-devel-8.17.0-10.19.2 npm8-8.17.0-10.19.2 - SUSE Manager Proxy 4.1 (noarch): nodejs-common-2.0-3.4.1 nodejs8-docs-8.17.0-10.19.2 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): nodejs8-8.17.0-10.19.2 nodejs8-debuginfo-8.17.0-10.19.2 nodejs8-debugsource-8.17.0-10.19.2 nodejs8-devel-8.17.0-10.19.2 npm8-8.17.0-10.19.2 - SUSE Linux Enterprise Server for SAP 15-SP2 (noarch): nodejs-common-2.0-3.4.1 nodejs8-docs-8.17.0-10.19.2 - SUSE Linux Enterprise Server for SAP 15-SP1 (noarch): nodejs-common-2.0-3.4.1 - SUSE Linux Enterprise Server for SAP 15 (noarch): nodejs-common-2.0-3.4.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): nodejs8-8.17.0-10.19.2 nodejs8-debuginfo-8.17.0-10.19.2 nodejs8-debugsource-8.17.0-10.19.2 nodejs8-devel-8.17.0-10.19.2 npm8-8.17.0-10.19.2 - SUSE Linux Enterprise Server 15-SP2-LTSS (noarch): nodejs-common-2.0-3.4.1 nodejs8-docs-8.17.0-10.19.2 - SUSE Linux Enterprise Server 15-SP2-BCL (noarch): nodejs-common-2.0-3.4.1 nodejs8-docs-8.17.0-10.19.2 - SUSE Linux Enterprise Server 15-SP2-BCL (x86_64): nodejs8-8.17.0-10.19.2 nodejs8-debuginfo-8.17.0-10.19.2 nodejs8-debugsource-8.17.0-10.19.2 nodejs8-devel-8.17.0-10.19.2 npm8-8.17.0-10.19.2 - SUSE Linux Enterprise Server 15-SP1-LTSS (noarch): nodejs-common-2.0-3.4.1 - SUSE Linux Enterprise Server 15-SP1-BCL (noarch): nodejs-common-2.0-3.4.1 - SUSE Linux Enterprise Server 15-LTSS (noarch): nodejs-common-2.0-3.4.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64): nodejs8-8.17.0-10.19.2 nodejs8-debuginfo-8.17.0-10.19.2 nodejs8-debugsource-8.17.0-10.19.2 nodejs8-devel-8.17.0-10.19.2 npm8-8.17.0-10.19.2 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (noarch): nodejs-common-2.0-3.4.1 nodejs8-docs-8.17.0-10.19.2 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64): nodejs8-8.17.0-10.19.2 nodejs8-debuginfo-8.17.0-10.19.2 nodejs8-debugsource-8.17.0-10.19.2 nodejs8-devel-8.17.0-10.19.2 npm8-8.17.0-10.19.2 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (noarch): nodejs-common-2.0-3.4.1 nodejs8-docs-8.17.0-10.19.2 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (noarch): nodejs-common-2.0-3.4.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (noarch): nodejs-common-2.0-3.4.1 - SUSE Linux Enterprise High Performance Computing 15-LTSS (noarch): nodejs-common-2.0-3.4.1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS (noarch): nodejs-common-2.0-3.4.1 - SUSE Enterprise Storage 7 (aarch64 x86_64): nodejs8-8.17.0-10.19.2 nodejs8-debuginfo-8.17.0-10.19.2 nodejs8-debugsource-8.17.0-10.19.2 nodejs8-devel-8.17.0-10.19.2 npm8-8.17.0-10.19.2 - SUSE Enterprise Storage 7 (noarch): nodejs-common-2.0-3.4.1 nodejs8-docs-8.17.0-10.19.2 - SUSE Enterprise Storage 6 (noarch): nodejs-common-2.0-3.4.1 - SUSE CaaS Platform 4.0 (noarch): nodejs-common-2.0-3.4.1 References: https://www.suse.com/security/cve/CVE-2021-23343.html https://www.suse.com/security/cve/CVE-2021-32803.html https://www.suse.com/security/cve/CVE-2021-32804.html https://www.suse.com/security/cve/CVE-2021-3807.html https://www.suse.com/security/cve/CVE-2021-3918.html https://bugzilla.suse.com/1191962 https://bugzilla.suse.com/1191963 https://bugzilla.suse.com/1192153 https://bugzilla.suse.com/1192154 https://bugzilla.suse.com/1192696 . Important release for nodejs8 fixes several vulnerabilities; updates accessible for numerous SUSE versions.. SUSE Security Update,nodejs8 security,arbitrary file creation,resolution,system patch. . Severity: Critical. LinuxSecurity.com Team
Mar 03, 2022
•Critical
SuSE
172
security advisorymoderatesecurity issueUbuntu 16.04 ESM: USN-5122-2 Moderate: Apport File Issue
Apport could be made to create files as the administrator.. =========================================================================Ubuntu Security Notice USN-5122-2 October 26, 2021 apport vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 ESM - Ubuntu 14.04 ESM Summary: Apport could be made to create files as the administrator. Software Description: - apport: automatically generate crash reports for debugging Details: USN-5122-1 fixed a vulnerability in Apport. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Original advisory details: It was discovered that Apport could be tricked into writing core files as root into arbitrary directories in certain scenarios. A local attacker could possibly use this issue to escalate privileges. On Ubuntu 16.04 ESM This update will cause Apport to generate all core files in the /var/lib/apport/coredump directory. On Ubuntu 14.04 ESM, core file generation has been disabled by default. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 ESM: apport 2.20.1-0ubuntu2.30+esm3 python3-apport 2.20.1-0ubuntu2.30+esm3 Ubuntu 14.04 ESM: apport 2.14.1-0ubuntu3.29+esm9 python3-apport 2.14.1-0ubuntu3.29+esm9 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-5122-2 https://ubuntu.com/security/notices/USN-5122-1 https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1948657 . The Apport weakness identified in various Ubuntu versions enables unauthorized file generation with elevated privileges. It's crucial to mitigate this security flaw without delay.. Apport Vulnerability, Ubuntu Security, File Creation Escalation, Update Ubuntu, Linux Security Advisory. . Severity:Important. LinuxSecurity.com Team
Oct 26, 2021
•Important
Ubuntu
172
security advisorysoftware updateUbuntuUbuntu 20.04 LTS: 4764-1 Moderate: GLib Archive File Creation Risk
GLib could be made to create files if it opened a specially crafted archive.. =========================================================================Ubuntu Security Notice USN-4764-1 March 15, 2021 glib2.0 vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.10 - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: GLib could be made to create files if it opened a specially crafted archive. Software Description: - glib2.0: GLib library of C routines Details: It was discovered that GLib incorrectly handled certain symlinks when replacing files. If a user or automated system were tricked into extracting a specially crafted file with File Roller, a remote attacker could possibly create files outside of the intended directory. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 20.10: libglib2.0-0 2.66.1-2ubuntu0.2 Ubuntu 20.04 LTS: libglib2.0-0 2.64.6-1~ubuntu20.04.3 Ubuntu 18.04 LTS: libglib2.0-0 2.56.4-0ubuntu0.18.04.8 Ubuntu 16.04 LTS: libglib2.0-0 2.48.2-0ubuntu4.8 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-4764-1 CVE-2021-28153 Package Information: https://launchpad.net/ubuntu/+source/glib2.0/2.66.1-2ubuntu0.2 https://launchpad.net/ubuntu/+source/glib2.0/2.64.6-1~ubuntu20.04.3 https://launchpad.net/ubuntu/+source/glib2.0/2.56.4-0ubuntu0.18.04.8 https://launchpad.net/ubuntu/+source/glib2.0/2.48.2-0ubuntu4.8 . Serious vulnerability found in GLib impacts various Ubuntu versions, enabling the risk of unauthorized file creations via compressed archives.. GLib Exploit, Archive Vulnerability, Ubuntu Update, Software Threats. . Severity: Important. LinuxSecurity.com Team
Mar 15, 2021
•Important
Ubuntu
172
security advisorymoderatesambaUbuntu 12.04 ESM USN-3939-2 Moderate: Issue with Samba File Handling
Samba could be made to create files in unexpected locations.. =========================================================================Ubuntu Security Notice USN-3939-2 April 08, 2019 samba vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 12.04 ESM Summary: Samba could be made to create files in unexpected locations. Software Description: - samba: SMB/CIFS file, print, and login server for Unix Details: USN-3939-1 fixed a vulnerability in Samba. This update provides the corresponding update for Ubuntu 12.04 ESM. Original advisory details: Michael Hanselmann discovered that Samba incorrectly handled registry files. A remote attacker could possibly use this issue to create new registry files outside of the share, contrary to expectations. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 12.04 ESM: libsmbclient 2:3.6.25-0ubuntu0.12.04.17 samba 2:3.6.25-0ubuntu0.12.04.17 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-3939-2 https://ubuntu.com/security/notices/USN-3939-1 CVE-2019-3880 . A Samba security flaw enabling file generation in unintended directories has been identified. Ensure you update your Ubuntu system to safeguard against threats.. Samba Vulnerability, Ubuntu Security Update, File Creation Bug. . Severity: Medium. LinuxSecurity.com Team
Apr 08, 2019
•Medium
Ubuntu
172
security advisorysambaremote attackUbuntu 18.10: USN-3939-1 Moderate: Samba File Creation Issue
Samba could be made to create files in unexpected locations.. =========================================================================Ubuntu Security Notice USN-3939-1 April 08, 2019 samba vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.10 - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: Samba could be made to create files in unexpected locations. Software Description: - samba: SMB/CIFS file, print, and login server for Unix Details: Michael Hanselmann discovered that Samba incorrectly handled registry files. A remote attacker could possibly use this issue to create new registry files outside of the share, contrary to expectations. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 18.10: libsmbclient 2:4.8.4+dfsg-2ubuntu2.3 samba 2:4.8.4+dfsg-2ubuntu2.3 Ubuntu 18.04 LTS: libsmbclient 2:4.7.6+dfsg~ubuntu-0ubuntu2.9 samba 2:4.7.6+dfsg~ubuntu-0ubuntu2.9 Ubuntu 16.04 LTS: libsmbclient 2:4.3.11+dfsg-0ubuntu0.16.04.19 samba 2:4.3.11+dfsg-0ubuntu0.16.04.19 Ubuntu 14.04 LTS: libsmbclient 2:4.3.11+dfsg-0ubuntu0.14.04.20 samba 2:4.3.11+dfsg-0ubuntu0.14.04.20 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-3939-1 CVE-2019-3880 Package Information: https://launchpad.net/ubuntu/+source/samba/2:4.8.4+dfsg-2ubuntu2.3 https://launchpad.net/ubuntu/+source/samba/2:4.7.6+dfsg~ubuntu-0ubuntu2.9 https://launchpad.net/ubuntu/+source/samba/2:4.3.11+dfsg-0ubuntu0.16.04.19 https://launchpad.net/ubuntu/+source/samba/2:4.3.11+dfsg-0ubuntu0.14.04.20 . Serious Samba flaw inUbuntu 18.10 and LTS leads to file placement in incorrect directories. Apply the update immediately!. Samba Vulnerability, Ubuntu Security Notice, File Creation Issue. . LinuxSecurity.com Team
Apr 08, 2019
Ubuntu
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!