Multiple vulnerabilities have been found in Node.js, worst of which could allow remote attackers to write arbitrary files.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202003-48 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Node.js: Multiple vulnerabilities Date: March 20, 2020 Bugs: #658074, #665656, #672136, #679132, #702988, #708458 ID: 202003-48 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities have been found in Node.js, worst of which could allow remote attackers to write arbitrary files. Background ========= Node.js is a JavaScript runtime built on Chrome’s V8 JavaScript engine. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-libs/nodejs < 12.15.0 > = 10.19.0 > = 12.15.0 Description ========== Multiple vulnerabilities have been discovered in Node.js. Please review the CVE identifiers referenced below for details. Impact ===== A remote attacker could possibly write arbitrary files, cause a Denial of Service condition or can conduct HTTP request splitting attacks. Workaround ========= There is no known workaround at this time. Resolution ========= All Node.js
rsync could be made to write files outside of the expected directory.. =========================================================================Ubuntu Security Notice USN-2879-1 January 21, 2016 rsync vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 15.10 - Ubuntu 15.04 - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS Summary: rsync could be made to write files outside of the expected directory. Software Description: - rsync: fast, versatile, remote (and local) file-copying tool Details: It was discovered that rsync incorrectly handled invalid filenames. A malicious server could use this issue to write files outside of the intended destination directory. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 15.10: rsync 3.1.1-3ubuntu0.15.10.1 Ubuntu 15.04: rsync 3.1.1-3ubuntu0.15.04.1 Ubuntu 14.04 LTS: rsync 3.1.0-2ubuntu0.2 Ubuntu 12.04 LTS: rsync 3.0.9-1ubuntu1.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-2879-1 CVE-2014-9512 Package Information: https://launchpad.net/ubuntu/+source/rsync/3.1.1-3ubuntu0.15.10.1 https://launchpad.net/ubuntu/+source/rsync/3.1.1-3ubuntu0.15.04.1 https://launchpad.net/ubuntu/+source/rsync/3.1.0-2ubuntu0.2 https://launchpad.net/ubuntu/+source/rsync/3.0.9-1ubuntu1.1 . Ubuntu Security Notice USN-2879-1 details an rsync issue that permits file writing outside expected directories.. Rsync Vulnerability, File Access, Software Update. . LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.