Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 2 articles for you...
197
security advisoryupdatecriticalDebian 11: DLA-4158-1 critical: fossil web application cloning fix
Fossil is all-in-one DSCM (Distributed Software Configuration Management) with built-in bug tracking, wiki and web interface. Following the fix for CVE-2024-24795 for apache2, the fossil HTTP client could no longer clone remote Fossil repositories hosted on . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4158-1
May 09, 2025
•Critical
Debian LTS
197
security advisorymoderatesecurity updateDebian 10 Buster: DLA-3819-1 Moderate: Apache Security Fix for Fossil
Fossil was broken by fixes of CVE-2024-24795 for apache2 package, and needed an update. As part of the security fix, the Apache webserver . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3819-1
May 25, 2024
Debian LTS
202
security advisoryremote code executionsecurity fixopenSUSE 15-SP2: 2021:1070-1 Important: Remote Code Execution Fix
An update that solves one vulnerability and has one errata is now available. . openSUSE Security Update: Security update for fossil ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1070-1 Rating: important References: #1047218 #1175760 Cross-References: CVE-2020-24614 CVSS scores: CVE-2020-24614 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for fossil fixes the following issues: - fossil 2.12.1: * CVE-2020-24614: Remote authenticated users with check-in or administrative privileges could have executed arbitrary code [boo#1175760] * Security fix in the "fossil git export" command. New "safety-net" features were added to prevent similar problems in the future. * Enhancements to the graph display for cases when there are many cherry-pick merges into a single check-in. Example * Enhance the fossil open command with the new --workdir option and the ability to accept a URL as the repository name, causing the remote repository to be cloned automatically. Do not allow "fossil open" to open in a non-empty working directory unless the --keep option or the new --force option is used. * Enhance the markdown formatter to more closely follow the CommonMark specification with regard to text highlighting. Underscores in the middle of identifiers (ex: fossil_printf()) no longer need to be escaped. * The markdown-to-html translator can prevent unsafe HTML (for example: ) on user-contributed pages like forum and tickets and wiki. The admin can adjust this behavior using the safe-html setting on the Admin/Wiki page.The default is to disallow unsafe HTML everywhere. * Added the "collapse" and "expand" capability for long forum posts. * The "fossil remote" command now has options for specifying multiple persistent remotes with symbolic names. Currently only one remote can be used at a time, but that might change in the future. * Add the "Remember me?" checkbox on the login page. Use a session cookie for the login if it is not checked. * Added the experimental "fossil hook" command for managing "hook scripts" that run before checkin or after a push. * Enhance the fossil revert command so that it is able to revert all files beneath a directory. * Add the fossil bisect skip command. * Add the fossil backup command. * Enhance fossil bisect ui so that it shows all unchecked check-ins in between the innermost "good" and "bad" check-ins. * Added the --reset flag to the "fossil add", "fossil rm", and "fossil addremove" commands. * Added the "--min N" and "--logfile FILENAME" flags to the backoffice command, as well as other enhancements to make the backoffice command a viable replacement for automatic backoffice. Other incremental backoffice improvements. * Added the /fileedit page, which allows editing of text files online. Requires explicit activation by a setup user. * Translate built-in help text into HTML for display on web pages. * On the /timeline webpage, the combination of query parameters "p=CHECKIN" and "bt=ANCESTOR" draws all ancestors of CHECKIN going back to ANCESTOR. * Update the built-in SQLite so that the "fossil sql" command supports new output modes ".mode box" and ".mode json". * Add the "obscure()" SQL function to the "fossil sql" command. * Added virtual tables "helptext" and "builtin" to the "fossil sql" command, providing access to the dispatch table including all help text, and the builtin data files,respectively. * Delta compression is now applied to forum edits. * The wiki editor has been modernized and is now Ajax-based. - Package the fossil.1 manual page. - fossil 2.11.1: * Make the "fossil git export" command more restrictive about characters that it allows in the tag names - Add fossil-2.11-reproducible.patch to override build date (boo#1047218) This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1070=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): fossil-2.12.1-bp152.2.9.1 References: https://www.suse.com/security/cve/CVE-2020-24614.html https://bugzilla.suse.com/1047218 https://bugzilla.suse.com/1175760 . Important openSUSE patch for git addresses vulnerabilities linked to potential remote code execution and brings improvements.. openSUSE Security Update,Fossil Software Patch,Remote Code Fix,Software Security Update. . Severity: Important. LinuxSecurity.com Team
Jul 21, 2021
•Important
OpenSUSE
202
security advisorymoderatesecurity updateopenSUSE Security Alert: Important Git Patch for CVE-2021-1060-2
An update that contains security fixes can now be installed. . openSUSE Security Update: Security update for fossil ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1050-1 Rating: moderate References: #1187988 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for fossil fixes the following issues: fossil 2.16: * Add the fossil patch command * Improve the fossil ui command to work on check-out directories and remote machines * web UI improvements * Add fossil bisect run command for improved automation of bisects * Improve fossil merge handling of renames * wiki now defaults to markdown * email alerts can now be set to expire to prevent sending mail to abandoned accounts forever fossil 2.15.2: * Fix the client-side TLS so that it verifies that the server hostname matches its certificate (boo#1187988) fossil 2.15.1: * fix access to tables starting "fx_" in ticket report fossil 2.15: * Relax default Content Security policy to allow images to be loaded from any URL * Updates to skins and their configuration options * Built-in skin can now be selected via the skin= request parameter and the /skins page. * /cookies page can now now delete individual cookies * Various extensions to diff displaz and operations * Add the --list option to the tarball, zip, and sqlar commands. * New TH1 commands: "builtin_request_js", "capexpr", "foreach", "lappend", and "string match" * The leaves command now shows the branch point of each leaf. * The fossil add command refuses to add files whose names are reserved by Windows (ex: "aux") unless the --allow-reserved option is included. fossil 2.14 * add fossil chat * enhanced fossil clone * performance optimization * enhanced documents * Pikchr improvements * Schema Update Notice #1: This release drops a trigger from the database schema * Schema Update Notice #2: This release changes how the descriptions of wiki edits are stored in the EVENT table, for improved display on timelines fossil 2.13: * wiki improvements: interwiki links, markup features * support for rendering pikchr markup scriptions * line number modes support interactive selection of range of lines to hyperlink to * Enhance finfo page to track a file across renames - minimum/bundled version of sqlite increased to 3.34.0 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1050=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 ppc64le s390x x86_64): fossil-2.16-bp153.2.3.1 References: https://bugzilla.suse.com/1187988 . Explore the recent safety enhancements for Fossil within openSUSE. Upgrade today to bolster your system's defenses.. Fossil Security Fixes, openSUSE Updates, Security Patch Installation. . Severity: Important. LinuxSecurity.com Team
Jul 17, 2021
•Important
OpenSUSE
202
security advisorysoftware updatesecurity fixopenSUSE: 2021:1051-1 Moderate: Fossil Update Enhancements
An update that contains security fixes can now be installed. . openSUSE Security Update: Security update for fossil ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1051-1 Rating: moderate References: #1187988 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for fossil fixes the following issues: fossil 2.16: * Add the fossil patch command * Improve the fossil ui command to work on check-out directories and remote machines * web UI improvements * Add fossil bisect run command for improved automation of bisects * Improve fossil merge handling of renames * wiki now defaults to markdown * email alerts can now be set to expire to prevent sending mail to abandoned accounts forever fossil 2.15.2: * Fix the client-side TLS so that it verifies that the server hostname matches its certificate (boo#1187988) fossil 2.15.1: * fix access to tables starting "fx_" in ticket report fossil 2.15: * Relax default Content Security policy to allow images to be loaded from any URL * Updates to skins and their configuration options * Built-in skin can now be selected via the skin= request parameter and the /skins page. * /cookies page can now now delete individual cookies * Various extensions to diff displaz and operations * Add the --list option to the tarball, zip, and sqlar commands. * New TH1 commands: "builtin_request_js", "capexpr", "foreach", "lappend", and "string match" * The leaves command now shows the branch point of each leaf. * The fossil add command refuses to add files whose names are reserved by Windows (ex: "aux") unless the --allow-reserved option is included. fossil 2.14 * add fossil chat * enhanced fossil clone * performance optimization * enhanced documents * Pikchr improvements * Schema Update Notice #1: This release drops a trigger from the database schema * Schema Update Notice #2: This release changes how the descriptions of wiki edits are stored in the EVENT table, for improved display on timelines fossil 2.13: * wiki improvements: interwiki links, markup features * support for rendering pikchr markup scriptions * line number modes support interactive selection of range of lines to hyperlink to * Enhance finfo page to track a file across renames - minimum/bundled version of sqlite increased to 3.34.0 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1051=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): fossil-2.16-bp152.2.6.1 References: https://bugzilla.suse.com/1187988 . Kubuntu releases a new version featuring significant upgrades and essential patches to enhance overall security and optimize functionality.. openSUSE Security Update,fossil security fix,software updates. . LinuxSecurity.com Team
Jul 17, 2021
OpenSUSE
202
security advisorysecurity fixmoderate issueopenSUSE: 2021:1052-1 Moderate: Fossil Security Update Instructions
An update that contains security fixes can now be installed. . openSUSE Security Update: Security update for fossil ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1052-1 Rating: moderate References: #1187988 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for fossil fixes the following issues: fossil 2.16: * Add the fossil patch command * Improve the fossil ui command to work on check-out directories and remote machines * web UI improvements * Add fossil bisect run command for improved automation of bisects * Improve fossil merge handling of renames * wiki now defaults to markdown * email alerts can now be set to expire to prevent sending mail to abandoned accounts forever fossil 2.15.2: * Fix the client-side TLS so that it verifies that the server hostname matches its certificate (boo#1187988) fossil 2.15.1: * fix access to tables starting "fx_" in ticket report fossil 2.15: * Relax default Content Security policy to allow images to be loaded from any URL * Updates to skins and their configuration options * Built-in skin can now be selected via the skin= request parameter and the /skins page. * /cookies page can now now delete individual cookies * Various extensions to diff displaz and operations * Add the --list option to the tarball, zip, and sqlar commands. * New TH1 commands: "builtin_request_js", "capexpr", "foreach", "lappend", and "string match" * The leaves command now shows the branch point of each leaf. * The fossil add command refuses to add files whose names are reserved by Windows (ex: "aux") unless the --allow-reserved option is included. fossil 2.14 * add fossil chat * enhanced fossil clone * performance optimization * enhanced documents * Pikchr improvements * Schema Update Notice #1: This release drops a trigger from the database schema * Schema Update Notice #2: This release changes how the descriptions of wiki edits are stored in the EVENT table, for improved display on timelines fossil 2.13: * wiki improvements: interwiki links, markup features * support for rendering pikchr markup scriptions * line number modes support interactive selection of range of lines to hyperlink to * Enhance finfo page to track a file across renames - minimum/bundled version of sqlite increased to 3.34.0 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-1052=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): fossil-2.16-bp151.4.9.1 References: https://bugzilla.suse.com/1187988 . Patch release for fossil on openSUSE addressing moderate vulnerabilities and enhancing user experience following the guideline.. openSUSE Security Update,fossil software fixes,backports install. . LinuxSecurity.com Team
Jul 17, 2021
OpenSUSE
89
security advisorysoftware updateFedoraFedora 34: FEDORA-2021-bd2de1337e Critical: Fossil Remote Exploit Risk
Upgrade to fossil 2.12.1. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-ac6cf99f87 2020-12-05 01:38:23.726791 --------------------------------------------------------------------------------Name : fossil Product : Fedora 33 Version : 2.12.1 Release : 1.fc33 URL : https://www.fossil-scm.org/home/doc/trunk/www/index.wiki Summary : A distributed SCM with bug tracking and wiki Description : Fossil is a simple, high-reliability, distributed software configuration management with distributed bug tracking, distributed wiki and built-in web interface. --------------------------------------------------------------------------------Update Information: Upgrade to fossil 2.12.1 --------------------------------------------------------------------------------ChangeLog: * Mon Oct 19 2020 Sheng Mao - 2.12.1-1 - Upgrade to fossil 2.12.1 after adding FTS4 to system-wide sqlite (rhbz#1887106) rhbz#1863577, rhbz#1870790 * Sat Aug 1 2020 Fedora Release Engineering - 2.8-5 - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild * Mon Jul 27 2020 Fedora Release Engineering - 2.8-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild --------------------------------------------------------------------------------References: [ 1 ] Bug #1863577 - fossil: FTBFS in Fedora rawhide/f33 https://bugzilla.redhat.com/show_bug.cgi?id=1863577 [ 2 ] Bug #1870790 - CVE-2020-24614 fossil: allows remote authenticated users to execute arbitrary code [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1870790 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-ac6cf99f87' at the command line. For more information, refer to the dnf documentation availableat https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Dec 04, 2020
•Critical
Fedora
89
security advisoryhigh severityfedoraFedora: FEDORA-2021-78d9f59f64 High: Python Remote Code Execution
Upgrade to fossil 2.12.1. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-50be892d25 2020-12-05 01:15:15.347444 --------------------------------------------------------------------------------Name : fossil Product : Fedora 32 Version : 2.12.1 Release : 1.fc32 URL : https://www.fossil-scm.org/home/doc/trunk/www/index.wiki Summary : A distributed SCM with bug tracking and wiki Description : Fossil is a simple, high-reliability, distributed software configuration management with distributed bug tracking, distributed wiki and built-in web interface. --------------------------------------------------------------------------------Update Information: Upgrade to fossil 2.12.1 --------------------------------------------------------------------------------ChangeLog: * Mon Oct 19 2020 Sheng Mao - 2.12.1-1 - Upgrade to fossil 2.12.1 after adding FTS4 to system-wide sqlite (rhbz#1887106) rhbz#1863577, rhbz#1870790 * Sat Aug 1 2020 Fedora Release Engineering - 2.8-5 - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild * Mon Jul 27 2020 Fedora Release Engineering - 2.8-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild --------------------------------------------------------------------------------References: [ 1 ] Bug #1863577 - fossil: FTBFS in Fedora rawhide/f33 https://bugzilla.redhat.com/show_bug.cgi?id=1863577 [ 2 ] Bug #1870790 - CVE-2020-24614 fossil: allows remote authenticated users to execute arbitrary code [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1870790 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-50be892d25' at the command line. For more information, refer to the dnf documentation availableat https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Dec 04, 2020
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!