Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found 0 articles for you...
198
security advisoryhigh severitysoftware updateArch Linux ASA-202103-14 High Severity: Groovy Privilege Escalation
The package groovy before version 2.5.14-1 is vulnerable to privilege escalation. . Arch Linux Security Advisory ASA-202103-14 ========================================= Severity: High Date : 2021-03-25 CVE-ID : CVE-2020-17521 Package : groovy Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1325 Summary ====== The package groovy before version 2.5.14-1 is vulnerable to privilege escalation. Resolution ========= Upgrade to 2.5.14-1. # pacman -Syu "groovy> =2.5.14-1" The problem has been fixed upstream in version 2.5.14. Workaround ========= None. Description ========== Groovy before version 2.5.14 may create temporary directories within the OS temporary directory which is shared between all users on affected systems. Groovy will create such directories for internal use when producing Java Stubs or on behalf of user code via two extension methods for creating temporary directories. If Groovy user code uses either of these extension methods, and stores executable code in the resulting temporary directory, this can lead to local privilege escalation. If such Groovy code is making use of the temporary directory to store sensitive information, such information could be exposed or modified. Impact ===== A local attacker is able to obtain and modify sensitive information in Groovy temporary directories leading to privilege escalation if executable code is stored. References ========= https://bugs.archlinux.org/task/68865 https://issues.apache.org/jira/browse/GROOVY-9824 https://github.com/apache/groovy/commit/98dc5d713926cd81b006c510a1546ccd520fe17f https://security.archlinux.org/CVE-2020-17521 . Debian Security Notice DSA-2023-1234 addresses a critical denial of service vulnerability in nginx versions earlier than 1.19.10.. Groovy Privilege Escalation, Arch Linux Security, Software Vulnerability. . Severity: Important. LinuxSecurity.com Team
Mar 26, 2021
•Important
ArchLinux
100
security advisorymoderateinformation disclosureSUSE: 2020:3917-1 Moderate Vulnerability: Groovy Information Disclosure
An update that fixes one vulnerability is now available. . SUSE Security Update: Security update for groovy ______________________________________________________________________________ Announcement ID: SUSE-SU-2020:3917-1 Rating: moderate References: #1179729 Cross-References: CVE-2020-17521 Affected Products: SUSE Linux Enterprise Module for Development Tools 15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for groovy fixes the following issues: - groovy was updated to 2.4.21 - CVE-2020-17521: Fixed an information disclosure vulnerability (bsc#1179729). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Development Tools 15-SP2: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP2-2020-3917=1 Package List: - SUSE Linux Enterprise Module for Development Tools 15-SP2 (noarch): groovy-lib-2.4.21-3.3.2 References: https://www.suse.com/security/cve/CVE-2020-17521.html https://bugzilla.suse.com/1179729 . SUSE Security Patch addresses a potential information leak in groovy. Notification ID: SUSE-SU-2020:3918-1, moderate risk level.. SUSE Security Update,groovy patch,information disclosure,software update. . LinuxSecurity.com Team
Dec 22, 2020
SuSE
91
security advisorygentooarbitrary code executionGentoo: GLSA-202003-01 Normal: Groovy Code Execution Risk
A vulnerability within serialization might allow remote attackers to execute arbitrary code.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202003-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Groovy: Arbitrary code execution Date: March 07, 2020 Bugs: #605690 ID: 202003-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= A vulnerability within serialization might allow remote attackers to execute arbitrary code. Background ========= A multi-faceted language for the Java platform Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-java/groovy
Mar 12, 2020
Gentoo
200
security advisoryremote code executionapplication securityScientific Linux 7: SLSA-2017-2486-1 Important Groovy RCE Advisory
It was found that a flaw in Apache groovy library allows remote code execution wherever deserialization occurs in the application. It is possible for an attacker to craft a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability. (CVE-2016-6 [More...]. Synopsis: Important: groovy security update Advisory ID: SLSA-2017:2486-1 Issue Date: 2017-08-17 CVE Numbers: CVE-2016-6814 -- Security Fix(es): * It was found that a flaw in Apache groovy library allows remote code execution wherever deserialization occurs in the application. It is possible for an attacker to craft a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability. (CVE-2016-6814) -- SL7 noarch groovy-1.8.9-8.el7_4.noarch.rpm groovy-javadoc-1.8.9-8.el7_4.noarch.rpm - Scientific Linux Development Team . Tackling a significant vulnerability in the Apache Groovy framework reveals remote code execution threats impacting various software solutions.. Apache Groovy Security, Adversarial Serialization, Scientific Linux Update. . Severity: Important. LinuxSecurity.com Team
Aug 21, 2017
•Important
Scientific Linux
89
security advisoryfedoracriticalFedora 25: 2017-33c8085c5d Critical: Groovy18 Information Disclosure
Fixes information disclosure vulnerability (CVE-2016-6814). --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2017-33c8085c5d 2017-08-17 23:34:46.456642 --------------------------------------------------------------------------------Name : groovy18 Product : Fedora 25 Version : 1.8.9 Release : 28.fc25 URL : http://groovy-lang.org Summary : Dynamic language for the Java Platform Description : Groovy is an agile and dynamic language for the Java Virtual Machine, built upon Java with features inspired by languages like Python, Ruby and Smalltalk. It seamlessly integrates with all existing Java objects and libraries and compiles straight to Java byte-code so you can use it anywhere you can use Java. --------------------------------------------------------------------------------Update Information: Fixes information disclosure vulnerability (CVE-2016-6814) --------------------------------------------------------------------------------References: [ 1 ] Bug #1413466 - CVE-2016-6814 Apache Groovy: Remote code execution via deserialization https://bugzilla.redhat.com/show_bug.cgi?id=1413466 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade groovy18' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Aug 18, 2017
•Critical
Fedora
89
security advisorycriticalFedoraFedora 24: Security Advisory for Groovy Remote Code Execution
Security fix for CVE-2016-6814. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2017-1ce2a05ff1 2017-01-24 19:30:33.806708 -------------------------------------------------------------------------------- Name : groovy Product : Fedora 24 Version : 2.4.5 Release : 8.fc24 URL : http://groovy-lang.org Summary : Dynamic language for the Java Platform Description : Groovy is an agile and dynamic language for the Java Virtual Machine, built upon Java with features inspired by languages like Python, Ruby and Smalltalk. It seamlessly integrates with all existing Java objects and libraries and compiles straight to Java bytecode so you can use it anywhere you can use Java. -------------------------------------------------------------------------------- Update Information: Security fix for CVE-2016-6814 -------------------------------------------------------------------------------- References: [ 1 ] Bug #1413466 - CVE-2016-6814 Apache Groovy: Remote code execution via deserialization https://bugzilla.redhat.com/show_bug.cgi?id=1413466 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade groovy' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Jan 25, 2017
•Critical
Fedora
89
security advisorycriticalsoftware updateUbuntu 18.04: 2022-a1b2c3d4e5 Medium: Funky Data Exposure
Security fix for CVE-2016-6814. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2017-cc0e0daf0f 2017-01-21 16:03:46.478947 -------------------------------------------------------------------------------- Name : groovy Product : Fedora 25 Version : 2.4.5 Release : 10.fc25 URL : http://groovy-lang.org Summary : Dynamic language for the Java Platform Description : Groovy is an agile and dynamic language for the Java Virtual Machine, built upon Java with features inspired by languages like Python, Ruby and Smalltalk. It seamlessly integrates with all existing Java objects and libraries and compiles straight to Java bytecode so you can use it anywhere you can use Java. -------------------------------------------------------------------------------- Update Information: Security fix for CVE-2016-6814 -------------------------------------------------------------------------------- References: [ 1 ] Bug #1413466 - CVE-2016-6814 Apache Groovy: Information disclosure https://bugzilla.redhat.com/show_bug.cgi?id=1413466 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade groovy' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Jan 21, 2017
•Medium
Fedora
89
security advisoryfedoracriticalFedora Update: 2015-15907 Critical Fix for Groovy CVE-2015-3253
Fixes CVE-2015-3253. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2015-15907 2015-09-24 05:07:02.458138 -------------------------------------------------------------------------------- Name : groovy Product : Fedora 22 Version : 2.4.0 Release : 2.fc22 URL : Summary : Dynamic language for the Java Platform Description : Groovy is an agile and dynamic language for the Java Virtual Machine, built upon Java with features inspired by languages like Python, Ruby and Smalltalk. It seamlessly integrates with all existing Java objects and libraries and compiles straight to Java bytecode so you can use it anywhere you can use Java. -------------------------------------------------------------------------------- Update Information: Fixes CVE-2015-3253 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update groovy' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Sep 24, 2015
•Critical
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!