Alerts This Week
Warning Icon 1 525
Alerts This Week
Warning Icon 1 525

Stay Secure with the Latest Linux Advisories

Filter Icon Refine advisories
X Clear Filters
X Clear Filters
View More

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

What got you started with Linux?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/150-what-got-you-started-with-linux?task=poll.vote&format=json
150
radio
0
[{"id":483,"title":"Self-taught through trial and error","votes":545,"type":"x","order":1,"pct":78.42,"resources":[]},{"id":484,"title":"Formal training or courses","votes":30,"type":"x","order":2,"pct":4.32,"resources":[]},{"id":485,"title":"A job that required it","votes":34,"type":"x","order":3,"pct":4.89,"resources":[]},{"id":486,"title":"Other","votes":86,"type":"x","order":4,"pct":12.37,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Loading...

Explore Latest Linux Security advisories

We found 5 articles for you...
172

Ubuntu 25.04: sha.js Critical D0S Denial of Service USN-7778-1

sha.js could be made to consume resources or return incorrect hash values if it received specially crafted input.. ========================================================================== Ubuntu Security Notice USN-7778-1 September 25, 2025 node-sha.js vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 25.04 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: sha.js could be made to consume resources or return incorrect hash values if it received specially crafted input. Software Description: - node-sha.js: Streamable SHA hashes in pure javascript Details: Nikita Skovoroda discovered that sha.js did not properly handle certain inputs. An attacker could possibly use this issue to manipulate the internal state of hash functions, resulting in hash collisions, denial of service, or other unspecified impact. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 25.04 node-sha.js 2.4.11+~2.4.0-2+deb13u1build0.25.04.1 Ubuntu 24.04 LTS node-sha.js 2.4.11+~2.4.0-2+deb13u1build0.24.04.1 Ubuntu 22.04 LTS node-sha.js 2.4.11+~2.4.0-1ubuntu0.1 Ubuntu 20.04 LTS node-sha.js 2.4.11-2ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 18.04 LTS node-sha.js 2.4.9-1ubuntu0.1~esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7778-1 CVE-2025-9288 Package Information: https://launchpad.net/ubuntu/+source/node-sha.js/2.4.11+~2.4.0-2+deb13u1build0.25.04.1 https://launchpad.net/ubuntu/+source/node-sha.js/2.4.11+~2.4.0-2+deb13u1build0.24.04.1 https://launchpad.net/ubuntu/+source/node-sha.js/2.4.11+~2.4.0-1ubuntu0.1 .Upgrade Ubuntu installations to address the significant sha.js vulnerability which leads to excessive resource usage or invalid hash results.. ubuntu sha.js denial of service hash collision security fix. . Severity: Critical. LinuxSecurity.com Team

Calendar 2 Sep 25, 2025 Critical Ubuntu
203

Mageia: 2020-0343 Moderate: python-ipaddress Dos Threat

Hash collisions in IPv4Interface and IPv6Interface could lead to DOS (CVE-2020-14422). References: - https://bugs.mageia.org/show_bug.cgi?id=27056 . MGASA-2020-0343 - Updated python-ipaddress package fixes security vulnerability Publication date: 25 Aug 2020 URL: https://advisories.mageia.org/MGASA-2020-0343.html Type: security Affected Mageia releases: 7 CVE: CVE-2020-14422 Hash collisions in IPv4Interface and IPv6Interface could lead to DOS (CVE-2020-14422). References: - https://bugs.mageia.org/show_bug.cgi?id=27056 - - https://www.cve.org/CVERecord?id=CVE-2020-14422 SRPMS: - 7/core/python-ipaddress-1.0.22-1.1.mga7 . The python-ipaddress library has released an update that resolves a significant hash collision vulnerability, which posed a risk for denial-of-service attacks. For more information, read on.. python ipaddress, security update, hash collision, DOS attack. . LinuxSecurity.com Team

Calendar 2 Aug 25, 2020 Mageia
89

Fedora 31: 2020-d808fdd597 Critical: Python3 DoS and Pathfix Issue

Security fix for CVE-2019-20907, CVE-2020-14422. Provide a versioned pathfix3.7.py command.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-d808fdd597 2020-08-14 02:43:09.714652 --------------------------------------------------------------------------------Name : python3 Product : Fedora 31 Version : 3.7.8 Release : 2.fc31 URL : https://www.python.org/ Summary : Interpreter of the Python programming language Description : Python is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3 package provides the "python3" executable: the reference interpreter for the Python language, version 3. The majority of its standard library is provided in the python3-libs package, which should be installed automatically along with python3. The remaining parts of the Python standard library are broken out into the python3-tkinter and python3-test packages, which may need to be installed separately. Documentation for Python is provided in the python3-docs package. Packages containing additional libraries for Python are generally named with the "python3-" prefix. --------------------------------------------------------------------------------Update Information: Security fix for CVE-2019-20907, CVE-2020-14422. Provide a versioned pathfix3.7.py command. --------------------------------------------------------------------------------ChangeLog: * Tue Jul 28 2020 Charalampos Stratakis - 3.7.8-2 - Avoid infinite loop when reading specially crafted TAR files (CVE-2019-20907) Resolves: rhbz#1856481 - Resolve hash collisions for Pv4Interface and IPv6Interface (CVE-2020-14422) Resolves: rhbz#1854926 - Ship versioned pathfixX.Y.py in main and non-main Pythonversions --------------------------------------------------------------------------------References: [ 1 ] Bug #1854926 - CVE-2020-14422 python: DoS via inefficiency in IPv{4,6}Interface classes https://bugzilla.redhat.com/show_bug.cgi?id=1854926 [ 2 ] Bug #1856481 - CVE-2019-20907 python: infinite loop in the tarfile module via crafted TAR archive https://bugzilla.redhat.com/show_bug.cgi?id=1856481 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-d808fdd597' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ . Essential security patches for Fedora python3 correcting distinct vulnerabilities using the pathfix utility.. Fedora Python Update, CVE Fixes, Python Security, Software Update. . Severity: Critical. LinuxSecurity.com Team

Calendar 2 Aug 13, 2020 Critical Fedora
98

Red Hat: RHSA-2018:0522 Low: .NET Core Denial of Service Risk

Updates for rh-dotnet20-dotnet, rh-dotnetcore10-dotnetcore, and rh-dotnetcore11-dotnetcore are now available for .NET Core on Red Hat Enterprise Linux. Red Hat Product Security has rated this update as having a security impact. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Low: .NET Core on Red Hat Enterprise Linux security update Advisory ID: RHSA-2018:0522-01 Product: .NET Core on Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2018:0522 Issue date: 2018-03-14 CVE Names: CVE-2018-0875 ==================================================================== 1. Summary: Updates for rh-dotnet20-dotnet, rh-dotnetcore10-dotnetcore, and rh-dotnetcore11-dotnetcore are now available for .NET Core on Red Hat Enterprise Linux. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: .NET Core on Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64 .NET Core on Red Hat Enterprise Linux Server (v. 7) - x86_64 .NET Core on Red Hat Enterprise Linux Workstation (v. 7) - x86_64 3. Description: .NET Core is a managed software framework. It implements a subset of the .NET framework APIs and includes a CLR implementation. New versions of .NET Core that address several security vulnerabilities are now available. The updated versions are .NET Core 1.0.10, 1.1.7, and 2.0.6. These correspond to the March 2018 security release by .NET Core upstream projects. Security Fix(es): * .NET Core: Hash Collision Denial of Service (CVE-2018-0875) Red Hat would like to thank Ben Adams (Illyriad Games) for reporting this issue. For more details about the security issue(s), including the impact, aCVSS score, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1552060 - CVE-2018-0875 .NET Core: Hash Collision Denial of Service 6. Package List: .NET Core on Red Hat Enterprise Linux ComputeNode (v. 7): Source: rh-dotnetcore10-dotnetcore-1.0.10-1.el7.src.rpm x86_64: rh-dotnetcore10-dotnetcore-1.0.10-1.el7.x86_64.rpm rh-dotnetcore10-dotnetcore-debuginfo-1.0.10-1.el7.x86_64.rpm .NET Core on Red Hat Enterprise Linux ComputeNode (v. 7): Source: rh-dotnetcore11-dotnetcore-1.1.7-1.el7.src.rpm x86_64: rh-dotnetcore11-dotnetcore-1.1.7-1.el7.x86_64.rpm rh-dotnetcore11-dotnetcore-debuginfo-1.1.7-1.el7.x86_64.rpm .NET Core on Red Hat Enterprise Linux ComputeNode (v. 7): Source: rh-dotnet20-dotnet-2.0.6-1.el7.src.rpm x86_64: rh-dotnet20-dotnet-2.0.6-1.el7.x86_64.rpm rh-dotnet20-dotnet-debuginfo-2.0.6-1.el7.x86_64.rpm rh-dotnet20-dotnet-host-2.0.6-1.el7.x86_64.rpm rh-dotnet20-dotnet-runtime-2.0-2.0.6-1.el7.x86_64.rpm rh-dotnet20-dotnet-sdk-2.1-2.1.101-1.el7.x86_64.rpm .NET Core on Red Hat Enterprise Linux Server (v. 7): Source: rh-dotnetcore10-dotnetcore-1.0.10-1.el7.src.rpm x86_64: rh-dotnetcore10-dotnetcore-1.0.10-1.el7.x86_64.rpm rh-dotnetcore10-dotnetcore-debuginfo-1.0.10-1.el7.x86_64.rpm .NET Core on Red Hat Enterprise Linux Server (v. 7): Source: rh-dotnetcore11-dotnetcore-1.1.7-1.el7.src.rpm x86_64: rh-dotnetcore11-dotnetcore-1.1.7-1.el7.x86_64.rpm rh-dotnetcore11-dotnetcore-debuginfo-1.1.7-1.el7.x86_64.rpm .NET Core on Red Hat Enterprise Linux Server (v.7): Source: rh-dotnet20-dotnet-2.0.6-1.el7.src.rpm x86_64: rh-dotnet20-dotnet-2.0.6-1.el7.x86_64.rpm rh-dotnet20-dotnet-debuginfo-2.0.6-1.el7.x86_64.rpm rh-dotnet20-dotnet-host-2.0.6-1.el7.x86_64.rpm rh-dotnet20-dotnet-runtime-2.0-2.0.6-1.el7.x86_64.rpm rh-dotnet20-dotnet-sdk-2.1-2.1.101-1.el7.x86_64.rpm .NET Core on Red Hat Enterprise Linux Workstation (v. 7): Source: rh-dotnetcore10-dotnetcore-1.0.10-1.el7.src.rpm x86_64: rh-dotnetcore10-dotnetcore-1.0.10-1.el7.x86_64.rpm rh-dotnetcore10-dotnetcore-debuginfo-1.0.10-1.el7.x86_64.rpm .NET Core on Red Hat Enterprise Linux Workstation (v. 7): Source: rh-dotnetcore11-dotnetcore-1.1.7-1.el7.src.rpm x86_64: rh-dotnetcore11-dotnetcore-1.1.7-1.el7.x86_64.rpm rh-dotnetcore11-dotnetcore-debuginfo-1.1.7-1.el7.x86_64.rpm .NET Core on Red Hat Enterprise Linux Workstation (v. 7): Source: rh-dotnet20-dotnet-2.0.6-1.el7.src.rpm x86_64: rh-dotnet20-dotnet-2.0.6-1.el7.x86_64.rpm rh-dotnet20-dotnet-debuginfo-2.0.6-1.el7.x86_64.rpm rh-dotnet20-dotnet-host-2.0.6-1.el7.x86_64.rpm rh-dotnet20-dotnet-runtime-2.0-2.0.6-1.el7.x86_64.rpm rh-dotnet20-dotnet-sdk-2.1-2.1.101-1.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2018-0875 https://access.redhat.com/security/updates/classification#low 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2018 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFaqUTsXlSAg2UNWIIRAuzUAKCDhqW/mE1ZwG1Bv9JVc2oVTo7cngCfUnVc slFh/sAwzwax82xICfw1G1M=37s1 -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . A new patch for .NET Core has been released for Red Hat Enterprise Linux, which mitigates a minor security concern that all users are encouraged to implement.. Red Hat, .NET Core, security update, patch management, hashcollision. . Severity: Low. LinuxSecurity.com Team

Calendar 2 Mar 14, 2018 Low Red Hat
98

Red Hat: RHSA-2017-2908-01 Moderate: rh-nodejs6-nodejs Denial of Service

An update for rh-nodejs6-nodejs is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: rh-nodejs6-nodejs security update Advisory ID: RHSA-2017:2908-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2017:2908 Issue date: 2017-10-18 CVE Names: CVE-2017-11499 ==================================================================== 1. Summary: An update for rh-nodejs6-nodejs is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64 3. Description: Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: rh-nodejs6-nodejs (6.11.3). (BZ#1476317) Security Fix(es): * It was found that Node.js was using a non-randomizedseed when populating hash tables. An attacker, able to supply a large number of inputs, could send specially crafted entries to the Node.js application, maximizing hash collisions to trigger an excessive amount of CPU usage, resulting in a denial of service. (CVE-2017-11499) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1475327 - CVE-2017-11499 nodejs: Constant Hashtable Seeds vulnerability 6. Package List: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6): Source: rh-nodejs6-nodejs-6.11.3-2.el6.src.rpm noarch: rh-nodejs6-nodejs-docs-6.11.3-2.el6.noarch.rpm x86_64: rh-nodejs6-nodejs-6.11.3-2.el6.x86_64.rpm rh-nodejs6-nodejs-debuginfo-6.11.3-2.el6.x86_64.rpm rh-nodejs6-nodejs-devel-6.11.3-2.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7): Source: rh-nodejs6-nodejs-6.11.3-2.el6.src.rpm noarch: rh-nodejs6-nodejs-docs-6.11.3-2.el6.noarch.rpm x86_64: rh-nodejs6-nodejs-6.11.3-2.el6.x86_64.rpm rh-nodejs6-nodejs-debuginfo-6.11.3-2.el6.x86_64.rpm rh-nodejs6-nodejs-devel-6.11.3-2.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6): Source: rh-nodejs6-nodejs-6.11.3-2.el6.src.rpm noarch: rh-nodejs6-nodejs-docs-6.11.3-2.el6.noarch.rpm x86_64: rh-nodejs6-nodejs-6.11.3-2.el6.x86_64.rpm rh-nodejs6-nodejs-debuginfo-6.11.3-2.el6.x86_64.rpm rh-nodejs6-nodejs-devel-6.11.3-2.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7): Source: rh-nodejs6-nodejs-6.11.3-2.el7.src.rpm noarch: rh-nodejs6-nodejs-docs-6.11.3-2.el7.noarch.rpm x86_64: rh-nodejs6-nodejs-6.11.3-2.el7.x86_64.rpm rh-nodejs6-nodejs-debuginfo-6.11.3-2.el7.x86_64.rpm rh-nodejs6-nodejs-devel-6.11.3-2.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v.7.3): Source: rh-nodejs6-nodejs-6.11.3-2.el7.src.rpm noarch: rh-nodejs6-nodejs-docs-6.11.3-2.el7.noarch.rpm x86_64: rh-nodejs6-nodejs-6.11.3-2.el7.x86_64.rpm rh-nodejs6-nodejs-debuginfo-6.11.3-2.el7.x86_64.rpm rh-nodejs6-nodejs-devel-6.11.3-2.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7): Source: rh-nodejs6-nodejs-6.11.3-2.el7.src.rpm noarch: rh-nodejs6-nodejs-docs-6.11.3-2.el7.noarch.rpm x86_64: rh-nodejs6-nodejs-6.11.3-2.el7.x86_64.rpm rh-nodejs6-nodejs-debuginfo-6.11.3-2.el7.x86_64.rpm rh-nodejs6-nodejs-devel-6.11.3-2.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2017-11499 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2017 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFZ5wgTXlSAg2UNWIIRAjr0AKCktmtDIRE7ArlXEpBANfCnZBp0nQCggwVi mNsMtsRQP3PlvvgN4fizpvU=oUtq -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . Routine security enhancement for rh-nodejs6-nodejs dealing with hash collisions to prevent DoS scenarios. For detailed information and further updates, please look within.. Red Hat Software Collections, Node.js Update, Software Fix. . LinuxSecurity.com Team

Calendar 2 Oct 18, 2017 Red Hat
91

Gentoo: GLSA-201405-16 Advisory on Mono Denial of Service Issue

A hash collision vulnerability in Mono allows remote attackers to cause a Denial of Service condition.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201405-16 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Mono: Denial of Service Date: May 18, 2014 Bugs: #433768 ID: 201405-16 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= A hash collision vulnerability in Mono allows remote attackers to cause a Denial of Service condition. Background ========= Mono is an open source implementation of Microsoft's .NET Framework. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-lang/mono < 2.10.9-r2 > = 2.10.9-r2 Description ========== Mono does not properly randomize hash functions for form posts to protect against hash collision attacks. Impact ===== A remote attacker could send specially crafted parameters, possibly resulting in a Denial of Service condition. Workaround ========= There is no known workaround at this time. Resolution ========= All Mono users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =dev-lang/mono-2.10.9-r2" References ========= [ 1 ] CVE-2012-3543 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3543 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201405-16 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security ofour users' machines is of utmost importance to us. Any security concerns should be addressed to This email address is being protected from spambots. You need JavaScript enabled to view it. or alternatively, you may file a bug at https://bugs.gentoo.org. License ====== Copyright 2014 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5/ . The Gentoo advisory GLSA-201405-17 discusses a vulnerability in OpenSSL which could allow for a remote attacker to compromise system integrity.. Gentoo Security, Hash Collision, Mono Denial of Service. . LinuxSecurity.com Team

Calendar 2 May 18, 2014 Gentoo
87

Debian: DSA-2525-1 Moderate: Expat Denial Of Service And Memory Leak

It was discovered that Expat, a C library to parse XML, is vulnerable to denial of service through hash collisions and a memory leak in pool handling. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2525-1 This email address is being protected from spambots. You need JavaScript enabled to view it. http://www.debian.org/security/ Moritz Muehlenhoff August 06, 2012 http://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : expat Vulnerability : several Problem type : local Debian-specific: no CVE ID : CVE-2012-0876 CVE-2012-1148 It was discovered that Expat, a C library to parse XML, is vulnerable to denial of service through hash collisions and a memory leak in pool handling. For the stable distribution (squeeze), this problem has been fixed in version 2.0.1-7+squeeze1. For the testing distribution (wheezy), this problem has been fixed in version 2.1.0~beta3-1. For the unstable distribution (sid), this problem has been fixed in version 2.1.0~beta3-1. We recommend that you upgrade your expat packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . The expatriate documentation repository is susceptible to service disruptions due to hashing conflicts and inefficient memory management. Immediate updates are advised.. Expat Security, Denial Of Service, Debian Security, XML Parsing, Hash Collision. . LinuxSecurity.com Team

Calendar 2 Aug 06, 2012 Debian
91

Gentoo: GLSA-201207-06 Normal: JRuby Denial of Service Condition

A hash collision vulnerability in JRuby allows remote attackers to cause a Denial of Service condition.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201207-06 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: JRuby: Denial of Service Date: July 09, 2012 Bugs: #396305 ID: 201207-06 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= A hash collision vulnerability in JRuby allows remote attackers to cause a Denial of Service condition. Background ========= JRuby is a Java-based Ruby interpreter implementation. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-java/jruby < 1.6.5.1 > = 1.6.5.1 Description ========== JRuby does not properly randomize hash functions to protect against hash collision attacks. Impact ===== A remote attacker could send a specially crafted input, possibly resulting in a Denial of Service condition. Workaround ========= There is no known workaround at this time. Resolution ========= All JRuby users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =dev-java/jruby-1.6.5.1" References ========= [ 1 ] CVE-2011-4838 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4838 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201207-06 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is ofutmost importance to us. Any security concerns should be addressed to This email address is being protected from spambots. You need JavaScript enabled to view it. or alternatively, you may file a bug at https://bugs.gentoo.org. License ====== Copyright 2012 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5/ . Security flaw discovered in JRuby. Users of Gentoo Linux advised to update to reduce potential threats.. JRuby Security, Denial of Service, Gentoo Advisory. . LinuxSecurity.com Team

Calendar 2 Jul 09, 2012 Gentoo
News Add Esm H240

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

What got you started with Linux?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/150-what-got-you-started-with-linux?task=poll.vote&format=json
150
radio
0
[{"id":483,"title":"Self-taught through trial and error","votes":545,"type":"x","order":1,"pct":78.42,"resources":[]},{"id":484,"title":"Formal training or courses","votes":30,"type":"x","order":2,"pct":4.32,"resources":[]},{"id":485,"title":"A job that required it","votes":34,"type":"x","order":3,"pct":4.89,"resources":[]},{"id":486,"title":"Other","votes":86,"type":"x","order":4,"pct":12.37,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Your message here