Libzypp from mageia 7 is affected by a security issue. This update fixes this. Incorrect Default Permissions vulnerability in libzypp allowed local . MGASA-2020-0245 - Updated libzypp packages fix security vulnerability Publication date: 10 Jun 2020 URL: https://advisories.mageia.org/MGASA-2020-0245.html Type: security Affected Mageia releases: 7 CVE: CVE-2019-18900 Libzypp from mageia 7 is affected by a security issue. This update fixes this. Incorrect Default Permissions vulnerability in libzypp allowed local attackers to read a cookie store used by libzypp, exposing private cookies. References: - https://bugs.mageia.org/show_bug.cgi?id=26068 - https://bugzilla.suse.com/show_bug.cgi?id=1158763 - https://github.com/openSUSE/libzypp/pull/196 - https://github.com/openSUSE/libzypp/commit/ea50981352bb5c7ab48663edaeb2df1ddd66953e - https://github.com/openSUSE/libzypp/commit/508b1201f23b44ee90dee6dbbeb3ac5f8bd4c089 - https://www.cve.org/CVERecord?id=CVE-2019-18900 SRPMS: - 7/core/libzypp-17.9.0-1.1.mga7 . MGASA-2020-0246 resolves a vulnerability in libzypp, improving the overall safety of Mageia 7.. libzypp update, mageia security, permissions fix, cookie security. . Severity: Critical. LinuxSecurity.com Team
It was discovered that there was an issue where incorrect default permissions on a HTTP cookie store could have allowed local attackers to read private credentials. . Package : libzypp Version : 14.29.1-2+deb8u1 CVE ID : CVE-2019-18900 It was discovered that there was an issue where incorrect default permissions on a HTTP cookie store could have allowed local attackersto read private credentials. For Debian 8 "Jessie", this issue has been fixed in libzypp version 14.29.1-2+deb8u1. We recommend that you upgrade your libzypp packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS Regards, - -- ,'`. : :' : Chris Lamb `. `'`
mantis, a PHP/MySQL web based bug tracking system, stores the passwordused to access its database in a configuration file which isworld-readable.. -------------------------------------------------------------------------- Debian Security Advisory DSA 335-1
Get the latest Linux and open source security news straight to your inbox.