Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -2 articles for you...
172
security advisoryremote accessUbuntuUbuntu 25 OpenJDK 25 Important Security Threats USN-7995-1
Several security issues were fixed in OpenJDK 25.. ========================================================================== Ubuntu Security Notice USN-7995-1 February 02, 2026 openjdk-25 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 25.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS Summary: Several security issues were fixed in OpenJDK 25. Software Description: - openjdk-25: Open Source Java implementation Details: It was discovered that the RMI component of OpenJDK 25 would establish RMI TCP endpoint connections to a remote host without setting an endpoint identification algorithm. An unauthenticated remote attacker could possibly use this issue to steal sensitive information. (CVE-2026-21925) Mingijung discovered that the AWT and JavaFX componenets of OpenJDK 25 could run programs if Desktop.browse() was supplied a filename as a URI. An unauthenticated remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-21932) Zhihui Chen discovered that the Networking component of OpenJDK 25 was suceptible to a CRLF injection vulnerability via the HttpServer class. An unauthenticated remote attacker could possibly use this issue to modify files or leak sensitive information. (CVE-2026-21933) Ireneusz Pastusiak discovered that the Security component of OpenJDK 25 failed to verify provided URIs point to a legitimate source when AIA is enabled. An unauthenticated remote attacker could possibly use this issue to redirect users to malicious hosts. (CVE-2026-21945) In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes. Please see the following for more information: https://openjdk.org/groups/vulnerability/advisories/2026-01-20 Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 25.10 openjdk-25-jdk 25.0.2+10-1~25.10 openjdk-25-jdk-headless 25.0.2+10-1~25.10 openjdk-25-jre 25.0.2+10-1~25.10 openjdk-25-jre-headless 25.0.2+10-1~25.10 openjdk-25-jre-zero 25.0.2+10-1~25.10 openjdk-25-jvmci-jdk 25.0.2+10-1~25.10 Ubuntu 24.04 LTS openjdk-25-jdk 25.0.2+10-1~24.04 openjdk-25-jdk-headless 25.0.2+10-1~24.04 openjdk-25-jre 25.0.2+10-1~24.04 openjdk-25-jre-headless 25.0.2+10-1~24.04 openjdk-25-jre-zero 25.0.2+10-1~24.04 openjdk-25-jvmci-jdk 25.0.2+10-1~24.04 Ubuntu 22.04 LTS openjdk-25-jdk 25.0.2+10-1~22.04 openjdk-25-jdk-headless 25.0.2+10-1~22.04 openjdk-25-jre 25.0.2+10-1~22.04 openjdk-25-jre-headless 25.0.2+10-1~22.04 openjdk-25-jre-zero 25.0.2+10-1~22.04 openjdk-25-jvmci-jdk 25.0.2+10-1~22.04 This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart Java applications to make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7995-1 CVE-2026-21925, CVE-2026-21932, CVE-2026-21933, CVE-2026-21945 Package Information: https://launchpad.net/ubuntu/+source/openjdk-25/25.0.2+10-1~25.10 https://launchpad.net/ubuntu/+source/openjdk-25/25.0.2+10-1~24.04 https://launchpad.net/ubuntu/+source/openjdk-25/25.0.2+10-1~22.04 . Address critical issues in OpenJDK 25 for Ubuntu, including exploits that may lead to information theft and arbitrary code execution.. OpenJDK security update, Ubuntu 25 vulnerabilities, remote code execution, Java security issues. . Severity: Important. LinuxSecurity.com Team
Feb 03, 2026
•Important
Ubuntu
98
security advisorymoderatesecurity fixRed Hat Enterprise Linux: RHSA-2020:1660-01 Moderate: Open Redirect Issue
An update for mod_auth_mellon is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: mod_auth_mellon security and bug fix update Advisory ID: RHSA-2020:1660-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2020:1660 Issue date: 2020-04-28 CVE Names: CVE-2019-13038 ==================================================================== 1. Summary: An update for mod_auth_mellon is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64 3. Description: The mod_auth_mellon module for the Apache HTTP Server is an authentication service that implements the SAML 2.0 federation protocol. The module grants access based on the attributes received in assertions generated by an IdP server. Security Fix(es): * mod_auth_mellon: Open Redirect via the login?ReturnTo= substring which could facilitate information theft (CVE-2019-13038) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.2 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includesthe changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1725740 - CVE-2019-13038 mod_auth_mellon: Open Redirect via the login?ReturnTo= substring which could facilitate information theft 1761774 - mod_auth_mellon fix for AJAX header name X-Requested-With 6. Package List: Red Hat Enterprise Linux AppStream (v. 8): Source: mod_auth_mellon-0.14.0-11.el8.src.rpm aarch64: mod_auth_mellon-0.14.0-11.el8.aarch64.rpm mod_auth_mellon-debuginfo-0.14.0-11.el8.aarch64.rpm mod_auth_mellon-debugsource-0.14.0-11.el8.aarch64.rpm mod_auth_mellon-diagnostics-0.14.0-11.el8.aarch64.rpm mod_auth_mellon-diagnostics-debuginfo-0.14.0-11.el8.aarch64.rpm ppc64le: mod_auth_mellon-0.14.0-11.el8.ppc64le.rpm mod_auth_mellon-debuginfo-0.14.0-11.el8.ppc64le.rpm mod_auth_mellon-debugsource-0.14.0-11.el8.ppc64le.rpm mod_auth_mellon-diagnostics-0.14.0-11.el8.ppc64le.rpm mod_auth_mellon-diagnostics-debuginfo-0.14.0-11.el8.ppc64le.rpm s390x: mod_auth_mellon-0.14.0-11.el8.s390x.rpm mod_auth_mellon-debuginfo-0.14.0-11.el8.s390x.rpm mod_auth_mellon-debugsource-0.14.0-11.el8.s390x.rpm mod_auth_mellon-diagnostics-0.14.0-11.el8.s390x.rpm mod_auth_mellon-diagnostics-debuginfo-0.14.0-11.el8.s390x.rpm x86_64: mod_auth_mellon-0.14.0-11.el8.x86_64.rpm mod_auth_mellon-debuginfo-0.14.0-11.el8.x86_64.rpm mod_auth_mellon-debugsource-0.14.0-11.el8.x86_64.rpm mod_auth_mellon-diagnostics-0.14.0-11.el8.x86_64.rpm mod_auth_mellon-diagnostics-debuginfo-0.14.0-11.el8.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2019-13038 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.2_release_notes/index 8. Contact: The Red Hat security contact is . More contact details athttps://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXqhVWtzjgjWX9erEAQgNexAAmRfckRPzmYwsvvqwO2DixA9EBrNp94ub 59HB5glxoaGQyl5HkxRIHboj5t2fkJlVm25lQBng9DXo9VENbfvXRJMvqImw1d4d I8ex3XCtljmE6pwrclVZTLsURgMFGJUKYltuwU0OOiQBGj6/7Ldp/j0poq34PPtL 3E0IxJHC7PoRSs9PrwIqxcYjO5XwVk/0q4v/uqYQ6lEj2Bl5CS6BkUNAZaF22mFQ sXfe/qJwUV6wRE9R0IrY+kYJVntvkqMKmLTF+lLSliYEkqlfXnt2AtYeUCNsCYPe JN/oOhFMi6OdsiWCXgV+9tKDbV1CUsLfXgPUpjsDyyKDbP2+aaQAnQNLrDC+O4vY 0q/iIObitBC8ZS4wzAFBhN4sFMJ67sfrXnqryt4nvSrZb0T1Kra+Oo5H0Ea/LQwj Z8xmQmZUHxnNeTBKLifwJoUSHmixyJs4oX/HbPlEj74wA1V07EssI9GIpAX4p5wn v6Cdx7RCFY9zSRkJpclzoW3x4rL1zIyr/ewjhf+Tsohegv2whW6UIIsEX7UOpRtd 6FbrMZ3ZMmEhqdfmpQe6IDFZqMD0RHemcFEoDlRAZWz3nPifFHXZzJIwwVEfvzwx QhYt6xg7Jqmosda0a/7MtvhpqKFSJmdpQy3nuimUDuqviL5I987W3rvDflmqTd7b HhHeKS8xreA=OMvI -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Apr 28, 2020
Red Hat
200
security advisorymoderateinformation theftScientific Linux SL7: SLSA-2020-1003-1 Moderate Risk in mod_auth_mellon
mod_auth_mellon: Open Redirect via the login?ReturnTo= substring which could facilitate information theft SL7 x86_64 mod_auth_mellon-diagnostics-0.14.0-8.el7.x86_64.rpm mod_auth_mellon-0.14.0-8.el7.x86_64.rpm mod_auth_mellon-debuginfo-0.14.0-8.el7.x86_64.rpm - Scientific Linux Development Team. Synopsis: Moderate: mod_auth_mellon security and bug fix update Advisory ID: SLSA-2020:1003-1 Issue Date: 2020-04-07 CVE Numbers: CVE-2019-13038 -- * mod_auth_mellon: Open Redirect via the login?ReturnTo= substring which could facilitate information theft -- SL7 x86_64 mod_auth_mellon-diagnostics-0.14.0-8.el7.x86_64.rpm mod_auth_mellon-0.14.0-8.el7.x86_64.rpm mod_auth_mellon-debuginfo-0.14.0-8.el7.x86_64.rpm - Scientific Linux Development Team . The mod_auth_mellon security patch mitigates open redirect vulnerabilities on SL7. Significant revisions bolster user safeguards.. mod_auth_mellon update, open redirect risk, SL7 security fix. . LinuxSecurity.com Team
Apr 20, 2020
Scientific Linux
89
security advisorysoftware updateFedoraFedora 30: 2019-e8d74ece30 Moderate: Open Redirect in Mod_Auth_Mellon
Fixes a CVE: CVE-2019-13038 mod_auth_mellon: an Open Redirect via the login?ReturnTo= substring which could facilitate information theft. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2019-e8d74ece30 2019-11-28 01:30:37.434437 --------------------------------------------------------------------------------Name : mod_auth_mellon Product : Fedora 30 Version : 0.15.0 Release : 1.fc30 URL : https://github.com/latchset/mod_auth_mellon Summary : A SAML 2.0 authentication module for the Apache Httpd Server Description : The mod_auth_mellon module is an authentication service that implements the SAML 2.0 federation protocol. It grants access based on the attributes received in assertions generated by a IdP server. --------------------------------------------------------------------------------Update Information: Fixes a CVE: CVE-2019-13038 mod_auth_mellon: an Open Redirect via the login?ReturnTo= substring which could facilitate information theft --------------------------------------------------------------------------------ChangeLog: * Tue Nov 19 2019 Jakub Hrozek - 0.15.0-1 - New upstream version 0.15.0 - Resolves: rhbz#1725742 - CVE-2019-13038 mod_auth_mellon: an Open Redirect via the login?ReturnTo= substring which could facilitate information theft [fedora-all] * Thu Jul 25 2019 Fedora Release Engineering - 0.14.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild --------------------------------------------------------------------------------References: [ 1 ] Bug #1725742 - CVE-2019-13038 mod_auth_mellon: an Open Redirect via the login?ReturnTo= substring which could facilitate information theft [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1725742 --------------------------------------------------------------------------------This update can be installed with the "dnf" updateprogram. Use su -c 'dnf upgrade --advisory FEDORA-2019-e8d74ece30' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Nov 27, 2019
•Important
Fedora
89
security advisorymoderatefedoraFedora 31: 2019-1444823e77 Moderate: Mod_Auth_Mellon Open Redirect Issue
Fixes a CVE: CVE-2019-13038 mod_auth_mellon: an Open Redirect via the login?ReturnTo= substring which could facilitate information theft. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2019-1444823e77 2019-11-28 01:09:04.913019 --------------------------------------------------------------------------------Name : mod_auth_mellon Product : Fedora 31 Version : 0.15.0 Release : 1.fc31 URL : https://github.com/latchset/mod_auth_mellon Summary : A SAML 2.0 authentication module for the Apache Httpd Server Description : The mod_auth_mellon module is an authentication service that implements the SAML 2.0 federation protocol. It grants access based on the attributes received in assertions generated by a IdP server. --------------------------------------------------------------------------------Update Information: Fixes a CVE: CVE-2019-13038 mod_auth_mellon: an Open Redirect via the login?ReturnTo= substring which could facilitate information theft --------------------------------------------------------------------------------ChangeLog: * Tue Nov 19 2019 Jakub Hrozek - 0.15.0-1 - New upstream version 0.15.0 - Resolves: rhbz#1725742 - CVE-2019-13038 mod_auth_mellon: an Open Redirect via the login?ReturnTo= substring which could facilitate information theft [fedora-all] --------------------------------------------------------------------------------References: [ 1 ] Bug #1725742 - CVE-2019-13038 mod_auth_mellon: an Open Redirect via the login?ReturnTo= substring which could facilitate information theft [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1725742 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2019-1444823e77' at the command line. For more information, refer to the dnfdocumentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Nov 27, 2019
•Important
Fedora
172
security advisoryUbuntuinformation theftUbuntu 14.04 ESM: USN-4049-2 Critical GLib Permissions Issue
GLib did not properly restrict directory and file permissions.. =========================================================================Ubuntu Security Notice USN-4049-2 July 08, 2019 glib2.0 vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 14.04 ESM - Ubuntu 12.04 ESM Summary: GLib did not properly restrict directory and file permissions. Software Description: - glib2.0: GLib Input, Output and Streaming Library (fam module) Details: USN-4049-1 fixed a vulnerability in GLib. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that GLib created directories and files without properly restricting permissions. An attacker could possibly use this issue to access sensitive information. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 14.04 ESM: libglib2.0-0 2.40.2-0ubuntu1.1+esm2 libglib2.0-bin 2.40.2-0ubuntu1.1+esm2 Ubuntu 12.04 ESM: libglib2.0-0 2.32.4-0ubuntu1.3 libglib2.0-bin 2.32.4-0ubuntu1.3 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-4049-2 https://ubuntu.com/security/notices/USN-4049-1 CVE-2019-13012 . The recent GLib patch for Ubuntu tackles file access issues that pose risks to overall system integrity.. Ubuntu Security Notice, GLib Vulnerability, File Permissions, Update Instructions. . Severity: Critical. LinuxSecurity.com Team
Jul 08, 2019
•Critical
Ubuntu
172
security advisorymoderatecross-site scriptingUbuntu: 1182-1 Moderate: Samba Cross-Site Scripting Threats
An attacker could use a malicious URL to reconfigure Samba or steal information.. =========================================================================Ubuntu Security Notice USN-1182-1 August 02, 2011 samba vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 11.04 - Ubuntu 10.10 - Ubuntu 10.04 LTS - Ubuntu 8.04 LTS Summary: An attacker could use a malicious URL to reconfigure Samba or steal information. Software Description: - samba: SMB/CIFS file, print, and login server for Unix Details: Yoshihiro Ishikawa discovered that the Samba Web Administration Tool (SWAT) was vulnerable to cross-site request forgeries (CSRF). If a Samba administrator were tricked into clicking a link on a specially crafted web page, an attacker could trigger commands that could modify the Samba configuration. (CVE-2011-2522) Nobuhiro Tsuji discovered that the Samba Web Administration Tool (SWAT) did not properly sanitize its input when processing password change requests, resulting in cross-site scripting (XSS) vulnerabilities. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. (CVE-2011-2694) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 11.04: swat 2:3.5.8~dfsg-1ubuntu2.3 Ubuntu 10.10: swat 2:3.5.4~dfsg-1ubuntu8.5 Ubuntu 10.04 LTS: swat 2:3.4.7~dfsg-1ubuntu3.7 Ubuntu 8.04 LTS: swat 3.0.28a-1ubuntu4.15 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-1182-1 CVE-2011-2522, CVE-2011-2694 PackageInformation: https://launchpad.net/ubuntu/+source/samba/2:3.5.8~dfsg-1ubuntu2.3 https://launchpad.net/ubuntu/+source/samba/2:3.5.4~dfsg-1ubuntu8.5 https://launchpad.net/ubuntu/+source/samba/2:3.4.7~dfsg-1ubuntu3.7 https://launchpad.net/ubuntu/+source/samba/3.0.28a-1ubuntu4.15 . The Ubuntu Security Notice USN-1182-1 highlights critical Samba vulnerabilities, allowing remote code execution and potential denial-of-service attacks. Samba Flaws, Security Update, Ubuntu Advisory. . LinuxSecurity.com Team
Aug 02, 2011
Ubuntu
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!