Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -3 articles for you...
172
security advisorydenial of serviceUbuntuUbuntu 25.04: node-cipher-base Important Input Manipulation USN-7746-1
cipher-base could be made to stall or return incorrect hash values if it received specially crafted input.. ========================================================================== Ubuntu Security Notice USN-7746-1 September 11, 2025 node-cipher-base vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 25.04 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: cipher-base could be made to stall or return incorrect hash values if it received specially crafted input. Software Description: - node-cipher-base: abstract base class for crypto-streams Details: Nikita Skovoroda discovered that cipher-base did not properly manage certain inputs. An attacker could possibly use this issue to manipulate the internal state of hash functions, resulting in hash collisions, denial of service, or other unspecified impact. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 25.04 node-cipher-base 1.0.4-6+deb13u1ubuntu0.25.04.1 Ubuntu 24.04 LTS node-cipher-base 1.0.4-6+deb13u1ubuntu0.24.04.1 Ubuntu 22.04 LTS node-cipher-base 1.0.4-6+deb13u1ubuntu0.22.04.1 Ubuntu 20.04 LTS node-cipher-base 1.0.4-4ubuntu0.1~esm2 Available with Ubuntu Pro Ubuntu 18.04 LTS node-cipher-base 1.0.4-1ubuntu0.1~esm2 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7746-1 CVE-2025-9287 Package Information: https://launchpad.net/ubuntu/+source/node-cipher-base/1.0.4-6+deb13u1ubuntu0.25.04.1 https://launchpad.net/ubuntu/+source/node-cipher-base/1.0.4-6+deb13u1ubuntu0.24.04.1 . Follow these steps to fix the security vulnerability in node-cipher-base on Ubuntu: updatethe repository, check for upgrades, and confirm the package version.. node-cipher-base update, security advisory for Ubuntu, denial of service risk. . Severity: Important. LinuxSecurity.com Team
Sep 11, 2025
•Important
Ubuntu
197
security advisorydenial of servicecode executionDebian 11 bullseye DLA-4147-1 moderate: fig2dev code execution and DoS
Multiple vulnerabilities were found in fig2dev, a utility for converting XFig figure files, which could lead to code execution or denial of service upon specially crafted input files. . ------------------------------------------------------------------------- Debian LTS Advisory DLA-4147-1
Apr 30, 2025
Debian LTS
197
security advisorydenial of servicedebianDebian: DLA-3267-1 Critical: libxstream-java Denial Of Service
XStream serializes Java objects to XML and back again. Versions prior to 1.4.11.1-1+deb10u4 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation of the processed input stream. The attack uses the hash code . -------------------------------------------------------------------------Debian LTS Advisory DLA-3267-1
Jan 11, 2023
•Critical
Debian LTS
89
security advisorycriticalFedoraFedora 34: FEDORA-2021-b21bbfa198 Critical: PhpMailer Input Manipulation
**Version 6.4.1** (April 29th, 2021) * **SECURITY** Fixes CVE-2020-36326, a regression of CVE-2018-19296 object injection introduced in 6.1.8, see SECURITY.md for details * Reject more file paths that look like URLs, matching RFC3986 spec, blocking URLS using schemes such as `ssh2` * Ensure method signature consistency in `doCallback` calls * Ukrainian language update * Add. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2021-b21bbfa198 2021-05-12 05:41:31.251870 --------------------------------------------------------------------------------Name : php-phpmailer6 Product : Fedora 34 Version : 6.4.1 Release : 1.fc34 URL : https://github.com/PHPMailer/PHPMailer Summary : Full-featured email creation and transfer class for PHP Description : PHPMailer - A full-featured email creation and transfer class for PHP Class Features * Probably the world's most popular code for sending email from PHP! * Used by many open-source projects: WordPress, Drupal, 1CRM, SugarCRM, Yii, Joomla! and many more * Integrated SMTP support - send without a local mail server * Send emails with multiple To, CC, BCC and Reply-to addresses * Multipart/alternative emails for mail clients that do not read HTML email * Add attachments, including inline * Support for UTF-8 content and 8bit, base64, binary, and quoted-printable encodings * SMTP authentication with LOGIN, PLAIN, CRAM-MD5 and XOAUTH2 mechanisms over SSL and SMTP+STARTTLS transports * Validates email addresses automatically * Protect against header injection attacks * Error messages in 47 languages! * DKIM and S/MIME signing support * Compatible with PHP 5.5 and later * Namespaced to prevent name clashes * Much more! Autoloader: /usr/share/php/PHPMailer/PHPMailer6/autoload.php --------------------------------------------------------------------------------Update Information: **Version 6.4.1** (April 29th, 2021) * **SECURITY** FixesCVE-2020-36326, a regression of CVE-2018-19296 object injection introduced in 6.1.8, see SECURITY.md for details * Reject more file paths that look like URLs, matching RFC3986 spec, blocking URLS using schemes such as `ssh2` * Ensure method signature consistency in `doCallback` calls * Ukrainian language update * Add composer scripts for checking coding standards and running tests --------------------------------------------------------------------------------ChangeLog: * Mon May 3 2021 Remi Collet - 6.4.1-1 - update to 6.4.1 --------------------------------------------------------------------------------References: [ 1 ] Bug #1955757 - CVE-2020-36326 php-phpmailer6: Object injection through Phar Deserialization via addAttachment with a UNC pathname [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1955757 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2021-b21bbfa198' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
May 12, 2021
•Critical
Fedora
172
security advisorycriticaldirectory traversalUbuntu 20.10, 20.04 LTS: USN-4707-1 Critical TCMU Input Threat
tcmu could be made to crash if it received specially crafted input.. =========================================================================Ubuntu Security Notice USN-4707-1 January 28, 2021 tcmu vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.10 - Ubuntu 20.04 LTS Summary: tcmu could be made to crash if it received specially crafted input. Software Description: - tcmu: TCM-Userspace backend Details: It was discovered that TCMU lacked a check for transport-layer restrictions, allowing remote attackers to read or write files via directory traversal in an XCOPY request. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 20.10: libtcmu2 1.5.2-5ubuntu0.20.10.1 tcmu-runner 1.5.2-5ubuntu0.20.10.1 Ubuntu 20.04 LTS: libtcmu2 1.5.2-5ubuntu0.20.04.1 tcmu-runner 1.5.2-5ubuntu0.20.04.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-4707-1 CVE-2021-3139 Package Information: https://launchpad.net/ubuntu/+source/tcmu/1.5.2-5ubuntu0.20.10.1 https://launchpad.net/ubuntu/+source/tcmu/1.5.2-5ubuntu0.20.04.1 . Critical TCMU input issue could crash Ubuntu 20.10 and 20.04 LTS systems with crafted input, requiring urgent update.. TCMU Vulnerability, Ubuntu Update, Input Manipulation. . Severity: Critical. LinuxSecurity.com Team
Jan 28, 2021
•Critical
Ubuntu
197
security advisorycode executiondebianDebian 8: DLA-1986-1 Critical: Ruby-Haml Input Manipulation Risk
In haml, when using user input to perform tasks on the server, characters like < > " ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additional . Package : ruby-haml Version : 4.0.5-2+deb8u1 CVE ID : CVE-2017-1002201 In haml, when using user input to perform tasks on the server, characterslike < > " ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code. For Debian 8 "Jessie", this problem has been fixed in version 4.0.5-2+deb8u1. We recommend that you upgrade your ruby-haml packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Update ruby-haml to address an input handling issue that may result in potential code execution risks.. input escaping, security update, ruby-haml, Debian LTS. . Severity: Critical. LinuxSecurity.com Team
Nov 10, 2019
•Critical
Debian LTS
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!