Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -5 articles for you...
89
security advisorycriticalFedoraFedora 31: FEDORA-2019-b123c48a8b High: Podman Vulnerability Reported
New upstream release. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2019-a658c47a7a 2019-05-04 00:16:11.078355 --------------------------------------------------------------------------------Name : bubblewrap Product : Fedora 30 Version : 0.3.3 Release : 2.fc30 URL : https://github.com/containers/bubblewrap Summary : Core execution tool for unprivileged containers Description : Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces. --------------------------------------------------------------------------------Update Information: New upstream release --------------------------------------------------------------------------------ChangeLog: * Wed May 1 2019 Colin Walters - 0.3.3-2 - New upstream release --------------------------------------------------------------------------------References: [ 1 ] Bug #1695964 - bubblewrap: insecure use of /tmp [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1695964 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2019-a658c47a7a' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
May 03, 2019
•Important
Fedora
89
security advisorysecurity issuecriticalFedora 26 FlightCrew 0.9.1: Critical Insecure /tmp Usage Fix
- security fix for rhbz 1450956. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2017-1f533a944e 2017-06-09 18:48:36.532267 --------------------------------------------------------------------------------Name : FlightCrew Product : Fedora 26 Version : 0.9.1 Release : 7.fc26 URL : https://sigil-ebook.com/ Summary : EPUB validator Description : FlightCrew is a C++ epub validator. --------------------------------------------------------------------------------Update Information: - security fix for rhbz 1450956 --------------------------------------------------------------------------------References: [ 1 ] Bug #1450956 - FlightCrew: Insecure use of /tmp https://bugzilla.redhat.com/show_bug.cgi?id=1450956 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade FlightCrew' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Jun 09, 2017
•Critical
Fedora
89
security advisoryfedoracritical updateFedora 22: 2015-06-23 Critical Update for Trafficserver
https://cwiki.apache.org/confluence/display/TS/What%27s+New+in+v5.3.x. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2015-10524 2015-06-23 03:02:27 -------------------------------------------------------------------------------- Name : trafficserver Product : Fedora 22 Version : 5.3.0 Release : 1.fc22 URL : https://trafficserver.apache.org/index.html Summary : Fast, scalable and extensible HTTP/1.1 compliant caching proxy server Description : Apache Traffic Server is a fast, scalable and extensible HTTP/1.1 compliant caching proxy server. -------------------------------------------------------------------------------- Update Information: https://cwiki.apache.org/confluence/display/TS/What%27s+New+in+v5.3.x -------------------------------------------------------------------------------- ChangeLog: * Sun Jun 21 2015 Peter Robinson 5.3.0-1 - Update to 5.3.0 LTS release - Build on aarch64 and power64 - Split perl bindings to sub package - Cleanup and modernise spec * Fri Jun 19 2015 Fedora Release Engineering - 5.0.1-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild * Sat May 2 2015 Kalev Lember - 5.0.1-3 - Rebuilt for GCC 5 C++11 ABI change -------------------------------------------------------------------------------- References: [ 1 ] Bug #1103173 - trafficserver: insecure temporary file usage [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1103173 [ 2 ] Bug #1103174 - trafficserver: insecure temporary file usage [epel-6] https://bugzilla.redhat.com/show_bug.cgi?id=1103174 [ 3 ] Bug #1102559 - Add AArch64 support to trafficserver https://bugzilla.redhat.com/show_bug.cgi?id=1102559 [ 4 ] Bug #1179204 - trafficserver: incorrect handling of "Max-Forwards" header [fedora-21] https://bugzilla.redhat.com/show_bug.cgi?id=1179204 [ 5 ] Bug #1133387 - CVE-2014-3525 trafficserver: unspecified flaw related to health checks fixed inversions 4.2.1.1 and 5.0.1 [epel-6] https://bugzilla.redhat.com/show_bug.cgi?id=1133387 [ 6 ] Bug #1179205 - trafficserver: incorrect handling of "Max-Forwards" header [epel-7] https://bugzilla.redhat.com/show_bug.cgi?id=1179205 [ 7 ] Bug #994224 - trafficserver must be compiled with -fno-strict-aliasing, but it is not https://bugzilla.redhat.com/show_bug.cgi?id=994224 [ 8 ] Bug #955127 - trafficserver package should be built with PIE flags https://bugzilla.redhat.com/show_bug.cgi?id=955127 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update trafficserver' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Jul 03, 2015
•Critical
Fedora
91
security advisorygentoosymlink attackGentoo: GLSA-201206-17 Normal: Symlink Attack Risk in Virtualenv
An insecure temporary file usage has been reported in virtualenv, possibly allowing symlink attacks.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201206-17 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: virtualenv: Insecure temporary file usage Date: June 22, 2012 Bugs: #395285 ID: 201206-17 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= An insecure temporary file usage has been reported in virtualenv, possibly allowing symlink attacks. Background ========= virtualenv is a virtual Python environment builder. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-python/virtualenv < 1.5.1 > = 1.5.1 Description ========== The virtualenv.py script in virtualenv does not handle temporary files securely. Impact ===== A local attacker could perform symlink attacks to overwrite arbitrary files with the privileges of the user running the application. Workaround ========= There is no known workaround at this time. Resolution ========= All virtualenv users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =dev-python/virtualenv-1.5.1" References ========= [ 1 ] CVE-2011-4617 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4617 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201206-17 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and securityof our users' machines is of utmost importance to us. Any security concerns should be addressed to
Jun 22, 2012
Gentoo
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!