Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -2 articles for you...
203
security advisorymoderatecross-user attackMageia 8: 2023-0058 Moderate: Ipython Cross-User Attack Threat
Executed config files from the current working directory, which could result in cross-user attacks if run from a directory multiple users may write to. (CVE-2022-21699) References: . MGASA-2023-0058 - Updated ipython packages fix security vulnerability Publication date: 27 Feb 2023 URL: https://advisories.mageia.org/MGASA-2023-0058.html Type: security Affected Mageia releases: 8 CVE: CVE-2022-21699 Executed config files from the current working directory, which could result in cross-user attacks if run from a directory multiple users may write to. (CVE-2022-21699) References: - https://bugs.mageia.org/show_bug.cgi?id=29969 - https://lists.debian.org/debian-lts-announce/2022/01/msg00021.html - https://lists.debian.org/debian-security-announce/2022/msg00032.html - https://lists.fedoraproject.org/archives/list/
Feb 27, 2023
•Important
Mageia
87
security advisorydebiancross-user attackDebian DSA-5065-1 Addressed Cross-User Vulnerability in IPython
It was discovered that IPython, an enhanced interactive Python shell, executed config files from the current working directory, which could result in cross-user attacks if run from a directory multiple users may write to. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-5065-1
Jan 31, 2022
•Important
Debian
91
security advisorygentooarbitrary code executionGentoo: GLSA 201512-02 Normal: IPython Code Execution Threat
A vulnerability in IPython could result in execution of arbitrary JavaScript.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201512-02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: IPython: User-assisted execution of arbitrary code Date: December 17, 2015 Bugs: #560708 ID: 201512-02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= A vulnerability in IPython could result in execution of arbitrary JavaScript. Background ========= IPython is an advanced interactive shell for Python. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-python/ipython < 3.2.1-r1 > = 3.2.1-r1 Description ========== IPython does not properly check the MIME type of a file. Impact ===== A remote attacker could entice a user to open a specially crafted text file using IPython, possibly resulting in execution of arbitrary JavaScript with the privileges of the process. Workaround ========= There is no known workaround at this time. Resolution ========= All IPython users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =dev-python/ipython-3.2.1-r1" References ========= [ 1 ] CVE-2015-7337 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7337 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201512-02 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of ourusers' machines is of utmost importance to us. Any security concerns should be addressed to
Dec 17, 2015
Gentoo
89
security advisorysoftware updateFedoraFedora 23: ipython Security Advisory for Execution Flaws and XSS Patches
Add upstream patch to fix file execution vulnerability (bug #1264067) ---- Add upstream patch to fix XSS vulnerability (bug #1259405). -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2015-16128 2015-09-25 07:56:18.561783 -------------------------------------------------------------------------------- Name : ipython Product : Fedora 23 Version : 3.2.1 Release : 3.fc23 URL : https://ipython.org/ Summary : An enhanced interactive Python shell Description : IPython provides a replacement for the interactive Python interpreter with extra functionality. Main features: * Comprehensive object introspection. * Input history, persistent across sessions. * Caching of output results during a session with automatically generated references. * Readline based name completion. * Extensible system of 'magic' commands for controlling the environment and performing many tasks related either to IPython or the operating system. * Configuration system with easy switching between different setups (simpler than changing $PYTHONSTARTUP environment variables every time). * Session logging and reloading. * Extensible syntax processing for special purpose situations. * Access to the system shell with user-extensible alias system. * Easily embeddable in other Python programs. * Integrated access to the pdb debugger and the Python profiler. -------------------------------------------------------------------------------- Update Information: Add upstream patch to fix file execution vulnerability (bug #1264067) ---- Add upstream patch to fix XSS vulnerability (bug #1259405) -------------------------------------------------------------------------------- References: [ 1 ] Bug #1264067 - CVE-2015-7337 ipython: Maliciously crafted files can be executed due to wrong file type determination https://bugzilla.redhat.com/show_bug.cgi?id=1264067 [ 2 ] Bug #1259405 - CVE-2015-6938 ipython: XSS via local folder name https://bugzilla.redhat.com/show_bug.cgi?id=1259405 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update ipython' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Sep 25, 2015
•Important
Fedora
89
security advisoryfedoraupdateFedora 21: 2015-14901 Critical Update for ipython XSS Issue
Add upstream patch to fix XSS vulnerability (bug #1259405). -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2015-14901 2015-09-17 21:56:49.243553 -------------------------------------------------------------------------------- Name : ipython Product : Fedora 21 Version : 2.4.1 Release : 8.fc21 URL : https://ipython.org/ Summary : An enhanced interactive Python shell Description : IPython provides a replacement for the interactive Python interpreter with extra functionality. Main features: * Comprehensive object introspection. * Input history, persistent across sessions. * Caching of output results during a session with automatically generated references. * Readline based name completion. * Extensible system of 'magic' commands for controlling the environment and performing many tasks related either to IPython or the operating system. * Configuration system with easy switching between different setups (simpler than changing $PYTHONSTARTUP environment variables every time). * Session logging and reloading. * Extensible syntax processing for special purpose situations. * Access to the system shell with user-extensible alias system. * Easily embeddable in other Python programs. * Integrated access to the pdb debugger and the Python profiler. -------------------------------------------------------------------------------- Update Information: Add upstream patch to fix XSS vulnerability (bug #1259405) -------------------------------------------------------------------------------- References: [ 1 ] Bug #1259405 - CVE-2015-6938 ipython: XSS via local folder name https://bugzilla.redhat.com/show_bug.cgi?id=1259405 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update ipython' at the command line. For more information, refer to "Managing Software with yum", available at . Allpackages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Sep 18, 2015
•Critical
Fedora
89
security advisorymoderatesecurity updateFedora 23: 2015-15467 Moderate: ipython XSS Vulnerability Patch
Add upstream patch to fix XSS vulnerability (bug #1259405). -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2015-14902 2015-09-17 21:57:09.572655 -------------------------------------------------------------------------------- Name : ipython Product : Fedora 22 Version : 2.4.1 Release : 8.fc22 URL : https://ipython.org/ Summary : An enhanced interactive Python shell Description : IPython provides a replacement for the interactive Python interpreter with extra functionality. Main features: * Comprehensive object introspection. * Input history, persistent across sessions. * Caching of output results during a session with automatically generated references. * Readline based name completion. * Extensible system of 'magic' commands for controlling the environment and performing many tasks related either to IPython or the operating system. * Configuration system with easy switching between different setups (simpler than changing $PYTHONSTARTUP environment variables every time). * Session logging and reloading. * Extensible syntax processing for special purpose situations. * Access to the system shell with user-extensible alias system. * Easily embeddable in other Python programs. * Integrated access to the pdb debugger and the Python profiler. -------------------------------------------------------------------------------- Update Information: Add upstream patch to fix XSS vulnerability (bug #1259405) -------------------------------------------------------------------------------- References: [ 1 ] Bug #1259405 - CVE-2015-6938 ipython: XSS via local folder name https://bugzilla.redhat.com/show_bug.cgi?id=1259405 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update ipython' at the command line. For more information, refer to "Managing Software with yum", available at . Allpackages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Sep 18, 2015
Fedora
89
security advisoryfedoraupdateFedora 21: Fix for Critical Ipython CSRF Issue 2015-11767 Now Available
Fix CSRF issue. - Fix font-awesome paths (bug #1219956) - Add upstream patch to fix PyQt4 import (bug #1219997) - Use python2 macros, fix python3 shebang fix Fix fontawesome path. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2015-11767 2015-07-17 23:29:35 -------------------------------------------------------------------------------- Name : ipython Product : Fedora 21 Version : 2.4.1 Release : 7.fc21 URL : https://ipython.org/ Summary : An enhanced interactive Python shell Description : IPython provides a replacement for the interactive Python interpreter with extra functionality. Main features: * Comprehensive object introspection. * Input history, persistent across sessions. * Caching of output results during a session with automatically generated references. * Readline based name completion. * Extensible system of 'magic' commands for controlling the environment and performing many tasks related either to IPython or the operating system. * Configuration system with easy switching between different setups (simpler than changing $PYTHONSTARTUP environment variables every time). * Session logging and reloading. * Extensible syntax processing for special purpose situations. * Access to the system shell with user-extensible alias system. * Easily embeddable in other Python programs. * Integrated access to the pdb debugger and the Python profiler. -------------------------------------------------------------------------------- Update Information: Fix CSRF issue. - Fix font-awesome paths (bug #1219956) - Add upstream patch to fix PyQt4 import (bug #1219997) - Use python2 macros, fix python3 shebang fix Fix fontawesome path -------------------------------------------------------------------------------- ChangeLog: * Thu Jul 16 2015 Orion Poplawski - 2.4.1-7 - Update to 2.x to fix CSRF issue (bug #1243842) * Mon Jul 13 2015 Orion Poplawski - 2.4.1-6 - Fix fontawesome path * Sat May 92015 Orion Poplawski - 2.4.1-5 - Sync more font-awesome changes from 3.1.0 * Sat May 9 2015 Orion Poplawski - 2.4.1-4 - More font-awesome fixes (bug #1170270) * Fri May 8 2015 Orion Poplawski - 2.4.1-3 - Add upstream patch to fix PyQt4 import (bug #1219997) - Use python2 macros, fix python3 shebang fix * Fri May 8 2015 Orion Poplawski - 2.4.1-2 - Fix font-awesome paths (bug #1219956) * Thu Feb 26 2015 Orion Poplawski - 2.4.1-1 - update to 2.4.1 * Wed Feb 25 2015 Orion Poplawski - 2.4.0-1 - update to 2.4.0 * Fri Nov 14 2014 Orion Poplawski - 2.3.0-1 - update to 2.3.0 -------------------------------------------------------------------------------- References: [ 1 ] Bug #1243842 - CVE-2015-5607 iptyhon: cross-site request forgery in get_origin() https://bugzilla.redhat.com/show_bug.cgi?id=1243842 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update ipython' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Jul 30, 2015
•Critical
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!