Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -3 articles for you...
91
security advisoryhigh severitygentooGentoo: GLSA-201803-07 High: JabberD 2.x Escalation and DoS Risk
Multiple vulnerabilities have been found in Gentoo's JabberD 2.x ebuild, the worst of which allows local attackers to escalate privileges. [More...]. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201803-07 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: JabberD 2.x: Multiple vulnerabilities Date: March 19, 2018 Bugs: #623806, #629412, #631068 ID: 201803-07 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities have been found in Gentoo's JabberD 2.x ebuild, the worst of which allows local attackers to escalate privileges. Background ========= JabberD 2.x is an open source Jabber server written in C. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-im/jabberd2
Mar 19, 2018
Gentoo
89
security advisorycriticalFedoraFedora 25: Critical Jabberd 2.6.1 Security Fix Advisory
updated to 2.6.1 (security bugfix release). --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2017-9dd1004ad8 2017-07-14 11:44:22.390822 --------------------------------------------------------------------------------Name : jabberd Product : Fedora 25 Version : 2.6.1 Release : 1.fc25 URL : https://jabberd2.org/ Summary : OpenSource server implementation of the Jabber protocols Description : The jabberd project aims to provide an open-source server implementation of the Jabber protocols for instant messaging and XML routing. The goal of this project is to provide a scalable, reliable, efficient and extensible server that provides a complete set of features and is up to date with the latest protocol revisions. jabberd2 is the next generation of the jabberd server. It has been rewritten from the ground up to be scalable, architecturally sound, and to support the latest protocol extensions coming out of the JSF. This package defaults to use pam and sqlite. --------------------------------------------------------------------------------Update Information: updated to 2.6.1 (security bugfix release) --------------------------------------------------------------------------------References: [ 1 ] Bug #1468568 - CVE-2017-10807 jabberd: CVE-2017-10807 [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1468568 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade jabberd' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Jul 14, 2017
•Critical
Fedora
89
security advisoryfedoraupdateCentOS 8: CENTOS-2019-b7893a47de Critical: OpenSSL Vulnerability Fix
updated to 2.6.1 (security bugfix release). --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2017-f6361db8fd 2017-07-14 11:43:27.890586 --------------------------------------------------------------------------------Name : jabberd Product : Fedora 24 Version : 2.6.1 Release : 1.fc24 URL : https://jabberd2.org/ Summary : OpenSource server implementation of the Jabber protocols Description : The jabberd project aims to provide an open-source server implementation of the Jabber protocols for instant messaging and XML routing. The goal of this project is to provide a scalable, reliable, efficient and extensible server that provides a complete set of features and is up to date with the latest protocol revisions. jabberd2 is the next generation of the jabberd server. It has been rewritten from the ground up to be scalable, architecturally sound, and to support the latest protocol extensions coming out of the JSF. This package defaults to use pam and sqlite. --------------------------------------------------------------------------------Update Information: updated to 2.6.1 (security bugfix release) --------------------------------------------------------------------------------References: [ 1 ] Bug #1468568 - CVE-2017-10807 jabberd: CVE-2017-10807 [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1468568 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade jabberd' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Jul 14, 2017
•Critical
Fedora
89
security advisorysecurity updatefedoraFedora 26: 2017-313712a583 Moderate: Jabberd Security Fix
updated to 2.6.1 (security bugfix release). --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2017-313712a583 2017-07-14 11:45:23.814624 --------------------------------------------------------------------------------Name : jabberd Product : Fedora 26 Version : 2.6.1 Release : 1.fc26 URL : https://jabberd2.org/ Summary : OpenSource server implementation of the Jabber protocols Description : The jabberd project aims to provide an open-source server implementation of the Jabber protocols for instant messaging and XML routing. The goal of this project is to provide a scalable, reliable, efficient and extensible server that provides a complete set of features and is up to date with the latest protocol revisions. jabberd2 is the next generation of the jabberd server. It has been rewritten from the ground up to be scalable, architecturally sound, and to support the latest protocol extensions coming out of the JSF. This package defaults to use pam and sqlite. --------------------------------------------------------------------------------Update Information: updated to 2.6.1 (security bugfix release) --------------------------------------------------------------------------------References: [ 1 ] Bug #1468568 - CVE-2017-10807 jabberd: CVE-2017-10807 [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1468568 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade jabberd' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Jul 14, 2017
•Important
Fedora
89
security advisoryFedoraopen sourceFedora 23: Jabberd Security Advisory for Dialback PRNG Fix
fixes "Dialback secrets are generated using a non-cryptographically secure PRNG". -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2016-ba6fd98830 2016-02-29 02:06:34.731967 -------------------------------------------------------------------------------- Name : jabberd Product : Fedora 23 Version : 2.3.3 Release : 7.fc23 URL : https://jabberd2.org/ Summary : OpenSource server implementation of the Jabber protocols Description : The jabberd project aims to provide an open-source server implementation of the Jabber protocols for instant messaging and XML routing. The goal of this project is to provide a scalable, reliable, efficient and extensible server that provides a complete set of features and is up to date with the latest protocol revisions. jabberd2 is the next generation of the jabberd server. It has been rewritten from the ground up to be scalable, architecturally sound, and to support the latest protocol extensions coming out of the JSF. This package defaults to use pam and sqlite. -------------------------------------------------------------------------------- Update Information: fixes "Dialback secrets are generated using a non-cryptographically secure PRNG" -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update jabberd' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Feb 29, 2016
•Critical
Fedora
91
security advisorygentoovulnerabilityGentoo: 200409-31 Normal: jabberd 1.x Denial of Service Attack
The jabberd server was found to be vulnerable to a remote Denial of Service attack.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200409-31 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: jabberd 1.x: Denial of Service vulnerability Date: September 23, 2004 Bugs: #64741 ID: 200409-31 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= The jabberd server was found to be vulnerable to a remote Denial of Service attack. Background ========= Jabber is a set of streaming XML protocols enabling message, presence, and other structured information exchange between two hosts. jabberd is the original implementation of the Jabber protocol server. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-im/jabberd = 1.4.3-r4 Description ========== Jose Antonio Calvo found a defect in routines handling XML parsing of incoming data. jabberd 1.x may crash upon reception of invalid data on any socket connection on which XML is parsed. Impact ===== A remote attacker may send a specific sequence of bytes to an open socket to crash the jabberd server, resulting in a Denial of Service. Workaround ========= There is no known workaround at this time. Resolution ========= All jabberd users should upgrade to the latest version: # emerge sync # emerge -pv "> =net-im/jabberd-1.4.3-r4" # emerge "> =net-im/jabberd-1.4.3-r4" References ========= [ 1 ] Vulnerability disclosure [ 2 ] Jabber announcement Availability =========== This GLSA and any updatesto it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200409-31 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Sep 23, 2004
Gentoo
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!