Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -6 articles for you...
198
security advisoryhigh severityremote attackArch Linux: 202007-6 High: libjcat Insufficient Validation Exploit
The package libjcat before version 0.1.3-1 is vulnerable to insufficient validation. . Arch Linux Security Advisory ASA-202007-6 ======================================== Severity: High Date : 2020-07-31 CVE-ID : CVE-2020-10759 Package : libjcat Type : insufficient validation Remote : Yes Link : https://security.archlinux.org/AVG-1185 Summary ====== The package libjcat before version 0.1.3-1 is vulnerable to insufficient validation. Resolution ========= Upgrade to 0.1.3-1. # pacman -Syu "libjcat> =0.1.3-1" The problem has been fixed upstream in version 0.1.3. Workaround ========= None. Description ========== A PGP signature verification bypass has been found in fwupd prior to 1.4.0, and in libjcat
Jul 31, 2020
ArchLinux
91
security advisorygentoocode executionGentoo: GLSA-202007-04 Normal: fwupd, libjcat Code Execution
Multiple vulnerabilities have been found in fwupd and libjcat, the worst of which could result in the arbitrary execution of code.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202007-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: fwupd, libjcat: Multiple vulnerabilities Date: July 26, 2020 Bugs: #727656 ID: 202007-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities have been found in fwupd and libjcat, the worst of which could result in the arbitrary execution of code. Background ========= fwupd aims to make updating firmware on Linux automatic, safe and reliable. libjcat is a library and tool for reading and writing Jcat files. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 sys-apps/fwupd < 1.3.10 > = 1.3.10 2 dev-libs/libjcat < 0.1.3 > = 0.1.3 ------------------------------------------------------------------- 2 affected packages Description ========== Multiple vulnerabilities have been discovered in fwupd and libjcat. Please review the CVE identifiers referenced below for details. Impact ===== Please review the referenced CVE identifiers for details. Workaround ========= There is no known workaround at this time. Resolution ========= All fwupd users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =sys-apps/fwupd-1.3.10" All libjcat users should upgrade to the latest version: # emerge --sync # emerge--ask --oneshot --verbose "> =dev-libs/libjcat-0.1.3" References ========= [ 1 ] CVE-2020-10759 https://nvd.nist.gov/vuln/detail/CVE-2020-10759 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202007-04 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Jul 26, 2020
Gentoo
89
security advisorymoderatefedoraFedora 32: libjcat FEDORA-2020-eec60309f2 Moderate: Signature Bypass
Security fix for CVE-2020-10759. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-eec60309f2 2020-06-16 01:25:41.304231 --------------------------------------------------------------------------------Name : libjcat Product : Fedora 32 Version : 0.1.2 Release : 2.fc32 URL : https://github.com/hughsie/libjcat Summary : Library for reading Jcat files Description : This library allows reading and writing gzip-compressed JSON catalog files, which can be used to store GPG, PKCS-7 and SHA-256 checksums for each file. This provides equivalent functionality to the catalog files supported in Microsoft Windows. --------------------------------------------------------------------------------Update Information: Security fix for CVE-2020-10759 --------------------------------------------------------------------------------ChangeLog: * Fri Jun 5 2020 Richard Hughes 0.1.2-2 - Fix for CVE-2020-10759 * Mon Apr 27 2020 Richard Hughes 0.1.2-1 - New upstream release - Build fixes mostly for RHEL * Tue Apr 14 2020 Richard Hughes 0.1.1-1 - New upstream release - Allow adding an item ID 'alias' - Make the installed tests actually work --------------------------------------------------------------------------------References: [ 1 ] Bug #1844316 - CVE-2020-10759 fwupd: Possible bypass in signature verification https://bugzilla.redhat.com/show_bug.cgi?id=1844316 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-eec60309f2' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Jun 15, 2020
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!