Explore top 10 tips to secure your open-source projects now. Read More
×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 13 articles for you...
172
security advisorycriticalremote code executionUbuntu 26.04 24.04 Socat Critical Remote Execution Local File Overwrite
Several security issues were fixed in socat.. ========================================================================== Ubuntu Security Notice USN-8511-1 July 06, 2026 socat vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 24.04 LTS Summary: Several security issues were fixed in socat. Software Description: - socat: multipurpose relay for bidirectional data transfer Details: It was discovered that socat incorrectly handled the SOCKS5 proxy server reply parser. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-56123) It was discovered that socat incorrectly handled a sample script. A local attacker could possibly use this issue to overwrite arbitrary files. This issue only affected Ubuntu 24.04 LTS. (CVE-2024-54661) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS socat 1.8.1.1-1ubuntu0.1 Ubuntu 24.04 LTS socat 1.8.0.0-4ubuntu0.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8511-1 CVE-2024-54661, CVE-2026-56123 Package Information: https://launchpad.net/ubuntu/+source/socat/1.8.1.1-1ubuntu0.1 https://launchpad.net/ubuntu/+source/socat/1.8.0.0-4ubuntu0.1 . Discover critical updates to socat on Ubuntu, addressing both remote code execution and local file overwrite issues. Act now!. Ubuntu socat security update, remote code execution, local file overwrite, socat vulnerabilities. . Severity: Critical. LinuxSecurity.com Team
Jul 06, 2026
•Critical
Ubuntu
100
security advisorybuffer overflowSuSESUSE Libsolv Important Buffer Overflow and File Overwrite Fixes 2026-2575-1
An update that solves seven vulnerabilities, contains three features and has 14 security fixes can now be installed.. # Security update for libsolv, libzypp, zypper Announcement ID: SUSE-SU-2026:2575-1 Release Date: 2026-06-23T12:48:49Z Rating: important References: * bsc#1158038 * bsc#1239718 * bsc#1246504 * bsc#1247948 * bsc#1249435 * bsc#1252744 * bsc#1253193 * bsc#1253740 * bsc#1257068 * bsc#1257882 * bsc#1258193 * bsc#1259311 * bsc#1259706 * bsc#1259802 * bsc#1259842 * bsc#1265223 * bsc#1265935 * bsc#1265938 * bsc#1266039 * bsc#1267426 * bsc#1267874 * jsc#PED-13680 * jsc#PED-14658 * jsc#PED-15607 Cross-References: * CVE-2026-25707 * CVE-2026-44933 * CVE-2026-44941 * CVE-2026-44942 * CVE-2026-48863 * CVE-2026-9149 * CVE-2026-9150 CVSS scores: * CVE-2026-25707 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2026-44933 ( SUSE ): 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-44933 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-44933 ( NVD ): 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-44933 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-44941 ( SUSE ): 7.5 CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-44941 ( SUSE ): 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H * CVE-2026-44942 ( SUSE ): 6.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-44942 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2026-44942 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2026-48863 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-48863 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-9149 ( SUSE ): 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-9149 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-9149 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-9150 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-9150 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP5 LTSS * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves seven vulnerabilities, contains three features and has 14 security fixes can now be installed. ## Description: This update for libsolv, libzypp, zypper fixes the following issues * CVE-2026-9149: Heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file (bsc#1265935). * CVE-2026-9150: Stack-based buffer overflow in libsolv's Debian metadata parser when handling SHA384/SHA512 checksums (bsc#1265938). * CVE-2026-25707: Handcrafted repo metadata may cause arbitrary local files to be overwritten (bsc#1259802). * CVE-2026-44933: scan of the Mandatory signature verification plugin support (bsc#1265223). * CVE-2026-44941: path traversal via "keyhint" (bsc#1267426). * CVE-2026-44942: .repo files can have an optional path which can lead to path traversal attacks (bsc#1267874). * CVE-2026-48863: Fix buffer overflow when parsing EdDSA signature (bsc#1266039). Changes in libzypp: Updated to version 17.38.13 (35): * A .repo files "path=" entry must not refer to a location outside the repo (bsc#1267874, CVE-2026-44942) A "path=" entry may solely denote a sub- directory of the baseurl where the metadata arelocated. A relative path trying to access data outside the baseurl is reported and sanitized. * Fix potential crash on malformed or malicious repository metadata (fixes #740) * Repo metadata: discard entries referring to a location outside the repo (bsc#1259802, CVE-2026-25707) Mirroring those data locally would refer to a location outside the repo's local cache directory. Those data entries are reported and discarded. * zypp.conf: Allow [env] section to add environment variables. This feature is designed to enable environment-specific settings or debugging options over an extended period. See zypp.conf(5). * Prevent configured scripts from escaping the sigcheck directory (bsc#1265223, CVE-2026-44933) * StringV: guard hasPrefix/hasPrefixCI against reading past the view end (fixes #735) * Mandatory signature verification plugin support (PED#11922) * Fix purge-kernel -rc kernel handling (bsc#1239718) * Explicitly_set_pool_DISTTYPE_RPM (fixes #726) * Check for trusted key updates when updating the general keyring (bsc#1259706) * Support multiple MirroredOrigin authorities (bsc#1253193) * Workaround doxygen bug: doxygen/doxygen#12057 * libzypp.spec: Add missing graphviz-gd BuildRequires (boo#1259842) * Fix preloader not caching packages from arch specific subrepos (bsc#1253740) * Deprioritize invalid mirrors (fixes openSUSE/zypper#636) * Fix Product::referencePackage lookup (bsc#1259311) Use a provided autoproduct() as hint to the package name of the release package. It might be that not just multiple versions of the same release package provide the same product version, but also different release packages. * specfile: on fedora use %{_prefix}/share as zyppconfdir if %{_distconfdir} is undefined (fixes #693) This will set '-DZYPPCONFDIR=%{zyppconfdir}' for cmake. * Fall back to a writable location when precaching packages without root (bsc#1247948) * Prepare a legacy /etc/zypp/zypp.conf to be installed on old distros.See the ZYPP.CONF(5) man page for details. * Fix runtime check for broken rpm --runposttrans (bsc#1257068) * Avoid libcurl-mini4 when building as it does not support ftp protocol. * Translation: updated .pot file. * zypp.conf: follow the UAPI configuration file specification (PED-14658) In short terms it means we will no longer ship an /etc/zypp/zypp.conf, but store our own defaults in /usr/etc/zypp/zypp.conf. The systems administrator may choose to keep a full copy in /etc/zypp/zypp.conf ignoring our config file settings completely, or - the preferred way - to overwrite specific settings via /etc/zypp/zypp.conf.d/*.conf overlay files. See the ZYPP.CONF(5) man page for details. * cmake: correctly detect rpm6 (fixes #689) * Use 'zypp.tmp' as temp directory component to ease setting up SELinux policies (bsc#1249435) * zyppng: Update Provider to current MediaCurl2 download approach, drop Metalink ( fixes #682 ) Changes in libsolv: Updated to version 0.7.39: * fix solv_chksum_free segfault when called with a NULL pointer * made repo_add_solv more robust against corrupt files [bsc#1265935] [CVE-2026-9149] * fix potential buffer overflow when verifying EdDSA signatures [bsc#1266039] [CVE-2026-48863] * added limit checks in multiple places to catch overflows * reduce the size of the language id cache * fixed Debian canon selection * fixed dbpath detection in repo_rpmdb_librpm * reduced stack usage in repo page compression (needed for musl) * fix parsing of sha512 checksums in debian repositories [bsc#1265938] [CVE-2026-9150] * improve speed of dirpool_add_dir makeing parsing of filelists.xml twice as fast * fix parsing of recommends in the old Mandriva synthesis format * respect the "default" attribute in environment optionlist in the comps parser * support suse namespace deps in boolean dependencies [bsc#1258193] * support for the Elbrus2000 (e2k) architecture * support language() suse namespace rewriting Changes inzypper: Update to version 1.14.98: * Transactional systems: Delegate rw-commands to transactional-wrapper if available (jsc#PED-13680, jsc#PED-15607) On a transactional system where the root filesystem is mounted read-only, zypper commands that modify the system cannot be executed directly. If the system provides a transactional-wrapper utility, zypper will automatically attempt to invoke it. The wrapper transparently executes the zypper command within a new, writable snapshot and manages the lifecycle of that snapshot based on the command's exit status. On transactional systems lacking a transactional-wrapper, users must manually invoke specialized tools -such as transactional-update- to install, update, or remove software. * Add --filter-version-change to zypper lu. Adds filtering by version change significance to reduce noise in update listings. Supports levels: rebuild (hides rebuild-only changes) and package (hides all release-only changes). * Autorefresh ris-services the way as plugin-services (bsc#1246504) It's actually wrong to treat service refreshes different depending on the service type. For the purpose of a service it makes no difference how the data about the repos to use are acquired. * Report download progress for command line rpms (fixes #613) * Hint to '-vv ref' to see the mirrors used to download the metadata (bsc#1257882) * Service: Allow "zypper ls SERVICE ..." to test whether a service with this alias is defined (bsc#1252744) The command prints an abstract of all services passed on the command line. It returns 3-ZYPPER_EXIT_ERR_INVALID_ARGS if some argument does not name an existing service. * Keep repo data when updating the service settings (bsc#1252744) * info: Enhance pattern content table (bsc#1158038) Alternatives (multiple packages providing the same requirement) are now listed as a single entry in the content table. The entry shows either the installed package which satisfiesthe requirement or the requirement itself as type 'Provides'. Listing all potential alternatives was miss leading, especially if the alternatives were mutual exclusive. It looked like an installed pattern had not-installed requirements and it was not possible to install all requirements at the same time. Original description from SUSE:Maintenance:44536: This update for libsolv, libzypp fixes the following issues Security issues: * CVE-2026-9149: Heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file (bsc#1265935). * CVE-2026-9150: Stack-based buffer overflow in libsolv's Debian metadata parser when handling SHA384/SHA512 checksums (bsc#1265938). * CVE-2026-25707: Handcrafted repo metadata may cause arbitrary local files to be overwritten (bsc#1259802). * CVE-2026-44933: scan of the Mandatory signature verification plugin support (bsc#1265223). * CVE-2026-44942: .repo files can have an optional path which can lead to path traversal attacks (bsc#1267874). * CVE-2026-48863: Fix bufffer overflow when parsing EdDSA signature (bsc#1266039). Changes in libzypp: Updated to version 17.38.13 (35): * Fix potential crash on malformed or malicious repository metadata (fixes #740) * Repo metadata: discard entries referring to a location outside the repo (bsc#1259802, CVE-2026-25707) Mirroring those data locally would refer to a location outside the repo's local cache directory. Those data entries are reported and discarded. * zypp.conf: Allow [env] section to add environment variables. This feature is designed to enable environment-specific settings or debugging options over an extended period. See zypp.conf(5). * Prevent configured scripts from escaping the sigcheck directory (bsc#1265223, CVE-2026-44933) * StringV: guard hasPrefix/hasPrefixCI against reading past the view end (fixes #735) * Mandatory signature verification plugin support (PED#11922) * Fix purge-kernel -rc kernelhandling (bsc#1239718) * Explicitly_set_pool_DISTTYPE_RPM (fixes #726) * Check for trusted key updates when updating the general keyring (bsc#1259706) * Support multiple MirroredOrigin authorities (bsc#1253193) * Workaround doxygen bug: doxygen/doxygen#12057 * libzypp.spec: Add missing graphviz-gd BuildRequires (boo#1259842) * Fix preloader not caching packages from arch specific subrepos (bsc#1253740) * Deprioritize invalid mirrors (fixes openSUSE/zypper#636) * Fix Product::referencePackage lookup (bsc#1259311) Use a provided autoproduct() as hint to the package name of the release package. It might be that not just multiple versions of the same release package provide the same product version, but also different release packages. * specfile: on fedora use %{_prefix}/share as zyppconfdir if %{_distconfdir} is undefined (fixes #693) This will set '-DZYPPCONFDIR=%{zyppconfdir}' for cmake. * Fall back to a writable location when precaching packages without root (bsc#1247948) * Prepare a legacy /etc/zypp/zypp.conf to be installed on old distros. See the ZYPP.CONF(5) man page for details. * Fix runtime check for broken rpm --runposttrans (bsc#1257068) * Avoid libcurl-mini4 when building as it does not support ftp protocol. * Translation: updated .pot file. * zypp.conf: follow the UAPI configuration file specification (PED-14658) In short terms it means we will no longer ship an /etc/zypp/zypp.conf, but store our own defaults in /usr/etc/zypp/zypp.conf. The systems administrator may choose to keep a full copy in /etc/zypp/zypp.conf ignoring our config file settings completely, or - the preferred way - to overwrite specific settings via /etc/zypp/zypp.conf.d/*.conf overlay files. See the ZYPP.CONF(5) man page for details. * cmake: correctly detect rpm6 (fixes #689) * Use 'zypp.tmp' as temp directory component to ease setting up SELinux policies (bsc#1249435) * zyppng: Update Provider to current MediaCurl2 download approach,drop Metalink ( fixes #682 ) Changes in libsolv: Updated to version 0.7.39: * fix solv_chksum_free segfault when called with a NULL pointer * made repo_add_solv more robust against corrupt files [bsc#1265935] [CVE-2026-9149] * fix potential buffer overflow when verifying EdDSA signatures [bsc#1266039] [CVE-2026-48863] * added limit checks in multiple places to catch overflows * reduce the size of the language id cache * fixed Debian canon selection * fixed dbpath detection in repo_rpmdb_librpm * reduced stack usage in repo page compression (needed for musl) * fix parsing of sha512 checksums in debian repositories [bsc#1265938] [CVE-2026-9150] * improve speed of dirpool_add_dir makeing parsing of filelists.xml twice as fast * fix parsing of recommends in the old Mandriva synthesis format * respect the "default" attribute in environment optionlist in the comps parser * support suse namespace deps in boolean dependencies [bsc#1258193] * support for the Elbrus2000 (e2k) architecture * support language() suse namespace rewriting Update to version 1.14.98: * Transactional systems: Delegate rw-commands to transactional-wrapper if available (jsc#PED-13680, jsc#PED-15607) On a transactional system where the root filesystem is mounted read-only, zypper commands that modify the system cannot be executed directly. If the system provides a transactional-wrapper utility, zypper will automatically attempt to invoke it. The wrapper transparently executes the zypper command within a new, writable snapshot and manages the lifecycle of that snapshot based on the command's exit status. On transactional systems lacking a transactional-wrapper, users must manually invoke specialized tools -such as transactional-update- to install, update, or remove software. * Add --filter-version-change to zypper lu. Adds filtering by version change significance to reduce noise in update listings. Supports levels: rebuild (hides rebuild-onlychanges) and package (hides all release-only changes). * Autorefresh ris-services the way as plugin-services (bsc#1246504) It's actually wrong to treat service refreshes different depending on the service type. For the purpose of a service it makes no difference how the data about the repos to use are acquired. * Report download progress for command line rpms (fixes #613) * Hint to '-vv ref' to see the mirrors used to download the metadata (bsc#1257882) * Service: Allow "zypper ls SERVICE ..." to test whether a service with this alias is defined (bsc#1252744) The command prints an abstract of all services passed on the command line. It returns 3-ZYPPER_EXIT_ERR_INVALID_ARGS if some argument does not name an existing service. * Keep repo data when updating the service settings (bsc#1252744) * info: Enhance pattern content table (bsc#1158038) Alternatives (multiple packages providing the same requirement) are now listed as a single entry in the content table. The entry shows either the installed package which satisfies the requirement or the requirement itself as type 'Provides'. Listing all potential alternatives was miss leading, especially if the alternatives were mutual exclusive. It looked like an installed pattern had not-installed requirements and it was not possible to install all requirements at the same time. ## Special Instructions and Notes: ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-2575=1 * SUSE Linux Enterprise Micro 5.5 zypper in -t patch SUSE-SLE-Micro-5.5-2026-2575=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-2575=1SUSE-SLE- INSTALLER-15-SP5-2026-2575=1 * SUSE Linux Enterprise Server 15 SP5 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-2575=1 * SUSE Linux Enterprise Server 15 SP5 zypper in -t patch SUSE-SLE-INSTALLER-15-SP5-2026-2575=1 * SUSE Linux Enterprise High Performance Computing 15 SP5 zypper in -t patch SUSE-SLE-INSTALLER-15-SP5-2026-2575=1 * SUSE Linux Enterprise Desktop 15 SP5 zypper in -t patch SUSE-SLE-INSTALLER-15-SP5-2026-2575=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-2575=1 * openSUSE Leap 15.5 zypper in -t patch SUSE-2026-2575=1 ## Package List: * SUSE Linux Enterprise High Performance Computing 15 SP5 (aarch64 x86_64) * libsolv-tools-base-0.7.39-150500.6.17.1 * libzypp-17.38.13-150500.6.74.1 * libsolv-tools-0.7.39-150500.6.17.1 * SUSE Linux Enterprise Desktop 15 SP5 (x86_64) * libsolv-tools-base-0.7.39-150500.6.17.1 * libzypp-17.38.13-150500.6.74.1 * libsolv-tools-0.7.39-150500.6.17.1 * SUSE Linux Enterprise Server 15 SP5 (aarch64 ppc64le s390x x86_64) * libsolv-tools-base-0.7.39-150500.6.17.1 * libzypp-17.38.13-150500.6.74.1 * libsolv-tools-0.7.39-150500.6.17.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 (ppc64le x86_64) * libzypp-devel-17.38.13-150500.6.74.1 * libzypp-17.38.13-150500.6.74.1 * python3-solv-0.7.39-150500.6.17.1 * libzypp-debugsource-17.38.13-150500.6.74.1 * libsolv-tools-debuginfo-0.7.39-150500.6.17.1 * ruby-solv-0.7.39-150500.6.17.1 * ruby-solv-debuginfo-0.7.39-150500.6.17.1 * perl-solv-debuginfo-0.7.39-150500.6.17.1 * libsolv-debugsource-0.7.39-150500.6.17.1 * libsolv-tools-0.7.39-150500.6.17.1 * perl-solv-0.7.39-150500.6.17.1 * zypper-debuginfo-1.14.98-150500.6.45.1 * libsolv-tools-base-debuginfo-0.7.39-150500.6.17.1 * libsolv-devel-debuginfo-0.7.39-150500.6.17.1 * libsolv-debuginfo-0.7.39-150500.6.17.1 *zypper-debugsource-1.14.98-150500.6.45.1 * libsolv-devel-0.7.39-150500.6.17.1 * zypper-1.14.98-150500.6.45.1 * libsolv-tools-base-0.7.39-150500.6.17.1 * libzypp-debuginfo-17.38.13-150500.6.74.1 * python3-solv-debuginfo-0.7.39-150500.6.17.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 (noarch) * zypper-needs-restarting-1.14.98-150500.6.45.1 * zypper-log-1.14.98-150500.6.45.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (aarch64 x86_64) * libzypp-devel-17.38.13-150500.6.74.1 * libzypp-17.38.13-150500.6.74.1 * python3-solv-0.7.39-150500.6.17.1 * libzypp-debugsource-17.38.13-150500.6.74.1 * libsolv-tools-debuginfo-0.7.39-150500.6.17.1 * ruby-solv-0.7.39-150500.6.17.1 * ruby-solv-debuginfo-0.7.39-150500.6.17.1 * perl-solv-debuginfo-0.7.39-150500.6.17.1 * libsolv-debugsource-0.7.39-150500.6.17.1 * libsolv-tools-0.7.39-150500.6.17.1 * perl-solv-0.7.39-150500.6.17.1 * zypper-debuginfo-1.14.98-150500.6.45.1 * libsolv-tools-base-debuginfo-0.7.39-150500.6.17.1 * libsolv-devel-debuginfo-0.7.39-150500.6.17.1 * libsolv-debuginfo-0.7.39-150500.6.17.1 * zypper-debugsource-1.14.98-150500.6.45.1 * libsolv-devel-0.7.39-150500.6.17.1 * zypper-1.14.98-150500.6.45.1 * libsolv-tools-base-0.7.39-150500.6.17.1 * libzypp-debuginfo-17.38.13-150500.6.74.1 * python3-solv-debuginfo-0.7.39-150500.6.17.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (noarch) * zypper-needs-restarting-1.14.98-150500.6.45.1 * zypper-log-1.14.98-150500.6.45.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (aarch64 x86_64) * libzypp-devel-17.38.13-150500.6.74.1 * libzypp-17.38.13-150500.6.74.1 * python3-solv-0.7.39-150500.6.17.1 * libzypp-debugsource-17.38.13-150500.6.74.1 * libsolv-tools-debuginfo-0.7.39-150500.6.17.1 * ruby-solv-0.7.39-150500.6.17.1 * ruby-solv-debuginfo-0.7.39-150500.6.17.1 *perl-solv-debuginfo-0.7.39-150500.6.17.1 * libsolv-debugsource-0.7.39-150500.6.17.1 * libsolv-tools-0.7.39-150500.6.17.1 * perl-solv-0.7.39-150500.6.17.1 * zypper-debuginfo-1.14.98-150500.6.45.1 * libsolv-tools-base-debuginfo-0.7.39-150500.6.17.1 * libsolv-devel-debuginfo-0.7.39-150500.6.17.1 * libsolv-debuginfo-0.7.39-150500.6.17.1 * zypper-debugsource-1.14.98-150500.6.45.1 * libsolv-devel-0.7.39-150500.6.17.1 * zypper-1.14.98-150500.6.45.1 * libsolv-tools-base-0.7.39-150500.6.17.1 * libzypp-debuginfo-17.38.13-150500.6.74.1 * python3-solv-debuginfo-0.7.39-150500.6.17.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (noarch) * zypper-needs-restarting-1.14.98-150500.6.45.1 * zypper-log-1.14.98-150500.6.45.1 * openSUSE Leap 15.5 (aarch64 i586 ppc64le s390x x86_64) * libzypp-devel-17.38.13-150500.6.74.1 * libsolv-demo-debuginfo-0.7.39-150500.6.17.1 * libzypp-17.38.13-150500.6.74.1 * python3-solv-0.7.39-150500.6.17.1 * libsolv-demo-0.7.39-150500.6.17.1 * libzypp-debugsource-17.38.13-150500.6.74.1 * python311-solv-0.7.39-150500.6.17.1 * python311-solv-debuginfo-0.7.39-150500.6.17.1 * libsolv-tools-debuginfo-0.7.39-150500.6.17.1 * ruby-solv-0.7.39-150500.6.17.1 * ruby-solv-debuginfo-0.7.39-150500.6.17.1 * perl-solv-debuginfo-0.7.39-150500.6.17.1 * libsolv-debugsource-0.7.39-150500.6.17.1 * libsolv-tools-0.7.39-150500.6.17.1 * perl-solv-0.7.39-150500.6.17.1 * zypper-debuginfo-1.14.98-150500.6.45.1 * libsolv-tools-base-debuginfo-0.7.39-150500.6.17.1 * libsolv-devel-debuginfo-0.7.39-150500.6.17.1 * libsolv-debuginfo-0.7.39-150500.6.17.1 * zypper-debugsource-1.14.98-150500.6.45.1 * libsolv-devel-0.7.39-150500.6.17.1 * zypper-1.14.98-150500.6.45.1 * libsolv-tools-base-0.7.39-150500.6.17.1 * libzypp-debuginfo-17.38.13-150500.6.74.1 * libzypp-devel-doc-17.38.13-150500.6.74.1 * python3-solv-debuginfo-0.7.39-150500.6.17.1 * openSUSE Leap 15.5(noarch) * zypper-needs-restarting-1.14.98-150500.6.45.1 * zypper-aptitude-1.14.98-150500.6.45.1 * zypper-log-1.14.98-150500.6.45.1 * SUSE Linux Enterprise Micro 5.5 (aarch64 ppc64le s390x x86_64) * libsolv-debugsource-0.7.39-150500.6.17.1 * libsolv-debuginfo-0.7.39-150500.6.17.1 * libsolv-tools-0.7.39-150500.6.17.1 * zypper-debugsource-1.14.98-150500.6.45.1 * zypper-1.14.98-150500.6.45.1 * zypper-debuginfo-1.14.98-150500.6.45.1 * libzypp-debugsource-17.38.13-150500.6.74.1 * libsolv-tools-base-0.7.39-150500.6.17.1 * libzypp-17.38.13-150500.6.74.1 * libsolv-tools-debuginfo-0.7.39-150500.6.17.1 * libzypp-debuginfo-17.38.13-150500.6.74.1 * libsolv-tools-base-debuginfo-0.7.39-150500.6.17.1 * SUSE Linux Enterprise Micro 5.5 (noarch) * zypper-needs-restarting-1.14.98-150500.6.45.1 * SUSE Linux Enterprise Server 15 SP5 LTSS (aarch64 ppc64le s390x x86_64) * libzypp-devel-17.38.13-150500.6.74.1 * libzypp-17.38.13-150500.6.74.1 * python3-solv-0.7.39-150500.6.17.1 * libzypp-debugsource-17.38.13-150500.6.74.1 * libsolv-tools-debuginfo-0.7.39-150500.6.17.1 * ruby-solv-0.7.39-150500.6.17.1 * ruby-solv-debuginfo-0.7.39-150500.6.17.1 * perl-solv-debuginfo-0.7.39-150500.6.17.1 * libsolv-debugsource-0.7.39-150500.6.17.1 * libsolv-tools-0.7.39-150500.6.17.1 * perl-solv-0.7.39-150500.6.17.1 * zypper-debuginfo-1.14.98-150500.6.45.1 * libsolv-tools-base-debuginfo-0.7.39-150500.6.17.1 * libsolv-devel-debuginfo-0.7.39-150500.6.17.1 * libsolv-debuginfo-0.7.39-150500.6.17.1 * zypper-debugsource-1.14.98-150500.6.45.1 * libsolv-devel-0.7.39-150500.6.17.1 * zypper-1.14.98-150500.6.45.1 * libsolv-tools-base-0.7.39-150500.6.17.1 * libzypp-debuginfo-17.38.13-150500.6.74.1 * python3-solv-debuginfo-0.7.39-150500.6.17.1 * SUSE Linux Enterprise Server 15 SP5 LTSS (noarch) * zypper-needs-restarting-1.14.98-150500.6.45.1 * zypper-log-1.14.98-150500.6.45.1 ## References: *https://www.suse.com/security/cve/CVE-2026-25707.html * https://www.suse.com/security/cve/CVE-2026-44933.html * https://www.suse.com/security/cve/CVE-2026-44941.html * https://www.suse.com/security/cve/CVE-2026-44942.html * https://www.suse.com/security/cve/CVE-2026-48863.html * https://www.suse.com/security/cve/CVE-2026-9149.html * https://www.suse.com/security/cve/CVE-2026-9150.html * https://bugzilla.suse.com/show_bug.cgi?id=1158038 * https://bugzilla.suse.com/show_bug.cgi?id=1239718 * https://bugzilla.suse.com/show_bug.cgi?id=1246504 * https://bugzilla.suse.com/show_bug.cgi?id=1247948 * https://bugzilla.suse.com/show_bug.cgi?id=1249435 * https://bugzilla.suse.com/show_bug.cgi?id=1252744 * https://bugzilla.suse.com/show_bug.cgi?id=1253193 * https://bugzilla.suse.com/show_bug.cgi?id=1253740 * https://bugzilla.suse.com/show_bug.cgi?id=1257068 * https://bugzilla.suse.com/show_bug.cgi?id=1257882 * https://bugzilla.suse.com/show_bug.cgi?id=1258193 * https://bugzilla.suse.com/show_bug.cgi?id=1259311 * https://bugzilla.suse.com/show_bug.cgi?id=1259706 * https://bugzilla.suse.com/show_bug.cgi?id=1259802 * https://bugzilla.suse.com/show_bug.cgi?id=1259842 * https://bugzilla.suse.com/show_bug.cgi?id=1265223 * https://bugzilla.suse.com/show_bug.cgi?id=1265935 * https://bugzilla.suse.com/show_bug.cgi?id=1265938 * https://bugzilla.suse.com/show_bug.cgi?id=1266039 * https://bugzilla.suse.com/show_bug.cgi?id=1267426 * https://bugzilla.suse.com/show_bug.cgi?id=1267874 * https://jira.suse.com/browse/PED-13680 * https://jira.suse.com/browse/PED-14658 * https://jira.suse.com/browse/PED-15607 . A critical security update addresses multiple vulnerabilities in SUSE, including buffer overflows and file overwrites. Optimize your systems.. SUSE security updates, libsolv vulnerabilities, zypper update, openSUSE patches. . Severity: Important. LinuxSecurity.com Team
Jun 23, 2026
•Important
SuSE
98
security advisoryRed Hat Enterprise Linuxsecurity impactModerate Update: dmidecode Local File Overwrite in RHEL 8 RHSA-2023:5252-01
An update for dmidecode is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: dmidecode security update Advisory ID: RHSA-2023:5252-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2023:5252 Issue date: 2023-09-19 CVE Names: CVE-2023-30630 ===================================================================== 1. Summary: An update for dmidecode is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, x86_64 3. Description: The dmidecode packages provide utilities for extracting Intel 64 and Intel Itanium hardware information from the system BIOS or Extensible Firmware Interface (EFI), depending on the SMBIOS/DMI standard. This information typically includes system manufacturer, model name, serial number, BIOS version, and asset tag, as well as other details, depending on the manufacturer. Security Fix(es): * dmidecode: dump-bin to overwrite a local file (CVE-2023-30630) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, referto: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2186669 - CVE-2023-30630 dmidecode: dump-bin to overwrite a local file 6. Package List: Red Hat Enterprise Linux BaseOS (v. 8): Source: dmidecode-3.3-4.el8_8.1.src.rpm aarch64: dmidecode-3.3-4.el8_8.1.aarch64.rpm dmidecode-debuginfo-3.3-4.el8_8.1.aarch64.rpm dmidecode-debugsource-3.3-4.el8_8.1.aarch64.rpm x86_64: dmidecode-3.3-4.el8_8.1.x86_64.rpm dmidecode-debuginfo-3.3-4.el8_8.1.x86_64.rpm dmidecode-debugsource-3.3-4.el8_8.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2023-30630 https://access.redhat.com/security/updates/classification#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCAAGBQJlCb3lAAoJENzjgjWX9erEvf8P/0Q5xme4wX46ceez/+txxBu1 yjx1WZK9JZvvOj8trsldeG6caztK9+cq2vBpYSy6LCqsxrv1vev5+X79q53M+D3e 4FLuLfvmv2+YU70Mw4gxui5inC4Vq9C3/74T3KrVDJAQmNRyxsjkRqFEHx3lrcI6 N/741+yZNQf2UhcJGfqXAXDXR3MJ6b6QKxPWlYDHc5h4tV6s9Y26LZdUE5qyPaU9 SAA7IRjaph92zy9+f/ndvPeQ2KTp/UgrxPoAav96+Lz0/Xuo+nahFLEVFEi+eCc3 J3mu/J/vViXd4h0Y5kgle74alPhcQyOxUbvs4kE5jCdGvJOM6Os7EZ6h0nVAn8dM y7NAAcwQ/IHL6/47wsapO5Q/GBzZymbYwWKZGcERJJxD8QRuOr+EeQ/AyC6ePScK n6KLbXyt+mBOH0+BzMAsaxJVvG5PaZMmiip7ECnqSeVv/zfPj8DZoiDp88AfzL+w +W2Zgk1gJH9u5jQlx/0IX5icOavxu2jnFT8F2K5rTg8dj5W30RGjYgainFzbt3on c/wBHlAY/3ipR+0GN28JfeWOqJ2yTFldpazczfBU4wSr4lHx9k395lH39pUo0yzR eWA1cdiCzUBRzbOvhofM89l8paghrfoasFI86Zc385TNSRu1nJ/LnjK5RUElZ5Wp qUolUpWxaMko2Dz+hYXX =QDC0 -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Sep 19, 2023
Red Hat
98
security advisorymoderatesecurity fixRHEL 9 RHSA-2023-5061 Moderate: Dmidecode Local File Overwrite
An update for dmidecode is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: dmidecode security update Advisory ID: RHSA-2023:5061-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2023:5061 Issue date: 2023-09-12 CVE Names: CVE-2023-30630 ===================================================================== 1. Summary: An update for dmidecode is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux BaseOS (v. 9) - aarch64, x86_64 3. Description: The dmidecode packages provide utilities for extracting Intel 64 and Intel Itanium hardware information from the system BIOS or Extensible Firmware Interface (EFI), depending on the SMBIOS/DMI standard. This information typically includes system manufacturer, model name, serial number, BIOS version, and asset tag, as well as other details, depending on the manufacturer. Security Fix(es): * dmidecode: dump-bin to overwrite a local file (CVE-2023-30630) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, referto: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2186669 - CVE-2023-30630 dmidecode: dump-bin to overwrite a local file 6. Package List: Red Hat Enterprise Linux BaseOS (v. 9): Source: dmidecode-3.3-7.el9_2.1.src.rpm aarch64: dmidecode-3.3-7.el9_2.1.aarch64.rpm dmidecode-debuginfo-3.3-7.el9_2.1.aarch64.rpm dmidecode-debugsource-3.3-7.el9_2.1.aarch64.rpm x86_64: dmidecode-3.3-7.el9_2.1.x86_64.rpm dmidecode-debuginfo-3.3-7.el9_2.1.x86_64.rpm dmidecode-debugsource-3.3-7.el9_2.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2023-30630 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCAAGBQJlAINeAAoJENzjgjWX9erE1ggP/jpgP6tmujOEKsHNMmefIpfo h8Fs+hDUJxaD8BsFgKyVX3YEv4Gx/czFytIfiNmZAutM5B5kq6oVuojQv1/aUzq2 SQ4sbT3WJLcbz+Y8SgBnkiHvif7jCOCZ/KSe0J99Y7Oab54nx0ApA/Cjjj2CtHE6 U8UXNZh4S6mXn58AFM7Pstbk7bv+F9X2meKF+0uM6u5jEO87wXYR261DekaYS7uI ZEZ5R4tnQG3uZ6N4zrqf0GrDxamZfvFqRd1ENhN/lUa8GvTglDym1vnV49QBe0Ol L7BDDAx8Zd2rnD7+fHTxyIvFF5/rF7pp9IR+qvKtgci4Dtn/la+AYlZxnEv8RmHh b6SnSj2kxFPueAHBcMLeCF/ska7D2rEJflQcggEN0P+7cqIGnAXz5tRULBQ04dbc Zq3IZ56/vJ/djY2m7Lih34Z/Kq4pm61tNN0CO6g9GUZf4kF3LdWCmFflm0wzQHeH ZPx8rWXbH0Yeo5BL59p3stViYSQ4n1XlRscqPCWfisiAXS1zNWP1/lUli9Et3woA F0/cvMULK5jZtrA9hFMzuz/38EsbfOdinywVLMcS/DlylRIFul+yEfjgGMuGnfol X/YK4B0Zfdf2yd8tfRjQHy3LUK9tROYIgIj20GmNBoGA6J9Hs8ZiPFlytAb5nEQ7 zTNd47I4HgAeayIuwREi =9ZnK -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Sep 12, 2023
Red Hat
89
security advisoryfedoracurlFedora 31: FEDORA-2020-55f1f7cb13 Critical: Curl Local File Safety
- avoid overwriting a local file with -J (CVE-2020-8177) - fix partial password leak over DNS on HTTP redirect (CVE-2020-8169). --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-55f1f7cb13 2020-07-10 01:00:39.961680 --------------------------------------------------------------------------------Name : curl Product : Fedora 31 Version : 7.66.0 Release : 2.fc31 URL : https://curl.se/ Summary : A utility for getting files from remote servers (FTP, HTTP, and others) Description : curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies, user+password authentication (Basic, Digest, NTLM, Negotiate, kerberos...), file transfer resume, proxy tunneling and a busload of other useful tricks. --------------------------------------------------------------------------------Update Information: - avoid overwriting a local file with -J (CVE-2020-8177) - fix partial password leak over DNS on HTTP redirect (CVE-2020-8169) --------------------------------------------------------------------------------ChangeLog: * Wed Jun 24 2020 Kamil Dudka - 7.66.0-2 - avoid overwriting a local file with -J (CVE-2020-8177) - fix partial password leak over DNS on HTTP redirect (CVE-2020-8169) --------------------------------------------------------------------------------References: [ 1 ] Bug #1847915 - CVE-2020-8177 curl: command line arguments lead to local file overwrite https://bugzilla.redhat.com/show_bug.cgi?id=1847915 [ 2 ] Bug #1847916 - CVE-2020-8169 libcurl: partial password leak over DNS on HTTP redirect https://bugzilla.redhat.com/show_bug.cgi?id=1847916 --------------------------------------------------------------------------------This update canbe installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-55f1f7cb13' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Jul 09, 2020
•Critical
Fedora
89
security advisorycriticalFedoraFedora 33: FEDORA-2020-8bd1aa7647 Important: wget Remote Code Execution
- avoid overwriting a local file with -J (CVE-2020-8177) - fix partial password leak over DNS on HTTP redirect (CVE-2020-8169). --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-6af1dd2936 2020-06-27 02:05:35.505793 --------------------------------------------------------------------------------Name : curl Product : Fedora 32 Version : 7.69.1 Release : 4.fc32 URL : https://curl.se/ Summary : A utility for getting files from remote servers (FTP, HTTP, and others) Description : curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies, user+password authentication (Basic, Digest, NTLM, Negotiate, kerberos...), file transfer resume, proxy tunneling and a busload of other useful tricks. --------------------------------------------------------------------------------Update Information: - avoid overwriting a local file with -J (CVE-2020-8177) - fix partial password leak over DNS on HTTP redirect (CVE-2020-8169) --------------------------------------------------------------------------------ChangeLog: * Wed Jun 24 2020 Kamil Dudka - 7.69.1-4 - avoid overwriting a local file with -J (CVE-2020-8177) - fix partial password leak over DNS on HTTP redirect (CVE-2020-8169) --------------------------------------------------------------------------------References: [ 1 ] Bug #1847915 - CVE-2020-8177 curl: command line arguments lead to local file overwrite https://bugzilla.redhat.com/show_bug.cgi?id=1847915 [ 2 ] Bug #1847916 - CVE-2020-8169 libcurl: partial password leak over DNS on HTTP redirect https://bugzilla.redhat.com/show_bug.cgi?id=1847916 --------------------------------------------------------------------------------This update canbe installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-6af1dd2936' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Jun 26, 2020
•Important
Fedora
100
security advisoryimportantSUSE LinuxSUSE: 2020:1734-1 Important: curl Local File Overwrite Security Fix
An update that fixes one vulnerability is now available. . SUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: SUSE-SU-2020:1734-1 Rating: important References: #1173027 Cross-References: CVE-2020-8177 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP5 SUSE Linux Enterprise Server 12-SP5 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for curl fixes the following issues: - CVE-2020-8177: Fixed an issue where curl could have been tricked by a malicious server to overwrite a local file when using the -J option (bsc#1173027). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP5: zypper in -t patch SUSE-SLE-SDK-12-SP5-2020-1734=1 - SUSE Linux Enterprise Server 12-SP5: zypper in -t patch SUSE-SLE-SERVER-12-SP5-2020-1734=1 Package List: - SUSE Linux Enterprise Software Development Kit 12-SP5 (aarch64 ppc64le s390x x86_64): curl-debuginfo-7.60.0-11.3.2 curl-debugsource-7.60.0-11.3.2 libcurl-devel-7.60.0-11.3.2 - SUSE Linux Enterprise Server 12-SP5 (aarch64 ppc64le s390x x86_64): curl-7.60.0-11.3.2 curl-debuginfo-7.60.0-11.3.2 curl-debugsource-7.60.0-11.3.2 libcurl4-7.60.0-11.3.2 libcurl4-debuginfo-7.60.0-11.3.2 - SUSE Linux Enterprise Server 12-SP5 (s390x x86_64): libcurl4-32bit-7.60.0-11.3.2 libcurl4-debuginfo-32bit-7.60.0-11.3.2 References: https://www.suse.com/security/cve/CVE-2020-8177.html https://bugzilla.suse.com/1173027 _______________________________________________ sle-security-updates mailing list
Jun 24, 2020
•Important
SuSE
172
security advisoryUbuntuinformation exposureUbuntu 20.04 LTS: USN-4402-1 Moderate: Curl Information Exposure
Several security issues were fixed in curl.. =========================================================================Ubuntu Security Notice USN-4402-1 June 24, 2020 curl vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.04 LTS - Ubuntu 19.10 - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS - Ubuntu 14.04 ESM - Ubuntu 12.04 ESM Summary: Several security issues were fixed in curl. Software Description: - curl: HTTP, HTTPS, and FTP client and client libraries Details: Marek Szlagor, Gregory Jefferis and Jeroen Ooms discovered that curl incorrectly handled certain credentials. An attacker could possibly use this issue to expose sensitive information. This issue only affected Ubuntu 19.10 and Ubuntu 20.04 LTS. (CVE-2020-8169) It was discovered that curl incorrectly handled certain parameters. An attacker could possibly use this issue to overwrite a local file. (CVE-2020-8177) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 20.04 LTS: curl 7.68.0-1ubuntu2.1 libcurl3-gnutls 7.68.0-1ubuntu2.1 libcurl3-nss 7.68.0-1ubuntu2.1 libcurl4 7.68.0-1ubuntu2.1 Ubuntu 19.10: curl 7.65.3-1ubuntu3.1 libcurl3-gnutls 7.65.3-1ubuntu3.1 libcurl3-nss 7.65.3-1ubuntu3.1 libcurl4 7.65.3-1ubuntu3.1 Ubuntu 18.04 LTS: curl 7.58.0-2ubuntu3.9 libcurl3-gnutls 7.58.0-2ubuntu3.9 libcurl3-nss 7.58.0-2ubuntu3.9 libcurl4 7.58.0-2ubuntu3.9 Ubuntu 16.04 LTS: curl 7.47.0-1ubuntu2.15 libcurl3 7.47.0-1ubuntu2.15 libcurl3-gnutls 7.47.0-1ubuntu2.15 libcurl3-nss 7.47.0-1ubuntu2.15 Ubuntu 14.04 ESM: curl 7.35.0-1ubuntu2.20+esm4 libcurl3 7.35.0-1ubuntu2.20+esm4 libcurl3-gnutls 7.35.0-1ubuntu2.20+esm4 libcurl3-nss 7.35.0-1ubuntu2.20+esm4 Ubuntu 12.04 ESM: curl 7.22.0-3ubuntu4.28 libcurl3 7.22.0-3ubuntu4.28 libcurl3-gnutls 7.22.0-3ubuntu4.28 libcurl3-nss 7.22.0-3ubuntu4.28 In general, a standard system update will make all the necessary changes. References: CVE-2020-8169, CVE-2020-8177 Package Information: https://launchpad.net/ubuntu/+source/curl/7.68.0-1ubuntu2.1 https://launchpad.net/ubuntu/+source/curl/7.65.3-1ubuntu3.1 https://launchpad.net/ubuntu/+source/curl/7.58.0-2ubuntu3.9 https://launchpad.net/ubuntu/+source/curl/7.47.0-1ubuntu2.15 . Significant security flaws in curl were patched by recent Ubuntu updates, highlighting issues of information leakage and potential for unauthorized file overwriting.. Ubuntu curl vulnerabilities security update. . LinuxSecurity.com Team
Jun 24, 2020
Ubuntu
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!