Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Several security issues were fixed in PHP.. =========================================================================Ubuntu Security Notice USN-2254-1 June 23, 2014 php5 vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 14.04 LTS - Ubuntu 13.10 - Ubuntu 12.04 LTS - Ubuntu 10.04 LTS Summary: Several security issues were fixed in PHP. Software Description: - php5: HTML-embedded scripting language interpreter Details: Christian Hoffmann discovered that the PHP FastCGI Process Manager (FPM) set incorrect permissions on the UNIX socket. A local attacker could use this issue to possibly elevate their privileges. This issue only affected Ubuntu 12.04 LTS, Ubuntu 13.10, and Ubuntu 14.04 LTS. (CVE-2014-0185) Francisco Alonso discovered that the PHP Fileinfo component incorrectly handled certain CDF documents. A remote attacker could use this issue to cause PHP to hang or crash, resulting in a denial of service. (CVE-2014-0237, CVE-2014-0238) Stefan Esser discovered that PHP incorrectly handled DNS TXT records. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2014-4049) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 14.04 LTS: libapache2-mod-php5 5.5.9+dfsg-1ubuntu4.1 php5-cgi 5.5.9+dfsg-1ubuntu4.1 php5-cli 5.5.9+dfsg-1ubuntu4.1 php5-fpm 5.5.9+dfsg-1ubuntu4.1 Ubuntu 13.10: libapache2-mod-php5 5.5.3+dfsg-1ubuntu2.4 php5-cgi 5.5.3+dfsg-1ubuntu2.4 php5-cli 5.5.3+dfsg-1ubuntu2.4 php5-fpm 5.5.3+dfsg-1ubuntu2.4 Ubuntu 12.04 LTS: libapache2-mod-php5 5.3.10-1ubuntu3.12 php5-cgi 5.3.10-1ubuntu3.12 php5-cli 5.3.10-1ubuntu3.12 php5-fpm 5.3.10-1ubuntu3.12 Ubuntu 10.04 LTS: libapache2-mod-php5 5.3.2-1ubuntu4.25 php5-cgi 5.3.2-1ubuntu4.25 php5-cli 5.3.2-1ubuntu4.25 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-2254-1 CVE-2014-0185, CVE-2014-0237, CVE-2014-0238, CVE-2014-4049 Package Information: https://launchpad.net/ubuntu/+source/php5/5.5.9+dfsg-1ubuntu4.1 https://launchpad.net/ubuntu/+source/php5/5.5.3+dfsg-1ubuntu2.4 https://launchpad.net/ubuntu/+source/php5/5.3.10-1ubuntu3.12 https://launchpad.net/ubuntu/+source/php5/5.3.2-1ubuntu4.25 . Various CVEs associated with PHP vulnerabilities have been announced and patched across different Ubuntu versions, addressing threats from both local and remote attackers.. PHP Risks, Ubuntu Security, Denial of Service. . Severity: Important. LinuxSecurity.com Team
Updated kernel packages that fix security issues are now available for Red Hat Enterprise Linux 4.7 Extended Update Support. This update has been rated as having important security impact by the Red Hat Security Response Team.. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Important: kernel security update Advisory ID: RHSA-2009:1588-02 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2009:1588.html Issue date: 2009-11-17 CVE Names: CVE-2009-3547 ==================================================================== 1. Summary: Updated kernel packages that fix security issues are now available for Red Hat Enterprise Linux 4.7 Extended Update Support. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4.7.z - i386, ia64, noarch, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux ES version 4.7.z - i386, ia64, noarch, x86_64 3. Description: The kernel packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issues: * a NULL pointer dereference flaw was found in each of the following functions in the Linux kernel: pipe_read_open(), pipe_write_open(), and pipe_rdwr_open(). When the mutex lock is not held, the i_pipe pointer could be released by other processes before it is used to update the pipe's reader and writer counters. This could lead to a local denial of service or privilege escalation. (CVE-2009-3547, Important) Users should upgrade to these updated packages, which contain a backported patch to correct these issues. The system must be rebooted for this update to take effect. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Thisupdate is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at 5. Bugs fixed (http://bugzilla.redhat.com/): 530490 - CVE-2009-3547 kernel: fs: pipe.c null pointer dereference 6. Package List: Red Hat Enterprise Linux AS version 4.7.z: Source: kernel-2.6.9-78.0.28.EL.src.rpm i386: kernel-2.6.9-78.0.28.EL.i686.rpm kernel-debuginfo-2.6.9-78.0.28.EL.i686.rpm kernel-devel-2.6.9-78.0.28.EL.i686.rpm kernel-hugemem-2.6.9-78.0.28.EL.i686.rpm kernel-hugemem-devel-2.6.9-78.0.28.EL.i686.rpm kernel-smp-2.6.9-78.0.28.EL.i686.rpm kernel-smp-devel-2.6.9-78.0.28.EL.i686.rpm kernel-xenU-2.6.9-78.0.28.EL.i686.rpm kernel-xenU-devel-2.6.9-78.0.28.EL.i686.rpm ia64: kernel-2.6.9-78.0.28.EL.ia64.rpm kernel-debuginfo-2.6.9-78.0.28.EL.ia64.rpm kernel-devel-2.6.9-78.0.28.EL.ia64.rpm kernel-largesmp-2.6.9-78.0.28.EL.ia64.rpm kernel-largesmp-devel-2.6.9-78.0.28.EL.ia64.rpm noarch: kernel-doc-2.6.9-78.0.28.EL.noarch.rpm ppc: kernel-2.6.9-78.0.28.EL.ppc64.rpm kernel-2.6.9-78.0.28.EL.ppc64iseries.rpm kernel-debuginfo-2.6.9-78.0.28.EL.ppc64.rpm kernel-debuginfo-2.6.9-78.0.28.EL.ppc64iseries.rpm kernel-devel-2.6.9-78.0.28.EL.ppc64.rpm kernel-devel-2.6.9-78.0.28.EL.ppc64iseries.rpm kernel-largesmp-2.6.9-78.0.28.EL.ppc64.rpm kernel-largesmp-devel-2.6.9-78.0.28.EL.ppc64.rpm s390: kernel-2.6.9-78.0.28.EL.s390.rpm kernel-debuginfo-2.6.9-78.0.28.EL.s390.rpm kernel-devel-2.6.9-78.0.28.EL.s390.rpm s390x: kernel-2.6.9-78.0.28.EL.s390x.rpm kernel-debuginfo-2.6.9-78.0.28.EL.s390x.rpm kernel-devel-2.6.9-78.0.28.EL.s390x.rpm x86_64: kernel-2.6.9-78.0.28.EL.x86_64.rpm kernel-debuginfo-2.6.9-78.0.28.EL.x86_64.rpm kernel-devel-2.6.9-78.0.28.EL.x86_64.rpm kernel-largesmp-2.6.9-78.0.28.EL.x86_64.rpm kernel-largesmp-devel-2.6.9-78.0.28.EL.x86_64.rpm kernel-smp-2.6.9-78.0.28.EL.x86_64.rpm kernel-smp-devel-2.6.9-78.0.28.EL.x86_64.rpm kernel-xenU-2.6.9-78.0.28.EL.x86_64.rpm kernel-xenU-devel-2.6.9-78.0.28.EL.x86_64.rpm Red Hat Enterprise Linux ES version4.7.z: Source: kernel-2.6.9-78.0.28.EL.src.rpm i386: kernel-2.6.9-78.0.28.EL.i686.rpm kernel-debuginfo-2.6.9-78.0.28.EL.i686.rpm kernel-devel-2.6.9-78.0.28.EL.i686.rpm kernel-hugemem-2.6.9-78.0.28.EL.i686.rpm kernel-hugemem-devel-2.6.9-78.0.28.EL.i686.rpm kernel-smp-2.6.9-78.0.28.EL.i686.rpm kernel-smp-devel-2.6.9-78.0.28.EL.i686.rpm kernel-xenU-2.6.9-78.0.28.EL.i686.rpm kernel-xenU-devel-2.6.9-78.0.28.EL.i686.rpm ia64: kernel-2.6.9-78.0.28.EL.ia64.rpm kernel-debuginfo-2.6.9-78.0.28.EL.ia64.rpm kernel-devel-2.6.9-78.0.28.EL.ia64.rpm kernel-largesmp-2.6.9-78.0.28.EL.ia64.rpm kernel-largesmp-devel-2.6.9-78.0.28.EL.ia64.rpm noarch: kernel-doc-2.6.9-78.0.28.EL.noarch.rpm x86_64: kernel-2.6.9-78.0.28.EL.x86_64.rpm kernel-debuginfo-2.6.9-78.0.28.EL.x86_64.rpm kernel-devel-2.6.9-78.0.28.EL.x86_64.rpm kernel-largesmp-2.6.9-78.0.28.EL.x86_64.rpm kernel-largesmp-devel-2.6.9-78.0.28.EL.x86_64.rpm kernel-smp-2.6.9-78.0.28.EL.x86_64.rpm kernel-smp-devel-2.6.9-78.0.28.EL.x86_64.rpm kernel-xenU-2.6.9-78.0.28.EL.x86_64.rpm kernel-xenU-devel-2.6.9-78.0.28.EL.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key#package 7. References: https://www.cve.org/CVERecord?id=CVE-2009-3547 https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2009 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFLAsHPXlSAg2UNWIIRAnrUAJ4kZabgvSp+lrl8C90AgZpxkYp25gCgo4KI DDCDA11FNUHQsUDt6VPn4Bg=yPx5 -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list
Marcus Meissner discovered that the PulseAudio sound server performed insufficent checks when dropping privileges, which could lead to local privilege escalation. . - ------------------------------------------------------------------------Debian Security Advisory DSA-1476-1
Updated package.. - --------------------------------------------------------------------------Debian Security Advisory DSA 1237-1
Exploit could cause arbitrary code to be executed with the privileges of the log2mail process.. Debian Security Advisory DSA 513-1
eldav, a WebDAV client for Emacs, creates temporary files without taking appropriate security precautions. This vulnerability could be exploited by a local user to create or overwrite files with the privileges of the user running emacs and eldav.. -------------------------------------------------------------------------- Debian Security Advisory DSA 325-1
Due to insufficient bounds checking performed by the whois parser, it may be possible to corrupt memory on the system stack.. -------------------------------------------------------------------------- Debian Security Advisory DSA 254-1
The KDE team discovered several vulnerabilities in the K DesktopEnvironment. In some instances KDE fails to properly quote parametersof instructions passed to a command shell for execution.. -------------------------------------------------------------------------- Debian Security Advisory DSA 242-1
Get the latest Linux and open source security news straight to your inbox.