Stay Secure with the Latest Linux Advisories

security advisoryhigh severitysecurity issue

Fedora: FSA-202008-34 Critical: Kernel Denial of Service Vulnerability

The package lynis before version 2.5.0-1 is vulnerable to arbitrary file overwrite. . Arch Linux Security Advisory ASA-201705-20 ========================================= Severity: High Date : 2017-05-22 CVE-ID : CVE-2017-8108 Package : lynis Type : arbitrary file overwrite Remote : No Link : https://security.archlinux.org/AVG-278 Summary ====== The package lynis before version 2.5.0-1 is vulnerable to arbitrary file overwrite. Resolution ========= Upgrade to 2.5.0-1. # pacman -Syu "lynis> =2.5.0-1" The problem has been fixed upstream in version 2.5.0. Workaround ========= None. Description ========== Michael Scherer discovered that some Lynis tests reuse the same temporary file. As some tests remove the temporary file, this might give an attacker the possibility to perform a link following attack. While timing must be perfect, there is a very small time window in which the attack can recreate the temporary file and symlink it to another resource, like a file. In this case data may be overwritten, or possibly executed. Impact ===== A local unprivileged attacker is able to overwrite arbitrary files on the filesystem possibly leading to privilege escalation. References ========= https://bugs.archlinux.org/task/54067 https://cisofy.com/security/cve/cve-2017-8108/ https://security.archlinux.org/CVE-2017-8108 . The Debian Security Advisory DSA-2021-45 outlines a critical vulnerability that allows for unauthorized code execution in libvpx.. Arch Linux, Lynis Package, Security Update, File Overwrite Risk. . LinuxSecurity.com Team

May 22, 2017 ArchLinux