Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 544
Alerts This Week
Warning Icon 1 544

Stay Secure with the Latest Linux Advisories

Fedora Large Esm H800
Fedora

Fedora 43 Kernel Important Security Fix for net/can 2026-f1fc7772c3

Calendar White Jul 21, 2026
Important
Fedora Large Esm H900
Fedora

Fedora 43 Nuclei Important Cross-site Scripting DoS Threat 2026-d36ca2dd19

Calendar White Jul 21, 2026
Important
Fedora Large Esm H900
Fedora

Fedora 43 perl-Crypt-OpenSSL-X509 Important Fix CVE-2026-58101

Calendar White Jul 21, 2026
Critical
Fedora Large Esm H800
Fedora

Fedora 43 rust-syslog Critical Path Traversal DoS Vuln 2026-659cb50390

Calendar White Jul 21, 2026
Important
Fedora Large Esm H900
Fedora

Fedora 43 Rust RPKI Critical Path Traversal Issues Fix 2026-659cb50390

Calendar White Jul 21, 2026
Important
Fedora Large Esm H900
Fedora

Fedora 43 Routinator Important Security Fixes CVE-2026-49232 to 49235

Calendar White Jul 21, 2026
Important
Fedora Large Esm H800
Fedora

Fedora 43 rust-fern Important Path Traversal Fix Advisory 2026-659cb50390

Calendar White Jul 21, 2026
Important
Fedora Large Esm H900
Fedora

Fedora 44 Kernel Important Net CAN Issue Fix Advisory 2026-2dd8b600bb

Calendar White Jul 21, 2026
Important
Fedora Large Esm H900
Fedora

Fedora 44 btrbk Critical Update Snapshot Tool Fix CVE-2026-62943

Calendar White Jul 21, 2026
Important
Filter%20icon Refine advisories
X Clear Filters
X Clear Filters
View More

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

More Polls

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":1,"type":"x","order":4,"pct":100,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Loading...

Explore Latest Linux Security advisories

We found 6 articles for you...
172
Ls Advisories Ubuntu Esm H240
Price Tag%201security advisorysecurity updatecritical

Ubuntu 20.04: USN-6881-1 Critical Exim Response Injection Threat

Exim could be made to allow response injection if it received a specially crafted response.. ========================================================================== Ubuntu Security Notice USN-6881-1 July 08, 2024 exim4 vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: Exim could be made to allow response injection if it received a specially crafted response. Software Description: - exim4: Exim is a mail transport agent Details: It was discovered that Exim did not enforce STARTTLS sync point on client side. An attacker could possibly use this issue to perform response injection during MTA SMTP sending. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 20.04 LTS exim4 4.93-13ubuntu1.11 exim4-base 4.93-13ubuntu1.11 eximon4 4.93-13ubuntu1.11 Ubuntu 18.04 LTS exim4 4.90.1-1ubuntu1.10+esm4 Available with Ubuntu Pro exim4-base 4.90.1-1ubuntu1.10+esm4 Available with Ubuntu Pro eximon4 4.90.1-1ubuntu1.10+esm4 Available with Ubuntu Pro Ubuntu 16.04 LTS exim4 4.86.2-2ubuntu2.6+esm7 Available with Ubuntu Pro exim4-base 4.86.2-2ubuntu2.6+esm7 Available with Ubuntu Pro eximon4 4.86.2-2ubuntu2.6+esm7 Available with Ubuntu Pro Ubuntu 14.04 LTS exim4 4.82-3ubuntu2.4+esm8 Available with Ubuntu Pro exim4-base 4.82-3ubuntu2.4+esm8 Available with Ubuntu Pro eximon4 4.82-3ubuntu2.4+esm8 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6881-1 CVE-2021-38371 Package Information: https://launchpad.net/ubuntu/+source/exim4/4.93-13ubuntu1.11 . Exim has implemented a security patch addressing a response injection vulnerability that impacts various versions of Ubuntu. Discover additional details here.. Exim Update, Ubuntu Security, Mail Transport Agent, Security Patch. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Jul 10, 2024 •Critical Ubuntu
172
Ls Advisories Ubuntu Esm H240
Price Tag%201security advisorydenial of servicecritical issue

Ubuntu 16.04 ESM: USN-4934-2 Critical: Exim Denial Of Service

Several security issues were fixed in Exim.. =========================================================================Ubuntu Security Notice USN-4934-2 May 06, 2021 exim4 vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 ESM - Ubuntu 14.04 ESM Summary: Several security issues were fixed in Exim. Software Description: - exim4: Exim is a mail transport agent Details: USN-4934-1 fixed several vulnerabilities in Exim. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. CVE-2020-28026 only affected Ubuntu 16.04 ESM. Original advisory details: It was discovered that Exim contained multiple security issues. An attacker could use these issues to cause a denial of service, execute arbitrary code remotely, obtain sensitive information, or escalate local privileges. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 ESM: exim4-base 4.86.2-2ubuntu2.6+esm1 exim4-daemon-heavy 4.86.2-2ubuntu2.6+esm1 exim4-daemon-light 4.86.2-2ubuntu2.6+esm1 Ubuntu 14.04 ESM: exim4-base 4.82-3ubuntu2.4+esm3 exim4-daemon-heavy 4.82-3ubuntu2.4+esm3 exim4-daemon-light 4.82-3ubuntu2.4+esm3 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-4934-2 https://ubuntu.com/security/notices/USN-4934-1 CVE-2020-28007, CVE-2020-28008, CVE-2020-28009, CVE-2020-28011, CVE-2020-28012, CVE-2020-28013, CVE-2020-28014, CVE-2020-28015, CVE-2020-28016, CVE-2020-28017, CVE-2020-28020, CVE-2020-28022, CVE-2020-28024, CVE-2020-28025, CVE-2020-28026, CVE-2021-27216 . Multiple security issues in Exim addressed by Ubuntu advisory 4934-2, impacting versions 14.04 and 16.04 ESM.. Exim Fix, Denial Of Service, Ubuntu Security Notice. .Severity: Critical. LinuxSecurity.com Team

Calendar%202 May 06, 2021 •Critical Ubuntu
Banner 1 1028x280 1708121660 1771599717
87
Ls Advisories Debian Esm H240
Price Tag%201security advisoryremote code executiondebian

Debian DSA-4488-1 Critical Exim4 Root Code Execution Update

Jeremy Harris discovered that Exim, a mail transport agent, does not properly handle the ${sort } expansion. This flaw can be exploited by a remote attacker to execute programs with root privileges in non-default (and unusual) configurations where ${sort } expansion is used for items . - ------------------------------------------------------------------------- Debian Security Advisory DSA-4488-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/security/ Salvatore Bonaccorso July 25, 2019 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : exim4 CVE ID : CVE-2019-13917 Jeremy Harris discovered that Exim, a mail transport agent, does not properly handle the ${sort } expansion. This flaw can be exploited by a remote attacker to execute programs with root privileges in non-default (and unusual) configurations where ${sort } expansion is used for items that can be controlled by an attacker. For the oldstable distribution (stretch), this problem has been fixed in version 4.89-2+deb9u5. For the stable distribution (buster), this problem has been fixed in version 4.92-8+deb10u1. We recommend that you upgrade your exim4 packages. For the detailed security status of exim4 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/exim4 Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . Debian Security Notice DSA-4490-1 highlights a severe vulnerability in Exim4, which could lead to unauthorized root access. Immediate upgrade advised.. Exim4, Debian Advisory, Remote Code Execution. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Jul 25, 2019 •Critical Debian
87
Ls Advisories Debian Esm H240
Price Tag%201security advisorysecurity updatedebian

Debian: DSA-4456-1 Moderate: Exim4 Command Execution Issue

The Qualys Research Labs reported a flaw in Exim, a mail transport agent. Improper validation of the recipient address in the deliver_message() function may result in the execution of arbitrary commands. . - ------------------------------------------------------------------------- Debian Security Advisory DSA-4456-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/security/ Salvatore Bonaccorso June 05, 2019 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : exim4 CVE ID : CVE-2019-10149 The Qualys Research Labs reported a flaw in Exim, a mail transport agent. Improper validation of the recipient address in the deliver_message() function may result in the execution of arbitrary commands. For the stable distribution (stretch), this problem has been fixed in version 4.89-2+deb9u4. We recommend that you upgrade your exim4 packages. For the detailed security status of exim4 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/exim4 Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . - ------------------------------------------------------------------------- Debian Security Advisory. qualys, research, reported, transport, agent, improper, validation. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Jun 05, 2019 •Important Debian
Banner 1 1028x280 1708121660 1771599717
172
Ls Advisories Ubuntu Esm H240
Price Tag%201security advisorysecurity updatelocal privilege escalation

Ubuntu 15.10, 14.04 LTS, 12.04 LTS Exim Security Advisory

Several security issues were fixed in Exim.. =========================================================================Ubuntu Security Notice USN-2933-1 March 15, 2016 exim4 vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 15.10 - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS Summary: Several security issues were fixed in Exim. Software Description: - exim4: Exim is a mail transport agent Details: It was discovered that Exim incorrectly filtered environment variables when used with the perl_startup configuration option. If the perl_startup option was enabled, a local attacker could use this issue to escalate their privileges to the root user. This issue has been fixed by having Exim clean the complete execution environment by default on startup, including any subprocesses such as transports that call other programs. This change in behaviour may break existing installations and can be adjusted by using two new configuration options, keep_environment and add_environment. (CVE-2016-1531) Patrick William discovered that Exim incorrectly expanded mathematical comparisons twice. A local attacker could possibly use this issue to perform arbitrary file operations as the Exim user. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-2972) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 15.10: exim4-daemon-heavy 4.86-3ubuntu1.1 exim4-daemon-light 4.86-3ubuntu1.1 Ubuntu 14.04 LTS: exim4-daemon-custom 4.82-3ubuntu2.1 exim4-daemon-heavy 4.82-3ubuntu2.1 exim4-daemon-light 4.82-3ubuntu2.1 Ubuntu 12.04 LTS: exim4-daemon-custom 4.76-3ubuntu3.3 exim4-daemon-heavy 4.76-3ubuntu3.3 exim4-daemon-light 4.76-3ubuntu3.3 This update introduces environmentfiltering, which may break certain existing installations. After performing a standard system update, the new keep_environment and add_environment configurations options can be used to adjust the new behaviour. References: https://ubuntu.com/security/notices/USN-2933-1 CVE-2014-2972, CVE-2016-1531 Package Information: https://launchpad.net/ubuntu/+source/exim4/4.86-3ubuntu1.1 https://launchpad.net/ubuntu/+source/exim4/4.82-3ubuntu2.1 https://launchpad.net/ubuntu/+source/exim4/4.76-3ubuntu3.3 . March 15, 2016 advisory regarding Exim security flaws in Ubuntu that enable local users to gain elevated privileges.. Exim Security Issues, Ubuntu Security Update, Local User Attack, Mail Transport Agent. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Mar 15, 2016 •Important Ubuntu
200
Ls Advisories Scientific Esm H240
Price Tag%201security advisorymoderate severitypostfix

Scientific Linux: 2011-05-31 Moderate: Postfix Buffer Over-Read

Moderate: postfix security update. Date: Wed, 1 Jun 2011 11:41:43 -0500 Reply-To: Troy Dawson Sender: Security Errata for Scientific Linux From: Troy Dawson Subject: Security ERRATA Moderate: postfix on SL4.x, SL5.x i386/x86_64 Comments: To: "This email address is being protected from spambots. You need JavaScript enabled to view it." MIME-Version: 1.0 Synopsis: Moderate: postfix security update Issue Date: 2011-05-31 CVE Numbers: CVE-2011-1720 Postfix is a Mail Transport Agent (MTA), supporting LDAP, SMTP AUTH (SASL), and TLS. A heap-based buffer over-read flaw was found in the way Postfix performed SASL handlers management for SMTP sessions, when Cyrus SASL authentication was enabled. A remote attacker could use this flaw to cause the Postfix smtpd server to crash via a specially-crafted SASL authentication request. The smtpd process was automatically restarted by the postfix master process after the time configured with service_throttle_time elapsed. (CVE-2011-1720) Note: Cyrus SASL authentication for Postfix is not enabled by default. Users of Postfix are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing this update, the postfix service will be restarted automatically. SL4: x86_64 postfix-2.2.10-1.5.el4.x86_64.rpm postfix-pflogsumm-2.2.10-1.5.el4.x86_64.rpm postfix-debuginfo-2.2.10-1.5.el4.x86_64.rpm i386 postfix-2.2.10-1.5.el4.i386.rpm postfix-pflogsumm-2.2.10-1.5.el4.i386.rpm postfix-debuginfo-2.2.10-1.5.el4.i386.rpm SL5: x86_64 postfix-pflogsumm-2.3.3-2.3.el5_6.x86_64.rpm postfix-2.3.3-2.3.el5_6.x86_64.rpm postfix-debuginfo-2.3.3-2.3.el5_6.x86_64.rpm i386 postfix-2.3.3-2.3.el5_6.i386.rpm postfix-debuginfo-2.3.3-2.3.el5_6.i386.rpm postfix-pflogsumm-2.3.3-2.3.el5_6.i386.rpm - Scientific Linux Development Team . Security patch for Postfix on Scientific Linux resolves a noteworthy buffer over-read vulnerability. Update now to safeguard your system.. postfix update, Scientific Linux security, mail transport agent security. . LinuxSecurity.com Team

Calendar%202 Jun 01, 2011 Scientific Linux
Banner 1 1028x280 1708121660 1771599717
98
Ls Advisories Redhat Esm H240
Price Tag%201security advisorymoderatebuffer overflow

Red Hat: RHSA-2011:0843-01 Moderate: Postfix SASL Crash

Updated postfix packages that fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: postfix security update Advisory ID: RHSA-2011:0843-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2011:0843.html Issue date: 2011-05-31 CVE Names: CVE-2011-1720 ==================================================================== 1. Summary: Updated postfix packages that fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Optional (v.6) - i386, x86_64 3. Description: Postfix is a Mail Transport Agent (MTA), supporting LDAP, SMTP AUTH (SASL), and TLS. A heap-based buffer over-read flaw was found in the way Postfix performed SASL handlers management for SMTP sessions, when Cyrus SASL authentication was enabled. A remote attacker could use this flaw to cause the Postfix smtpd server to crash via a specially-crafted SASL authentication request. The smtpd process was automatically restarted by the postfix master process after the time configured with service_throttle_time elapsed. (CVE-2011-1720) Note: Cyrus SASL authentication for Postfix is not enabled by default. Red Hat would like to thank the CERT/CC for reporting this issue. Upstream acknowledges Thomas Jarosch of Intra2net AG as the original reporter. Users of Postfix are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing this update, the postfix service will be restarted automatically. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/kb/docs/DOC-11259 5. Bugs fixed (http://bugzilla.redhat.com/): 699035 - CVE-2011-1720 postfix (smtpd): Crash due to improper management of SASL handlers for SMTP sessions 6. Package List: Red Hat Enterprise Linux AS version4: Source: i386: postfix-2.2.10-1.5.el4.i386.rpm postfix-debuginfo-2.2.10-1.5.el4.i386.rpm postfix-pflogsumm-2.2.10-1.5.el4.i386.rpm ia64: postfix-2.2.10-1.5.el4.ia64.rpm postfix-debuginfo-2.2.10-1.5.el4.ia64.rpm postfix-pflogsumm-2.2.10-1.5.el4.ia64.rpm ppc: postfix-2.2.10-1.5.el4.ppc.rpm postfix-debuginfo-2.2.10-1.5.el4.ppc.rpm postfix-pflogsumm-2.2.10-1.5.el4.ppc.rpm s390: postfix-2.2.10-1.5.el4.s390.rpm postfix-debuginfo-2.2.10-1.5.el4.s390.rpm postfix-pflogsumm-2.2.10-1.5.el4.s390.rpm s390x: postfix-2.2.10-1.5.el4.s390x.rpm postfix-debuginfo-2.2.10-1.5.el4.s390x.rpm postfix-pflogsumm-2.2.10-1.5.el4.s390x.rpm x86_64: postfix-2.2.10-1.5.el4.x86_64.rpm postfix-debuginfo-2.2.10-1.5.el4.x86_64.rpm postfix-pflogsumm-2.2.10-1.5.el4.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: Source: i386: postfix-2.2.10-1.5.el4.i386.rpm postfix-debuginfo-2.2.10-1.5.el4.i386.rpm postfix-pflogsumm-2.2.10-1.5.el4.i386.rpm x86_64: postfix-2.2.10-1.5.el4.x86_64.rpm postfix-debuginfo-2.2.10-1.5.el4.x86_64.rpm postfix-pflogsumm-2.2.10-1.5.el4.x86_64.rpm Red Hat Enterprise Linux ES version 4: Source: i386: postfix-2.2.10-1.5.el4.i386.rpm postfix-debuginfo-2.2.10-1.5.el4.i386.rpm postfix-pflogsumm-2.2.10-1.5.el4.i386.rpm ia64: postfix-2.2.10-1.5.el4.ia64.rpm postfix-debuginfo-2.2.10-1.5.el4.ia64.rpm postfix-pflogsumm-2.2.10-1.5.el4.ia64.rpm x86_64: postfix-2.2.10-1.5.el4.x86_64.rpm postfix-debuginfo-2.2.10-1.5.el4.x86_64.rpm postfix-pflogsumm-2.2.10-1.5.el4.x86_64.rpm Red Hat Enterprise Linux WS version 4: Source: i386: postfix-2.2.10-1.5.el4.i386.rpm postfix-debuginfo-2.2.10-1.5.el4.i386.rpm postfix-pflogsumm-2.2.10-1.5.el4.i386.rpm ia64: postfix-2.2.10-1.5.el4.ia64.rpm postfix-debuginfo-2.2.10-1.5.el4.ia64.rpm postfix-pflogsumm-2.2.10-1.5.el4.ia64.rpm x86_64: postfix-2.2.10-1.5.el4.x86_64.rpm postfix-debuginfo-2.2.10-1.5.el4.x86_64.rpm postfix-pflogsumm-2.2.10-1.5.el4.x86_64.rpm Red Hat Enterprise Linux Desktop (v. 5client): Source: i386: postfix-2.3.3-2.3.el5_6.i386.rpm postfix-debuginfo-2.3.3-2.3.el5_6.i386.rpm postfix-pflogsumm-2.3.3-2.3.el5_6.i386.rpm x86_64: postfix-2.3.3-2.3.el5_6.x86_64.rpm postfix-debuginfo-2.3.3-2.3.el5_6.x86_64.rpm postfix-pflogsumm-2.3.3-2.3.el5_6.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): Source: i386: postfix-2.3.3-2.3.el5_6.i386.rpm postfix-debuginfo-2.3.3-2.3.el5_6.i386.rpm postfix-pflogsumm-2.3.3-2.3.el5_6.i386.rpm ia64: postfix-2.3.3-2.3.el5_6.ia64.rpm postfix-debuginfo-2.3.3-2.3.el5_6.ia64.rpm postfix-pflogsumm-2.3.3-2.3.el5_6.ia64.rpm ppc: postfix-2.3.3-2.3.el5_6.ppc.rpm postfix-debuginfo-2.3.3-2.3.el5_6.ppc.rpm postfix-pflogsumm-2.3.3-2.3.el5_6.ppc.rpm s390x: postfix-2.3.3-2.3.el5_6.s390x.rpm postfix-debuginfo-2.3.3-2.3.el5_6.s390x.rpm postfix-pflogsumm-2.3.3-2.3.el5_6.s390x.rpm x86_64: postfix-2.3.3-2.3.el5_6.x86_64.rpm postfix-debuginfo-2.3.3-2.3.el5_6.x86_64.rpm postfix-pflogsumm-2.3.3-2.3.el5_6.x86_64.rpm Red Hat Enterprise Linux Desktop (v. 6): Source: i386: postfix-2.6.6-2.2.el6_1.i686.rpm postfix-debuginfo-2.6.6-2.2.el6_1.i686.rpm x86_64: postfix-2.6.6-2.2.el6_1.x86_64.rpm postfix-debuginfo-2.6.6-2.2.el6_1.x86_64.rpm Red Hat Enterprise Linux Desktop Optional (v. 6): Source: i386: postfix-debuginfo-2.6.6-2.2.el6_1.i686.rpm postfix-perl-scripts-2.6.6-2.2.el6_1.i686.rpm x86_64: postfix-debuginfo-2.6.6-2.2.el6_1.x86_64.rpm postfix-perl-scripts-2.6.6-2.2.el6_1.x86_64.rpm Red Hat Enterprise Linux HPC Node (v. 6): Source: x86_64: postfix-2.6.6-2.2.el6_1.x86_64.rpm postfix-debuginfo-2.6.6-2.2.el6_1.x86_64.rpm Red Hat Enterprise Linux HPC Node Optional (v. 6): Source: x86_64: postfix-debuginfo-2.6.6-2.2.el6_1.x86_64.rpm postfix-perl-scripts-2.6.6-2.2.el6_1.x86_64.rpm Red Hat Enterprise Linux Server (v.6): Source: i386: postfix-2.6.6-2.2.el6_1.i686.rpm postfix-debuginfo-2.6.6-2.2.el6_1.i686.rpm ppc64: postfix-2.6.6-2.2.el6_1.ppc64.rpm postfix-debuginfo-2.6.6-2.2.el6_1.ppc64.rpm s390x: postfix-2.6.6-2.2.el6_1.s390x.rpm postfix-debuginfo-2.6.6-2.2.el6_1.s390x.rpm x86_64: postfix-2.6.6-2.2.el6_1.x86_64.rpm postfix-debuginfo-2.6.6-2.2.el6_1.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 6): Source: i386: postfix-debuginfo-2.6.6-2.2.el6_1.i686.rpm postfix-perl-scripts-2.6.6-2.2.el6_1.i686.rpm ppc64: postfix-debuginfo-2.6.6-2.2.el6_1.ppc64.rpm postfix-perl-scripts-2.6.6-2.2.el6_1.ppc64.rpm s390x: postfix-debuginfo-2.6.6-2.2.el6_1.s390x.rpm postfix-perl-scripts-2.6.6-2.2.el6_1.s390x.rpm x86_64: postfix-debuginfo-2.6.6-2.2.el6_1.x86_64.rpm postfix-perl-scripts-2.6.6-2.2.el6_1.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: i386: postfix-2.6.6-2.2.el6_1.i686.rpm postfix-debuginfo-2.6.6-2.2.el6_1.i686.rpm x86_64: postfix-2.6.6-2.2.el6_1.x86_64.rpm postfix-debuginfo-2.6.6-2.2.el6_1.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 6): Source: i386: postfix-debuginfo-2.6.6-2.2.el6_1.i686.rpm postfix-perl-scripts-2.6.6-2.2.el6_1.i686.rpm x86_64: postfix-debuginfo-2.6.6-2.2.el6_1.x86_64.rpm postfix-perl-scripts-2.6.6-2.2.el6_1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key#package 7. References: https://access.redhat.com/security/cve/CVE-2011-1720 https://access.redhat.com/security/updates/classification#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2011 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFN5Q+zXlSAg2UNWIIRAnNJAJ9+kzFv8T5mFcOL0cP6TOKtt5A/rQCgn9WN fXvwjl2pb9anlkEY59xkzUI=OfHv -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . The recentsecurity patch for Postfix on Red Hat delivers a noteworthy enhancement to the efficiency of the mail transfer system, addressing moderate vulnerabilities.. Postfix Security Update, Red Hat Security Fix, Mail Transport Agent, SASL Authentication. . LinuxSecurity.com Team

Calendar%202 May 31, 2011 Red Hat
98
Ls Advisories Redhat Esm H240
Price Tag%201security advisorysecurity updateRed Hat Enterprise Linux

Moderate Risk of Postfix TLS Injection in Red Hat Enterprise Linux 6

Updated postfix packages that fix one security issue are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: postfix security update Advisory ID: RHSA-2011:0423-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2011:0423.html Issue date: 2011-04-06 CVE Names: CVE-2011-0411 ==================================================================== 1. Summary: Updated postfix packages that fix one security issue are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64 3. Description: Postfix is a Mail Transport Agent (MTA), supporting LDAP, SMTP AUTH (SASL), and TLS. It was discovered that Postfix did not flush the received SMTP commands buffer after switching to TLS encryption for an SMTP session. A man-in-the-middle attacker could use this flaw to inject SMTP commands into a victim's session during the plain text phase. This would lead tothose commands being processed by Postfix after TLS encryption is enabled, possibly allowing the attacker to steal the victim's mail or authentication credentials. (CVE-2011-0411) Red Hat would like to thank the CERT/CC for reporting CVE-2011-0411. The CERT/CC acknowledges Wietse Venema as the original reporter. Users of Postfix are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing this update, the postfix service will be restarted automatically. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/kb/docs/DOC-11259 5. Bugs fixed (http://bugzilla.redhat.com/): 674814 - CVE-2011-0411 postfix: SMTP commands injection during plaintext to TLS session switch 6. Package List: Red Hat Enterprise Linux Desktop (v. 6): Source: i386: postfix-2.6.6-2.1.el6_0.i686.rpm postfix-debuginfo-2.6.6-2.1.el6_0.i686.rpm x86_64: postfix-2.6.6-2.1.el6_0.x86_64.rpm postfix-debuginfo-2.6.6-2.1.el6_0.x86_64.rpm Red Hat Enterprise Linux Desktop Optional (v. 6): Source: i386: postfix-debuginfo-2.6.6-2.1.el6_0.i686.rpm postfix-perl-scripts-2.6.6-2.1.el6_0.i686.rpm x86_64: postfix-debuginfo-2.6.6-2.1.el6_0.x86_64.rpm postfix-perl-scripts-2.6.6-2.1.el6_0.x86_64.rpm Red Hat Enterprise Linux HPC Node (v. 6): Source: x86_64: postfix-2.6.6-2.1.el6_0.x86_64.rpm postfix-debuginfo-2.6.6-2.1.el6_0.x86_64.rpm Red Hat Enterprise Linux HPC Node Optional (v. 6): Source: x86_64: postfix-debuginfo-2.6.6-2.1.el6_0.x86_64.rpm postfix-perl-scripts-2.6.6-2.1.el6_0.x86_64.rpm Red Hat Enterprise Linux Server (v.6): Source: i386: postfix-2.6.6-2.1.el6_0.i686.rpm postfix-debuginfo-2.6.6-2.1.el6_0.i686.rpm ppc64: postfix-2.6.6-2.1.el6_0.ppc64.rpm postfix-debuginfo-2.6.6-2.1.el6_0.ppc64.rpm s390x: postfix-2.6.6-2.1.el6_0.s390x.rpm postfix-debuginfo-2.6.6-2.1.el6_0.s390x.rpm x86_64: postfix-2.6.6-2.1.el6_0.x86_64.rpm postfix-debuginfo-2.6.6-2.1.el6_0.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 6): Source: i386: postfix-debuginfo-2.6.6-2.1.el6_0.i686.rpm postfix-perl-scripts-2.6.6-2.1.el6_0.i686.rpm ppc64: postfix-debuginfo-2.6.6-2.1.el6_0.ppc64.rpm postfix-perl-scripts-2.6.6-2.1.el6_0.ppc64.rpm s390x: postfix-debuginfo-2.6.6-2.1.el6_0.s390x.rpm postfix-perl-scripts-2.6.6-2.1.el6_0.s390x.rpm x86_64: postfix-debuginfo-2.6.6-2.1.el6_0.x86_64.rpm postfix-perl-scripts-2.6.6-2.1.el6_0.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: i386: postfix-2.6.6-2.1.el6_0.i686.rpm postfix-debuginfo-2.6.6-2.1.el6_0.i686.rpm x86_64: postfix-2.6.6-2.1.el6_0.x86_64.rpm postfix-debuginfo-2.6.6-2.1.el6_0.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 6): Source: i386: postfix-debuginfo-2.6.6-2.1.el6_0.i686.rpm postfix-perl-scripts-2.6.6-2.1.el6_0.i686.rpm x86_64: postfix-debuginfo-2.6.6-2.1.el6_0.x86_64.rpm postfix-perl-scripts-2.6.6-2.1.el6_0.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://access.redhat.com/security/cve/CVE-2011-0411 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2011 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFNnPbmXlSAg2UNWIIRArjjAJ9no1IivbfjzXL6NQTi1NKVP9DorACgi5Yq OAjkNbu7ke3ZJ1IxJOJbCyo=timm -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . Red Hatissues a significant security alert for postfix to mitigate a TLS vulnerability in Enterprise Linux 6.. Postfix Update, Red Hat Enterprise, TLS Injection Risk, Security Advisory, Moderate Impact. . LinuxSecurity.com Team

Calendar%202 Apr 06, 2011 Red Hat
Banner 1 1028x280 1708121660 1771599717
News Add Esm H240

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

More Polls

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":1,"type":"x","order":4,"pct":100,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200

Search Topics