Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 515
Alerts This Week
Warning Icon 1 515

Stay Secure with the Latest Linux Advisories

Rockylinux Esm H800
Rocky

Rocky Linux httpd Important Denial of Service Fix RLSA-2026-42828

Calendar White Jul 21, 2026
Important
Ubuntu Large Esm H900
Ubuntu

Ubuntu Imagemagick Critical Denial of Service Vulnerabilities USN-8558-1

Calendar White Jul 21, 2026
Critical
Ubuntu Large Esm H900
Ubuntu

Ubuntu jbig2dec Important Denial of Service Vulnerabilities USN-8582-1

Calendar White Jul 21, 2026
Important
Ubuntu Large Esm H800
Ubuntu

Ubuntu 26.04 AccountsService Important Local Exec Threat CVE-2026-61897

Calendar White Jul 21, 2026
Important
Ubuntu Large Esm H900
Ubuntu

Ubuntu OpenSSH Critical Network Access Issue CVE-2026-35414 USN-8577-1

Calendar White Jul 21, 2026
Critical
Ubuntu Large Esm H900
Ubuntu

Ubuntu 16.04 CUPS Critical Control Character Injection CVE-2026-34980

Calendar White Jul 21, 2026
Critical
Ubuntu Large Esm H800
Ubuntu

Ubuntu 26.04 Snapd Critical Security Issues July 2026 USN-8579-1

Calendar White Jul 21, 2026
Critical
Debianlts Large Esm H900
Debian LTS

Debian rtpengine Critical Origin Validation Issue DLA-4691-1 CVE-2025-53399

Calendar White Jul 21, 2026
Critical
Opensuse Large Esm H900
openSUSE

openSUSE Leap 16.0 Beets Moderate Web Issue Fix SUSE-SU-2026-21383-1

Calendar White Jul 21, 2026
moderate
Filter%20icon Refine advisories
X Clear Filters
X Clear Filters
View More

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

More Polls

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":1,"type":"x","order":4,"pct":100,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Loading...

Explore Latest Linux Security advisories

We found 19 articles for you...
202
Ls Advisories Opensuse Esm H240
Price Tag%201security advisorymoderatenull pointer

openSUSE dhcpcd Moderate NULL Pointer Issue Fix 2026-21220-1

An update that solves one vulnerability and has one bug fix can now be installed.. openSUSE security update: security update for dhcpcd ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21220-1 Rating: moderate References: * bsc#1268761 Cross-References: * CVE-2025-70102 CVSS scores: * CVE-2025-70102 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2025-70102 ( SUSE ): 6.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Affected Products: openSUSE Leap 16.0 ------------------------------------------------------------- An update that solves one vulnerability and has one bug fix can now be installed. Description: This update for dhcpcd fixes the following issue Update to 10.3.2: - CVE-2025-70102: NULL pointer dereference in `parse_option()` when processing a specially crafted configuration input (bsc#1268761). Changes for dhcpcd: * options: Ensure ldop is not NULL dereferenced * DHCP: Don't run double EXPIRE hooks on carrier loss * DHCP: free the state when dropping on state NONE * BSD: don't send uninitialised memory using ps_root_indirectioctl * Fix fallback_time option * IPv4: Ignore DHCP state when building routes * route: Routes may not have an interface assinged * options: Ensure that an overly long bitflag string does not crash * options: Don't assume vsio options have an argument * common: Cast via uintptr_t rather than unsigned long in UNCONST * privsep: Ensure we recv for real after a successful recv MSG_PEEK * DHCP: Add parentheses to macro definitions * ipv6nd: empty IPV6RA_EXPIRE eloop queue when dropping * privsep: enforce message boundaries with MSG_EOR on our messages * Protocols will notify when dhcpcd can exit * DHCP: Don't request T1 and T2 * DHCP: Don't request a lease time * DHCP6: Don't exit if using DHCP4 INFORM in non manager mode * ND: Route Information Option prefix is optional * ipv6: respect slaac hwaddr to really use the hwaddr * When stoppingall interfaces at exit and releasing, remove persistance * NetBSD: Delete RTF_CONNECTED route when changing it * privsep: Drain the log when the root process is exiting * eloop: vastly reworked, kqueue and epoll support on by default Patch instructions: To install this openSUSE security update use the suse recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 16.0 zypper in -t patch openSUSE-Leap-16.0-1147=1 Package List: - openSUSE Leap 16.0: dhcpcd-10.3.2-160000.1.1 References: * https://www.suse.com/security/cve/CVE-2025-70102.html . Update for openSUSE dhcpcd addresses moderate flaws to protect network configurations against exploitation.. openSUSE dhcpcd patch NULL security update. . Severity: moderate. LinuxSecurity.com Team

Calendar%202 Jul 03, 2026 •moderate OpenSUSE
100
Ls Advisories Suse Esm H240
Price Tag%201security advisorySuSEimportant

SUSE PostgreSQL14 Important SQL Injection Path Traversal Fix 2026-22177-1

An update that solves eight vulnerabilities, contains one feature and has one fix can now be installed.. # Security update for postgresql14 Announcement ID: SUSE-SU-2026:22177-1 Release Date: 2026-06-19T16:51:39Z Rating: important References: * bsc#1263804 * bsc#1265172 * bsc#1265173 * bsc#1265174 * bsc#1265175 * bsc#1265177 * bsc#1265178 * bsc#1265179 * bsc#1265181 * jsc#PED-14823 Cross-References: * CVE-2026-6472 * CVE-2026-6473 * CVE-2026-6474 * CVE-2026-6475 * CVE-2026-6477 * CVE-2026-6478 * CVE-2026-6479 * CVE-2026-6637 CVSS scores: * CVE-2026-6472 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N * CVE-2026-6472 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N * CVE-2026-6473 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2026-6473 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2026-6474 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N * CVE-2026-6474 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N * CVE-2026-6475 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-6475 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-6477 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-6477 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-6478 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-6478 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-6479 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-6479 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-6637 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2026-6637 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * SUSE Linux Enterprise Server 16.0 * SUSE Linux Enterprise Server for SAP applications 16.0 An update that solves eight vulnerabilities, contains one feature and hasone fix can now be installed. ## Description: This update for postgresql14 fixes the following issues Security issues: * CVE-2026-6472: ensure the user has CREATE privilege on the schema specified (bsc#1265172). * CVE-2026-6473: integer overflows in memory-allocation calculations (bsc#1265173). * CVE-2026-6474: Guard against malicious time zone names (bsc#1265174). * CVE-2026-6475: Prevent path traversal in pg_basebackup and pg_rewind (bsc#1265175). * CVE-2026-6477: Mark PQfn() as unsafe, and avoid using it within libpq (bsc#1265177). * CVE-2026-6478: Use timing-safe string comparisons in authentication code (bsc#1265178). * CVE-2026-6479: Prevent unbounded recursion while processing startup packets (bsc#1265179). * CVE-2026-6637: Prevent SQL injection and buffer overruns in contrib/spi (bsc#1265181). Non security issue: * Update to version 14.23. * Get rid of update-alternatives for openSUSE/SLE 16.0 and newer to support immutable systems and transactional updates (jsc#PED-14823). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server 16.0 zypper in -t patch SUSE-SLES-16.0-967=1 * SUSE Linux Enterprise Server for SAP applications 16.0 zypper in -t patch SUSE-SLES-16.0-967=1 ## Package List: * SUSE Linux Enterprise Server for SAP applications 16.0 (ppc64le x86_64) * postgresql14-plperl-debuginfo-14.23-160000.1.1 * postgresql14-contrib-14.23-160000.1.1 * postgresql14-server-devel-14.23-160000.1.1 * postgresql14-server-devel-debuginfo-14.23-160000.1.1 * postgresql14-devel-debuginfo-14.23-160000.1.1 * postgresql14-server-14.23-160000.1.1 * postgresql14-contrib-debuginfo-14.23-160000.1.1 * postgresql14-14.23-160000.1.1 * postgresql14-plpython-14.23-160000.1.1 * postgresql14-plpython-debuginfo-14.23-160000.1.1 *postgresql14-pltcl-14.23-160000.1.1 * postgresql14-plperl-14.23-160000.1.1 * postgresql14-server-debuginfo-14.23-160000.1.1 * postgresql14-devel-14.23-160000.1.1 * postgresql14-pltcl-debuginfo-14.23-160000.1.1 * postgresql14-debuginfo-14.23-160000.1.1 * postgresql14-debugsource-14.23-160000.1.1 * SUSE Linux Enterprise Server for SAP applications 16.0 (noarch) * postgresql14-docs-14.23-160000.1.1 * SUSE Linux Enterprise Server 16.0 (aarch64 ppc64le s390x x86_64) * postgresql14-plperl-debuginfo-14.23-160000.1.1 * postgresql14-contrib-14.23-160000.1.1 * postgresql14-server-devel-14.23-160000.1.1 * postgresql14-server-devel-debuginfo-14.23-160000.1.1 * postgresql14-devel-debuginfo-14.23-160000.1.1 * postgresql14-server-14.23-160000.1.1 * postgresql14-contrib-debuginfo-14.23-160000.1.1 * postgresql14-14.23-160000.1.1 * postgresql14-plpython-14.23-160000.1.1 * postgresql14-plpython-debuginfo-14.23-160000.1.1 * postgresql14-pltcl-14.23-160000.1.1 * postgresql14-plperl-14.23-160000.1.1 * postgresql14-server-debuginfo-14.23-160000.1.1 * postgresql14-devel-14.23-160000.1.1 * postgresql14-pltcl-debuginfo-14.23-160000.1.1 * postgresql14-debuginfo-14.23-160000.1.1 * postgresql14-debugsource-14.23-160000.1.1 * SUSE Linux Enterprise Server 16.0 (noarch) * postgresql14-docs-14.23-160000.1.1 ## References: * https://www.suse.com/security/cve/CVE-2026-6472.html * https://www.suse.com/security/cve/CVE-2026-6473.html * https://www.suse.com/security/cve/CVE-2026-6474.html * https://www.suse.com/security/cve/CVE-2026-6475.html * https://www.suse.com/security/cve/CVE-2026-6477.html * https://www.suse.com/security/cve/CVE-2026-6478.html * https://www.suse.com/security/cve/CVE-2026-6479.html * https://www.suse.com/security/cve/CVE-2026-6637.html * https://bugzilla.suse.com/show_bug.cgi?id=1263804 * https://bugzilla.suse.com/show_bug.cgi?id=1265172 * https://bugzilla.suse.com/show_bug.cgi?id=1265173 *https://bugzilla.suse.com/show_bug.cgi?id=1265174 * https://bugzilla.suse.com/show_bug.cgi?id=1265175 * https://bugzilla.suse.com/show_bug.cgi?id=1265177 * https://bugzilla.suse.com/show_bug.cgi?id=1265178 * https://bugzilla.suse.com/show_bug.cgi?id=1265179 * https://bugzilla.suse.com/show_bug.cgi?id=1265181 * https://jira.suse.com/browse/PED-14823 . Eight vulnerabilities in postgresql14 addressed in important SUSE update. Security fixes include preventing path traversal.. SUSE PostgreSQL Security Update, SUSE Vulnerability Management, PostgreSQL Security Fix, SUSE Linux Patch. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Jun 23, 2026 •Important SuSE
Banner 3 1028x280 1708121785 1771599793
172
Ls Advisories Ubuntu Esm H240
Price Tag%201security advisorydenial of serviceUbuntu

Ubuntu 26.04 QT WebEngine Important Denial Of Service Risk USN-8347-1

QT WebEngine could be made to crash or run programs if it received specially crafted input.. ========================================================================== Ubuntu Security Notice USN-8347-1 May 28, 2026 qtwebengine-opensource-src vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: QT WebEngine could be made to crash or run programs if it received specially crafted input. Software Description: - qtwebengine-opensource-src: QT application web browser engine Details: It was discovered that the vendored LibTIFF in QT WebEngine incorrectly handled memory when parsing malformed TIFF image metadata. An attacker could possibly use this issue to cause a denial of service, obtain sensitive information, or execute arbitrary code. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS libqt5webengine-data 5.15.19+dfsg2-4ubuntu0.1~esm1 Available with Ubuntu Pro libqt5webengine5 5.15.19+dfsg2-4ubuntu0.1~esm1 Available with Ubuntu Pro libqt5webenginecore5 5.15.19+dfsg2-4ubuntu0.1~esm1 Available with Ubuntu Pro libqt5webenginewidgets5 5.15.19+dfsg2-4ubuntu0.1~esm1 Available with Ubuntu Pro qml-module-qtwebengine 5.15.19+dfsg2-4ubuntu0.1~esm1 Available with Ubuntu Pro qtwebengine5-dev 5.15.19+dfsg2-4ubuntu0.1~esm1 Available with Ubuntu Pro qtwebengine5-dev-tools 5.15.19+dfsg2-4ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 24.04 LTS libqt5pdf5 5.15.16+dfsg-3ubuntu0.1~esm1 Available with Ubuntu Pro libqt5pdfwidgets5 5.15.16+dfsg-3ubuntu0.1~esm1 Available with Ubuntu Pro libqt5webengine-data 5.15.16+dfsg-3ubuntu0.1~esm1 Available with Ubuntu Pro libqt5webengine5 5.15.16+dfsg-3ubuntu0.1~esm1 Available with Ubuntu Pro libqt5webenginecore5 5.15.16+dfsg-3ubuntu0.1~esm1 Available with Ubuntu Pro libqt5webenginewidgets5 5.15.16+dfsg-3ubuntu0.1~esm1 Available with Ubuntu Pro qml-module-qtquick-pdf 5.15.16+dfsg-3ubuntu0.1~esm1 Available with Ubuntu Pro qml-module-qtwebengine 5.15.16+dfsg-3ubuntu0.1~esm1 Available with Ubuntu Pro qt5-image-formats-plugin-pdf 5.15.16+dfsg-3ubuntu0.1~esm1 Available with Ubuntu Pro qtpdf5-dev 5.15.16+dfsg-3ubuntu0.1~esm1 Available with Ubuntu Pro qtwebengine5-dev 5.15.16+dfsg-3ubuntu0.1~esm1 Available with Ubuntu Pro qtwebengine5-dev-tools 5.15.16+dfsg-3ubuntu0.1~esm1 Available with Ubuntu Pro qtwebengine5-private-dev 5.15.16+dfsg-3ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 22.04 LTS libqt5pdf5 5.15.9+dfsg-1ubuntu0.1~esm1 Available with Ubuntu Pro libqt5pdfwidgets5 5.15.9+dfsg-1ubuntu0.1~esm1 Available with Ubuntu Pro libqt5webengine-data 5.15.9+dfsg-1ubuntu0.1~esm1 Available with Ubuntu Pro libqt5webengine5 5.15.9+dfsg-1ubuntu0.1~esm1 Available with Ubuntu Pro libqt5webenginecore5 5.15.9+dfsg-1ubuntu0.1~esm1 Available with Ubuntu Pro libqt5webenginewidgets5 5.15.9+dfsg-1ubuntu0.1~esm1 Available with Ubuntu Pro qml-module-qtquick-pdf 5.15.9+dfsg-1ubuntu0.1~esm1 Available with Ubuntu Pro qml-module-qtwebengine 5.15.9+dfsg-1ubuntu0.1~esm1 Available with Ubuntu Pro qt5-image-formats-plugin-pdf 5.15.9+dfsg-1ubuntu0.1~esm1 Available with Ubuntu Pro qtpdf5-dev 5.15.9+dfsg-1ubuntu0.1~esm1 Available with Ubuntu Pro qtwebengine5-dev 5.15.9+dfsg-1ubuntu0.1~esm1 Available with Ubuntu Pro qtwebengine5-dev-tools 5.15.9+dfsg-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 20.04 LTS libqt5webengine-data 5.12.8+dfsg-0ubuntu1.1+esm1 Available with Ubuntu Pro libqt5webengine5 5.12.8+dfsg-0ubuntu1.1+esm1 Available with Ubuntu Pro libqt5webenginecore5 5.12.8+dfsg-0ubuntu1.1+esm1 Available with Ubuntu Pro libqt5webenginewidgets5 5.12.8+dfsg-0ubuntu1.1+esm1 Available with Ubuntu Pro qml-module-qtwebengine 5.12.8+dfsg-0ubuntu1.1+esm1 Available with Ubuntu Pro qtwebengine5-dev 5.12.8+dfsg-0ubuntu1.1+esm1 Available with Ubuntu Pro qtwebengine5-dev-tools 5.12.8+dfsg-0ubuntu1.1+esm1 Available with Ubuntu Pro Ubuntu 18.04 LTS libqt5webengine-data 5.9.5+dfsg-0ubuntu2+esm1 Available with Ubuntu Pro libqt5webengine5 5.9.5+dfsg-0ubuntu2+esm1 Available with Ubuntu Pro libqt5webenginecore5 5.9.5+dfsg-0ubuntu2+esm1 Available with Ubuntu Pro libqt5webenginewidgets5 5.9.5+dfsg-0ubuntu2+esm1 Available with Ubuntu Pro qml-module-qtwebengine 5.9.5+dfsg-0ubuntu2+esm1 Available with Ubuntu Pro qtwebengine5-dev 5.9.5+dfsg-0ubuntu2+esm1 Available with Ubuntu Pro qtwebengine5-dev-tools 5.9.5+dfsg-0ubuntu2+esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8347-1 CVE-2025-9900 . QT WebEngine may crash or run unintended programs due to malformed input; important updates available for multiple Ubuntu versions.. QT WebEngine security, Ubuntu updates, denial of service risk, memory handling error, software vulnerability. . Severity: Important. LinuxSecurity.com Team

Calendar%202 May 29, 2026 •Important Ubuntu
172
Ls Advisories Ubuntu Esm H240
Price Tag%201security advisorycross site scriptingUbuntu

Ubuntu 22.04 CiviCRM Important JavaScript Execution Risk USN-8242-1

CiviCRM could be made to run malicious JavaScript in the user's browser if it received specially crafted input.. ========================================================================== Ubuntu Security Notice USN-8242-1 May 07, 2026 civicrm vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: CiviCRM could be made to run malicious JavaScript in the user's browser if it received specially crafted input. Software Description: - civicrm: Constituent relationship management solution Details: Takuya Aramaki discovered that Smarty, vendored in CiviCRM, did not properly escape JavaScript code. An attacker could possibly use this issue to conduct a cross-site scripting attack. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS civicrm-common 5.33.2+dfsg1-1ubuntu1+esm1 Available with Ubuntu Pro Ubuntu 20.04 LTS civicrm-common 5.21.2+dfsg-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 18.04 LTS civicrm-common 4.7.30+dfsg-1ubuntu1+esm1 Available with Ubuntu Pro Ubuntu 16.04 LTS civicrm-common 4.7.1+dfsg-2ubuntu1+esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8242-1 CVE-2023-28447 . CiviCRM on Ubuntu may run malicious JavaScript due to insufficient escaping, risking user data. Update recommended.. CiviCRM Update, Ubuntu Security, Cross-Site Scripting Risk. . Severity: Important. LinuxSecurity.com Team

Calendar%202 May 07, 2026 •Important Ubuntu
Banner 3 1028x280 1708121785 1771599793
203
Ls Advisories Mageia Esm H240
Price Tag%201security advisoryremote code executionimportant

Mageia: yelp Important Remote Code Exec CVE-2025-3155 Advisory 2025-0297

MGASA-2025-0297 - Updated yelp & yelp-xsl packages fix security vulnerability. MGASA-2025-0297 - Updated yelp & yelp-xsl packages fix security vulnerability Publication date: 15 Nov 2025 URL: https://advisories.mageia.org/MGASA-2025-0297.html Type: security Affected Mageia releases: 9 CVE: CVE-2025-3155 Description: The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment. (CVE-2025-3155) References: - https://bugs.mageia.org/show_bug.cgi?id=34173 - https://www.openwall.com/lists/oss-security/2025/04/04/1 - https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./message/27Z5WA2SKQGJ4UVVHUNWY73Y4PNKT3AA/ - https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./message/LNBXVCRWOMV4OCPACFVW6R4I6T4PSAEM/ - - https://www.cve.org/CVERecord?id=CVE-2025-3155 SRPMS: - 9/core/yelp-42.2-1.1.mga9 - 9/core/yelp-xsl-42.1-1.1.mga9 . Updated yelp & yelp-xsl packages address important security flaw allowing arbitrary script execution.. Mageia security advisory,yelp vulnerability,remote code execution,security update,malicious input. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Nov 15, 2025 •Important Mageia
202
Ls Advisories Opensuse Esm H240
Price Tag%201security advisorysecurity issueimportant

openSUSE: Chromium Important Security Update CVE-2025-54874

An update that fixes 9 vulnerabilities is now available. . openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2025:0292-1 Rating: important References: #1247661 #1247664 Cross-References: CVE-2025-54874 CVE-2025-8576 CVE-2025-8577 CVE-2025-8578 CVE-2025-8579 CVE-2025-8580 CVE-2025-8581 CVE-2025-8582 CVE-2025-8583 CVSS scores: CVE-2025-54874 (SUSE): 7.3 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Affected Products: openSUSE Backports SLE-15-SP6 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: Chromium was updated to fix: - CVE-2025-54874 fix missing error check in openjpeg (bsc#1247661) Chromium 139.0.7258.66 (boo#1247664): * CVE-2025-8576: Use after free in Extensions * CVE-2025-8577: Inappropriate implementation in Picture In Picture * CVE-2025-8578: Use after free in Cast * CVE-2025-8579: Inappropriate implementation in Gemini Live in Chrome * CVE-2025-8580: Inappropriate implementation in Filesystems * CVE-2025-8581: Inappropriate implementation in Extensions * CVE-2025-8582: Insufficient validation of untrusted input in DOM * CVE-2025-8583: Inappropriate implementation in Permissions Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP6: zypper in -t patch openSUSE-2025-292=1 Package List: - openSUSE Backports SLE-15-SP6 (aarch64 ppc64le x86_64): chromedriver-139.0.7258.66-bp156.2.152.1 chromedriver-debuginfo-139.0.7258.66-bp156.2.152.1 chromium-139.0.7258.66-bp156.2.152.1 chromium-debuginfo-139.0.7258.66-bp156.2.152.1 References: https://www.suse.com/security/cve/CVE-2025-54874.html https://www.suse.com/security/cve/CVE-2025-8576.html https://www.suse.com/security/cve/CVE-2025-8577.html https://www.suse.com/security/cve/CVE-2025-8578.html https://www.suse.com/security/cve/CVE-2025-8579.html https://www.suse.com/security/cve/CVE-2025-8580.html https://www.suse.com/security/cve/CVE-2025-8581.html https://www.suse.com/security/cve/CVE-2025-8582.html https://www.suse.com/security/cve/CVE-2025-8583.html https://bugzilla.suse.com/1247661 https://bugzilla.suse.com/1247664 . A critical modification for Fedora rectifies 7 flaws in Firefox. Update strongly advised for protection.. opensuse, chromium, security advisory, vulnerabilities, updates. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Aug 12, 2025 •Important OpenSUSE
Banner 3 1028x280 1708121785 1771599793
197
Ls Advisories Deblts Esm H240
Price Tag%201security advisoryDebianmalicious input

Debian 11: DLA-4185-1 Critical: yelp-xsl Script Execution Threat

A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment. . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4185-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/lts/security/ Lucas Kanashiro May 28, 2025 https://wiki.debian.org/LTS - ------------------------------------------------------------------------- Package : yelp-xsl Version : 3.38.3-1+deb11u1 CVE ID : CVE-2025-3155 Debian Bug : #1102080 A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment. For Debian 11 bullseye, this problem has been fixed in version 3.38.3-1+deb11u1. We recommend that you upgrade your yelp-xsl packages. For the detailed security status of yelp-xsl please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/yelp-xsl Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . An important patch for yelp-xsl addresses a vulnerability that permits the running of scripts capable of leaking user data.. debian security update,yelp-xsl exploit,arbitrary script bug. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 May 28, 2025 •Critical Debian LTS
172
Ls Advisories Ubuntu Esm H240
Price Tag%201security advisorydenial of servicesoftware update

Ubuntu 24.10, 24.04, 22.04 LTS: USN-7435-1 critical: protobuf DoS

Protocol Buffers could be made to crash if it received specially crafted input.. ========================================================================== Ubuntu Security Notice USN-7435-1 April 14, 2025 protobuf vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS Summary: Protocol Buffers could be made to crash if it received specially crafted input. Software Description: - protobuf: protocol buffers data serialization library Details: It was discovered that Protocol Buffers incorrectly handled memory when receiving malicious input using the Java bindings. An attacker could possibly use this issue to cause a denial of service. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 24.10 libprotobuf-java 3.21.12-9ubuntu1.1 Ubuntu 24.04 LTS libprotobuf-java 3.21.12-8.2ubuntu0.1 Ubuntu 22.04 LTS libprotobuf-java 3.12.4-1ubuntu7.22.04.2 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7435-1 CVE-2024-7254 Package Information: https://launchpad.net/ubuntu/+source/protobuf/3.21.12-9ubuntu1.1 https://launchpad.net/ubuntu/+source/protobuf/3.21.12-8.2ubuntu0.1 https://launchpad.net/ubuntu/+source/protobuf/3.12.4-1ubuntu7.22.04.2 . Be aware of potential failures in Protocol Buffers when dealing with specially designed input in Ubuntu versions. Ensure that your system is up to date.. Ubuntu protocol buffers, denial of service, software update, security advisory, malicious input. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Apr 14, 2025 •Critical Ubuntu
Banner 3 1028x280 1708121785 1771599793
News Add Esm H240

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

More Polls

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":1,"type":"x","order":4,"pct":100,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200

Search Topics