Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -5 articles for you...
98
security advisoryimportantfirefoxRed Hat Enterprise Linux 8.2 Important Firefox Update for CVE-2021-23961
An update for firefox is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: firefox security update Advisory ID: RHSA-2021:1361-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:1361 Issue date: 2021-04-26 CVE Names: CVE-2021-23961 CVE-2021-23994 CVE-2021-23995 CVE-2021-23998 CVE-2021-23999 CVE-2021-24002 CVE-2021-29945 CVE-2021-29946 ==================================================================== 1. Summary: An update for firefox is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream EUS (v. 8.2) - aarch64, ppc64le, s390x, x86_64 3. Description: Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 78.10.0 ESR. Security Fix(es): * Mozilla: Out of bound write due to lazy initialization (CVE-2021-23994) * Mozilla: Use-after-free in Responsive Design Mode (CVE-2021-23995) * Mozilla: More internal network hosts could have been probed by a malicious webpage (CVE-2021-23961) * Mozilla: Secure Lock icon could have been spoofed (CVE-2021-23998) * Mozilla: Blob URLs may have been granted additional privileges (CVE-2021-23999) * Mozilla: Arbitrary FTP command execution on FTPservers using an encoded URL (CVE-2021-24002) * Mozilla: Incorrect size computation in WebAssembly JIT could lead to null-reads (CVE-2021-29945) * Mozilla: Port blocking could be bypassed (CVE-2021-29946) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the update, Firefox must be restarted for the changes to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1951364 - CVE-2021-23994 Mozilla: Out of bound write due to lazy initialization 1951365 - CVE-2021-23995 Mozilla: Use-after-free in Responsive Design Mode 1951366 - CVE-2021-23998 Mozilla: Secure Lock icon could have been spoofed 1951367 - CVE-2021-23961 Mozilla: More internal network hosts could have been probed by a malicious webpage 1951368 - CVE-2021-23999 Mozilla: Blob URLs may have been granted additional privileges 1951369 - CVE-2021-24002 Mozilla: Arbitrary FTP command execution on FTP servers using an encoded URL 1951370 - CVE-2021-29945 Mozilla: Incorrect size computation in WebAssembly JIT could lead to null-reads 1951371 - CVE-2021-29946 Mozilla: Port blocking could be bypassed 6. Package List: Red Hat Enterprise Linux AppStream EUS (v.8.2): Source: firefox-78.10.0-1.el8_2.src.rpm aarch64: firefox-78.10.0-1.el8_2.aarch64.rpm firefox-debuginfo-78.10.0-1.el8_2.aarch64.rpm firefox-debugsource-78.10.0-1.el8_2.aarch64.rpm ppc64le: firefox-78.10.0-1.el8_2.ppc64le.rpm firefox-debuginfo-78.10.0-1.el8_2.ppc64le.rpm firefox-debugsource-78.10.0-1.el8_2.ppc64le.rpm s390x: firefox-78.10.0-1.el8_2.s390x.rpm firefox-debuginfo-78.10.0-1.el8_2.s390x.rpm firefox-debugsource-78.10.0-1.el8_2.s390x.rpm x86_64: firefox-78.10.0-1.el8_2.x86_64.rpm firefox-debuginfo-78.10.0-1.el8_2.x86_64.rpm firefox-debugsource-78.10.0-1.el8_2.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2021-23961 https://access.redhat.com/security/cve/CVE-2021-23994 https://access.redhat.com/security/cve/CVE-2021-23995 https://access.redhat.com/security/cve/CVE-2021-23998 https://access.redhat.com/security/cve/CVE-2021-23999 https://access.redhat.com/security/cve/CVE-2021-24002 https://access.redhat.com/security/cve/CVE-2021-29945 https://access.redhat.com/security/cve/CVE-2021-29946 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBYIak/tzjgjWX9erEAQhfBA/9EmBBuAYkmUjm10Eg6Ym/DiQTNybKS/UC iZR7AIy5jR8xAvhfGzloW2axl0BUk4BYt8X4WkEmf4Q6GNvTcplurmCDuBYD3C0z j3EVgsn/Axpfr7xL8eaObKsc0qWUkB2e86DgnmJ2zz2JUguPTVkJWk9NV7KYiqnv DGwN7FuhGnFwrkSzJcBFTm1Pp4dgwqeJr8a/iCYvwm842/lnO2nXYXBTrXxiLINS 8DQJ5vEcqTP2QFWd2axBoukoF03zkTtU7WVAQU0Cs9PB3TZGGYRuCpZsdfgUkjmk oOYA6Y3lT3afQ2dK5HaT8E/F7jmnWVzchB3zP/yMrYPvdOl3Weo2/HpYpSdTjlLu NMdpX0GKNdFzyixZ22K7hSFQPJNgsq6+zuJWxajBF5fNEOoI9X8eQgA3/8VV0HiA qi3Tn70KYlTfjodcFxAc17pHjZ0UiakeSbAZ9QZ4ltV89qVXsbI2Zf8EPuoZN+Dv 5MA0IJOZaLAiaVz8oNoGXt6M5yBFGeSME9HD0RHicQPcfWWISJglWlk9oQnMnUWv CoFHHKrMCQ9q2ty/DPZKi31tc7dQVhf/dcm+NlFa9Uix7e2wIXsVPoUYZh3cTnfx p9xdlzD/8pCSGA72gMsGL9b34I+17kNwOOw9lobecpU5X3+YLr7uKMSL0t7g6W6r khzJopw4knc=ZyGQ -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Apr 26, 2021
•Important
Red Hat
100
security advisoryimportantweb securitySUSE: 2021:1307-1 Important Notice Regarding Firefox Security Issue
An update that fixes 8 vulnerabilities is now available. . SUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2021:1307-1 Rating: important References: #1184960 Cross-References: CVE-2021-23961 CVE-2021-23994 CVE-2021-23995 CVE-2021-23998 CVE-2021-23999 CVE-2021-24002 CVE-2021-29945 CVE-2021-29946 CVSS scores: CVE-2021-23961 (NVD) : 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N CVE-2021-23961 (SUSE): 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N CVE-2021-23994 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-23995 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-23998 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-23999 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-24002 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-29945 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-29946 (SUSE): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L Affected Products: SUSE Linux Enterprise Module for Desktop Applications 15-SP3 SUSE Linux Enterprise Module for Desktop Applications 15-SP2 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: - Firefox was updated to 78.10.0 ESR (bsc#1184960) * CVE-2021-23994: Out of bound write due to lazy initialization * CVE-2021-23995: Use-after-free in Responsive Design Mode * CVE-2021-23998: Secure Lock icon could have been spoofed * CVE-2021-23961: More internal network hosts could have been probedby a malicious webpage * CVE-2021-23999: Blob URLs may have been granted additional privileges * CVE-2021-24002: Arbitrary FTP command execution on FTP servers using an encoded URL * CVE-2021-29945: Incorrect size computation in WebAssembly JIT could lead to null-reads * CVE-2021-29946: Port blocking could be bypassed Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Desktop Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP3-2021-1307=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP2: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP2-2021-1307=1 Package List: - SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (aarch64 ppc64le s390x x86_64): MozillaFirefox-78.10.0-8.38.1 MozillaFirefox-debuginfo-78.10.0-8.38.1 MozillaFirefox-debugsource-78.10.0-8.38.1 MozillaFirefox-translations-common-78.10.0-8.38.1 MozillaFirefox-translations-other-78.10.0-8.38.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (aarch64 ppc64le x86_64): MozillaFirefox-devel-78.10.0-8.38.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP2 (aarch64 ppc64le s390x x86_64): MozillaFirefox-78.10.0-8.38.1 MozillaFirefox-debuginfo-78.10.0-8.38.1 MozillaFirefox-debugsource-78.10.0-8.38.1 MozillaFirefox-devel-78.10.0-8.38.1 MozillaFirefox-translations-common-78.10.0-8.38.1 MozillaFirefox-translations-other-78.10.0-8.38.1 References: https://www.suse.com/security/cve/CVE-2021-23961.html https://www.suse.com/security/cve/CVE-2021-23994.html https://www.suse.com/security/cve/CVE-2021-23995.html https://www.suse.com/security/cve/CVE-2021-23998.html https://www.suse.com/security/cve/CVE-2021-23999.html https://www.suse.com/security/cve/CVE-2021-24002.html https://www.suse.com/security/cve/CVE-2021-29945.html https://www.suse.com/security/cve/CVE-2021-29946.html https://bugzilla.suse.com/1184960 . SUSE enhances MozillaFirefox to address 8 security flaws. Key updates are released to safeguard user privacy.. SUSE Security Update, MozillaFirefox, Security Fixes. . Severity: Important. LinuxSecurity.com Team
Apr 23, 2021
•Important
SuSE
202
security advisorycriticalsoftware updateopenSUSE Leap 15.2: 2020:2317-1 Critical MozillaThunderbird Update
An update that fixes 8 vulnerabilities is now available. . openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:2317-1 Rating: critical References: #1180039 Cross-References: CVE-2020-16042 CVE-2020-26971 CVE-2020-26973 CVE-2020-26974 CVE-2020-26978 CVE-2020-35111 CVE-2020-35112 CVE-2020-35113 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: - Mozilla Thunderbird 78.6 * new: MailExtensions: Added browser.windows.openDefaultBrowser() (bmo#1664708) * changed: Thunderbird now only shows quota exceeded indications on the main window (bmo#1671748) * changed: MailExtensions: menus API enabled in messages being composed (bmo#1670832) * changed: MailExtensions: Honor allowScriptsToClose argument in windows.create API function (bmo#1675940) * changed: MailExtensions: APIs that returned an accountId will reflect the account the message belongs to, not what is stored in message headers (bmo#1644032) * fixed: Keyboard shortcut for toggling message "read" status not shown in menus (bmo#1619248) * fixed: OpenPGP: After importing a secret key, Key Manager displayed properties of the wrong key (bmo#1667054) * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041) * fixed: OpenPGP: Discovering keys online via Key Manager sometimes failed on Linux (bmo#1634053) * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save As" did not work (bmo#1663169) * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757) * fixed:OpenPGP: Verification of clear signed UTF-8 text failed (bmo#1679756) * fixed: Address book: Some columns incorrectly displayed no data (bmo#1631201) * fixed: Address book: The address book view did not update after changing the name format in the menu (bmo#1678555) * fixed: Calendar: Could not import an ICS file into a CalDAV calendar (bmo#1652984) * fixed: Calendar: Two "Home" calendars were visible on a new profile (bmo#1656782) * fixed: Calendar: Dark theme was incomplete on Linux (bmo#1655543) * fixed: Dark theme did not apply to new mail notification popups (bmo#1681083) * fixed: Folder icon, message list, and contact side bar visual improvements (bmo#1679436) * fixed: MailExtensions: HTTP refresh in browser content tabs did not work (bmo#1667774) * fixed: MailExtensions: messageDisplayScripts failed to run in main window (bmo#1674932) * fixed: Various security fixes MFSA 2020-56 (bsc#1180039) * CVE-2020-16042 (bmo#1679003) Operations on a BigInt could have caused uninitialized memory to be exposed * CVE-2020-26971 (bmo#1663466) Heap buffer overflow in WebGL * CVE-2020-26973 (bmo#1680084) CSS Sanitizer performed incorrect sanitization * CVE-2020-26974 (bmo#1681022) Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free * CVE-2020-26978 (bmo#1677047) Internal network hosts could have been probed by a malicious webpage * CVE-2020-35111 (bmo#1657916) The proxy.onRequest API did not catch view-source URLs * CVE-2020-35112 (bmo#1661365) Opening an extension-less download may have inadvertently launched an executable instead * CVE-2020-35113 (bmo#1664831, bmo#1673589) Memory safety bugs fixed in Thunderbird 78.6 This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update usethe SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2020-2317=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaThunderbird-78.6.0-lp152.2.23.1 MozillaThunderbird-debuginfo-78.6.0-lp152.2.23.1 MozillaThunderbird-debugsource-78.6.0-lp152.2.23.1 MozillaThunderbird-translations-common-78.6.0-lp152.2.23.1 MozillaThunderbird-translations-other-78.6.0-lp152.2.23.1 References: https://www.suse.com/security/cve/CVE-2020-16042.html https://www.suse.com/security/cve/CVE-2020-26971.html https://www.suse.com/security/cve/CVE-2020-26973.html https://www.suse.com/security/cve/CVE-2020-26974.html https://www.suse.com/security/cve/CVE-2020-26978.html https://www.suse.com/security/cve/CVE-2020-35111.html https://www.suse.com/security/cve/CVE-2020-35112.html https://www.suse.com/security/cve/CVE-2020-35113.html https://bugzilla.suse.com/1180039 _______________________________________________ openSUSE Security Announce mailing list --
Dec 22, 2020
•Critical
OpenSUSE
91
security advisorygentoobuffer overflowGentoo GLSA-200501-10 Normal: Vilistextum Buffer Overflow Exploit
Vilistextum is vulnerable to a buffer overflow that allows an attacker to execute arbitrary code through the use of a malicious webpage.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200501-10 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Vilistextum: Buffer overflow vulnerability Date: January 06, 2005 Bugs: #74694 ID: 200501-10 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Vilistextum is vulnerable to a buffer overflow that allows an attacker to execute arbitrary code through the use of a malicious webpage. Background ========= Vilistextum is an HTML to text converter. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-text/vilistextum < 2.6.7 > = 2.6.7 Description ========== Ariel Berkman discovered that Vilistextum unsafely reads data into an array without checking the length. This code vulnerability may lead to a buffer overflow. Impact ===== A remote attacker could craft a malicious webpage which, when converted, would result in the execution of arbitrary code with the rights of the user running Vilistextum. Workaround ========= There is no known workaround at this time. Resolution ========= All Vilistextum users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =app-text/vilistextum-2.6.7" References ========= [ 1 ] Original Advisory [ 2 ] CAN-2004-1299 https://www.cve.org/CVERecord?id=CVE-CAN-2004-1299 Availability =========== This GLSA andany updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200501-10 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Jan 06, 2005
Gentoo
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!