Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found -2 articles for you...
89
security advisoryFedoramedium riskFedora 36: FEDORA-2023-b7e90bc682 Medium: Stellarium File Write Risk
Patches for CVE-2023-28371. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2023-b7e90bc682 2023-03-29 01:28:11.391291 --------------------------------------------------------------------------------Name : stellarium Product : Fedora 36 Version : 1.2 Release : 9.fc36 URL : http://stellarium.org/ Summary : Photo-realistic nightsky renderer Description : Stellarium is a real-time 3D photo-realistic nightsky renderer. It can generate images of the sky as seen through the Earth's atmosphere with more than one hundred thousand stars from the Hipparcos Catalogue, constellations, planets, major satellites and nebulas. --------------------------------------------------------------------------------Update Information: Patches for CVE-2023-28371 --------------------------------------------------------------------------------ChangeLog: * Mon Mar 20 2023 Gwyn Ciesla - 1.2-9 - Patches for CVE-2023-28371 * Sun Mar 12 2023 Neal Gompa - 1.2-8 - Kill TELESCOPECONTROL support on F38 due to libindi 2 incompatibility * Thu Mar 2 2023 Mamoru TASAKA - 1.2-7 - F-39: kill USE_PLUGIN_TELESCOPECONTROL support due to libindi 2 incompatibility * Wed Mar 1 2023 Gwyn Ciesla - 1.2-6 - migrated to SPDX license * Sun Feb 26 2023 Gwyn Ciesla - 1.2-5 - libindi rebuild. --------------------------------------------------------------------------------References: [ 1 ] Bug #2180112 - CVE-2023-28371 stellarium: arbitrary file write [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2180112 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-b7e90bc682' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. Moredetails on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Mar 29, 2023
•Medium
Fedora
198
security advisoryarbitrary code executionmedium riskArch Linux ASA-202110-9 Medium Risk: Webkit2gtk Multiple Issues
The package webkit2gtk before version 2.34.1-1 is vulnerable to multiple issues including arbitrary code execution and sandbox escape. . Arch Linux Security Advisory ASA-202110-9 ======================================== Severity: Medium Date : 2021-10-29 CVE-ID : CVE-2021-30846 CVE-2021-30851 CVE-2021-42762 Package : webkit2gtk Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2483 Summary ====== The package webkit2gtk before version 2.34.1-1 is vulnerable to multiple issues including arbitrary code execution and sandbox escape. Resolution ========= Upgrade to 2.34.1-1. # pacman -Syu "webkit2gtk> =2.34.1-1" The problems have been fixed upstream in version 2.34.1. Workaround ========= None. Description ========== - CVE-2021-30846 (arbitrary code execution) A security issue has been found in WebKitGTK and WPE WebKit before 2.34.0. Processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2021-30851 (arbitrary code execution) A security issue has been found in WebKitGTK and WPE WebKit before 2.34.0. Processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2021-42762 (sandbox escape) BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133. Impact ===== A remote attacker could execute arbitrary code or escape the confinements of the security sandbox through crafted webcontent. References ========= https://webkitgtk.org/security/WSA-2021-0006.html#CVE-2021-30846 https://webkitgtk.org/security/WSA-2021-0006.html#CVE-2021-30851 https://webkitgtk.org/security/WSA-2021-0006.html#CVE-2021-42762 https://bugs.webkit.org/show_bug.cgi?id=231479 https://security.archlinux.org/CVE-2021-30846 https://security.archlinux.org/CVE-2021-30851 https://security.archlinux.org/CVE-2021-42762 . Update webkit2gtk on Arch Linux to address several vulnerabilities and improve security. For further details, read on.. Arch Linux, webkit2gtk, code execution risk, security advisory. . Severity: Medium. LinuxSecurity.com Team
Nov 01, 2021
•Medium
ArchLinux
198
security advisorydenial of servicemedium severityArch Linux: ASA-202102-35 Medium: python-httplib2 Denial Of Service
The package python-httplib2 before version 0.19.0-1 is vulnerable to denial of service. . Arch Linux Security Advisory ASA-202102-35 ========================================= Severity: Medium Date : 2021-02-27 CVE-ID : CVE-2021-21240 Package : python-httplib2 Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1546 Summary ====== The package python-httplib2 before version 0.19.0-1 is vulnerable to denial of service. Resolution ========= Upgrade to 0.19.0-1. # pacman -Syu "python-httplib2> =0.19.0-1" The problem has been fixed upstream in version 0.19.0. Workaround ========= The issue can be mitigated by using "httplib2.USE_WWW_AUTH_STRICT_PARSING = True". Description ========== In python-httplib2 before version 0.19.0, a malicious server which responds with a long series of "\xa0" characters in the "www- authenticate" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library. Impact ===== A malicious server can crash the application with crafted HTTP responses. References ========= https://github.com/httplib2/httplib2/security/advisories/GHSA-93xj-8mrv-444m https://github.com/httplib2/httplib2/pull/182 https://github.com/httplib2/httplib2/commit/bd9ee252c8f099608019709e22c0d705e98d26bc https://security.archlinux.org/CVE-2021-21240 . Arch Linux Security Advisory ASA-202102-35 ========================================= Severity: Mediu. package, python-httplib2, version, vulnerable, denial, service, linux. . Severity: Medium. LinuxSecurity.com Team
Mar 01, 2021
•Medium
ArchLinux
198
security advisorydenial of servicemedium riskArch Linux: ASA-201811-1 Low: Linux Denial of Service Issue
The package linux before version 4.18.13.arch1-1 is vulnerable to denial of service. . Arch Linux Security Advisory ASA-201811-1 ======================================== Severity: Low Date : 2018-11-01 CVE-ID : CVE-2018-18445 Package : linux Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-784 Summary ====== The package linux before version 4.18.13.arch1-1 is vulnerable to denial of service. Resolution ========= Upgrade to 4.18.13.arch1-1. # pacman -Syu "linux> =4.18.13.arch1-1" The problem has been fixed upstream in version 4.18.13.arch1. Workaround ========= None. Description ========== In the Linux kernel 4.14.x before 4.14.75 and 4.18.x before 4.18.13, faulty computation of numeric bounds in the BPF verifier permits out- of-bounds memory accesses because adjust_scalar_min_max_vals in kernel/bpf/verifier.c mishandles 32-bit right shifts. Impact ===== A local attacker is able to crash the kernel and leak information using a specially crafted BPF program. References ========= https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/ https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.13 https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.75 https://bugs.chromium.org/p/project-zero/issues/detail?id=1686 https://seclists.org/oss-sec/2018/q4/69 https://security.archlinux.org/CVE-2018-18445 . Arch Linux Security Advisory ASA-202109-2 discusses a minor severity vulnerability related to a denial of service in the linux kernel package.. Arch Linux, Linux Denial of Service, Security Advisory, Linux Package Update. . Severity: Low. LinuxSecurity.com Team
Nov 01, 2018
•Low
ArchLinux
198
security advisorydenial of servicemedium riskFedora: FED-202201-8 Low Risk: lib32-libpng DoS Threat Resolution
The package lib32-libpng before version 1.6.27-1 is vulnerable to denial of service. . Arch Linux Security Advisory ASA-201701-5 ======================================== Severity: Low Date : 2017-01-02 CVE-ID : CVE-2016-10087 Package : lib32-libpng Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-120 Summary ====== The package lib32-libpng before version 1.6.27-1 is vulnerable to denial of service. Resolution ========= Upgrade to 1.6.27-1. # pacman -Syu "lib32-libpng> =1.6.27-1" The problem has been fixed upstream in version 1.6.27. Workaround ========= None. Description ========== A NULL-pointer dereference issue has been found in png_set_text_2() in libpng. To be vulnerable, an application has to load a text chunk into the png structure, then delete all text, then add another text chunk to the same png structure. Impact ===== A remote attacker is able to crash the application under certain circumstances. References ========= https://seclists.org/oss-sec/2016/q4/782 https://security.archlinux.org/CVE-2016-10087 . The advisory for Arch Linux ASA-202104-5 discusses a potential denial of service issue in lib32-libjpeg prior to version 9c-1. Users are advised to perform an upgrade.. Arch Linux, libjpeg, lib32-libpng, Denial Of Service, Security Advisory. . Severity: Low. LinuxSecurity.com Team
Jan 02, 2017
•Low
ArchLinux
87
security advisorysoftware updatecode executionDebian: DSA-3082-1 Moderate: Flac Code Execution Threat
Michele Spagnuolo, of Google Security Team, and Miroslav Lichvar, of Red Hat, discovered two issues in flac, a library handling Free Lossless Audio Codec media: by providing a specially crafted FLAC file, an attacker could execute arbitrary code. . - ------------------------------------------------------------------------- Debian Security Advisory DSA-3082-1
Nov 30, 2014
•Important
Debian
87
security advisorydebiancross-site scriptingDebian: DSA-2830-1 Medium Risk: Ruby-i18n Cross-Site Scripting
Peter McLarnan discovered that the internationalization component of Ruby on Rails does not properly encode parameters in generated HTML code, resulting in a cross-site scripting vulnerability. This update corrects the underlying vulnerability in the i18n gem, as provided by . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2830-1
Dec 30, 2013
•Medium
Debian
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!