Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -4 articles for you...
89
security advisoryupdateFedoraFedora 39: Security Advisory for Rust-Lscolors Denial Of Service Fix
This update contains builds from a mini-mass-rebuild for Rust applications (and some C-style libraries). Rebuilding with the Rust 1.78 toolchain should fix incomplete debug information for the Rust standard library (and the resulting low-quality stack traces). Additionally, builds will have picked up fixes for some minor low-priority. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2024-40ee18b2e7 2024-06-02 03:36:56.060441 -------------------------------------------------------------------------------- Name : rust-lscolors Product : Fedora 39 Version : 0.17.0 Release : 2.fc39 URL : Summary : Colorize paths using the LS_COLORS environment variable Description : Colorize paths using the LS_COLORS environment variable. -------------------------------------------------------------------------------- Update Information: This update contains builds from a mini-mass-rebuild for Rust applications (and some C-style libraries). Rebuilding with the Rust 1.78 toolchain should fix incomplete debug information for the Rust standard library (and the resulting low-quality stack traces). Additionally, builds will have picked up fixes for some minor low-priority security and / or safety fixes in crate dependencies that had not yet been handled via a separate (targeted) rebuild: h2 v0.3.26+ (denial-of-service): https://rustsec.org/advisories/RUSTSEC-2024-0332.html glib v0.19.4+ and backports (UB): core/pull/1343 hashbrown v0.14.5+ (UB): https://github.com/rust-lang/hashbrown/pull/511 rustls v0.22.4+, v0.21.11+ (denial-of-service): https://rustsec.org/advisories/RUSTSEC-2024-0336.html -------------------------------------------------------------------------------- ChangeLog: * Thu May 23 2024 Fabio Valentini - 0.17.0-2 - Rebuild with Rust 1.78 to fix incomplete debuginfo and backtraces -------------------------------------------------------------------------------- This update can beinstalled with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-40ee18b2e7' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Jun 02, 2024
•Critical
Fedora
89
security advisorydenial of serviceFedoraFedora 39: 2024-40ee18b2e7 Moderate: Rust-B3Sum Denial Of Service
This update contains builds from a mini-mass-rebuild for Rust applications (and some C-style libraries). Rebuilding with the Rust 1.78 toolchain should fix incomplete debug information for the Rust standard library (and the resulting low-quality stack traces). Additionally, builds will have picked up fixes for some minor low-priority. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2024-40ee18b2e7 2024-06-02 03:36:56.060441 -------------------------------------------------------------------------------- Name : rust-b3sum Product : Fedora 39 Version : 1.5.1 Release : 2.fc39 URL : Summary : Command line implementation of the BLAKE3 hash function Description : A command line implementation of the BLAKE3 hash function. -------------------------------------------------------------------------------- Update Information: This update contains builds from a mini-mass-rebuild for Rust applications (and some C-style libraries). Rebuilding with the Rust 1.78 toolchain should fix incomplete debug information for the Rust standard library (and the resulting low-quality stack traces). Additionally, builds will have picked up fixes for some minor low-priority security and / or safety fixes in crate dependencies that had not yet been handled via a separate (targeted) rebuild: h2 v0.3.26+ (denial-of-service): https://rustsec.org/advisories/RUSTSEC-2024-0332.html glib v0.19.4+ and backports (UB): core/pull/1343 hashbrown v0.14.5+ (UB): https://github.com/rust-lang/hashbrown/pull/511 rustls v0.22.4+, v0.21.11+ (denial-of-service): https://rustsec.org/advisories/RUSTSEC-2024-0336.html -------------------------------------------------------------------------------- ChangeLog: * Thu May 23 2024 Fabio Valentini - 1.5.1-2 - Rebuild with Rust 1.78 to fix incomplete debuginfo and backtraces -------------------------------------------------------------------------------- This update can beinstalled with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-40ee18b2e7' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Jun 02, 2024
Fedora
89
security advisorysecurity issueFedoraFedora 31: FEDORA-2020-1a3bdfde17 Moderate: glibc Setuid Issue
This update fixes a minor security vulnerability ([`LD_PREFER_MAP_32BIT_EXEC` not ignored in setuid binaries](https://bugzilla.redhat.com/show_bug.cgi?id=1774682) and addresses are long-standing bug where missing shared objects could cause crashes due to incorrectly handled `dlopen` failures (RHBZ#1395758). The latter fix also causes. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-1a3bdfde17 2020-01-20 22:48:10.259348 --------------------------------------------------------------------------------Name : glibc Product : Fedora 31 Version : 2.30 Release : 10.fc31 URL : Summary : The GNU libc libraries Description : The glibc package contains standard libraries which are used by multiple programs on the system. In order to save disk space and memory, as well as to make upgrading easier, common system code is kept in one place and shared between programs. This particular package contains the most important sets of shared libraries: the standard C library and the standard math library. Without these two libraries, a Linux system will not function. --------------------------------------------------------------------------------Update Information: This update fixes a minor security vulnerability ([`LD_PREFER_MAP_32BIT_EXEC` not ignored in setuid binaries](https://bugzilla.redhat.com/show_bug.cgi?id=1774682) and addresses are long-standing bug where missing shared objects could cause crashes due to incorrectly handled `dlopen` failures (RHBZ#1395758). The latter fix also causes lazy binding failures in ELF constructors and destructors to result in process termination (the same effect that lazy binding failures have in other contexts), rather than leaving the process in an inconsistent state. Furthermore, various issues in the `utmp`/`utmpx` subsystem have been addressed. This update also includes various minor fixes from the glibc 2.30 upstream stable releasebranch. --------------------------------------------------------------------------------ChangeLog: * Fri Jan 17 2020 Florian Weimer - 2.30-10 - Fix dynamic loader crash after dlopen failure with NODELETE (#1395758) - Lazy binding failures during ELF constructors and destructors now always terminate the process. * Fri Jan 17 2020 Florian Weimer - 2.30-9 - Auto-sync with upstream branch release/2.30/master, commit 994e529a37953a057b9e6c80afa03b03fd3724f2: - Remove incorrect alloc_size attribute from pvalloc (swbz#25401) - login: Use pread64 in utmp implementation - Add nocancel version of pread64() - login: Introduce matches_last_entry to utmp processing - login: Acquire write lock early in pututline (swbz#24882) - login: Add nonstring attributes to struct utmp, struct utmpx (swbz#24899) - login: Remove double-assignment of fl.l_whence in try_file_lock - login: pututxline could fail to overwrite existing entries (swbz#24902) - login: Use struct flock64 in utmp (swbz#24880) - login: Disarm timer after utmp lock acquisition (swbz#24879) - login: Fix updwtmp, updwtmx unlocking - login: Replace macro-based control flow with function calls in utmp - login: Assume that _HAVE_UT_* constants are true - login: Remove utmp backend jump tables (swbz#23518) - misc/test-errno-linux: Handle EINVAL from quotactl - : Define __CORRECT_ISO_CPP_STRING_H_PROTO for Clang (swbz#25232) - x86: Assume --enable-cet if GCC defaults to CET (swbz#25225) - libio: Disable vtable validation for pre-2.1 interposed handles (swbz#25203) - S390: Fix handling of needles crossing a page in strstr z15 ifunc-variant. (swbz#25226) - rtld: Check __libc_enable_secure before honoring LD_PREFER_MAP_32BIT_EXEC (CVE-2019-19126) (#1774682) - Don't use a custom wrapper macro around __has_include (swbz#25189) * Wed Dec 4 2019 Arjun Shankar - 2.30-8 - Rebuild to fix corrupt annobin data in crti.o and crtn.o [BZ# 1779399] * Tue Nov 19 2019 Arjun Shankar - 2.30-7 - Auto-sync with upstream branchrelease/2.30/master, commit 919af705eef416f4469341dfdf4ca23450f30236: - Update Alpha libm-test-ulps - hppa: Update libm-tests-ulps - alpha: force old OSF1 syscalls for getegid, geteuid and getppid [BZ #24986] - Fix RISC-V vfork build with Linux 5.3 kernel headers. - S390: Add new s390 platform z15. - Make tst-strftime2 and tst-strftime3 depend on locale generation - mips: Force RWX stack for hard-float builds that can run on pre-4.8 kernels - malloc: Fix missing accounting of top chunk in malloc_info [BZ #24026] - Add glibc.malloc.mxfast tunable - malloc: Various cleanups for malloc/tst-mxfast - Base max_fast on alignment, not width, of bins (Bug 24903) * Mon Sep 30 2019 Florian Weimer - 2.30-6 - Set the expects flags to clock_nanosleep (#1473680) --------------------------------------------------------------------------------References: [ 1 ] Bug #1395758 - glibc: incomplete rollback of dynamic linker state on linking failure https://bugzilla.redhat.com/show_bug.cgi?id=1395758 [ 2 ] Bug #1774682 - CVE-2019-19126 glibc: LD_PREFER_MAP_32BIT_EXEC not ignored in setuid binaries [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1774682 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-1a3bdfde17' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Jan 20, 2020
Fedora
89
security advisoryFedoraBINDFedora 27: 2018-4dca7je64b Minor: BIND Authorization Vulnerabilities
Update to last supported version, fixes CVE-2017-3142 and CVE-2017-3143. Includes minor fix of missing dependencies.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2017-30f678e62a 2017-07-07 22:40:59.830090 --------------------------------------------------------------------------------Name : bind Product : Fedora 26 Version : 9.11.1 Release : 2.P2.fc26 URL : Summary : The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server Description : BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly. --------------------------------------------------------------------------------Update Information: Update to last supported version, fixes CVE-2017-3142 and CVE-2017-3143. Includes minor fix of missing dependencies. --------------------------------------------------------------------------------References: [ 1 ] Bug #1466189 - CVE-2017-3142 bind: An error in TSIG authentication can permit unauthorized zone transfers https://bugzilla.redhat.com/show_bug.cgi?id=1466189 [ 2 ] Bug #1466193 - CVE-2017-3143 bind: An error in TSIG authentication can permit unauthorized dynamic updates https://bugzilla.redhat.com/show_bug.cgi?id=1466193 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade bind' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Jul 07, 2017
•Important
Fedora
99
security advisorysoftware updateSlackwareSlackware: 2008-210-06 Medium: MTR Small Buffer Rectification
New mtr packages are available for Slackware 12.0, 12.1, and -current to fix a security issue. More details about this issue may be found in the Common Vulnerabilities and Exposures (CVE) database: . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] mtr (SSA:2008-210-06) New mtr packages are available for Slackware 12.0, 12.1, and -current to fix a security issue. More details about this issue may be found in the Common Vulnerabilities and Exposures (CVE) database: https://www.cve.org/CVERecord?id=CVE-2008-2357 Here are the details from the Slackware 12.1 ChangeLog: +--------------------------+ patches/packages/mtr-0.73-i486-1_slack12.1.tgz: Upgraded to mtr-0.73. This fixes a minor security bug where a very long hostname in the trace path could lead to an overflow (and most likely just a crash). (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ HINT: Getting slow download speeds from ftp.slackware.com? Give slackware.osuosl.org a try. This is another primary FTP site for Slackware that can be considerably faster than downloading directly from ftp.slackware.com. Thanks to the friendly folks at the OSU Open Source Lab (https://osuosl.org/) for donating additional FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://www.slackware.com/ for additional mirror sites near you. Updated package for Slackware 12.0: ftp://ftp.slackware.com/pub/slackware/slackware-12.0/patches/packages/mtr-0.73-i486-1_slack12.0.tgz Updated package for Slackware 12.1: ftp://ftp.slackware.com/pub/slackware/slackware-12.1/patches/packages/mtr-0.73-i486-1_slack12.1.tgz Updated package for Slackware -current: MD5 signatures: +-------------+ Slackware 12.0 package: a6e7fb366f0cff5b1911566a64eb4e68 mtr-0.73-i486-1_slack12.0.tgz Slackware 12.1 package: db3acb5ce1d51eee9065b02c951b1e81 mtr-0.73-i486-1_slack12.1.tgz Slackware -current package: 004f78f13e150f34d25b5c586b211ca7 mtr-0.73-i486-1.tgz Installation instructions: +------------------------+ Upgrade the package as root: # upgradepkg mtr-0.73-i486-1_slack12.1.tgz +-----+ . Fresh mtr packages have been released for Slackware 12.0, 12.1, and -current to address a critical security vulnerability. Ensure you upgrade as the root user!. Slackware Security, MTR Update, Package Management. . Severity: Medium. LinuxSecurity.com Team
Jul 29, 2008
•Medium
Slackware
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!