Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found 3 articles for you...
89
security advisoryFedorasystem updateFedora 41: 2024-acb9425c93 moderate: libell and iwd network fixes
libell 0.69: Add support for getting remaining microseconds left on a timer. Add support for setting link MTU on a network interface. iwd 2.21: Fix issue with pending scan requests after regdom update.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2024-acb9425c93 2024-09-20 00:15:03.879182 -------------------------------------------------------------------------------- Name : libell Product : Fedora 41 Version : 0.69 Release : 1.fc41 URL : https://01.org/ell Summary : Embedded Linux library Description : The Embedded Linux* Library (ELL) provides core, low-level functionality for system daemons. It typically has no dependencies other than the Linux kernel, C standard library, and libdl (for dynamic linking). While ELL is designed to be efficient and compact enough for use on embedded Linux platforms, it is not limited to resource-constrained systems. -------------------------------------------------------------------------------- Update Information: libell 0.69: Add support for getting remaining microseconds left on a timer. Add support for setting link MTU on a network interface. iwd 2.21: Fix issue with pending scan requests after regdom update. Fix issue with handling the rearming of the roaming timeout. Fix issue with survey request and externally triggered scans. Fix issue with RSSI fallback when setting CQM threshold fails. Fix issue with FT-over-Air without offchannel support. Add support for per station Affinities property. bluez 5.78: Fix issue with handling notification of scanned BISes to BASS Fix issue with handling checking BIS caps against peer caps. Fix issue with handling MGMT Set Device Flags overwrites. Fix issue with handling ASE notification order. Fix issue with handling BIG Info report events. Fix issue with handling PACS Server role. Fix issue with registering UHID_START multiple times. Fix issue with pairing method not settingauto-connect. -------------------------------------------------------------------------------- ChangeLog: * Mon Sep 9 2024 Peter Robinson - 0.69-1 - Update to 0.69 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2294016 - CVE-2023-52424 iwd: 802.11: SSID Confusion attack [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2294016 [ 2 ] Bug #2307290 - libell-0.68 is available https://bugzilla.redhat.com/show_bug.cgi?id=2307290 [ 3 ] Bug #2310802 - libell-0.69 is available https://bugzilla.redhat.com/show_bug.cgi?id=2310802 [ 4 ] Bug #2310805 - iwd-2.21 is available https://bugzilla.redhat.com/show_bug.cgi?id=2310805 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-acb9425c93' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Sep 20, 2024
•Important
Fedora
98
security advisorysecurity updateRed HatRed Hat: RHSA-2020-2684-01 Moderate: MitM Vulnerability in Network Plugins
An update for containernetworking-plugins is now available for Red Hat Enterprise Linux 7 Extras. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: containernetworking-plugins security update Advisory ID: RHSA-2020:2684-01 Product: Red Hat Enterprise Linux Extras Advisory URL: https://access.redhat.com/errata/RHSA-2020:2684 Issue date: 2020-06-23 CVE Names: CVE-2020-10749 ==================================================================== 1. Summary: An update for containernetworking-plugins is now available for Red Hat Enterprise Linux 7 Extras. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux 7 Extras - ppc64le, s390x, x86_64 3. Description: The Container Network Interface (CNI) project consists of a specification and libraries for writing plug-ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity of containers and removing allocated resources when the container is deleted. Security Fix(es): * containernetworking/plugins: IPv6 router advertisements allow for MitM attacks on IPv4 clusters (CVE-2020-10749) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory,refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1833220 - CVE-2020-10749 containernetworking/plugins: IPv6 router advertisements allow for MitM attacks on IPv4 clusters 6. Package List: Red Hat Enterprise Linux 7 Extras: Source: containernetworking-plugins-0.8.3-3.el7_8.src.rpm ppc64le: containernetworking-plugins-0.8.3-3.el7_8.ppc64le.rpm containernetworking-plugins-debuginfo-0.8.3-3.el7_8.ppc64le.rpm s390x: containernetworking-plugins-0.8.3-3.el7_8.s390x.rpm containernetworking-plugins-debuginfo-0.8.3-3.el7_8.s390x.rpm x86_64: containernetworking-plugins-0.8.3-3.el7_8.x86_64.rpm containernetworking-plugins-debuginfo-0.8.3-3.el7_8.x86_64.rpm Red Hat Enterprise Linux 7 Extras: Source: containernetworking-plugins-0.8.3-3.el7_8.src.rpm x86_64: containernetworking-plugins-0.8.3-3.el7_8.x86_64.rpm containernetworking-plugins-debuginfo-0.8.3-3.el7_8.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2020-10749 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBXvIR7NzjgjWX9erEAQgITxAAqJBOpSRe6gtzTCQIr765GwWSlukHF037 lRkZoNfRFWIdPjFsds4P9NzaPvN0a1xT/jYFvKwUmMT4FHBu1p9Q4PqkSkYj/PND 1eS3XicKQ/ZfoKGD9znS3t4Jamx9cuDjKOXv0Ji86h0rlsypJdTM5YgsCCMqc//i +nVmB7TDix6s2niF7LQFlvb+IMegfQLQlL60koBt4Th7JUa6e9Lyb8OZkJ9jW8Tc 8Hde89bNG3ogsHOX/GJwCyDWisP6G2c4c/qA930bOrK1pgHXRzbUpvBM+s10HUBH 7Z2imm1HWkHoQaZA4boabj17OUg5HPm15X+/RluxrMBeNxLWpVVbLLy+Csvjv2Oy CmO0XN+0rgXw9ZYhs/8Pggqh2IChy59dNi8rkBkAo1Psjc1lFCTzdQv/fCqao8HM FsczmTZpqgZH8hMiwi+zEJHa1iL+rIXl9N5Cj8zT+u1xvr0JjxzNXpUnaPuaygNR 7hLoSZB2xcThnhOSdsxEh0n28P+2l2GxmMI8Fp4IXBmBcDkC0PW2UU+wvIV5mBWw Pj/GENWUhs4dT+CUPOZep9IdRHQ6HVquohvSf16rfUQ/F3pJ7UN6jbu1+EIPN33e EBQmMmt+w7/bQDSDnUmwbW/r3NSDrnopEQPr/z8wU5EHn9MnB6e+v+NbMLlRwpwE hq0I2UvgzOs=1g4M -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Jun 23, 2020
•Important
Red Hat
89
security advisoryfedoracriticalFedora 30: FEDORA-2019-d2b57d3b19 Critical: CNI Portmap Plugin Issue
Resolves: #1715758 - CVE-2019-9946. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2019-d2b57d3b19 2019-06-12 14:47:01.833170 --------------------------------------------------------------------------------Name : containernetworking-plugins Product : Fedora 30 Version : 0.7.5 Release : 1.fc30 URL : https://github.com/containernetworking/plugins Summary : Libraries for writing CNI plugin Description : The CNI (Container Network Interface) project consists of a specification and libraries for writing plugins to configure network interfaces in Linux containers, along with a number of supported plugins. CNI concerns itself only with network connectivity of containers and removing allocated resources when the container is deleted. --------------------------------------------------------------------------------Update Information: Resolves: #1715758 - CVE-2019-9946 --------------------------------------------------------------------------------ChangeLog: * Fri May 31 2019 Lokesh Mandvekar - 0.7.5-1 - Resolves: #1715758 - CVE-2019-9946 - bump to v0.7.5 - BR: git - remove ExcludeArch: ppc64 --------------------------------------------------------------------------------References: [ 1 ] Bug #1715758 - CVE-2019-9946 containernetworking-plugins: kubernetes: Incorrect rule injection in CNI portmap plugin [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1715758 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2019-d2b57d3b19' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Jun 12, 2019
•Critical
Fedora
198
security advisorylocal attacklow severityArch Linux Security Advisory ASA-201705-17 Low Severity: Lxc Package Issues
The package lxc before version 1:2.0.8-1 is vulnerable to insufficient validation. . Arch Linux Security Advisory ASA-201705-17 ========================================= Severity: Low Date : 2017-05-13 CVE-ID : CVE-2017-5985 Package : lxc Type : insufficient validation Remote : No Link : https://security.archlinux.org/AVG-204 Summary ====== The package lxc before version 1:2.0.8-1 is vulnerable to insufficient validation. Resolution ========= Upgrade to 1:2.0.8-1. # pacman -Syu "lxc> =1:2.0.8-1" The problem has been fixed upstream in version 2.0.8. Workaround ========= None. Description ========== This security issue was reported by Jann Horn and has to do with a lack of netns ownership check in lxc-user-nic, which would allow any user with a lxc-usernet allocation to create network interfaces on the host including choosing the name of that network interface. The created interface wouldn't be UP so is unlikely to be automatically brought up or get an address, but this issue could be used to squat the name of a real system network interface before it appears. Impact ===== A local attacker is able to spoof a new network interface. References ========= https://lists.linuxcontainers.org/pipermail/lxc-users/2017-March/012925.html https://security.archlinux.org/CVE-2017-5985 . Debian Security Advisory DSA-2023-12 highlights a minor severity vulnerability concerning the software package samba.. Arch Linux, lxc update, insufficient validation issue, low severity advisory, network spoofing. . Severity: Low. LinuxSecurity.com Team
May 13, 2017
•Low
ArchLinux
172
security advisorycriticalUbuntuUbuntu 16.10: USN-3224-1 Critical LXC Network Interface Issue
LXC could be made to create arbitrary virtual network interfaces as anadministrator.. =========================================================================Ubuntu Security Notice USN-3224-1 March 09, 2017 lxc vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.10 - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: LXC could be made to create arbitrary virtual network interfaces as an administrator. Software Description: - lxc: Linux Containers userspace tools Details: Jann Horn discovered that LXC incorrectly verified permissions when creating virtual network interfaces. A local attacker could possibly use this issue to create virtual network interfaces in network namespaces that they do not own. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.10: lxc-common 2.0.7-0ubuntu1~16.10.2 Ubuntu 16.04 LTS: lxc-common 2.0.7-0ubuntu1~16.04.2 Ubuntu 14.04 LTS: lxc 1.0.9-0ubuntu3 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-3224-1 CVE-2017-5985 Package Information: https://launchpad.net/ubuntu/+source/lxc/2.0.7-0ubuntu1~16.10.2 https://launchpad.net/ubuntu/+source/lxc/2.0.7-0ubuntu1~16.04.2 https://launchpad.net/ubuntu/+source/lxc/1.0.9-0ubuntu3 . A new patch for LXC on Ubuntu has been released to rectify a permissions-related problem encountered during the establishment of virtual network interfaces.. LXC Security Update, Ubuntu Network Permissions, Virtual Interface Exploit. . Severity: Critical. LinuxSecurity.com Team
Mar 09, 2017
•Critical
Ubuntu
89
security advisorydenial of serviceFedoraFedora 23: 2016-02ed08bf15 Critical Denial Of Service Fix
The 4.4.6 update contains a number of important fixes across the tree. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2016-02ed08bf15 2016-03-23 17:54:24.524351 -------------------------------------------------------------------------------- Name : kernel Product : Fedora 23 Version : 4.4.6 Release : 300.fc23 URL : https://www.kernel.org/ Summary : The Linux kernel Description : The kernel meta package -------------------------------------------------------------------------------- Update Information: The 4.4.6 update contains a number of important fixes across the tree -------------------------------------------------------------------------------- References: [ 1 ] Bug #1318172 - CVE-2016-3156 kernel: ipv4: denial of service when destroying a network interface https://bugzilla.redhat.com/show_bug.cgi?id=1318172 [ 2 ] Bug #1317383 - CVE-2016-3134 kernel: netfilter: missing bounds check in ipt_entry structure https://bugzilla.redhat.com/show_bug.cgi?id=1317383 [ 3 ] Bug #1317386 - CVE-2016-3135 kernel: netfilter: size overflow in x_tables https://bugzilla.redhat.com/show_bug.cgi?id=1317386 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update kernel' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Mar 23, 2016
•Critical
Fedora
98
security advisorybuffer overflowcriticalRed Hat Enterprise Linux 5 RHSA-2013:0599-01 Critical: Xen Buffer Overflow
Updated xen packages that fix one security issue are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having [More...]. ==================================================================== Red Hat Security Advisory Synopsis: Important: xen security update Advisory ID: RHSA-2013:0599-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2013:0599.html Issue date: 2013-03-06 CVE Names: CVE-2012-6075 ==================================================================== 1. Summary: Updated xen packages that fix one security issue are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: RHEL Desktop Multi OS (v. 5 client) - i386, x86_64 RHEL Virtualization (v. 5 server) - i386, ia64, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 3. Description: The xen packages contain administration tools and the xend service for managing the kernel-xen kernel for virtualization on Red Hat Enterprise Linux. A flaw was found in the way QEMU emulated the e1000 network interface card when the host was configured to accept jumbo network frames, and a fully-virtualized guest using the e1000 emulated driver was not. A remote attacker could use this flaw to crash the guest or, potentially, execute arbitrary code with root privileges in the guest. (CVE-2012-6075) All users of xen are advised to upgrade to these updated packages, which correct this issue. After installing the updated packages, all running fully-virtualized guests must be restarted for this update to take effect. 4. Solution: Before applying this update,make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (http://bugzilla.redhat.com/): 889301 - CVE-2012-6075 qemu: e1000 driver buffer overflow when processing large packets when SBP and LPE flags are disabled 6. Package List: Red Hat Enterprise Linux Desktop (v. 5 client): Source: i386: xen-debuginfo-3.0.3-142.el5_9.2.i386.rpm xen-libs-3.0.3-142.el5_9.2.i386.rpm x86_64: xen-debuginfo-3.0.3-142.el5_9.2.i386.rpm xen-debuginfo-3.0.3-142.el5_9.2.x86_64.rpm xen-libs-3.0.3-142.el5_9.2.i386.rpm xen-libs-3.0.3-142.el5_9.2.x86_64.rpm RHEL Desktop Multi OS (v. 5 client): Source: i386: xen-3.0.3-142.el5_9.2.i386.rpm xen-debuginfo-3.0.3-142.el5_9.2.i386.rpm xen-devel-3.0.3-142.el5_9.2.i386.rpm x86_64: xen-3.0.3-142.el5_9.2.x86_64.rpm xen-debuginfo-3.0.3-142.el5_9.2.i386.rpm xen-debuginfo-3.0.3-142.el5_9.2.x86_64.rpm xen-devel-3.0.3-142.el5_9.2.i386.rpm xen-devel-3.0.3-142.el5_9.2.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): Source: i386: xen-debuginfo-3.0.3-142.el5_9.2.i386.rpm xen-libs-3.0.3-142.el5_9.2.i386.rpm ia64: xen-debuginfo-3.0.3-142.el5_9.2.ia64.rpm xen-libs-3.0.3-142.el5_9.2.ia64.rpm x86_64: xen-debuginfo-3.0.3-142.el5_9.2.i386.rpm xen-debuginfo-3.0.3-142.el5_9.2.x86_64.rpm xen-libs-3.0.3-142.el5_9.2.i386.rpm xen-libs-3.0.3-142.el5_9.2.x86_64.rpm RHEL Virtualization (v. 5 server): Source: i386: xen-3.0.3-142.el5_9.2.i386.rpm xen-debuginfo-3.0.3-142.el5_9.2.i386.rpm xen-devel-3.0.3-142.el5_9.2.i386.rpm ia64: xen-3.0.3-142.el5_9.2.ia64.rpm xen-debuginfo-3.0.3-142.el5_9.2.ia64.rpm xen-devel-3.0.3-142.el5_9.2.ia64.rpm x86_64: xen-3.0.3-142.el5_9.2.x86_64.rpm xen-debuginfo-3.0.3-142.el5_9.2.i386.rpm xen-debuginfo-3.0.3-142.el5_9.2.x86_64.rpm xen-devel-3.0.3-142.el5_9.2.i386.rpm xen-devel-3.0.3-142.el5_9.2.x86_64.rpm These packages are GPG signed by Red Hat for security. Our keyand details on how to verify the signature are available from https://access.redhat.com/security/team/key#package 7. References: https://access.redhat.com/security/cve/CVE-2012-6075 https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2013 Red Hat, Inc. . The latest release of xen packages in Red Hat tackles a significant security vulnerability impacting both virtualization technologies and network adaptability.. Red Hat Enterprise Linux,xen update,buffers. . Severity: Important. LinuxSecurity.com Team
Mar 06, 2013
•Important
Red Hat
200
security advisorycriticalprivilege escalationCritical Xen Update CVE-2012-0029 for Scientific Linux: Heap Overflow
Important: xen security and bug fix update. Date: Wed, 21 Mar 2012 16:24:44 -0500 Reply-To:
Mar 21, 2012
•Critical
Scientific Linux
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!