Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found -1 articles for you...
89
security advisoryFedoraDoS threatFedora 37: FEDORA-2023-ce436d56f8 low: FRRouting DoS Threat
New version 8.5.3.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2023-ce436d56f8 2023-11-15 02:00:25.496972 -------------------------------------------------------------------------------- Name : frr Product : Fedora 37 Version : 8.5.3 Release : 1.fc37 URL : https://www.frrouting.org/ Summary : Routing daemon Description : FRRouting is free software that manages TCP/IP based routing protocols. It takes a multi-server and multi-threaded approach to resolve the current complexity of the Internet. FRRouting supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD. FRRouting is a fork of Quagga. -------------------------------------------------------------------------------- Update Information: New version 8.5.3. -------------------------------------------------------------------------------- ChangeLog: * Mon Oct 9 2023 Michal Ruprich - 8.5.3-1 - New version 8.5.3 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2230983 - CVE-2023-38802 frr: Incorrect handling of a error in parsing of an invalid section of a BGP update can de-peer a router https://bugzilla.redhat.com/show_bug.cgi?id=2230983 [ 2 ] Bug #2235839 - CVE-2023-41358 frr: processes invalid NLRIs if attribute length is zero https://bugzilla.redhat.com/show_bug.cgi?id=2235839 [ 3 ] Bug #2235840 - CVE-2023-41359 frr: out of bounds read in bgp_attr_aigp_valid https://bugzilla.redhat.com/show_bug.cgi?id=2235840 [ 4 ] Bug #2235842 - CVE-2023-41360 frr: ahead-of-stream read of ORF header https://bugzilla.redhat.com/show_bug.cgi?id=2235842 [ 5 ] Bug #2237416 - CVE-2023-41909 frr: NULL pointer dereference in bgp_nlri_parse_flowspec() in bgpd/bgp_flowspec.c https://bugzilla.redhat.com/show_bug.cgi?id=2237416 [ 6 ] Bug #2238990 - CVE-2023-31489 frr: incorrect length check inbgp_capability_llgr() can lead do DoS https://bugzilla.redhat.com/show_bug.cgi?id=2238990 [ 7 ] Bug #2238992 - CVE-2023-31490 frr: missing length check in bgp_attr_psid_sub() can lead do DoS https://bugzilla.redhat.com/show_bug.cgi?id=2238992 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-ce436d56f8' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Nov 15, 2023
•Low
Fedora
98
security advisorysecurity issuebug fixRed Hat Enterprise Linux 8 RHSA-2023:5219-01 Important frr Security Issue
An update for frr is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: frr security and bug fix update Advisory ID: RHSA-2023:5219-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2023:5219 Issue date: 2023-09-19 CVE Names: CVE-2023-38802 ===================================================================== 1. Summary: An update for frr is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64 3. Description: FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD. Security Fix(es): * frr: Incorrect handling of a error in parsing of an invalid section of a BGP update can de-peer a router (CVE-2023-38802) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * BFD crash in FRR running in MetalLB (BZ#2231829) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed(https://bugzilla.redhat.com/): 2230983 - CVE-2023-38802 frr: Incorrect handling of a error in parsing of an invalid section of a BGP update can de-peer a router 2231829 - BFD crash in FRR running in MetalLB [rhel-8.8.0.z] 6. Package List: Red Hat Enterprise Linux AppStream (v. 8): Source: frr-7.5.1-7.el8_8.2.src.rpm aarch64: frr-7.5.1-7.el8_8.2.aarch64.rpm frr-debuginfo-7.5.1-7.el8_8.2.aarch64.rpm frr-debugsource-7.5.1-7.el8_8.2.aarch64.rpm noarch: frr-selinux-7.5.1-7.el8_8.2.noarch.rpm ppc64le: frr-7.5.1-7.el8_8.2.ppc64le.rpm frr-debuginfo-7.5.1-7.el8_8.2.ppc64le.rpm frr-debugsource-7.5.1-7.el8_8.2.ppc64le.rpm s390x: frr-7.5.1-7.el8_8.2.s390x.rpm frr-debuginfo-7.5.1-7.el8_8.2.s390x.rpm frr-debugsource-7.5.1-7.el8_8.2.s390x.rpm x86_64: frr-7.5.1-7.el8_8.2.x86_64.rpm frr-debuginfo-7.5.1-7.el8_8.2.x86_64.rpm frr-debugsource-7.5.1-7.el8_8.2.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2023-38802 https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIcBAEBCAAGBQJlCWltAAoJENzjgjWX9erET48P/i4sFRi3htQmxLHFxf5dTRWh rvCopOuKxIsVUdvPLoicy41cjFGlZmiF1xogHUvqRvXfiOEGHOzCWHjMdllYzj7F cDg4TJ9qGSmkPHf+5rLyXPKjFIQ3C9S/GT69IyPKDWHBwabOaEXfvAk5iAzDZFxH Wq4vIU4fBnX2HeiqQIl/UshktPolzUx8Gc0sCtMmVJEJX8YpowH4Qo6vxE7rpuhY 1XSIVs7YbG3F4tqLWRr0PDKTyVeObKM/O0DHTSgfAxZQVu3b4K5U2Lxwv8i90f7M dwRTqKGwyKXe0lr7ZtoAojTZkINk7pUIYac7baUzKyt0jKdQ2bkdMexmGHSQfNp7 Vmyh294YGaEoGrTnOkGfysK3LjwwvnppK4eab3Z3tBg+YWaEsRpXbr1Wrk9ZRuSC vPm3Vnuare1iECH85iuaUcu9qCoD66UR3UHQ/sYA37xB9hmy/6lR0YhLY6o06owc UvurOWIEMJUxtDWtp+dZepwfpk7c4v0Sgm5SstLLoVE4dwMURzWAOaWfr1jFNUIb Tx6oOAUt4yFZfS9a6T54sobOFES+rOS4rwSBmT7dr4M+7HytYEyIi2zQhpvrB89i k+Vx+2ae/tNHGFbIOa4qjl9yG3rPSum3rBNSv9uwqleVtDXDKrSMRh4TJC0VqIUi H8TQ9vh6iJug7mNeHAnj =P6/K -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Sep 19, 2023
•Important
Red Hat
172
security advisorydenial of servicecriticalUbuntu 23.04 USN-6240-1 Critical: FRR Denial Of Service Risk
FRR could be made to denial of service if it received a specially crafted message.. ========================================================================== Ubuntu Security Notice USN-6240-1 July 24, 2023 frr vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 23.04 Summary: FRR could be made to denial of service if it received a specially crafted message. Software Description: - frr: FRRouting suite of internet protocols Details: It was discovered that FRR incorrectly handled certain messages. An attacker could possibly use this issue to cause a denial of service. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 23.04: frr 8.4.2-1ubuntu1.2 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6240-1 CVE-2023-3748 Package Information: https://launchpad.net/ubuntu/+source/frr/8.4.2-1ubuntu1.2 . A new FRR patch has been released for Ubuntu addressing a denial of service vulnerability triggered by specially designed messages impacting network protocols.. FRR Denial Of Service, Ubuntu Security Update, FRRouting Risk. . Severity: Critical. LinuxSecurity.com Team
Jul 24, 2023
•Critical
Ubuntu
89
security advisoryFedorasoftware releaseFedora 36 FRRouting 8.5 Advisory: Critical Network Issues,
New version 8.5. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2023-14ec79ae02 2023-04-21 01:23:34.069315 --------------------------------------------------------------------------------Name : frr Product : Fedora 36 Version : 8.5 Release : 1.fc36 URL : https://www.frrouting.org/ Summary : Routing daemon Description : FRRouting is free software that manages TCP/IP based routing protocols. It takes a multi-server and multi-threaded approach to resolve the current complexity of the Internet. FRRouting supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD. FRRouting is a fork of Quagga. --------------------------------------------------------------------------------Update Information: New version 8.5 --------------------------------------------------------------------------------ChangeLog: * Wed Apr 12 2023 Michal Ruprich - 8.5-1 - New version 8.5 --------------------------------------------------------------------------------References: [ 1 ] Bug #2177783 - New versions of frr available https://bugzilla.redhat.com/show_bug.cgi?id=2177783 [ 2 ] Bug #2184469 - CVE-2022-36440 frr: Reachable assertion in peek_for_as4_capability function [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2184469 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-14ec79ae02' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Apr 21, 2023
•Critical
Fedora
199
security advisorysoftware updatesecurity fixCentOS 7: CESA-2018-0377 Important Quagga Security Update
Upstream details at : https://access.redhat.com/errata/RHSA-2018:0377. CentOS Errata and Security Advisory 2018:0377 Important Upstream details at : https://access.redhat.com/errata/RHSA-2018:0377 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: fc6365b8be5a0f09b1c7906a4e32460414fd98b941adbd0abdb9a5054a9ef9f8 quagga-0.99.22.4-5.el7_4.i686.rpm bb7a7b2c73271fa3ed56def5ada5ef5618c64222de4119f9e765c7ae3a90a1b7 quagga-0.99.22.4-5.el7_4.x86_64.rpm 3993c187f182e98af3e539c60f28c5815e3e081490d23b3fe16ee0b9b09c18fd quagga-contrib-0.99.22.4-5.el7_4.x86_64.rpm ed24c6cba7edd850c9a07376abfe5a648a48848d5f1d77d8911bd3867e9856c4 quagga-devel-0.99.22.4-5.el7_4.i686.rpm 98c5d9a54b49554af7e9749e7e431288c8e95fa653d3563fc6f352a5bfbf7479 quagga-devel-0.99.22.4-5.el7_4.x86_64.rpm Source: f078810b4dfb5361a04366c71cd6bf78970dfe54d3500d3fdadb76998c7f3cb6 quagga-0.99.22.4-5.el7_4.src.rpm -- Johnny Hughes CentOS Project { https://www.centos.org/ } irc: hughesjr, #
Mar 10, 2018
•Important
CentOS
87
security advisorydebiancritical advisoryDebian DSA-3341-1 Critical: Conntrack Crash with Network Protocols
It was discovered that in certain configurations, if the relevant conntrack kernel module is not loaded, conntrackd will crash when handling DCCP, SCTP or ICMPv6 packets. . - ------------------------------------------------------------------------- Debian Security Advisory DSA-3341-1
Aug 20, 2015
•Critical
Debian
98
security advisoryred hatbug fixRed Hat: RHSA-2015-1064-01 Moderate Python27 Security Updates
Updated python27 collection packages that fix multiple security issues and several bugs are now available as part of Red Hat Software Collections 2. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: python27 security, bug fix, and enhancement update Advisory ID: RHSA-2015:1064-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2015:1064.html Issue date: 2015-06-04 CVE Names: CVE-2013-1752 CVE-2013-1753 CVE-2014-1912 CVE-2014-4616 CVE-2014-4650 CVE-2014-7185 ==================================================================== 1. Summary: Updated python27 collection packages that fix multiple security issues and several bugs are now available as part of Red Hat Software Collections 2. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.5) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64 3. Description: Python is an interpreted, interactive, object-oriented programming language that supportsmodules, classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 collection provide a stable release of Python 2.7 with a number of additional utilities and database connectorsfor MySQL and PostgreSQL. The python27-python packages have been upgraded to upstream version 2.7.8, which provides numerous bug fixes over the previous version. (BZ#1167912) The following security issues were fixed in the python27-python component: It was discovered that the socket.recvfrom_into() function failed to check the size of the supplied buffer. This could lead to a buffer overflow when the function was called with an insufficiently sized buffer. (CVE-2014-1912) It was discovered that the Python xmlrpclib module did not restrict the size of gzip-compressed HTTP responses. A malicious XMLRPC server could cause an XMLRPC client using xmlrpclib to consume an excessive amount of memory. (CVE-2013-1753) It was discovered that multiple Python standard library modules implementing network protocols (such as httplib or smtplib) failed to restrict the sizes of server responses. A malicious server could cause a client using one of the affected modules to consume an excessive amount of memory. (CVE-2013-1752) It was discovered that the CGIHTTPServer module incorrectly handled URL encoded paths. A remote attacker could use this flaw to execute scripts outside of the cgi-bin directory, or disclose the source code of the scripts in the cgi-bin directory. (CVE-2014-4650) An integer overflow flaw was found in the way the buffer() function handled its offset and size arguments. An attacker able to control these arguments could use this flaw to disclose portions of the application memory or cause it to crash. (CVE-2014-7185) The following security issue was fixed in the python27-python and python27-python-simplejson components: A flaw was found in the way the json module handled negative index arguments passed to certain functions (such as raw_decode()). An attacker able to control the index value passed toone of the affected functions could possibly use this flaw to disclose portions of the application memory. (CVE-2014-4616) In addition, this update adds the following enhancement: * The python27 Software Collection now includes the python-wheel and python-pip modules. (BZ#994189, BZ#1167902) All python27 users are advised to upgrade to these updated packages, which correct these issues and add these enhancements. All running python27 instances must be restarted for this update to take effect. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 994189 - Please create a python-pip build for the python 2.7 and 3.3 SCL environments on RHEL 6 1046170 - CVE-2013-1753 python: XMLRPC library unrestricted decompression of HTTP responses using gzip enconding 1046174 - CVE-2013-1752 python: multiple unbound readline() DoS flaws in python stdlib 1062370 - CVE-2014-1912 python: buffer overflow in socket.recvfrom_into() 1112285 - CVE-2014-4616 python: missing boundary check in JSON module 1113527 - CVE-2014-4650 python: CGIHTTPServer module does not properly handle URL-encoded path separators in URLs 1146026 - CVE-2014-7185 python: buffer() integer overflow leading to out of bounds read 1167912 - Update Python in python27 SCL to Python 2.7.8 1170993 - RPM macro rpm/macros.python2.python27 references non-existing /usr/lib/rpm/brp-scl-compress 6. Package List: Red Hat Software Collections for Red Hat Enterprise Linux Server (v.6): Source: python27-1.1-17.el6.src.rpm python27-python-2.7.8-3.el6.src.rpm python27-python-pip-1.5.6-5.el6.src.rpm python27-python-setuptools-0.9.8-3.el6.src.rpm python27-python-simplejson-3.2.0-2.el6.src.rpm python27-python-wheel-0.24.0-2.el6.src.rpm noarch: python27-python-pip-1.5.6-5.el6.noarch.rpm python27-python-setuptools-0.9.8-3.el6.noarch.rpm python27-python-wheel-0.24.0-2.el6.noarch.rpm x86_64: python27-1.1-17.el6.x86_64.rpm python27-python-2.7.8-3.el6.x86_64.rpm python27-python-debug-2.7.8-3.el6.x86_64.rpm python27-python-debuginfo-2.7.8-3.el6.x86_64.rpm python27-python-devel-2.7.8-3.el6.x86_64.rpm python27-python-libs-2.7.8-3.el6.x86_64.rpm python27-python-simplejson-3.2.0-2.el6.x86_64.rpm python27-python-simplejson-debuginfo-3.2.0-2.el6.x86_64.rpm python27-python-test-2.7.8-3.el6.x86_64.rpm python27-python-tools-2.7.8-3.el6.x86_64.rpm python27-runtime-1.1-17.el6.x86_64.rpm python27-scldevel-1.1-17.el6.x86_64.rpm python27-tkinter-2.7.8-3.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.5): Source: python27-1.1-17.el6.src.rpm python27-python-2.7.8-3.el6.src.rpm python27-python-pip-1.5.6-5.el6.src.rpm python27-python-setuptools-0.9.8-3.el6.src.rpm python27-python-simplejson-3.2.0-2.el6.src.rpm python27-python-wheel-0.24.0-2.el6.src.rpm noarch: python27-python-pip-1.5.6-5.el6.noarch.rpm python27-python-setuptools-0.9.8-3.el6.noarch.rpm python27-python-wheel-0.24.0-2.el6.noarch.rpm x86_64: python27-1.1-17.el6.x86_64.rpm python27-python-2.7.8-3.el6.x86_64.rpm python27-python-debug-2.7.8-3.el6.x86_64.rpm python27-python-debuginfo-2.7.8-3.el6.x86_64.rpm python27-python-devel-2.7.8-3.el6.x86_64.rpm python27-python-libs-2.7.8-3.el6.x86_64.rpm python27-python-simplejson-3.2.0-2.el6.x86_64.rpm python27-python-simplejson-debuginfo-3.2.0-2.el6.x86_64.rpm python27-python-test-2.7.8-3.el6.x86_64.rpm python27-python-tools-2.7.8-3.el6.x86_64.rpm python27-runtime-1.1-17.el6.x86_64.rpm python27-scldevel-1.1-17.el6.x86_64.rpm python27-tkinter-2.7.8-3.el6.x86_64.rpm RedHat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6): Source: python27-1.1-17.el6.src.rpm python27-python-2.7.8-3.el6.src.rpm python27-python-pip-1.5.6-5.el6.src.rpm python27-python-setuptools-0.9.8-3.el6.src.rpm python27-python-simplejson-3.2.0-2.el6.src.rpm python27-python-wheel-0.24.0-2.el6.src.rpm noarch: python27-python-pip-1.5.6-5.el6.noarch.rpm python27-python-setuptools-0.9.8-3.el6.noarch.rpm python27-python-wheel-0.24.0-2.el6.noarch.rpm x86_64: python27-1.1-17.el6.x86_64.rpm python27-python-2.7.8-3.el6.x86_64.rpm python27-python-debug-2.7.8-3.el6.x86_64.rpm python27-python-debuginfo-2.7.8-3.el6.x86_64.rpm python27-python-devel-2.7.8-3.el6.x86_64.rpm python27-python-libs-2.7.8-3.el6.x86_64.rpm python27-python-simplejson-3.2.0-2.el6.x86_64.rpm python27-python-simplejson-debuginfo-3.2.0-2.el6.x86_64.rpm python27-python-test-2.7.8-3.el6.x86_64.rpm python27-python-tools-2.7.8-3.el6.x86_64.rpm python27-runtime-1.1-17.el6.x86_64.rpm python27-scldevel-1.1-17.el6.x86_64.rpm python27-tkinter-2.7.8-3.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v.6): Source: python27-1.1-17.el6.src.rpm python27-python-2.7.8-3.el6.src.rpm python27-python-pip-1.5.6-5.el6.src.rpm python27-python-setuptools-0.9.8-3.el6.src.rpm python27-python-simplejson-3.2.0-2.el6.src.rpm python27-python-wheel-0.24.0-2.el6.src.rpm noarch: python27-python-pip-1.5.6-5.el6.noarch.rpm python27-python-setuptools-0.9.8-3.el6.noarch.rpm python27-python-wheel-0.24.0-2.el6.noarch.rpm x86_64: python27-1.1-17.el6.x86_64.rpm python27-python-2.7.8-3.el6.x86_64.rpm python27-python-debug-2.7.8-3.el6.x86_64.rpm python27-python-debuginfo-2.7.8-3.el6.x86_64.rpm python27-python-devel-2.7.8-3.el6.x86_64.rpm python27-python-libs-2.7.8-3.el6.x86_64.rpm python27-python-simplejson-3.2.0-2.el6.x86_64.rpm python27-python-simplejson-debuginfo-3.2.0-2.el6.x86_64.rpm python27-python-test-2.7.8-3.el6.x86_64.rpm python27-python-tools-2.7.8-3.el6.x86_64.rpm python27-runtime-1.1-17.el6.x86_64.rpm python27-scldevel-1.1-17.el6.x86_64.rpm python27-tkinter-2.7.8-3.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7): Source: python27-1.1-20.el7.src.rpm python27-python-2.7.8-3.el7.src.rpm python27-python-pip-1.5.6-5.el7.src.rpm python27-python-setuptools-0.9.8-5.el7.src.rpm python27-python-simplejson-3.2.0-3.el7.src.rpm python27-python-wheel-0.24.0-2.el7.src.rpm noarch: python27-python-pip-1.5.6-5.el7.noarch.rpm python27-python-setuptools-0.9.8-5.el7.noarch.rpm python27-python-wheel-0.24.0-2.el7.noarch.rpm x86_64: python27-1.1-20.el7.x86_64.rpm python27-python-2.7.8-3.el7.x86_64.rpm python27-python-debug-2.7.8-3.el7.x86_64.rpm python27-python-debuginfo-2.7.8-3.el7.x86_64.rpm python27-python-devel-2.7.8-3.el7.x86_64.rpm python27-python-libs-2.7.8-3.el7.x86_64.rpm python27-python-simplejson-3.2.0-3.el7.x86_64.rpm python27-python-simplejson-debuginfo-3.2.0-3.el7.x86_64.rpm python27-python-test-2.7.8-3.el7.x86_64.rpm python27-python-tools-2.7.8-3.el7.x86_64.rpm python27-runtime-1.1-20.el7.x86_64.rpm python27-scldevel-1.1-20.el7.x86_64.rpm python27-tkinter-2.7.8-3.el7.x86_64.rpm Red HatSoftware Collections for Red Hat Enterprise Linux Workstation (v. 7): Source: python27-1.1-20.el7.src.rpm python27-python-2.7.8-3.el7.src.rpm python27-python-pip-1.5.6-5.el7.src.rpm python27-python-setuptools-0.9.8-5.el7.src.rpm python27-python-simplejson-3.2.0-3.el7.src.rpm python27-python-wheel-0.24.0-2.el7.src.rpm noarch: python27-python-pip-1.5.6-5.el7.noarch.rpm python27-python-setuptools-0.9.8-5.el7.noarch.rpm python27-python-wheel-0.24.0-2.el7.noarch.rpm x86_64: python27-1.1-20.el7.x86_64.rpm python27-python-2.7.8-3.el7.x86_64.rpm python27-python-debug-2.7.8-3.el7.x86_64.rpm python27-python-debuginfo-2.7.8-3.el7.x86_64.rpm python27-python-devel-2.7.8-3.el7.x86_64.rpm python27-python-libs-2.7.8-3.el7.x86_64.rpm python27-python-simplejson-3.2.0-3.el7.x86_64.rpm python27-python-simplejson-debuginfo-3.2.0-3.el7.x86_64.rpm python27-python-test-2.7.8-3.el7.x86_64.rpm python27-python-tools-2.7.8-3.el7.x86_64.rpm python27-runtime-1.1-20.el7.x86_64.rpm python27-scldevel-1.1-20.el7.x86_64.rpm python27-tkinter-2.7.8-3.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2013-1752 https://access.redhat.com/security/cve/CVE-2013-1753 https://access.redhat.com/security/cve/CVE-2014-1912 https://access.redhat.com/security/cve/CVE-2014-4616 https://access.redhat.com/security/cve/CVE-2014-4650 https://access.redhat.com/security/cve/CVE-2014-7185 https://access.redhat.com/security/updates/classification#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFVcBZ/XlSAg2UNWIIRAojaAKC/1aPfLPbhJulkzyGMdfoFYq3itwCgns9a lOwtT2ZeE8hH6JpnObD51MU=ulrW -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list
Jun 04, 2015
Red Hat
99
security advisorymoderatesecurity issueSlackware 12.2 Samba Access Issues Moderate Security Advisory
New samba packages are available for Slackware 10.0, 10.1, 10.2, 11.0, 12.0, 12.1, 12.2, and -current to fix security issues. More details about the issues may be found in the Common Vulnerabilities and Exposures (CVE) database: . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] samba (SSA:2009-177-01) New samba packages are available for Slackware 10.0, 10.1, 10.2, 11.0, 12.0, 12.1, 12.2, and -current to fix security issues. More details about the issues may be found in the Common Vulnerabilities and Exposures (CVE) database: https://www.cve.org/CVERecord?id=CVE-2009-1888 https://www.cve.org/CVERecord?id=CVE-2009-1886 Here are the details from the Slackware 12.2 ChangeLog: +--------------------------+ patches/packages/samba-3.2.13-i486-1_slack12.2.tgz: Upgraded. This upgrade fixes the following security issues: o CVE-2009-1888: In Samba 3.0.31 to 3.3.5 (inclusive), an uninitialized read of a data value can potentially affect access control when "dos filemode" is set to "yes". o CVE-2009-1886: In Samba 3.2.0 to 3.2.12 (inclusive), the smbclient commands dealing with file names treat user input as a format string to asprintf. With a maliciously crafted file name smbclient can be made to execute code triggered by the server. For more information, see: https://www.cve.org/CVERecord?id=CVE-2009-1888 https://www.cve.org/CVERecord?id=CVE-2009-1886 (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ HINT: Getting slow download speeds from ftp.slackware.com? Give slackware.osuosl.org a try. This is another primary FTP site for Slackware that can be considerably faster than downloading directly from ftp.slackware.com. Thanks to the friendly folks at the OSU Open Source Lab (https://osuosl.org/) for donating additional FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://www.slackware.com/ for additional mirror sites near you. Updatedpackage for Slackware 10.0: Updated package for Slackware 10.1: Updated package for Slackware 10.2: Updated package for Slackware 11.0: Updated package for Slackware 12.0: Updated package for Slackware 12.1: Updated package for Slackware 12.2: Updated package for Slackware -current: Updated package for Slackware64 -current: MD5 signatures: +-------------+ Slackware 10.0 package: b268a541aa91ef679749fd08b421c571 samba-3.0.35-i486-1_slack10.0.tgz Slackware 10.1 package: ded35718c82352b386a98a57a9c4f651 samba-3.0.35-i486-1_slack10.1.tgz Slackware 10.2 package: 0f839a4bf57edf292e243d03fa05b4a9 samba-3.0.35-i486-1_slack10.2.tgz Slackware 11.0 package: b54f1050aacc7e592c1db442ca0520d2 samba-3.0.35-i486-1_slack11.0.tgz Slackware 12.0 package: 55065c1d1b310ca41bf1d225cdb51554 samba-3.0.35-i486-1_slack12.0.tgz Slackware 12.1 package: d49c75cd61cbc1ed883b5059d201525a samba-3.0.35-i486-1_slack12.1.tgz Slackware 12.2 package: 35f7de0cc0b63c2d0dc203c9007d2ca8 samba-3.2.13-i486-1_slack12.2.tgz Slackware -current package: 36bef4c93d07f1bf6524e7734d6a50d6 samba-3.2.13-i486-1.txz Slackware64 -current package: 0cb1f8a1135bee591f7eaaf6324bcc1a samba-3.2.13-x86_64-1.txz Installation instructions: +------------------------+ Upgrade the package as root: # upgradepkg samba-3.2.13-i486-1_slack12.2.tgz Then, restart the Samba server if the machine uses it: # /etc/rc.d/rc.samba restart +-----+ . Crucial Samba patch released for Slackware fixing severe vulnerabilities affecting all versions from 10.0 to -current.. Slackware Samba Update, Security Fix, Network Protocols, Access Control. . Severity: Important. LinuxSecurity.com Team
Jun 27, 2009
•Important
Slackware
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!