Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -6 articles for you...
91
security advisorygentooprivilege escalationGentoo: GLSA 202103-15 Normal: Openfire Elevated Access Vulnerabilities
Multiple vulnerabilities have been found in Openfire, the worst of which could lead to privilege escalation.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201612-50 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Openfire: Multiple vulnerabilities Date: December 31, 2016 Bugs: #603604 ID: 201612-50 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities have been found in Openfire, the worst of which could lead to privilege escalation. Background ========= Openfire (formerly Wildfire) is a cross-platform real-time collaboration server based on the XMPP (Jabber) protocol. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-im/openfire < 4.1.0 > = 4.1.0 Description ========== Multiple vulnerabilities have been discovered in Openfire. Please review the CVE identifiers referenced below for details. Impact ===== A remote attacker could bypass the CSRF protection mechanism, conduct Cross-Site Scripting attacks, or an authenticated remote attacker could gain privileges while accessing Openfire's web interface. Workaround ========= There is no known workaround at this time. Resolution ========= All Openfire users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =net-im/openfire-4.1.0" References ========= [ 1 ] CVE-2015-6972 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-6972 [ 2 ] CVE-2015-6973 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-6973 [ 3 ]CVE-2015-7707 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7707 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201612-50 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Dec 31, 2016
Gentoo
198
security advisoryhigh severityprivilege escalationArch Linux: ASA-201612-21 High Severity Openfire Threats
The package openfire before version 4.1.0-1 is vulnerable to multiple issues including privilege escalation, cross-site request forgery and cross-site scripting. . Arch Linux Security Advisory ASA-201612-21 ========================================= Severity: High Date : 2016-12-23 CVE-ID : CVE-2015-6972 CVE-2015-6973 CVE-2015-7707 Package : openfire Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-15 Summary ====== The package openfire before version 4.1.0-1 is vulnerable to multiple issues including privilege escalation, cross-site request forgery and cross-site scripting. Resolution ========= Upgrade to 4.1.0-1. # pacman -Syu "openfire> =4.1.0-1" The problems have been fixed upstream in version 4.1.0. Workaround ========= None. Description ========== - CVE-2015-6972 (cross-site scripting) Multiple cross-site scripting (XSS) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to inject arbitrary web script or HTML via the (1) groupchatName parameter to plugins/clientcontrol/create-bookmark.jsp; the (2) urlName parameter to plugins/clientcontrol/create-bookmark.jsp; the (3) hostname parameter to server-session-details.jsp; or the (4) search parameter to group- summary.jsp. - CVE-2015-6973 (cross-site request forgery) Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentication of administrators for requests that (1) change a password via a crafted request to user-password.jsp, (2) add users via a crafted request to user-create.jsp, (3) edit server settings or (4) disable SSL on the server via a crafted request to server-props.jsp, or (5) add clients via a crafted request to plugins/clientcontrol/permitted-clients.jsp. - CVE-2015-7707 (privilege escalation) Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access via the isadmin parameter to user-edit- form.jsp. Impact ===== A remote attacker is able to escalateprivileges, perform cross-site request forgery and cross-site scripting. References ========= http://hyp3rlinx.altervista.org/advisories/AS-OPENFIRE-XSS.txt https://igniterealtime.atlassian.net/browse/OF-942 http://hyp3rlinx.altervista.org/advisories/AS-OPENFIRE-CSRF.txt http://hyp3rlinx.altervista.org/advisories/AS-OPENFIRE-PRIV-ESCALATION.txt https://igniterealtime.atlassian.net/browse/OF-941 https://security.archlinux.org/CVE-2015-6972 https://security.archlinux.org/CVE-2015-6973 https://security.archlinux.org/CVE-2015-7707 . Arch Linux Security Notice: Critical vulnerabilities identified in openfire package. Upgrade to version 4.1.0-1 to ensure safety.. Arch Linux Updates, Openfire Security Flaws, Privilege Escalation Fix. . LinuxSecurity.com Team
Dec 27, 2016
ArchLinux
91
security advisorygentoosql injectionGentoo: GLSA-200904-01 Normal: Openfire Remote Execution Threats
Multiple vulnerabilities were discovered in Openfire, the worst of which may allow remote execution of arbitrary code.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200904-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Openfire: Multiple vulnerabilities Date: April 02, 2009 Bugs: #246008, #254309 ID: 200904-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities were discovered in Openfire, the worst of which may allow remote execution of arbitrary code. Background ========= Ignite Realtime Openfire is a fast real-time collaboration server. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-im/openfire < 3.6.3 > = 3.6.3 Description ========== Two vulnerabilities have been reported by Federico Muttis, from CORE IMPACT's Exploit Writing Team: * Multiple missing or incomplete input validations in several .jsps (CVE-2009-0496). * Incorrect input validation of the "log" parameter in log.jsp (CVE-2009-0497). Multiple vulnerabilities have been reported by Andreas Kurtz: * Erroneous built-in exceptions to input validation in login.jsp (CVE-2008-6508). * Unsanitized user input to the "type" parameter in sipark-log-summary.jsp used in SQL statement. (CVE-2008-6509) * A Cross-Site-Scripting vulnerability due to unsanitized input to the "url" parameter. (CVE-2008-6510, CVE-2008-6511) Impact ===== A remote attacker could execute arbitrary code on clients' systems by uploading a specially craftedplugin, bypassing authentication. Additionally, an attacker could read arbitrary files on the server or execute arbitrary SQL statements. Depending on the server's configuration the attacker might also execute code on the server via an SQL injection. Workaround ========= There is no known workaround at this time. Resolution ========= All Openfire users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =net-im/openfire-3.6.3" References ========= [ 1 ] CVE-2008-6508 https://www.cve.org/CVERecord?id=CVE-2008-6508 [ 2 ] CVE-2008-6509 https://www.cve.org/CVERecord?id=CVE-2008-6509 [ 3 ] CVE-2008-6510 https://www.cve.org/CVERecord?id=CVE-2008-6510 [ 4 ] CVE-2008-6511 https://www.cve.org/CVERecord?id=CVE-2008-6511 [ 5 ] CVE-2009-0496 https://www.cve.org/CVERecord?id=CVE-2009-0496 [ 6 ] CVE-2009-0497 https://www.cve.org/CVERecord?id=CVE-2009-0497 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200904-01 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Apr 02, 2009
Gentoo
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!