Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -5 articles for you...
100
security advisoryimportantos command executionSUSE Linux: 2024:1598-2 Important: OS Command Execution in Less
* bsc#1222849 Cross-References: * CVE-2024-32487 . # Security update for less Announcement ID: SUSE-SU-2024:1598-2 Rating: important References: * bsc#1222849 Cross-References: * CVE-2024-32487 CVSS scores: * CVE-2024-32487 ( SUSE ): 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H Affected Products: * SUSE Linux Enterprise Micro 5.5 An update that solves one vulnerability can now be installed. ## Description: This update for less fixes the following issues: * CVE-2024-32487: Fixed mishandling of \n character in paths when LESSOPEN is set leads to OS command execution. (bsc#1222849) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Micro 5.5 zypper in -t patch SUSE-SLE-Micro-5.5-2024-1598=1 ## Package List: * SUSE Linux Enterprise Micro 5.5 (aarch64 ppc64le s390x x86_64) * less-debuginfo-590-150400.3.9.1 * less-590-150400.3.9.1 * less-debugsource-590-150400.3.9.1 ## References: * https://www.suse.com/security/cve/CVE-2024-32487.html * https://bugzilla.suse.com/show_bug.cgi?id=1222849 . This patch for Ubuntu addresses a vulnerability in grep, given a CVSS score of 7.9, resolving potential command injection threats.. SUSE Linux, less command, security update, CVE-2024-32487. . Severity: Important. LinuxSecurity.com Team
Jul 31, 2024
•Important
SuSE
89
security advisoryfedoraupdateFedora 39: Critical OS Command Execution in xdg-desktop-portal-hyprland
Update to 1.3.3 https://github.com/hyprwm/xdg-desktop-portal-hyprland/releases/tag/v1.3.3. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2024-295a735fbc 2024-07-31 01:32:35.066451 -------------------------------------------------------------------------------- Name : xdg-desktop-portal-hyprland Product : Fedora 39 Version : 1.3.3 Release : 2.fc39 URL : https://github.com/hyprwm/xdg-desktop-portal-hyprland Summary : xdg-desktop-portal backend for hyprland Description : xdg-desktop-portal backend for hyprland. -------------------------------------------------------------------------------- Update Information: Update to 1.3.3 https://github.com/hyprwm/xdg-desktop-portal-hyprland/releases/tag/v1.3.3 -------------------------------------------------------------------------------- ChangeLog: * Mon Jul 22 2024 Pavel Solovev - 1.3.3-2 - add missing br * Mon Jul 22 2024 Pavel Solovev - 1.3.3-1 - Update to 1.3.3 * Mon Jul 22 2024 Pavel Solovev - 1.3.2-1 - Update to 1.3.2 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2300328 - CVE-2024-42029 xdg-desktop-portal-hyprland: OS Command Execution due to Insecure Environment Variable Handling [fedora-39] https://bugzilla.redhat.com/show_bug.cgi?id=2300328 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-295a735fbc' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Jul 31, 2024
•Critical
Fedora
100
security advisoryupdateimportantSUSE: 2024:1598-1 Important: Less OS Command Execution Threat
* bsc#1222849 Cross-References: * CVE-2024-32487 . # Security update for less Announcement ID: SUSE-SU-2024:1598-1 Rating: important References: * bsc#1222849 Cross-References: * CVE-2024-32487 CVSS scores: * CVE-2024-32487 ( SUSE ): 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * openSUSE Leap Micro 5.3 * openSUSE Leap Micro 5.4 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves one vulnerability can now be installed. ## Description: This update for less fixes the following issues: * CVE-2024-32487: Fixed mishandling of \n character in paths when LESSOPEN is set leads to OS command execution. (bsc#1222849) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-1598=1 * openSUSE Leap Micro 5.3 zypper in -t patch openSUSE-Leap-Micro-5.3-2024-1598=1 *openSUSE Leap Micro 5.4 zypper in -t patch openSUSE-Leap-Micro-5.4-2024-1598=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-1598=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2024-1598=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2024-1598=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2024-1598=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2024-1598=1 * SUSE Linux Enterprise Micro 5.5 zypper in -t patch SUSE-SLE-Micro-5.5-2024-1598=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2024-1598=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-1598=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-1598=1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-1598=1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-1598=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-1598=1 * SUSE Manager Proxy 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2024-1598=1 * SUSE Manager Retail Branch Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.3-2024-1598=1 * SUSE Manager Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.3-2024-1598=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * less-debuginfo-590-150400.3.9.1 * less-590-150400.3.9.1 * less-debugsource-590-150400.3.9.1 * openSUSE Leap Micro 5.3 (aarch64 x86_64) * less-debuginfo-590-150400.3.9.1 *less-590-150400.3.9.1 * less-debugsource-590-150400.3.9.1 * openSUSE Leap Micro 5.4 (aarch64 s390x x86_64) * less-debuginfo-590-150400.3.9.1 * less-590-150400.3.9.1 * less-debugsource-590-150400.3.9.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * less-debuginfo-590-150400.3.9.1 * less-590-150400.3.9.1 * less-debugsource-590-150400.3.9.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64) * less-debuginfo-590-150400.3.9.1 * less-590-150400.3.9.1 * less-debugsource-590-150400.3.9.1 * SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64) * less-debuginfo-590-150400.3.9.1 * less-590-150400.3.9.1 * less-debugsource-590-150400.3.9.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64) * less-debuginfo-590-150400.3.9.1 * less-590-150400.3.9.1 * less-debugsource-590-150400.3.9.1 * SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64) * less-debuginfo-590-150400.3.9.1 * less-590-150400.3.9.1 * less-debugsource-590-150400.3.9.1 * SUSE Linux Enterprise Micro 5.5 (aarch64 s390x x86_64) * less-debuginfo-590-150400.3.9.1 * less-590-150400.3.9.1 * less-debugsource-590-150400.3.9.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * less-debuginfo-590-150400.3.9.1 * less-590-150400.3.9.1 * less-debugsource-590-150400.3.9.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * less-debuginfo-590-150400.3.9.1 * less-590-150400.3.9.1 * less-debugsource-590-150400.3.9.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * less-debuginfo-590-150400.3.9.1 * less-590-150400.3.9.1 * less-debugsource-590-150400.3.9.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (x86_64) * less-debuginfo-590-150400.3.9.1 * less-590-150400.3.9.1 * less-debugsource-590-150400.3.9.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (aarch64 ppc64le s390x x86_64) *less-debuginfo-590-150400.3.9.1 * less-590-150400.3.9.1 * less-debugsource-590-150400.3.9.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * less-debuginfo-590-150400.3.9.1 * less-590-150400.3.9.1 * less-debugsource-590-150400.3.9.1 * SUSE Manager Proxy 4.3 (x86_64) * less-debuginfo-590-150400.3.9.1 * less-590-150400.3.9.1 * less-debugsource-590-150400.3.9.1 * SUSE Manager Retail Branch Server 4.3 (x86_64) * less-debuginfo-590-150400.3.9.1 * less-590-150400.3.9.1 * less-debugsource-590-150400.3.9.1 * SUSE Manager Server 4.3 (ppc64le s390x x86_64) * less-debuginfo-590-150400.3.9.1 * less-590-150400.3.9.1 * less-debugsource-590-150400.3.9.1 ## References: * https://www.suse.com/security/cve/CVE-2024-32487.html * https://bugzilla.suse.com/show_bug.cgi?id=1222849 . Recent findings highlight a critical CVE-2024-32487 vulnerability in SUSE systems allowing OS command execution. Users must apply updates promptly to enhance security. SUSE Security Advisory, Less Security Update, OS Command Execution, Runtime Commands. . Severity: Important. LinuxSecurity.com Team
May 10, 2024
•Important
SuSE
98
security advisorysecurity issueimportantRed Hat OpenShift 4.9.19 RHSA-2022:0339-01 Important: CSRF Risk
Red Hat OpenShift Container Platform release 4.9.19 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.9.. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: OpenShift Container Platform 4.9.19 security update Advisory ID: RHSA-2022:0339-01 Product: Red Hat OpenShift Enterprise Advisory URL: https://access.redhat.com/errata/RHSA-2022:0339 Issue date: 2022-02-10 CVE Names: CVE-2022-20612 CVE-2022-20617 ==================================================================== 1. Summary: Red Hat OpenShift Container Platform release 4.9.19 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat OpenShift Container Platform 4.9 - aarch64, noarch, ppc64le, s390x, x86_64 3. Description: Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.9.19. See the following advisory for the container images for this release: https://access.redhat.com/errata/RHBA-2022:0340 Security Fix(es): * jenkins-2-plugins/docker-commons: does not sanitize the name of an image or a tag which could result in an OS command execution (CVE-2022-20617) * jenkins: no POST request is required for the endpoint handlingmanual build requests which could result in CSRF (CVE-2022-20612) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.9/html/release_notes/ocp-4-9-release-notes Details on how to access this content are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.9/html/updating_clusters/updating-cluster-cli 5. Bugs fixed (https://bugzilla.redhat.com/): 2044460 - CVE-2022-20612 jenkins: no POST request is required for the endpoint handling manual build requests which could result in CSRF 2044502 - CVE-2022-20617 jenkins-2-plugins/docker-commons: does not sanitize the name of an image or a tag which could result in an OS command execution 6. Package List: Red Hat OpenShift Container Platform 4.9: Source: openshift-4.9.0-202201261537.p0.g2cb6068.assembly.stream.el7.src.rpm x86_64: openshift-hyperkube-4.9.0-202201261537.p0.g2cb6068.assembly.stream.el7.x86_64.rpm Red Hat OpenShift Container Platform 4.9: Source: jenkins-2-plugins-4.9.1643389956-1.el8.src.rpm jenkins-2.319.2.1643391771-1.el8.src.rpm openshift-4.9.0-202201261537.p0.g2cb6068.assembly.stream.el8.src.rpm aarch64: openshift-hyperkube-4.9.0-202201261537.p0.g2cb6068.assembly.stream.el8.aarch64.rpm noarch: jenkins-2-plugins-4.9.1643389956-1.el8.noarch.rpm jenkins-2.319.2.1643391771-1.el8.noarch.rpm ppc64le: openshift-hyperkube-4.9.0-202201261537.p0.g2cb6068.assembly.stream.el8.ppc64le.rpm s390x: openshift-hyperkube-4.9.0-202201261537.p0.g2cb6068.assembly.stream.el8.s390x.rpm x86_64: openshift-hyperkube-4.9.0-202201261537.p0.g2cb6068.assembly.stream.el8.x86_64.rpm These packagesare GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2022-20612 https://access.redhat.com/security/cve/CVE-2022-20617 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYgTmQdzjgjWX9erEAQiYaA/9HRNrJL9+EkbBoe+4xaR6pzK1cPf0AMRY J5NwsSCQ3ZtCNevXy+lT4FxQN1h8sxiq13rGLQBGSuiH484teWrC0hIgFAmOhKK1 KYZ60AwDLcD6M+7dYjSTRa92MsPTnEj6JeL7Yu8zpVKDZFjBTu49aL7PLhA53/ax Claf8jBaoEjhMuswUIeZk/okE1YbuDGsB5/NeScluZIBaZLfE+nl56IDHZUZkeHV tVUycwoll46oYoZwRtyiFDD1/yRxZDmyd4KGh7pEJ2mJmyTK0UBEf8bs2lClZLLE 4MxIMWQh6HM1hawkRu3ALb7v2t8SbJ9c8pTvRQ7T92qRmT03rY5HKyGNLwGsC76l 1NJ8lS8tZEM7/YlOHAXPLmQbvWj2gN2sMBLYbHG9/A9eIFT3DItb/xwr2mzgYKF5 62kguGfx/d/DilnBEkJHFpDttkL5hWmnbkZQAtQ5vQ0PICKlegYpyU6totXV4EWc KUzbldVpvRVMD6qpJA8Jc5S6Fg8W5ZM7Jre80bQmM8jxSwFkO5Ye0c51gexVTx5w 4s0pcwFE0IL4+MwOaesWnBkU0Q6VFPOTPrrN+ggUMxINLPMF34y6fVriOX9XX+NR iTHWmAya/hHmg5iWARLipBNrnVDZIWzh/vbKUEW6h6g89MxXeIAPZ7xEw7oq75Ic zekSqOfHlCc=2eoh -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Feb 10, 2022
•Important
Red Hat
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!