Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -6 articles for you...
100
security advisorysoftware updatemoderate severitySUSE 2023:0921-2 Security Advisory: Gzip Input Overflow Risk Alert
An update that fixes one vulnerability is now available. . SUSE Security Update: Security update for flac ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:0815-1 Rating: moderate References: #1196660 Cross-References: CVE-2021-0561 CVSS scores: CVE-2021-0561 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-0561 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 SUSE Linux Enterprise Realtime Extension 15-SP2 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.2 SUSE Manager Server 4.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for flac fixes the following issues: - CVE-2021-0561: Fixed out of bound write in append_to_verify_fifo_interleaved_ (bsc#1196660). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Realtime Extension 15-SP2: zypper in -t patch SUSE-SLE-Product-RT-15-SP2-2022-815=1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3: zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP3-2022-815=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patchSUSE-SLE-Module-Basesystem-15-SP3-2022-815=1 Package List: - SUSE Linux Enterprise Realtime Extension 15-SP2 (x86_64): flac-debuginfo-1.3.2-3.9.1 flac-debugsource-1.3.2-3.9.1 flac-devel-1.3.2-3.9.1 libFLAC++6-1.3.2-3.9.1 libFLAC++6-debuginfo-1.3.2-3.9.1 libFLAC8-1.3.2-3.9.1 libFLAC8-debuginfo-1.3.2-3.9.1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (aarch64 ppc64le s390x x86_64): flac-1.3.2-3.9.1 flac-debuginfo-1.3.2-3.9.1 flac-debugsource-1.3.2-3.9.1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (x86_64): libFLAC8-32bit-1.3.2-3.9.1 libFLAC8-32bit-debuginfo-1.3.2-3.9.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): flac-debuginfo-1.3.2-3.9.1 flac-debugsource-1.3.2-3.9.1 flac-devel-1.3.2-3.9.1 libFLAC++6-1.3.2-3.9.1 libFLAC++6-debuginfo-1.3.2-3.9.1 libFLAC8-1.3.2-3.9.1 libFLAC8-debuginfo-1.3.2-3.9.1 References: https://www.suse.com/security/cve/CVE-2021-0561.html https://bugzilla.suse.com/1196660 . A recent update for flac resolves a moderate severity security flaw within SUSE systems. It's crucial to apply this patch to safeguard your infrastructure.. SUSE Linux Patch, Flac Update, Security Advisory, Linux Software Fix. . LinuxSecurity.com Team
Mar 14, 2022
SuSE
89
security advisorymoderatefedoraFedora 35 FEDORA-2022-db30f1bd42 Moderate FLAC Out Of Bound Write
Security fix for CVE-2021-0561. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-db30f1bd42 2022-02-25 16:50:19.402622 --------------------------------------------------------------------------------Name : flac Product : Fedora 35 Version : 1.3.4 Release : 1.fc35 URL : https://www.xiph.org/flac/ Summary : An encoder/decoder for the Free Lossless Audio Codec Description : FLAC stands for Free Lossless Audio Codec. Grossly oversimplified, FLAC is similar to Ogg Vorbis, but lossless. The FLAC project consists of the stream format, reference encoders and decoders in library form, flac, a command-line program to encode and decode FLAC files, metaflac, a command-line metadata editor for FLAC files and input plugins for various music players. This package contains the command-line tools and documentation. --------------------------------------------------------------------------------Update Information: Security fix for CVE-2021-0561 --------------------------------------------------------------------------------ChangeLog: * Thu Feb 24 2022 Miroslav Lichvar 1.3.4-1 - update to 1.3.4 (CVE-2021-0561) --------------------------------------------------------------------------------References: [ 1 ] Bug #2057776 - CVE-2021-0561 flac: out of bound write in append_to_verify_fifo_interleaved_ of stream_encoder.c https://bugzilla.redhat.com/show_bug.cgi?id=2057776 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-db30f1bd42' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Feb 25, 2022
Fedora
203
security advisoryhigh severitycode executionMageia 7, 8: MGASA-2021-0199 High: Firefox Internal Network Threat
More internal network hosts could have been probed by a malicious webpage: Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine (CVE-2021-23961). . MGASA-2021-0199 - Updated firefox packages fix security vulnerabilities Publication date: 29 Apr 2021 URL: https://advisories.mageia.org/MGASA-2021-0199.html Type: security Affected Mageia releases: 7, 8 CVE: CVE-2021-23961, CVE-2021-23994, CVE-2021-23995, CVE-2021-23998, CVE-2021-23999, CVE-2021-24002, CVE-2021-29945, CVE-2021-29946 More internal network hosts could have been probed by a malicious webpage: Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine (CVE-2021-23961). Out of bound write due to lazy initialization: A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write (CVE-2021-23994). Use-after-free in Responsive Design Mode: When Responsive Design Mode was enabled, it used references to objects that were previously freed. We presume that with enough effort this could have been exploited to run arbitrary code (CVE-2021-23995). Secure Lock icon could have been spoofed: Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS page (CVE-2021-23998). Blob URLs may have been granted additional privileges: If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional privileges that should not be granted to web content (CVE-2021-23999). Arbitrary FTP command execution on FTP servers using an encoded URL: When a user clicked on an FTP URL containing encoded newline characters(%0A and %0D), the newlines would have been interpreted as such andallowed arbitrary commands to be sent to the FTP server (CVE-2021-24002). Incorrect size computation in WebAssembly JIT could lead to null-reads: The WebAssembly JIT could miscalculate the size of a return type, which could lead to a null read and result in a crash. Note: This issue only affected x86-32 platforms. Other platforms are unaffected. (CVE-2021-29945). Port blocking could be bypassed: Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed port blocking restrictions when used in the Alt-Svc header (CVE-2021-29946). References: - https://bugs.mageia.org/show_bug.cgi?id=28822 - https://www.mozilla.org/en-US/security/advisories/mfsa2021-15/ - - https://access.redhat.com/errata/RHSA-2021:1360 - https://www.cve.org/CVERecord?id=CVE-2021-23961 - https://www.cve.org/CVERecord?id=CVE-2021-23994 - https://www.cve.org/CVERecord?id=CVE-2021-23995 - https://www.cve.org/CVERecord?id=CVE-2021-23998 - https://www.cve.org/CVERecord?id=CVE-2021-23999 - https://www.cve.org/CVERecord?id=CVE-2021-24002 - https://www.cve.org/CVERecord?id=CVE-2021-29945 - https://www.cve.org/CVERecord?id=CVE-2021-29946 SRPMS: - 7/core/firefox-l10n-78.10.0-1.mga7 - 7/core/nss-3.64.0-1.mga7 - 7/core/firefox-78.10.0-1.1.mga7 - 8/core/firefox-l10n-78.10.0-1.mga8 - 8/core/nss-3.64.0-1.mga8 - 8/core/firefox-78.10.0-1.1.mga8 . A critical security alert for Mageia users concerning vulnerabilities in Firefox that may endanger internal networks through potential malicious exploration.. Mageia Security Update, Firefox Security Flaws, Network Security Risks. . Severity: Important. LinuxSecurity.com Team
Apr 29, 2021
•Important
Mageia
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!