Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -4 articles for you...
87
security advisorydebianrace conditionDebian: Trn Race Condition Fix for Overwrite Risk Due to Hardcoded Filename
All former versions of trn used a hardcoded filename in /tmp as temporary storage. If the file already exists as symbolic link to users files they will be overwritten. . All former versions of trn used a hardcoded filename in /tmp as temporary storage. If the file already exists as symbolic link to users files they will be overwritten. We recommend you upgrade your man2html package as soon as possible. wget url will fetch the file for you dpkg -i file.deb will install the referenced file. Debian GNU/Linux 2.1 alias slink -------------------------------- Source archives: MD5 checksum: a1b2a19ea060c289e079444edf908a18 MD5 checksum: 562b8ad926784d101646dc7148919015 Alpha architecture: MD5 checksum: 919bbf1ae668786ec945d4fb042d0d27 Intel ia32 architecture: MD5 checksum: b14c9ba3eeef6a33e574c55e022c47a4 Motorola 680x0 architecture: MD5 checksum: 3ad7ab653b333cfc4fb4409c7fe1e192 Sun Sparc architecture: MD5 checksum: 97cebe97d78372706c225309898a2e7d Debian GNU/Linux unstable alias potato -------------------------------------- Source archives: -9.4.diff.gz MD5 checksum: 46a3f905fecec6e9079ccb6e6c0d27dd MD5 checksum: e23192e418c3299f0bee0c5ef0f182e8 . tar.gz MD5 checksum: b42f4226072442265fbbda865ca4b796 Alpha architecture: MD5 checksum: bdcad9ead736edd1082bd203a26a3233 ARM architecture: MD5 checksum: f8c918679d759b3ec22a017eb58fc3b4 Intel ia32 architecture: MD5 checksum: d2a73698ac259196876a71fd6f45b714 Motorola 680x0 architecture: MD5 checksum: 0eb1b01ce9d3a92c2072ba8a6e7c81fa PowerPC architecture: MD5 checksum: 60ddaabdecb48ae2062d5d88ee608c42 Sun Sparc architecture: MD5 checksum: a1525fc83d73502be41411e02ba8ec3f --Debian GNU/Linux . Security Managers .
Oct 22, 2020
•Critical
Debian
172
security advisorymoderatepackage updateUbuntu 12.04 LTS USN-1591-1 Moderate: Xdiagnose File Overwrite Risk
3rd party applications using xdiagnose could potentially be made tooverwrite files.. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 =========================================================================Ubuntu Security Notice USN-1591-1 October 02, 2012 xdiagnose update ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - - Ubuntu 12.04 LTS Summary: 3rd party applications using xdiagnose could potentially be made to overwrite files. Software Description: - - xdiagnose: X.org diagnosis tool Details: Alec Warner discovered that xdiagnose improperly handled temporary files in welcome.py when creating user-initiated archive files. While failsafeX does not use the vulnerable code, this update removes this functionality to protect any 3rd party applications which import the vulnerable code. In the default Ubuntu installation, this should be prevented by the Yama link restrictions. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 12.04 LTS: xdiagnose 2.5.2ubuntu0.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-1591-1 https://bugs.launchpad.net/ubuntu/+source/xdiagnose/+bug/1036211 Package Information: https://launchpad.net/ubuntu/+source/xdiagnose/2.5.2ubuntu0.1 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla -https://www.enigmail.net/index.php/en/ iQIbBAEBCgAGBQJQa0cLAAoJEFHb3FjMVZVzrYsP9Am30mCdGs6nEfuK162Kxi8j e/ByGns5xVxZoHgWyi54Jo9HD9d7rjtEdJoFWFVitTQGJlHq1CLrHhdSvXiKXIUe W1LaL5LP/8uGkAM1/HyBHG8vVNrh9T5PkB48AIdie0vhE3nvcRA1O3wcBqwzMFS7 6xIUoK9R9USmXfX2pkD1Mr2LMAxfRF0FLijAX/heQU3JiHuUlSHCcbyVcoiaAEFN k00uZMKUOWqn4kXfl9FvMbsxSN+Xg9pzQ/CN1byjWc/im8cVakU9I5kKQbp+t4FL ntN0PttVGn/9/+Rj2Pswa3zjGgnABitE0bEr3zYrwxfibLoVoqifR717731eFTXD dXbCx667rFtuwkEqssZjcwnovBqrfiG8cBeOxoDXie7vE7Z5alMoPRxOX8ZR1xuE KFP7pWSDp5aIJI7jp6yWO00puYuiW8gfjQ05fOiuUsLiCtFlY4W6Mz2FL3sXDtcw qywTqAj6O+AJiB+h0BFSaXEa7rZa8ZGbESR3QXSDW7UEssYuIEDlGsw6x7KZ1zFz AtL2dwFgqMBKRZCSmnaksMj6DnHLR8XNioXBoPAIF7VD2vT0r+siHpuvpAxxSd8y 6GnDeAzWSevR/Pq/2nzZPC/+07/EJa69CqxyzI43ZYb8oeZve52MmfFNaAgS1zkM /6u26JNyATb75G0cYdc=bAqp -----END PGP SIGNATURE----- -- ubuntu-security-announce mailing list
Oct 02, 2012
•Important
Ubuntu
91
security advisorygentoooverwrite riskGentoo GLSA 200509-21 Normal: Hylafax File Overwrite Risk
Hylafax is vulnerable to linking attacks, potentially allowing a local user to overwrite arbitrary files.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200509-21 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Hylafax: Insecure temporary file creation in xferfaxstats script Date: September 30, 2005 Bugs: #106882 ID: 200509-21 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Hylafax is vulnerable to linking attacks, potentially allowing a local user to overwrite arbitrary files. Background ========= Hylafax is a client-server fax package for class 1 and 2 fax modems. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-misc/hylafax < 4.2.2 *> = 4.2.0-r3 *> = 4.2.1-r2 > = 4.2.2 Description ========== Javier Fernandez-Sanguino has discovered that xferfaxstats cron script supplied by Hylafax insecurely creates temporary files with predictable filenames. Impact ===== A local attacker could create symbolic links in the temporary file directory, pointing to a valid file somewhere on the filesystem. When the xferfaxstats script of Hylafax is executed, this would result in the file being overwritten with the rights of the user running the script, which typically is the root user. Workaround ========= There is no known workaround at this time. Resolution ========= All Hylafax users should upgrade to the latestversion: # emerge --sync # emerge --ask --oneshot --verbose net-misc/hylafax References ========= [ 1 ] Original bug report Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200509-21 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Sep 30, 2005
Gentoo
91
security advisorygentoodata protectionGentoo: GLSA-200409-03 Normal: PostgreSQL Data Exposure Vulnerability
The mysqlhotcopy utility can create temporary files with predictable paths, allowing an attacker to use a symlink to trick MySQL into overwriting important data. [More...]. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200409-02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: MySQL: Insecure temporary file creation in mysqlhotcopy Date: September 01, 2004 Bugs: #60744 ID: 200409-02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= The mysqlhotcopy utility can create temporary files with predictable paths, allowing an attacker to use a symlink to trick MySQL into overwriting important data. Background ========= MySQL is a popular open-source multi-threaded, multi-user SQL database server. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-db/mysql = 4.0.20-r1 Description ========== Jeroen van Wolffelaar discovered that the MySQL database hot copy utility (mysqlhotcopy.sh), when using the scp method, uses temporary files with predictable names. A malicious local user with write access to the /tmp directory could create a symbolic link pointing to a file, which may then be overwritten. In cases where mysqlhotcopy is run as root, a malicious user could create a symlink to a critical file such as /etc/passwd and cause it to be overwritten. Impact ===== A local attacker could use this vulnerability to destroy other users' data or corrupt and destroy system files, possibly leading to a denial of service condition. Workaround ========= There is no knownworkaround at this time. Resolution ========= All MySQL users should upgrade to the latest version: # emerge sync # emerge -pv "> =dev-db/mysql-4.0.20-r1" # emerge "> =dev-db/mysql-4.0.20-r1" References ========= [ 1 ] CAN-2004-0457 https://www.cve.org/CVERecord?id=CVE-CAN-2004-0457 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200409-02 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Sep 01, 2004
Gentoo
91
security advisoryGentoofile handlingGentoo: GLSA-200407-08 Normal: OpenSSH Key Disclosure Vulnerability
Shorewall contains a bug in the code handling the creation of temporary files and directories. This can allow a non-root user to overwrite arbitrary system files. [More...]. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200407-07 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Shorewall : Insecure temp file handling Date: July 08, 2004 Bugs: #55675 ID: 200407-07 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Shorewall contains a bug in the code handling the creation of temporary files and directories. This can allow a non-root user to overwrite arbitrary system files. Background ========= Shorewall is a high level tool for configuring Netfilter, the firewall facility included in the Linux Kernel. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-firewall/shorewall = 1.4.10f Description ========== Shorewall uses temporary files and directories in an insecure manner. A local user could create symbolic links at specific locations, eventually overwriting other files on the filesystem with the rights of the shorewall process. Impact ===== An attacker could exploit this vulnerability to overwrite arbitrary system files with root privileges, resulting in Denial of Service or further exploitation. Workaround ========= There is no known workaround at this time. All users should upgrade to the latest available version of Shorewall. Resolution ========= All users should upgrade to the latest availableversion of Shorewall, as follows: # emerge sync # emerge -pv "> =net-firewall/shorewall-1.4.10f" # emerge "> =net-firewall/shorewall-1.4.10f" References ========= [ 1 ] Shorewall Announcement Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200407-07 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Jul 08, 2004
Gentoo
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!