Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 542
Alerts This Week
Warning Icon 1 542

Stay Secure with the Latest Linux Advisories

Filter%20icon Refine advisories
X Clear Filters
X Clear Filters
View More

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":1,"type":"x","order":4,"pct":100,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Loading...

Explore Latest Linux Security advisories

We found -4 articles for you...
89

Fedora 39: FEDORA-2024-7c800c4df7 Critical: PHP Injection Bypass

PHP version 8.2.24 (26 Sep 2024) CGI: Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926) (nielsdos) Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2024-7c800c4df7 2024-10-04 01:50:53.151752 -------------------------------------------------------------------------------- Name : php Product : Fedora 39 Version : 8.2.24 Release : 1.fc39 URL : http://www.php.net/ Summary : PHP scripting language for creating dynamic web sites Description : PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. -------------------------------------------------------------------------------- Update Information: PHP version 8.2.24 (26 Sep 2024) CGI: Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926) (nielsdos) Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927) (nielsdos) Core: Fixed bug GH-15408 (MSan false-positve on zend_max_execution_timer). (zeriyoshi) Fixed bug GH-15515 (Configure error grep illegal option q). (Peter Kokot) Fixed bug GH-15514 (Configure error: genif.sh: syntax error). (Peter Kokot) Fixed bug GH-15565 (--disable-ipv6 during compilation produces error EAI_SYSTEM not found). (nielsdos) Fixed bug GH-15587 (CRC32 API build error on arm 32-bit). (Bernd Kuhls, Thomas Petazzoni) Fixed bug GH-15330 (Do not scan generator frames more than once). (Arnaud) Fixed uninitializedlineno in constant AST of internal enums. (ilutov) Curl: FIxed bug GH-15547 (curl_multi_select overflow on timeout argument). (David Carlier) DOM: Fixed bug GH-15551 (Segmentation fault (access null pointer) in ext/dom/xml_common.h). (nielsdos) Fileinfo: Fixed bug GH-15752 (Incorrect error message for finfo_file with an empty filename argument). (DanielEScherzer) FPM: Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered). (CVE-2024-9026) (Jakub Zelenka) MySQLnd: Fixed bug GH-15432 (Heap corruption when querying a vector). (cmb, Kamil Tekiela) Opcache: Fixed bug GH-15661 (Access null pointer in Zend/Optimizer/zend_inference.c). (nielsdos) Fixed bug GH-15658 (Segmentation fault in Zend/zend_vm_execute.h). (nielsdos) SAPI: Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data). (CVE-2024-8925) (Arnaud) SOAP: Fixed bug php#73182 (PHP SOAPClient does not support stream context HTTP headers in array form). (nielsdos) Standard: Fixed bug GH-15552 (Signed integer overflow in ext/standard/scanf.c). (cmb) Streams: Fixed bug GH-15628 (php_stream_memory_get_buffer() not zero-terminated). (cmb) -------------------------------------------------------------------------------- ChangeLog: * Wed Sep 25 2024 Remi Collet - 8.2.24-1 - Update to 8.2.24 - http://www.php.net/releases/8_2_24.php -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-7c800c4df7' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it. Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue . Fedora 39 implements vital security patches for PHP, tackling various injection risks and misconfiguration issues.. php updates, Fedora security, critical fixes, parameter injection, CGI vulnerabilities. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Oct 04, 2024 Critical Fedora
89

Fedora 40: FEDORA-2024-2b429e720e moderate: php parameter injection

PHP version 8.3.12 (26 Sep 2024) CGI: Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926) (nielsdos) Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2024-2b429e720e 2024-10-02 02:58:10.993110 -------------------------------------------------------------------------------- Name : php Product : Fedora 40 Version : 8.3.12 Release : 1.fc40 URL : http://www.php.net/ Summary : PHP scripting language for creating dynamic web sites Description : PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. -------------------------------------------------------------------------------- Update Information: PHP version 8.3.12 (26 Sep 2024) CGI: Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926) (nielsdos) Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927) (nielsdos) Core: Fixed bug GH-15408 (MSan false-positve on zend_max_execution_timer). (zeriyoshi) Fixed bug GH-15515 (Configure error grep illegal option q). (Peter Kokot) Fixed bug GH-15514 (Configure error: genif.sh: syntax error). (Peter Kokot) Fixed bug GH-15565 (--disable-ipv6 during compilation produces error EAI_SYSTEM not found). (nielsdos) Fixed bug GH-15587 (CRC32 API build error on arm 32-bit). (Bernd Kuhls, Thomas Petazzoni) Fixed bug GH-15330 (Do not scan generator frames more than once). (Arnaud) Fixed uninitializedlineno in constant AST of internal enums. (ilutov) Curl: FIxed bug GH-15547 (curl_multi_select overflow on timeout argument). (David Carlier) DOM: Fixed bug GH-15551 (Segmentation fault (access null pointer) in ext/dom/xml_common.h). (nielsdos) Fixed bug GH-15654 (Signed integer overflow in ext/dom/nodelist.c). (nielsdos) Fileinfo: Fixed bug GH-15752 (Incorrect error message for finfo_file with an empty filename argument). (DanielEScherzer) FPM: Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered). (CVE-2024-9026) (Jakub Zelenka) MySQLnd: Fixed bug GH-15432 (Heap corruption when querying a vector). (cmb, Kamil Tekiela) Opcache: Fixed bug GH-15661 (Access null pointer in Zend/Optimizer/zend_inference.c). (nielsdos) Fixed bug GH-15658 (Segmentation fault in Zend/zend_vm_execute.h). (nielsdos) SAPI: Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data). (CVE-2024-8925) (Arnaud) Standard: Fixed bug GH-15552 (Signed integer overflow in ext/standard/scanf.c). (cmb) Streams: Fixed bug GH-15628 (php_stream_memory_get_buffer() not zero-terminated). (cmb) -------------------------------------------------------------------------------- ChangeLog: * Wed Sep 25 2024 Remi Collet - 8.3.12-1 - Update to 8.3.12 - http://www.php.net/releases/8_3_12.php - enable command history in phpdbg -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-2b429e720e' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it. Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue . The Laravel patch for Ubuntu resolves multiple vulnerabilities including request forgery, session fixation, and risks in 9.5.7. Fedora PHP Update, Security Advisory, PHP Parameter Injection. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Oct 02, 2024 Important Fedora
89

Fedora 41: 2024-a03b06dbd0 critical: php parameter injection

PHP version 8.3.12 (26 Sep 2024) CGI: Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926) (nielsdos) Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2024-a03b06dbd0 2024-10-02 01:30:51.688919 -------------------------------------------------------------------------------- Name : php Product : Fedora 41 Version : 8.3.12 Release : 1.fc41 URL : http://www.php.net/ Summary : PHP scripting language for creating dynamic web sites Description : PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. -------------------------------------------------------------------------------- Update Information: PHP version 8.3.12 (26 Sep 2024) CGI: Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926) (nielsdos) Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927) (nielsdos) Core: Fixed bug GH-15408 (MSan false-positve on zend_max_execution_timer). (zeriyoshi) Fixed bug GH-15515 (Configure error grep illegal option q). (Peter Kokot) Fixed bug GH-15514 (Configure error: genif.sh: syntax error). (Peter Kokot) Fixed bug GH-15565 (--disable-ipv6 during compilation produces error EAI_SYSTEM not found). (nielsdos) Fixed bug GH-15587 (CRC32 API build error on arm 32-bit). (Bernd Kuhls, Thomas Petazzoni) Fixed bug GH-15330 (Do not scan generator frames more than once). (Arnaud) Fixed uninitializedlineno in constant AST of internal enums. (ilutov) Curl: FIxed bug GH-15547 (curl_multi_select overflow on timeout argument). (David Carlier) DOM: Fixed bug GH-15551 (Segmentation fault (access null pointer) in ext/dom/xml_common.h). (nielsdos) Fixed bug GH-15654 (Signed integer overflow in ext/dom/nodelist.c). (nielsdos) Fileinfo: Fixed bug GH-15752 (Incorrect error message for finfo_file with an empty filename argument). (DanielEScherzer) FPM: Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered). (CVE-2024-9026) (Jakub Zelenka) MySQLnd: Fixed bug GH-15432 (Heap corruption when querying a vector). (cmb, Kamil Tekiela) Opcache: Fixed bug GH-15661 (Access null pointer in Zend/Optimizer/zend_inference.c). (nielsdos) Fixed bug GH-15658 (Segmentation fault in Zend/zend_vm_execute.h). (nielsdos) SAPI: Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data). (CVE-2024-8925) (Arnaud) Standard: Fixed bug GH-15552 (Signed integer overflow in ext/standard/scanf.c). (cmb) Streams: Fixed bug GH-15628 (php_stream_memory_get_buffer() not zero-terminated). (cmb) -------------------------------------------------------------------------------- ChangeLog: * Wed Sep 25 2024 Remi Collet - 8.3.12-1 - Update to 8.3.12 - http://www.php.net/releases/8_3_12.php * Wed Sep 11 2024 Remi Collet - 8.3.12~RC1-2 - enable command history in phpdbg * Tue Sep 10 2024 Remi Collet - 8.3.12~RC1-1 - update to 8.3.12RC1 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-a03b06dbd0' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it. Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue . Essential enhancements for PHP in Fedora 41 tackling several security vulnerabilities with crucial fixes.. PHP Update, Fedora Security, Parameter Injection Fix, Dynamic Web Security. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Oct 02, 2024 Critical Fedora
202

openSUSE Leap 42.1 & 42.2: 2017:0621-1 Important Munin Patch

An update that fixes one vulnerability is now available. An update that fixes one vulnerability is now available. An update that fixes one vulnerability is now available.. openSUSE Security Update: Security update for munin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0621-1 Rating: important References: #1026539 Cross-References: CVE-2017-6188 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for munin fixes the following issues: - An attacker has been able to write arbitrary local files with the permissions of the web server, by using parameter injection (boo#1026539, CVE-2017-6188) - The MySQL plugin has been fixed to work correctly against MySQL 5.5 on Leap 42.1 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-310=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-310=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (noarch): munin-2.0.25-9.1 munin-node-2.0.25-9.1 - openSUSE Leap 42.1 (noarch): munin-2.0.25-7.1 munin-node-2.0.25-7.1 References: https://www.suse.com/security/cve/CVE-2017-6188.html https://bugzilla.suse.com/1026539 . A significant patch for munin tackles severe vulnerabilities in openSUSE Leap. Make sure your system is updated!. OpenSUSE Security, Munin Update, Parameter Injection Threat. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Mar 07, 2017 Important OpenSUSE
91

Gentoo: 200909-06 Normal: aMule Parameter Injection Attack

An input validation error in aMule enables remote attackers to pass arbitrary parameters to a victim's media player.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200909-06 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: aMule: Parameter injection Date: September 09, 2009 Bugs: #268163 ID: 200909-06 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= An input validation error in aMule enables remote attackers to pass arbitrary parameters to a victim's media player. Background ========= aMule is an eMule-like client for the eD2k and Kademlia networks, supporting multiple platforms. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-p2p/amule < 2.2.5 > = 2.2.5 Description ========== Sam Hocevar discovered that the aMule preview function does not properly sanitize file names. Impact ===== A remote attacker could entice a user to download a file with a specially crafted file name to inject arbitrary arguments to the victim's video player. Workaround ========= There is no known workaround at this time. Resolution ========= All aMule users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose =net-p2p/amule-2.2.5 References ========= [ 1 ] CVE-2009-1440 https://www.cve.org/CVERecord?id=CVE-2009-1440 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200909-06 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to This email address is being protected from spambots. You need JavaScript enabled to view it. or alternatively, you may file a bug at https://bugs.gentoo.org. License ====== Copyright 2009 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5/ . Debian Security Advisory 200901-15 highlights VLC media player vulnerabilities that could enable unauthorized access to user data. Immediate patching advised.. input validation,aMule,param injection,remote access,security advisory. . LinuxSecurity.com Team

Calendar%202 Sep 09, 2009 Gentoo
News Add Esm H240

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":1,"type":"x","order":4,"pct":100,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200