Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -7 articles for you...
98
security advisorysecurity updateRed HatRed Hat: RHSA-2022:5823-01 Moderate: 389-ds Denial of Service Risk
An update for the 389-ds:1.4 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: 389-ds:1.4 security update Advisory ID: RHSA-2022:5823-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2022:5823 Issue date: 2022-08-02 CVE Names: CVE-2022-0918 CVE-2022-0996 ==================================================================== 1. Summary: An update for the 389-ds:1.4 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64 3. Description: 389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: sending crafted message could result in DoS (CVE-2022-0918) * 389-ds-base: expired password was still allowed to access the database (CVE-2022-0996) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed(https://bugzilla.redhat.com/): 2055815 - CVE-2022-0918 389-ds-base: sending crafted message could result in DoS 2064769 - CVE-2022-0996 389-ds-base: expired password was still allowed to access the database 6. Package List: Red Hat Enterprise Linux AppStream (v.8): Source: 389-ds-base-1.4.3.28-7.module+el8.6.0+15293+4900ec12.src.rpm aarch64: 389-ds-base-1.4.3.28-7.module+el8.6.0+15293+4900ec12.aarch64.rpm 389-ds-base-debuginfo-1.4.3.28-7.module+el8.6.0+15293+4900ec12.aarch64.rpm 389-ds-base-debugsource-1.4.3.28-7.module+el8.6.0+15293+4900ec12.aarch64.rpm 389-ds-base-devel-1.4.3.28-7.module+el8.6.0+15293+4900ec12.aarch64.rpm 389-ds-base-legacy-tools-1.4.3.28-7.module+el8.6.0+15293+4900ec12.aarch64.rpm 389-ds-base-legacy-tools-debuginfo-1.4.3.28-7.module+el8.6.0+15293+4900ec12.aarch64.rpm 389-ds-base-libs-1.4.3.28-7.module+el8.6.0+15293+4900ec12.aarch64.rpm 389-ds-base-libs-debuginfo-1.4.3.28-7.module+el8.6.0+15293+4900ec12.aarch64.rpm 389-ds-base-snmp-1.4.3.28-7.module+el8.6.0+15293+4900ec12.aarch64.rpm 389-ds-base-snmp-debuginfo-1.4.3.28-7.module+el8.6.0+15293+4900ec12.aarch64.rpm noarch: python3-lib389-1.4.3.28-7.module+el8.6.0+15293+4900ec12.noarch.rpm ppc64le: 389-ds-base-1.4.3.28-7.module+el8.6.0+15293+4900ec12.ppc64le.rpm 389-ds-base-debuginfo-1.4.3.28-7.module+el8.6.0+15293+4900ec12.ppc64le.rpm 389-ds-base-debugsource-1.4.3.28-7.module+el8.6.0+15293+4900ec12.ppc64le.rpm 389-ds-base-devel-1.4.3.28-7.module+el8.6.0+15293+4900ec12.ppc64le.rpm 389-ds-base-legacy-tools-1.4.3.28-7.module+el8.6.0+15293+4900ec12.ppc64le.rpm 389-ds-base-legacy-tools-debuginfo-1.4.3.28-7.module+el8.6.0+15293+4900ec12.ppc64le.rpm 389-ds-base-libs-1.4.3.28-7.module+el8.6.0+15293+4900ec12.ppc64le.rpm 389-ds-base-libs-debuginfo-1.4.3.28-7.module+el8.6.0+15293+4900ec12.ppc64le.rpm 389-ds-base-snmp-1.4.3.28-7.module+el8.6.0+15293+4900ec12.ppc64le.rpm 389-ds-base-snmp-debuginfo-1.4.3.28-7.module+el8.6.0+15293+4900ec12.ppc64le.rpm s390x: 389-ds-base-1.4.3.28-7.module+el8.6.0+15293+4900ec12.s390x.rpm 389-ds-base-debuginfo-1.4.3.28-7.module+el8.6.0+15293+4900ec12.s390x.rpm 389-ds-base-debugsource-1.4.3.28-7.module+el8.6.0+15293+4900ec12.s390x.rpm 389-ds-base-devel-1.4.3.28-7.module+el8.6.0+15293+4900ec12.s390x.rpm 389-ds-base-legacy-tools-1.4.3.28-7.module+el8.6.0+15293+4900ec12.s390x.rpm 389-ds-base-legacy-tools-debuginfo-1.4.3.28-7.module+el8.6.0+15293+4900ec12.s390x.rpm 389-ds-base-libs-1.4.3.28-7.module+el8.6.0+15293+4900ec12.s390x.rpm 389-ds-base-libs-debuginfo-1.4.3.28-7.module+el8.6.0+15293+4900ec12.s390x.rpm 389-ds-base-snmp-1.4.3.28-7.module+el8.6.0+15293+4900ec12.s390x.rpm 389-ds-base-snmp-debuginfo-1.4.3.28-7.module+el8.6.0+15293+4900ec12.s390x.rpm x86_64: 389-ds-base-1.4.3.28-7.module+el8.6.0+15293+4900ec12.x86_64.rpm 389-ds-base-debuginfo-1.4.3.28-7.module+el8.6.0+15293+4900ec12.x86_64.rpm 389-ds-base-debugsource-1.4.3.28-7.module+el8.6.0+15293+4900ec12.x86_64.rpm 389-ds-base-devel-1.4.3.28-7.module+el8.6.0+15293+4900ec12.x86_64.rpm 389-ds-base-legacy-tools-1.4.3.28-7.module+el8.6.0+15293+4900ec12.x86_64.rpm 389-ds-base-legacy-tools-debuginfo-1.4.3.28-7.module+el8.6.0+15293+4900ec12.x86_64.rpm 389-ds-base-libs-1.4.3.28-7.module+el8.6.0+15293+4900ec12.x86_64.rpm 389-ds-base-libs-debuginfo-1.4.3.28-7.module+el8.6.0+15293+4900ec12.x86_64.rpm 389-ds-base-snmp-1.4.3.28-7.module+el8.6.0+15293+4900ec12.x86_64.rpm 389-ds-base-snmp-debuginfo-1.4.3.28-7.module+el8.6.0+15293+4900ec12.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2022-0918 https://access.redhat.com/security/cve/CVE-2022-0996 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBYuqtXdzjgjWX9erEAQjNhhAAgdGFGdpxuDSAfDkauw5x1YCZzWUi03n3 QwmjoYQmScArxrRoD49HiytSOl6Fhqbe2jERomuNoZXxQhhQxdXR2oXVNyo6/aQ1 iv4FqFDfSvCLcnqVeVXX73M58p72qDiR8uM0DSS1AdeIeI7abAWkjGDSnPjE/RHy mYLv1pxyYnivJGA/Bd6L+5rqvBW5KU8UPAUbtVi2Pu2DaaGXtblvfrAUrDQxCubg Z4mikQqsBHR1/xicqrI57K8d9te3gNDZok7G+Ga3BlbOM9LM28wI4nUtZKfJZKiv PB0mMkQtCiVwcI75frAfRgdLCZ1INiUAgqki6PKTq8IN2r4iY9iLpAKPQmUwqV3T GLylAY5fokBz9V7/k6wdvQyPZuXpyHBvPYBOftCr84Mj3bWQQYsyOAe9/SIuuYLb qjqpgYeqdrce0B4FLeQ62vsCjzCRH6wLHnbyLB2d9vYNnNNQqwnLyu9/k7zootLA scu3l9GlX0WNchLK3PG305qsK6lQM5faIt9yd9L0NtGtiWWOBxMZUEUd+Xhpa/+V kqiOfqKOLl1V/WOZUY31HtjjwJuPV16y2D9qovtx36Y3ytITaN1RHU0TOAqoJBf9 /UJpKJEwQsXzNKmJoEI02u2zCU78ixO+Go5qsTZIpib086+BTd4bM/38LiYstH+7 vsjx/B7PR3Y=mraU -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Aug 03, 2022
Red Hat
172
security advisorymoderateupdateUbuntu 8.04 LTS USN-645-3 Moderate: Firefox Password Access Regression
USN-645-1 fixed vulnerabilities in Firefox and xulrunner. The upstream patches introduced a regression in the saved password handling. While password data was not lost, if a user had saved any passwords with non-ASCII characters, Firefox could not access the password database. This update fixes the problem. . =========================================================== Ubuntu Security Notice USN-645-3 September 25, 2008 firefox-3.0, xulrunner-1.9 regression https://bugs.launchpad.net/ubuntu/+source/firefox-3.0/+bug/270429 ========================================================== A security issue affects the following Ubuntu releases: Ubuntu 8.04 LTS This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 8.04 LTS: firefox 3.0.3+build1+nobinonly-0ubuntu0.8.04.1 xulrunner-1.9 1.9.0.3+build1+nobinonly-0ubuntu0.8.04.1 After a standard system upgrade you need to restart Firefox and any applications that use xulrunner, such as Epiphany, to effect the necessary changes. Details follow: USN-645-1 fixed vulnerabilities in Firefox and xulrunner. The upstream patches introduced a regression in the saved password handling. While password data was not lost, if a user had saved any passwords with non-ASCII characters, Firefox could not access the password database. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Justin Schuh, Tom Cross and Peter Williams discovered errors in the Firefox URL parsing routines. If a user were tricked into opening a crafted hyperlink, an attacker could overflow a stack buffer and execute arbitrary code. (CVE-2008-0016) It was discovered that the same-origin check in Firefox could be bypassed. If a user were tricked into opening a malicious website, an attacker may be able to execute JavaScript in thecontext of a different website. (CVE-2008-3835) Several problems were discovered in the JavaScript engine. This could allow an attacker to execute scripts from page content with chrome privileges. (CVE-2008-3836) Paul Nickerson discovered Firefox did not properly process mouse click events. If a user were tricked into opening a malicious web page, an attacker could move the content window, which could potentially be used to force a user to perform unintended drag and drop operations. (CVE-2008-3837) Several problems were discovered in the browser engine. This could allow an attacker to execute code with chrome privileges. (CVE-2008-4058, CVE-2008-4059, CVE-2008-4060) Drew Yao, David Maciejak and other Mozilla developers found several problems in the browser engine of Firefox. If a user were tricked into opening a malicious web page, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-4061, CVE-2008-4062, CVE-2008-4063, CVE-2008-4064) Dave Reed discovered a flaw in the JavaScript parsing code when processing certain BOM characters. An attacker could exploit this to bypass script filters and perform cross-site scripting attacks. (CVE-2008-4065) Gareth Heyes discovered a flaw in the HTML parser of Firefox. If a user were tricked into opening a malicious web page, an attacker could bypass script filtering and perform cross-site scripting attacks. (CVE-2008-4066) Boris Zbarsky and Georgi Guninski independently discovered flaws in the resource: protocol. An attacker could exploit this to perform directory traversal, read information about the system, and prompt the user to save information in a file. (CVE-2008-4067, CVE-2008-4068) Billy Hoffman discovered a problem in the XBM decoder. If a user were tricked into opening a malicious web page or XBM file, an attacker may be able to cause a denial of service via application crash. (CVE-2008-4069) Updated packages for Ubuntu 8.04 LTS: Source archives: Size/MD5: 105898 8e9d91766d1673d85b4e2e60f09ffbb6 Size/MD5: 2760 57a929804f986040bc7227fe3009156c Size/MD5: 11573662 bcf09e18019b2f2cbb8517932c891485 Size/MD5: 77467 f5a62ff3d325e95c5120cc22bda2d554 Size/MD5: 2825 ab55f7ea35f9ee735528805831854977 Size/MD5: 40164202 72a5e40dda74d050021677f1b3ebabcc Architecture independent packages: Size/MD5: 65954 3f06a1b75554d1d2340afc44b78022ac Size/MD5: 65968 6d8a8e29f0a7c87d2c8f179f574d7aa6 Size/MD5: 65924 3ac2f3dfa932bdc940950c0a894b9080 Size/MD5: 65912 e9e9a4746bec14f42b2450bea8225057 Size/MD5: 66064 6775e8fa75a92e1f33cc8ae5bb7f9e8a Size/MD5: 65974 751dd3d6688c6639e9d0ec0da761cc5c Size/MD5: 65924 cfb57e23eb08498e16a6bbef2ca4238e Size/MD5: 8974 25f83a796d3169788d39ea68cd8635c6 Size/MD5: 8962 01cc668f88c84f91e2fd886d42d92f13 Size/MD5: 65948 c4718d66cfe19443c59978f4e39e7e41 Size/MD5: 65914 71f6cddfc729e4018eefe95c79efd9df Size/MD5: 65906 97334f76bbbd654157c7c5aabf7e31c6 Size/MD5: 8946 f9d779ba38a6e7732ad71bb751523a7a Size/MD5: 65936 4fa1a2d88890b85d3bce5cb045ec792b Size/MD5: 8936 700210f41bc608472f4fe88615dab81f Size/MD5: 65902 d907072601c66ad491d706566c2824de Size/MD5: 125194 abdbdf7f8a7597a88c60af6d98ad3be3 Size/MD5: 235304 8c3f950ba19f57700fb82918f343bed3 amd64 architecture (Athlon64, Opteron, EM64T Xeon): Size/MD5: 9028 45557a5d8f43797bebb0ee77783bdc87 Size/MD5: 29576 78c9677804c24f5b6d95e0eb6c7a7f38 Size/MD5: 1086672 7399df1205d00bd6124d03fc63cf6592 Size/MD5: 4035336 eaff46064356cea1e966ab221e45eb30 Size/MD5: 48656 41dc8e708b4972e61b2e12ab54c0c4fc Size/MD5: 9031700f608db020679c1a062deaf017d5defd2 i386 architecture (x86 compatible Intel/AMD): Size/MD5: 9028 a8fd22201b420b5b0fa11fab1c9466d3 Size/MD5: 25726 823066888e006035bbe5f1eb790eccfa Size/MD5: 1065018 32827a47e8cd521d89391879a3d84d5c Size/MD5: 4016914 4285536cc152b65fa881946890b44185 Size/MD5: 38514 04869df4ca726ad6c59d2e43383bf4f6 Size/MD5: 7763786 685dc1eb5dce09d60c56ffa1c059735b lpia architecture (Low Power Intel Architecture): Size/MD5: 9028 2de0d8feb75644816867deec8668ec34 Size/MD5: 25342 5e70051d1c36fa4115ad1b569a57b290 Size/MD5: 1063126 4e9a3f4c3adaacb731b9d715e38fd3e2 Size/MD5: 4012342 92f97468c8260b9980d348024b3b6971 Size/MD5: 37610 88681831e70f2c7ab81da01928fcf09f Size/MD5: 7650950 80ab78a657265b9cad8ec759ac8864e9 powerpc architecture (Apple Macintosh G3/G4/G5): Size/MD5: 9026 c90a944ecbc4366a54001c769d29e35b Size/MD5: 27502 d140872135657f26a214585501d48c8c Size/MD5: 1079210 2594afd5cad19bc4bee8f0bad4483c5c Size/MD5: 4023426 cb239f374f28f6b90ae9289240acf871 Size/MD5: 43686 d176b974055a33ede0065b4c9f2047fd Size/MD5: 8609908 8e66fdbd3106ee310b9e8591d5fc35ad --Fba/0zbH8Xs+Fj9o Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature Content-Disposition: inline -----BEGIN PGP SIGNATURE-----Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFI29kjW0JvuRdL8BoRAkXfAKCfhJfZscIqOOc2vRx0MxXxzznO4wCePwxU +im4TJCKqO3mDNtpkmtZLsw=uAlq -----END PGP SIGNATURE-------Fba/0zbH8Xs+Fj9o-- --==============w51258102108683811=Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --ubuntu-security-announce mailing list
Sep 25, 2008
•Important
Ubuntu
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!