Fixed AD restrictions bypass associated with changing passwords (bsc#1201495). (CVE-2022-2031) Fixed a memory leak in SMB1 (bsc#1201496). (CVE-2022-32742) Fixed an arbitrary password change request for any AD user (bsc#1201493). (CVE-2022-32744) . MGASA-2022-0299 - Updated ldb/samba/sssd packages fix security vulnerability Publication date: 25 Aug 2022 URL: https://advisories.mageia.org/MGASA-2022-0299.html Type: security Affected Mageia releases: 8 CVE: CVE-2022-2031, CVE-2022-32742, CVE-2022-32744, CVE-2022-32745, CVE-2022-32746 Fixed AD restrictions bypass associated with changing passwords (bsc#1201495). (CVE-2022-2031) Fixed a memory leak in SMB1 (bsc#1201496). (CVE-2022-32742) Fixed an arbitrary password change request for any AD user (bsc#1201493). (CVE-2022-32744) Fixed a remote server crash with an LDAP add or modify request (bsc#1201492) (CVE-2022-32745) Fixed a use-after-free occurring in database audit logging (bsc#1201490). (CVE-2022-32746) References: - https://bugs.mageia.org/show_bug.cgi?id=30675 - - - - - - - https://ubuntu.com/security/notices/USN-5542-1 - https://lists.debian.org/debian-security-announce/2022/msg00174.html - https://lists.fedoraproject.org/archives/list/
It was discovered that debian-edu-config, a set of configuration files used for the Debian Edu blend, configured too permissive ACLs for the Kerberos admin server, which allowed password changes for other user principals. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-4589-1
This release turns on HTTPS encyption all over the publishing plugins. Users using Tumblr and Yandex.Fotki publishing are strongly advised to change their passwords and reauthenticate Shotwell to those services after upgrade. Users of Picasa and Youtube publishing are strongly advised to reauthenticate (Log out and back in) Shotwell to those services after upgrade. Changes in shotwell. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2017-ddee871dd1 2017-02-02 16:34:58.790356 -------------------------------------------------------------------------------- Name : shotwell Product : Fedora 24 Version : 0.24.5 Release : 1.fc24 URL : https://wiki.gnome.org/Apps/Shotwell Summary : A photo organizer for the GNOME desktop Description : Shotwell is an easy-to-use, fast photo organizer designed for the GNOME desktop. It allows you to import photos from your camera or disk, organize them by date and subject matter, even ratings. It also offers basic photo editing, like crop, red-eye correction, color adjustments, and straighten. Shotwell's non-destructive photo editor does not alter your master photos, making it easy to experiment and correct errors. -------------------------------------------------------------------------------- Update Information: This release turns on HTTPS encyption all over the publishing plugins. Usersusing Tumblr and Yandex.Fotki publishing are strongly advised to change their passwords and reauthenticate Shotwell to those services after upgrade. Users of Picasa and Youtube publishing are strongly advised to reauthenticate (Log out and back in) Shotwell to those services after upgrade. Changes in shotwell 0.24.5 release: * Publishing: Use HTTPS consistently * Updated translations Changes in shotwell 0.24.4 release: * Piwigo: Fix title and comments for uploaded images * Fix icon file name for Serbian and Korean * Improved duplicatedetection -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade shotwell' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
poppassd_pam allows anyone to change any user's password without authenticating the user first.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200501-22 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: poppassd_pam: Unauthorized password changing Date: January 11, 2005 Bugs: #75820 ID: 200501-22 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= poppassd_pam allows anyone to change any user's password without authenticating the user first. Background ========= poppassd_pam is a PAM-enabled server for changing system passwords that can be used to change POP server passwords. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- net-mail/poppassd_ceti = 1.8.4 net-mail/poppassd_pam
Get the latest Linux and open source security news straight to your inbox.