Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -3 articles for you...
100
security advisorysecurity updatemoderate severitySUSE Container: 2022:2950-1 moderate: bci/ruby security patch
The container bci/ruby was updated. The following patches have been included in this update:. SUSE Container Update Advisory: bci/ruby ----------------------------------------------------------------- Container Advisory ID : SUSE-CU-2022:2950-1 Container Tags : bci/ruby:2 , bci/ruby:2.5 , bci/ruby:2.5-31.18 , bci/ruby:latest Container Release : 31.18 Severity : moderate Type : security References : 1204455 1204456 CVE-2022-39253 CVE-2022-39260 ----------------------------------------------------------------- The container bci/ruby was updated. The following patches have been included in this update: ----------------------------------------------------------------- Advisory ID: SUSE-SU-2022:3931-1 Released: Thu Nov 10 11:26:01 2022 Summary: Security update for git Type: security Severity: moderate References: 1204455,1204456,CVE-2022-39253,CVE-2022-39260 This update for git fixes the following issues: - CVE-2022-39260: Fixed overflow in split_cmdline() (bsc#1204456). - CVE-2022-39253: Fixed dereference issue with symbolic links via the `--local` clone mechanism (bsc#1204455). The following package changes have been done: - git-core-2.35.3-150300.10.18.1 updated . SUSE upgrades bci/ruby by implementing security updates addressing moderately severe vulnerabilities, resolving overflow and dereferencing issues.. bci/ruby Security,SUSE Security Advisory,Software Update. . LinuxSecurity.com Team
Nov 11, 2022
SuSE
100
security advisoryimportantpatch informationSUSE: 2022:1422-1 important: bci/dotnet-runtime security issues
The container bci/dotnet-runtime was updated. The following patches have been included in this update:. SUSE Container Update Advisory: bci/dotnet-runtime ----------------------------------------------------------------- Container Advisory ID : SUSE-CU-2022:1422-1 Container Tags : bci/dotnet-runtime:3.1 , bci/dotnet-runtime:3.1-15.9 , bci/dotnet-runtime:3.1.26 , bci/dotnet-runtime:3.1.26-15.9 Container Release : 15.9 Severity : important Type : security References : 1185637 1199166 1200550 1200734 1200735 1200736 1200737 1201099 CVE-2022-1292 CVE-2022-2068 CVE-2022-2097 CVE-2022-32205 CVE-2022-32206 CVE-2022-32207 CVE-2022-32208 ----------------------------------------------------------------- The container bci/dotnet-runtime was updated. The following patches have been included in this update: ----------------------------------------------------------------- Advisory ID: SUSE-SU-2022:2305-1 Released: Wed Jul 6 13:38:42 2022 Summary: Security update for curl Type: security Severity: important References: 1200734,1200735,1200736,1200737,CVE-2022-32205,CVE-2022-32206,CVE-2022-32207,CVE-2022-32208 This update for curl fixes the following issues: - CVE-2022-32205: Set-Cookie denial of service (bsc#1200734) - CVE-2022-32206: HTTP compression denial of service (bsc#1200735) - CVE-2022-32207: Unpreserved file permissions (bsc#1200736) - CVE-2022-32208: FTP-KRB bad message verification (bsc#1200737) ----------------------------------------------------------------- Advisory ID: SUSE-SU-2022:2308-1 Released: Wed Jul 6 14:15:13 2022 Summary: Security update for openssl-1_1 Type: security Severity: important References: 1185637,1199166,1200550,1201099,CVE-2022-1292,CVE-2022-2068,CVE-2022-2097 This update for openssl-1_1 fixes the following issues: - CVE-2022-1292: Fixed command injection in c_rehash (bsc#1199166). - CVE-2022-2068: Fixed more shell code injection issues inc_rehash. (bsc#1200550) - CVE-2022-2097: Fixed partial missing encryption in AES OCB mode (bsc#1201099). The following package changes have been done: - libopenssl1_1-1.1.1l-150400.7.7.1 updated - libopenssl1_1-hmac-1.1.1l-150400.7.7.1 updated - libcurl4-7.79.1-150400.5.3.1 updated - container:sles15-image-15.0.0-27.8.3 updated . SUSE Container Update Announcement provides information on updates for bci/dotnet-runtime, highlighting critical security fixes and links to the relevant vulnerability documentation.. bci/dotnet-runtime update, container security, SUSE patch information. . Severity: Important. LinuxSecurity.com Team
Jul 07, 2022
•Important
SuSE
202
security advisorysecurity fixmemory issueFedora 34: 2021:0487-3 Critical: Kernel Memory Vulnerabilities
An update that solves 11 vulnerabilities and has 7 fixes is now available. . openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2923-1 Rating: important References: #1027519 #1176189 #1179246 #1183243 #1183877 #1185682 #1186428 #1186429 #1186433 #1186434 #1187406 #1188050 #1189373 #1189376 #1189378 #1189380 #1189381 #1189882 Cross-References: CVE-2021-0089 CVE-2021-28690 CVE-2021-28692 CVE-2021-28693 CVE-2021-28694 CVE-2021-28695 CVE-2021-28696 CVE-2021-28697 CVE-2021-28698 CVE-2021-28699 CVE-2021-28700 CVSS scores: CVE-2021-0089 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2021-28694 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-28695 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-28696 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-28697 (SUSE): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-28698 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-28699 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-28700 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves 11 vulnerabilities and has 7 fixes is now available. Description: This update for xen fixes the following issues: Update to Xen 4.13.3 general bug fix release (bsc#1027519). Security issues fixed: - CVE-2021-28693: xen/arm: Boot modules are not scrubbed (bsc#1186428) - CVE-2021-28692: xen: inappropriate x86 IOMMU timeout detection / handling (bsc#1186429) - CVE-2021-0089: xen: Speculative Code Store Bypass (bsc#1186433) - CVE-2021-28690: xen: x86: TSX Async Abort protections not restored after S3 (bsc#1186434) - CVE-2021-28694,CVE-2021-28695,CVE-2021-28696: IOMMU page mapping issues on x86 (XSA-378)(bsc#1189373). - CVE-2021-28697: grant table v2 status pages may remain accessible after de-allocation (XSA-379)(bsc#1189376). - CVE-2021-28698: long running loops in grant table handling (XSA-380)(bsc#1189378). - CVE-2021-28699: inadequate grant-v2 status frames array bounds check (XSA-382)(bsc#1189380). - CVE-2021-28700: No memory limit for dom0less domUs (XSA-383)(bsc#1189381). Other issues fixed: - Fixed "Panic on CPU 0: IO-APIC + timer doesn't work!" (bsc#1180491) - Fixed an issue with xencommons, where file format expecations by fillup did not allign (bsc#1185682) - Fixed shell macro expansion in the spec file, so that ExecStart= in xendomains-wait-disks.service is created correctly (bsc#1183877) - Upstream bug fixes (bsc#1027519) - Fixed Xen SLES11SP4 guest hangs on cluster (bsc#1188050). - xl monitoring process exits during xl save -p|-c keep the monitoring process running to cleanup the domU during shutdown (bsc#1176189). - Dom0 hangs when pinning CPUs for dom0 with HVM guest (bsc#1179246). - Some long deprecated commands were finally removed in qemu6. Adjust libxl to use supported commands (bsc#1183243). - Update logrotate.conf, move global options into per-file sections to prevent globbering of global state (bsc#1187406). - Prevent superpage allocation in the LAPIC and ACPI_INFO range (bsc#1189882). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2923=1 Package List: - openSUSE Leap 15.3 (aarch64 x86_64): xen-4.14.2_04-3.9.1 xen-debugsource-4.14.2_04-3.9.1 xen-devel-4.14.2_04-3.9.1 xen-doc-html-4.14.2_04-3.9.1 xen-libs-4.14.2_04-3.9.1 xen-libs-debuginfo-4.14.2_04-3.9.1 xen-tools-4.14.2_04-3.9.1 xen-tools-debuginfo-4.14.2_04-3.9.1 xen-tools-domU-4.14.2_04-3.9.1 xen-tools-domU-debuginfo-4.14.2_04-3.9.1 - openSUSE Leap 15.3 (noarch): xen-tools-xendomains-wait-disk-4.14.2_04-3.9.1 - openSUSE Leap 15.3 (x86_64): xen-libs-32bit-4.14.2_04-3.9.1 xen-libs-32bit-debuginfo-4.14.2_04-3.9.1 References: https://www.suse.com/security/cve/CVE-2021-0089.html https://www.suse.com/security/cve/CVE-2021-28690.html https://www.suse.com/security/cve/CVE-2021-28692.html https://www.suse.com/security/cve/CVE-2021-28693.html https://www.suse.com/security/cve/CVE-2021-28694.html https://www.suse.com/security/cve/CVE-2021-28695.html https://www.suse.com/security/cve/CVE-2021-28696.html https://www.suse.com/security/cve/CVE-2021-28697.html https://www.suse.com/security/cve/CVE-2021-28698.html https://www.suse.com/security/cve/CVE-2021-28699.html https://www.suse.com/security/cve/CVE-2021-28700.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1176189 https://bugzilla.suse.com/1179246 https://bugzilla.suse.com/1183243 https://bugzilla.suse.com/1183877 https://bugzilla.suse.com/1185682 https://bugzilla.suse.com/1186428 https://bugzilla.suse.com/1186429 https://bugzilla.suse.com/1186433 https://bugzilla.suse.com/1186434 https://bugzilla.suse.com/1187406 https://bugzilla.suse.com/1188050 https://bugzilla.suse.com/1189373 https://bugzilla.suse.com/1189376 https://bugzilla.suse.com/1189378 https://bugzilla.suse.com/1189380 https://bugzilla.suse.com/1189381 https://bugzilla.suse.com/1189882 . This Fedora security patch tackles critical concerns within qemu, rectifying various weaknesses and offering solutions..openSUSE Leap,xen security fixes,vulnerability management,security update,xen bugs. . Severity: Important. LinuxSecurity.com Team
Sep 02, 2021
•Important
OpenSUSE
100
security advisorydenial of servicepatch informationSUSE: 2020:3163-1 Moderate: ImageMagick Denial of Service Threat
An update that fixes one vulnerability is now available. . SUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: SUSE-SU-2020:3163-1 Rating: moderate References: #1178067 Cross-References: CVE-2020-27560 Affected Products: SUSE Linux Enterprise Workstation Extension 12-SP5 SUSE Linux Enterprise Software Development Kit 12-SP5 SUSE Linux Enterprise Server 12-SP5 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ImageMagick fixes the following issues: - CVE-2020-27560: Fixed potential denial of service in OptimizeLayerFrames function in MagickCore/layer.c (bsc#1178067). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12-SP5: zypper in -t patch SUSE-SLE-WE-12-SP5-2020-3163=1 - SUSE Linux Enterprise Software Development Kit 12-SP5: zypper in -t patch SUSE-SLE-SDK-12-SP5-2020-3163=1 - SUSE Linux Enterprise Server 12-SP5: zypper in -t patch SUSE-SLE-SERVER-12-SP5-2020-3163=1 Package List: - SUSE Linux Enterprise Workstation Extension 12-SP5 (x86_64): ImageMagick-6.8.8.1-71.147.1 ImageMagick-debuginfo-6.8.8.1-71.147.1 ImageMagick-debugsource-6.8.8.1-71.147.1 libMagick++-6_Q16-3-6.8.8.1-71.147.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-71.147.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-71.147.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-71.147.1 - SUSE Linux Enterprise Software Development Kit 12-SP5 (aarch64 ppc64le s390x x86_64): ImageMagick-6.8.8.1-71.147.1 ImageMagick-config-6-SUSE-6.8.8.1-71.147.1 ImageMagick-config-6-upstream-6.8.8.1-71.147.1 ImageMagick-debuginfo-6.8.8.1-71.147.1 ImageMagick-debugsource-6.8.8.1-71.147.1 ImageMagick-devel-6.8.8.1-71.147.1 libMagick++-6_Q16-3-6.8.8.1-71.147.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-71.147.1 libMagick++-devel-6.8.8.1-71.147.1 perl-PerlMagick-6.8.8.1-71.147.1 perl-PerlMagick-debuginfo-6.8.8.1-71.147.1 - SUSE Linux Enterprise Server 12-SP5 (aarch64 ppc64le s390x x86_64): ImageMagick-config-6-SUSE-6.8.8.1-71.147.1 ImageMagick-config-6-upstream-6.8.8.1-71.147.1 ImageMagick-debuginfo-6.8.8.1-71.147.1 ImageMagick-debugsource-6.8.8.1-71.147.1 libMagickCore-6_Q16-1-6.8.8.1-71.147.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-71.147.1 libMagickWand-6_Q16-1-6.8.8.1-71.147.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-71.147.1 References: https://www.suse.com/security/cve/CVE-2020-27560.html https://bugzilla.suse.com/1178067 . SUSE Security Bulletin for ImageMagick addresses medium-level denial of service flaws, accompanied by comprehensive instructions for applying patches.. ImageMagick Security Update,SUSE Linux Patch,Denial of Service Fix,Moderate Severity Security Update. . LinuxSecurity.com Team
Nov 05, 2020
SuSE
199
security advisorycritical issueruby updateCentOS 7: CESA-2018-0378 Important Ruby Update Critical
Upstream details at : https://access.redhat.com/errata/RHSA-2018:0378. CentOS Errata and Security Advisory 2018:0378 Important Upstream details at : https://access.redhat.com/errata/RHSA-2018:0378 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: dfd880e193b078a002b6ed82fc0a3b23345bc80a3c79cd9a1f040cd57876ec4a ruby-2.0.0.648-33.el7_4.x86_64.rpm dbf9f950b81c8241fef9b10b78a25e97cc1b3804f5deb2a2f453f263b5d0189f ruby-devel-2.0.0.648-33.el7_4.x86_64.rpm beef083a2a54547d95c336ebc858764e38da82e8c9cc3920cd6c78a660d0de2e ruby-doc-2.0.0.648-33.el7_4.noarch.rpm 3df59a8baae9716255cb059c822ad0f78e1d273e4055148b215eb565ae8eeb01 rubygem-bigdecimal-1.2.0-33.el7_4.x86_64.rpm 8d800ddb2a8a8cb2b5f02e75eccb2f8606d7bc2062d6bd360bb4dfe60ff5665b rubygem-io-console-0.4.2-33.el7_4.x86_64.rpm 925b180a90388ed123fce8edcb9a93561f491ff25cd1f439c57c669a9c802691 rubygem-json-1.7.7-33.el7_4.x86_64.rpm aaaaa6eb617796ac3b4f8416338bcada8d3c4e9e10b942003a887f00c5fe85ea rubygem-minitest-4.3.2-33.el7_4.noarch.rpm 67e08cdc568c055684b19e2ea329858ef1347db98a30e3581582e922dfa63bff rubygem-psych-2.0.0-33.el7_4.x86_64.rpm 820658af3f6636fbfac117df8dc3f36c3fced8d7a97127a7a2068dc3ec20f6f5 rubygem-rake-0.9.6-33.el7_4.noarch.rpm d36ba5af985c92e517e20869e08792617419e3cee95340d80059da3009bbda42 rubygem-rdoc-4.0.0-33.el7_4.noarch.rpm 9da643fbd7e79b9ec131b8dafb0b42be66218b8814ef379cee87b1935518db38 rubygems-2.0.14.1-33.el7_4.noarch.rpm a6aaef1d530032f9f471caab24e69b17ff6e63d700300a6ff4e8684eb37135ac rubygems-devel-2.0.14.1-33.el7_4.noarch.rpm ab5f862f877dba42ee9899c7341510fdc5dce9107146a5d11c0d61a9b599d40c ruby-irb-2.0.0.648-33.el7_4.noarch.rpm d27b1d0d883a282aa10064e0eeb72802939b27a7fca60a55d7052ddb6bbbfc6f ruby-libs-2.0.0.648-33.el7_4.i686.rpm c2e3b36b93c8340981191aaeba4af9e29d309fd73d83dbea140a7278835536bd ruby-libs-2.0.0.648-33.el7_4.x86_64.rpm e55b750243b6dc24c5054b9e09940970a67728ef1a23082b6cd4ff78568855f3 ruby-tcltk-2.0.0.648-33.el7_4.x86_64.rpm Source: 5448750c67f92c16d50e664108fa82a940c3c2f2b1ea1eee9b329c7f17da54d9 ruby-2.0.0.648-33.el7_4.src.rpm -- Johnny Hughes CentOS Project { https://www.centos.org/ } irc: hughesjr, #
Mar 10, 2018
•Important
CentOS
100
security advisoryremote exploitsendmailSuSE: 2020:045 Critical: OpenSSL Buffer Overflow Vulnerability
When sendmail receives an invalid DNS response it tries to call free on random data which results in a process crash.. ______________________________________________________________________________ SuSE Security Announcement Package: sendmail Announcement-ID: SuSE-SA:2003:035 Date: Tuesday, Aug 26th 2003 19:00 MEST Affected products: 8.0, 8.1, 8.2 SuSE Linux Enterprise Server 8 remote denial-of-service Severity (1-10): 5 SuSE default package: no Cross References: CAN-2003-0688 Content of this advisory: 1) security vulnerability resolved: calling free() with arbitrary argument problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds: - traceroute(-nanog) - gdm2 - pam_smb - exim 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The well known and widely used MTA sendmail is vulnerable to a remote denial-of-service attack in version 8.12.8 and earlier (but not before 8.12). The bug exists in the DNS map code. This feature is enabled by specifying FEATURE(`enhdnsbl'). When sendmail receives an invalid DNS response it tries to call free(3) on random data which results in a process crash. After your system was updated you have to restart your sendmail daemon to make the update effective. There is no known workaround for this vulnerability other than using a different MTA. Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. Our maintenance customers are being notified individually. The packages are being offered to install from the maintenance web. Intel i386 Platform: SuSE-8.2: eaf90e49886f496b2779107f1d9a831a patch rpm(s): c5999fe4026e05c4308249a7e3dbf8f4 source rpm(s): 2cda6c535a3be4e26c50373bd078b4c7 SuSE-8.1: 03d2b6e1083f863dc19a28f44256b071 patch rpm(s): ee6a3553396432bd3a208d355dacdd33 source rpm(s): 97417cee623251c6cc3009c13c5b1fbe SuSE-8.0: c7cd791bdbcf0c5ed80cd9aab0ccc965 patch rpm(s): a2d04f73894a09b9134f0f516c385d78 source rpm(s): 4c059b5714ba2dbe5860654622b65bfb Intel i386 Platform: SuSE-8.2: 1d5e50aea21f2ce88277fd9113dfb6da patch rpm(s): 402cff9f2e0e4b56b2409082d0adbc0d source rpm(s): 2cda6c535a3be4e26c50373bd078b4c7 SuSE-8.1: 7de06e8f16800359e25b5d9dcc739af5 patch rpm(s): 67c84d8cd4ff132ef0c1a91ed845b5d8 source rpm(s): 97417cee623251c6cc3009c13c5b1fbe SuSE-8.0: b95b64d0c474ee7b37a82e2fc04e72b7 patch rpm(s): e872341553634848bb19b0d89a1e3a37 source rpm(s): 4c059b5714ba2dbe5860654622b65bfb ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - traceroute(-nanog) A integer overflow in traceroute can be abused by local attackers to gain access to a raw IP socket. New packages are available on out FTP servers. - gdm2 Due to a bug in GDM it is possible for local users to read any text file on a system by creating a symlink from ~/.xsession-errors. Updated packages will be available on our FTP servers soon. - pam_smb A buffer overflow in the password handlingfunction of pam_smb allows remote root compromise. Fixed packages will be available soon. - exim Two bugs where fixed in exim. One bug allows remote access as user mail/mail and the other one allows local root access for 'Admin Users'. Fixed packages are available on our FTP servers. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key
Aug 26, 2003
•Critical
SuSE
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!