Explore top 10 tips to secure your open-source projects now. Read More
×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Is continuous patching actually viable?
Loading...
Explore Latest Linux Security advisories
We found 489 articles for you...
172
security advisoryremote accessUbuntuUbuntu 24.04 Sympa Important Path Traversal Vuln 2024-55919
Sympa could allow unintended access to network services.. ========================================================================== Ubuntu Security Notice USN-8552-1 July 15, 2026 sympa vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Sympa could allow unintended access to network services. Software Description: - sympa: mailing list management software Details: It was discovered that Sympa did not properly validate input on the generic SSO login. A remote attacker could possibly use this issue to perform a path traversal attack and gain unintended access. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 24.04 LTS sympa 6.2.70~dfsg-2+deb12u1build0.24.04.1 Ubuntu 22.04 LTS sympa 6.2.66~dfsg-2ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 20.04 LTS sympa 6.2.40~dfsg-4ubuntu0.20.04.1~esm2 Available with Ubuntu Pro Ubuntu 18.04 LTS sympa 6.2.24~dfsg-1ubuntu0.1~esm2 Available with Ubuntu Pro Ubuntu 16.04 LTS sympa 6.1.24~dfsg-1ubuntu0.1~esm1 Available with Ubuntu Pro After a standard system update you need to restart sympa to make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8552-1 CVE-2024-55919 Package Information: https://launchpad.net/ubuntu/+source/sympa/6.2.70~dfsg-2+deb12u1build0.24.04.1 . Unattended access to network services via Sympa on Ubuntu can be corrected by updating your system to the latest package versions.. Ubuntu security advisory, Sympa patch, network services access, remote accessvulnerability. . Severity: Important. LinuxSecurity.com Team
Jul 15, 2026
•Important
Ubuntu
89
security advisoryfedorahighFedora 44 Composer High Package Validation Path Traversal 2026-22ba02bee3
Version 2.10.2 - 2026-07-01 Security: Validate package names (GHSA-499r-g7pc-vmp9) Security: Validate package bin paths against path traversal (GHSA-gjfg-22fp- rrxx) Security: Sanitize URL-embedded usernames/token in verbose output. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-22ba02bee3 2026-07-11 01:06:30.201230+00:00 -------------------------------------------------------------------------------- Name : composer Product : Fedora 44 Version : 2.10.2 Release : 1.fc44 URL : https://getcomposer.org/ Summary : Dependency Manager for PHP Description : Composer helps you declare, manage and install dependencies of PHP projects, ensuring you have the right stack everywhere. Documentation: https://getcomposer.org/doc/ -------------------------------------------------------------------------------- Update Information: Version 2.10.2 - 2026-07-01 Security: Validate package names (GHSA-499r-g7pc-vmp9) Security: Validate package bin paths against path traversal (GHSA-gjfg-22fp- rrxx) Security: Sanitize URL-embedded usernames/token in verbose output (GHSA-g6xq-892h-64w3) Security: Only follow HTTP redirects from HTTP responses (#12948) Security: Prevent phar metadata unserialization on unsafe PHP versions (#12946) Security: Sanitize JSON parse errors in http responses to avoid leaking response body data (#12959) Added warning output in self-update command when using a soon-to-be EOL version (#12920) Added download retry when a GitHub codeload URL returns a 400 (#12962) Fixed audit command to output the audit result to stdout (#12904) Fixed backspace characters being output to non-decorated output (#12925) Fixed security advisory blocking causing issues with xdebug enabled (#12935) Fixed provider packages hiding suggestions for the package they provide themselves (#12933) Fixed security advisory blocking causing issues with xdebug enabled(#12935) -------------------------------------------------------------------------------- ChangeLog: * Wed Jul 1 2026 Remi Collet - 2.10.2-1 - update to 2.10.2 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-22ba02bee3' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Jul 10, 2026
•high
Fedora
89
security advisoryfedoraimportantFedora 43 Composer Important Path Traversal Security Fix 2026-3017b1bec1
Version 2.10.2 - 2026-07-01 Security: Validate package names (GHSA-499r-g7pc-vmp9) Security: Validate package bin paths against path traversal (GHSA-gjfg-22fp- rrxx) Security: Sanitize URL-embedded usernames/token in verbose output. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-3017b1bec1 2026-07-11 00:52:57.708467+00:00 -------------------------------------------------------------------------------- Name : composer Product : Fedora 43 Version : 2.10.2 Release : 1.fc43 URL : https://getcomposer.org/ Summary : Dependency Manager for PHP Description : Composer helps you declare, manage and install dependencies of PHP projects, ensuring you have the right stack everywhere. Documentation: https://getcomposer.org/doc/ -------------------------------------------------------------------------------- Update Information: Version 2.10.2 - 2026-07-01 Security: Validate package names (GHSA-499r-g7pc-vmp9) Security: Validate package bin paths against path traversal (GHSA-gjfg-22fp- rrxx) Security: Sanitize URL-embedded usernames/token in verbose output (GHSA-g6xq-892h-64w3) Security: Only follow HTTP redirects from HTTP responses (#12948) Security: Prevent phar metadata unserialization on unsafe PHP versions (#12946) Security: Sanitize JSON parse errors in http responses to avoid leaking response body data (#12959) Added warning output in self-update command when using a soon-to-be EOL version (#12920) Added download retry when a GitHub codeload URL returns a 400 (#12962) Fixed audit command to output the audit result to stdout (#12904) Fixed backspace characters being output to non-decorated output (#12925) Fixed security advisory blocking causing issues with xdebug enabled (#12935) Fixed provider packages hiding suggestions for the package they provide themselves (#12933) Fixed security advisory blocking causing issues with xdebug enabled(#12935) -------------------------------------------------------------------------------- ChangeLog: * Wed Jul 1 2026 Remi Collet - 2.10.2-1 - update to 2.10.2 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-3017b1bec1' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Jul 10, 2026
•Important
Fedora
217
security advisorysecurity issueimportantOracle Linux 9 python3.14-pip Important Path Traversal Fix ELSA-2026-36315
The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:. Oracle Linux Security Advisory ELSA-2026-36315 http://linux.oracle.com/errata/ELSA-2026-36315.html The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: x86_64: python3.14-pip-25.2-3.el9_8.5.noarch.rpm python3.14-pip-wheel-25.2-3.el9_8.5.noarch.rpm aarch64: python3.14-pip-25.2-3.el9_8.5.noarch.rpm python3.14-pip-wheel-25.2-3.el9_8.5.noarch.rpm SRPMS: http://oss.oracle.com/ol9/SRPMS-updates/python3.14-pip-25.2-3.el9_8.5.src.rpm Related CVEs: CVE-2026-8643 Description of changes: [25.2-5] - Fix gating plan - removed unnecessary older VERSION= tests - removed bootstrap test - fix pip_install_upgrade to run pip-3.14 - fix bash completion + remove unused metadata file [25.2-4] - Security fix for CVE-2026-8643: path traversal in wheel entry points _______________________________________________ El-errata mailing list
Jul 08, 2026
•Important
Oracle
172
security advisorydenial of servicecriticalUbuntu 26.04 Python Critical Issues Denial of Service Update USN-8509-1
Several security issues were fixed in Python.. ========================================================================== Ubuntu Security Notice USN-8509-1 July 06, 2026 python3.10, python3.12, python3.14 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS Summary: Several security issues were fixed in Python. Software Description: - python3.14: An interactive high-level object-oriented language - python3.12: An interactive high-level object-oriented language - python3.10: An interactive high-level object-oriented language Details: It was discovered that Python incorrectly normalized paths in the tarfile module. An attacker could possibly use this issue to bypass path restrictions. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-13462) It was discovered that Python's HTMLParser incorrectly handled certain malformed HTML input. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-69534) It was discovered that Python's email module incorrectly quoted newlines in headers. An attacker could possibly use this issue to inject arbitrary email headers. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-1299) It was discovered that Python's http.client module did not properly sanitize carriage return and linefeed characters when handling HTTP CONNECT tunnel request headers. An attacker could possibly use this issue to inject arbitrary HTTP headers. (CVE-2026-1502) It was discovered that Python's importlib module did not generate an audit event when loading legacy .pyc files. An attacker could possibly use this issue to bypass auditing mechanisms. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-2297) It was discovered that Python'sunicodedata.normalize() function had incorrect algorithmic complexity. An attacker could possibly use this issue to cause Python to consume excessive resources, leading to a denial of service. (CVE-2026-3276) It was discovered that Python's http.cookies module incorrectly handled control characters in certain cookie operations. An attacker could possibly use this issue to inject arbitrary content. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-3644) It was discovered that the Python pyexpat module was vulnerable to unbounded recursion in the Expat XML parser. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4224) It was discovered that Python's webbrowser module accepted leading dashes in URLs, which could be interpreted as command-line options. An attacker could possibly use this issue to execute arbitrary commands. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4519) It was discovered that Python incorrectly handled webbrowser.open() handlers. An attacker could possibly use this issue to execute arbitrary commands. (CVE-2026-4786) It was discovered that Python's remote debugging module did not properly validate offset tables when loading debug information. An attacker could possibly use this issue to cause Python to crash or execute arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-5713) It was discovered that Python's http.cookies module incorrectly escaped values in the js_output() method. An attacker could possibly use this issue to inject arbitrary JavaScript. (CVE-2026-6019) It was discovered that Python's lzma, bz2, and gzip decompressor objects had a use-after-free vulnerability. An attacker could possibly use this issue to cause Python to crash or execute arbitrary code. (CVE-2026-6100) It was discovered that Python's tarfile module did not properly validate link targets when using the data filter.An attacker could possibly use this issue to bypass path restrictions. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-7774) It was discovered that the fix for CVE-2021-4189 in Python's ftplib module was incomplete, allowing PASV responses to be used in ftplib.ftpcp(). An attacker could possibly use this issue to perform server-side request forgery attacks. (CVE-2026-8328) It was discovered that Python's bz2 module allowed reuse of a BZ2Decompressor object after a decompression error. An attacker could possibly use this issue to cause Python to crash or execute arbitrary code. (CVE-2026-9669) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS libpython3.14 3.14.4-1ubuntu0.1 python3.14 3.14.4-1ubuntu0.1 Ubuntu 24.04 LTS libpython3.12t64 3.12.3-1ubuntu0.15 python3.12 3.12.3-1ubuntu0.15 Ubuntu 22.04 LTS libpython3.10 3.10.12-1~22.04.16 python3.10 3.10.12-1~22.04.16 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8509-1 CVE-2021-4189, CVE-2025-13462, CVE-2025-69534, CVE-2026-0672, CVE-2026-1299, CVE-2026-1502, CVE-2026-2297, CVE-2026-3276, CVE-2026-3644, CVE-2026-4224, CVE-2026-4519, CVE-2026-4786, CVE-2026-5713, CVE-2026-6019, CVE-2026-6100, CVE-2026-7774, CVE-2026-8328, CVE-2026-9669 Package Information: https://launchpad.net/ubuntu/+source/python3.14/3.14.4-1ubuntu0.1 https://launchpad.net/ubuntu/+source/python3.12/3.12.3-1ubuntu0.15 https://launchpad.net/ubuntu/+source/python3.10/3.10.12-1~22.04.16 . Several security issues in Python for Ubuntu have been fixed, including critical threats. Update to ensure security.. Python security issues, Ubuntu Python vulnerabilities, Denial of service, Critical security updates. . Severity: Critical. LinuxSecurity.com Team
Jul 06, 2026
•Critical
Ubuntu
219
security advisoryremote accessimportantRocky Linux 10 perl-Archive-Tar Vital Path Traversal Alert RLSA-2026-30857
Important: perl-Archive-Tar security update. {"type": "TYPE_SECURITY", "shortCode": "RL", "name": "RLSA-2026:30857", "synopsis": "Important: perl-Archive-Tar security update", "severity": "SEVERITY_IMPORTANT", "topic": "An update is available for perl-Archive-Tar.\nThis update affects Rocky Linux 10.\nA Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list", "description": "Archive::Tar provides an object oriented mechanism for handling tar files. It provides class methods for quick and easy files handling while also allowing for the creation of tar file objects for custom manipulation. If you have the IO::Zlib module installed, Archive::Tar will also support compressed or gzipped tar files.\n\nSecurity Fix(es):\n\n* perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access (CVE-2026-42496)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "solution": null, "affectedProducts": ["Rocky Linux 10"], "fixes": [{"ticket": "2481314", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2481314", "description": ""}], "cves": [{"name": "CVE-2026-42496", "sourceBy": "MITRE", "sourceLink": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42496", "cvss3ScoringVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "cvss3BaseScore": "8.2", "cwe": "CWE-22"}], "references": [], "publishedAt": "2026-07-05T12:05:09.130757Z", "rpms": {"Rocky Linux 10": {"nvras": ["perl-Archive-Tar-0:3.02-512.el10_2.1.noarch.rpm", "perl-Archive-Tar-0:3.02-512.el10_2.1.src.rpm"]}}, "rebootSuggested": false, "buildReferences": []}. Stay informed about the perl-Archive-Tar security update affecting Rocky Linux with important vulnerability details and fixes.. Rocky Linux Security, Archive Tar Update, Important Security Advisory. .Severity: Important. LinuxSecurity.com Team
Jul 05, 2026
•Important
Rocky Linux
172
security advisorydenial of servicecriticalUbuntu 26.04 Vim Critical Path Traversal Denial of Service USN-8500-1
Several security issues were fixed in Vim.. ========================================================================== Ubuntu Security Notice USN-8500-1 July 02, 2026 vim vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 25.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: Several security issues were fixed in Vim. Software Description: - vim: Vi IMproved - enhanced vi editor Details: It was discovered that Vim incorrectly handled path traversal in the zip.vim plugin. An attacker could possibly use this issue to overwrite arbitrary files. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2026-35177) It was discovered that Vim incorrectly handled depth tracking when processing spell files. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-55693, CVE-2026-55892) It was discovered that Vim incorrectly handled filename escaping in the netrw plugin. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-55895) It was discovered that Vim incorrectly handled length calculations when opening encrypted files. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-57452) Dhruv Vishesh Gupta discovered that Vim incorrectly handled quoting of archive entry names. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-57453) It was discovered that Vim incorrectly handled bounds checking when translating words through a byte map. Anattacker could possibly use this issue to cause a denial of service. (CVE-2026-57455) Chenyuan Mi discovered that Vim incorrectly handled docstring escaping during Python omni-completion. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-57456) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS vim 2:9.1.2141-1ubuntu4.6 vim-common 2:9.1.2141-1ubuntu4.6 vim-gtk3 2:9.1.2141-1ubuntu4.6 vim-gui-common 2:9.1.2141-1ubuntu4.6 vim-motif 2:9.1.2141-1ubuntu4.6 vim-nox 2:9.1.2141-1ubuntu4.6 vim-runtime 2:9.1.2141-1ubuntu4.6 vim-tiny 2:9.1.2141-1ubuntu4.6 xxd 2:9.1.2141-1ubuntu4.6 Ubuntu 25.10 vim 2:9.1.0967-1ubuntu6.8 vim-athena 2:9.1.0967-1ubuntu6.8 vim-common 2:9.1.0967-1ubuntu6.8 vim-gtk3 2:9.1.0967-1ubuntu6.8 vim-gui-common 2:9.1.0967-1ubuntu6.8 vim-motif 2:9.1.0967-1ubuntu6.8 vim-nox 2:9.1.0967-1ubuntu6.8 vim-runtime 2:9.1.0967-1ubuntu6.8 vim-tiny 2:9.1.0967-1ubuntu6.8 xxd 2:9.1.0967-1ubuntu6.8 Ubuntu 24.04 LTS vim 2:9.1.0016-1ubuntu7.17 vim-athena 2:9.1.0016-1ubuntu7.17 vim-common 2:9.1.0016-1ubuntu7.17 vim-gtk3 2:9.1.0016-1ubuntu7.17 vim-gui-common 2:9.1.0016-1ubuntu7.17 vim-motif 2:9.1.0016-1ubuntu7.17 vim-nox 2:9.1.0016-1ubuntu7.17 vim-runtime 2:9.1.0016-1ubuntu7.17 vim-tiny 2:9.1.0016-1ubuntu7.17 xxd 2:9.1.0016-1ubuntu7.17 Ubuntu 22.04 LTS vim 2:8.2.3995-1ubuntu2.33 vim-athena 2:8.2.3995-1ubuntu2.33 vim-common 2:8.2.3995-1ubuntu2.33 vim-gtk 2:8.2.3995-1ubuntu2.33 vim-gtk3 2:8.2.3995-1ubuntu2.33 vim-gui-common 2:8.2.3995-1ubuntu2.33 vim-nox 2:8.2.3995-1ubuntu2.33 vim-runtime 2:8.2.3995-1ubuntu2.33 vim-tiny 2:8.2.3995-1ubuntu2.33 xxd 2:8.2.3995-1ubuntu2.33 Ubuntu 20.04 LTS vim 2:8.1.2269-1ubuntu5.32+esm9 Available with Ubuntu Pro vim-athena 2:8.1.2269-1ubuntu5.32+esm9 Available with Ubuntu Pro vim-common 2:8.1.2269-1ubuntu5.32+esm9 Available with Ubuntu Pro vim-gtk 2:8.1.2269-1ubuntu5.32+esm9 Available with Ubuntu Pro vim-gtk3 2:8.1.2269-1ubuntu5.32+esm9 Available with Ubuntu Pro vim-gui-common 2:8.1.2269-1ubuntu5.32+esm9 Available with Ubuntu Pro vim-nox 2:8.1.2269-1ubuntu5.32+esm9 Available with Ubuntu Pro vim-runtime 2:8.1.2269-1ubuntu5.32+esm9 Available with Ubuntu Pro vim-tiny 2:8.1.2269-1ubuntu5.32+esm9 Available with Ubuntu Pro xxd 2:8.1.2269-1ubuntu5.32+esm9 Available with Ubuntu Pro Ubuntu 18.04 LTS vim 2:8.0.1453-1ubuntu1.13+esm21 Available with Ubuntu Pro vim-athena 2:8.0.1453-1ubuntu1.13+esm21 Available with Ubuntu Pro vim-common 2:8.0.1453-1ubuntu1.13+esm21 Available with Ubuntu Pro vim-gnome 2:8.0.1453-1ubuntu1.13+esm21 Available with Ubuntu Pro vim-gtk 2:8.0.1453-1ubuntu1.13+esm21 Available with Ubuntu Pro vim-gtk3 2:8.0.1453-1ubuntu1.13+esm21 Available with Ubuntu Pro vim-gui-common 2:8.0.1453-1ubuntu1.13+esm21 Available with Ubuntu Pro vim-nox 2:8.0.1453-1ubuntu1.13+esm21 Available with Ubuntu Pro vim-runtime 2:8.0.1453-1ubuntu1.13+esm21 Available with Ubuntu Pro vim-tiny 2:8.0.1453-1ubuntu1.13+esm21 Available with Ubuntu Pro xxd 2:8.0.1453-1ubuntu1.13+esm21 Available with Ubuntu Pro Ubuntu 16.04 LTS vim 2:7.4.1689-3ubuntu1.5+esm36 Available with Ubuntu Pro vim-athena 2:7.4.1689-3ubuntu1.5+esm36 Available with Ubuntu Pro vim-athena-py2 2:7.4.1689-3ubuntu1.5+esm36 Available with Ubuntu Pro vim-common 2:7.4.1689-3ubuntu1.5+esm36 Available with Ubuntu Pro vim-gnome 2:7.4.1689-3ubuntu1.5+esm36 Available with Ubuntu Pro vim-gnome-py2 2:7.4.1689-3ubuntu1.5+esm36 Available with Ubuntu Pro vim-gtk 2:7.4.1689-3ubuntu1.5+esm36 Available with Ubuntu Pro vim-gtk-py2 2:7.4.1689-3ubuntu1.5+esm36 Available with Ubuntu Pro vim-gtk3 2:7.4.1689-3ubuntu1.5+esm36 Available with Ubuntu Pro vim-gtk3-py2 2:7.4.1689-3ubuntu1.5+esm36 Available with Ubuntu Pro vim-gui-common 2:7.4.1689-3ubuntu1.5+esm36 Available with Ubuntu Pro vim-nox 2:7.4.1689-3ubuntu1.5+esm36 Available with Ubuntu Pro vim-nox-py2 2:7.4.1689-3ubuntu1.5+esm36 Available with Ubuntu Pro vim-runtime 2:7.4.1689-3ubuntu1.5+esm36 Available with Ubuntu Pro vim-tiny 2:7.4.1689-3ubuntu1.5+esm36 Available with Ubuntu Pro Ubuntu 14.04 LTS vim 2:7.4.052-1ubuntu3.1+esm30 Available with Ubuntu Pro vim-athena 2:7.4.052-1ubuntu3.1+esm30 Available with Ubuntu Pro vim-common 2:7.4.052-1ubuntu3.1+esm30 Available with Ubuntu Pro vim-gnome 2:7.4.052-1ubuntu3.1+esm30 Available with Ubuntu Pro vim-gtk 2:7.4.052-1ubuntu3.1+esm30 Available with Ubuntu Pro vim-gui-common 2:7.4.052-1ubuntu3.1+esm30 Available with Ubuntu Pro vim-lesstif 2:7.4.052-1ubuntu3.1+esm30 Available with Ubuntu Pro vim-nox 2:7.4.052-1ubuntu3.1+esm30 Available with Ubuntu Pro vim-runtime 2:7.4.052-1ubuntu3.1+esm30 Available with Ubuntu Pro vim-tiny 2:7.4.052-1ubuntu3.1+esm30 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8500-1 CVE-2026-35177, CVE-2026-55693, CVE-2026-55892, CVE-2026-55895, CVE-2026-57452, CVE-2026-57453, CVE-2026-57455, CVE-2026-57456 Package Information: https://launchpad.net/ubuntu/+source/vim/2:9.1.2141-1ubuntu4.6 https://launchpad.net/ubuntu/+source/vim/2:9.1.0967-1ubuntu6.8 https://launchpad.net/ubuntu/+source/vim/2:9.1.0016-1ubuntu7.17 https://launchpad.net/ubuntu/+source/vim/2:8.2.3995-1ubuntu2.33 . Multiple security issues fixed in Vim affect various Ubuntu LTS releases, critical updates recommended for users.. Vim security update, Ubuntu vulnerabilities, security patch, system risks. . Severity: Critical. LinuxSecurity.com Team
Jul 02, 2026
•Critical
Ubuntu
100
security advisorySuSEimportantSUSE Python-pip Important Path Traversal Issue 2026-22300-1
An update that solves one vulnerability can now be installed.. # Security update for python-pip Announcement ID: SUSE-SU-2026:22300-1 Release Date: 2026-06-20T18:17:57Z Rating: important References: * bsc#1266669 Cross-References: * CVE-2026-8643 CVSS scores: * CVE-2026-8643 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H * CVE-2026-8643 ( NVD ): 4.1 CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-8643 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N * CVE-2026-8643 ( NVD ): 8.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Affected Products: * SUSE Linux Enterprise Server 16.0 * SUSE Linux Enterprise Server for SAP applications 16.0 An update that solves one vulnerability can now be installed. ## Description: This update for python-pip fixes the following issue * CVE-2026-8643: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite (bsc#1266669). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server 16.0 zypper in -t patch SUSE-SLES-16.0-1005=1 * SUSE Linux Enterprise Server for SAP applications 16.0 zypper in -t patch SUSE-SLES-16.0-1005=1 ## Package List: * SUSE Linux Enterprise Server for SAP applications 16.0 (noarch) * python313-pip-25.0.1-160000.5.1 * python313-pip-wheel-25.0.1-160000.5.1 * SUSE Linux Enterprise Server 16.0 (noarch) * python313-pip-25.0.1-160000.5.1 * python313-pip-wheel-25.0.1-160000.5.1 ## References: * https://www.suse.com/security/cve/CVE-2026-8643.html * https://bugzilla.suse.com/show_bug.cgi?id=1266669 . Update addresses an important security risk in python-pip affecting SUSE 16.0 relatedto file overwrite.. SUSE python-pip security update, SUSE 16.0 important advisory, python-pip vulnerability fix. . Severity: Important. LinuxSecurity.com Team
Jul 01, 2026
•Important
SuSE
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Is continuous patching actually viable?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!