Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -6 articles for you...
202
security advisorysecurity fiximportantopenSUSE 12.3: Important Acroread Update for Critical Exploits
An update that contains security fixes can now be installed.. openSUSE Security Update: acroread: not supported anymore ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0006-1 Rating: important References: #843835 Affected Products: openSUSE 12.3:NonFree openSUSE 12.2:NonFree ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: Adobe discontinued the Adobe Reader 9 for Linux in June 2013 and has not fixed and will not fix any further security issues in it. As there is no new version, it is officially out of support. The SUSE Security Team strongly recommends to not use it anymore. Installing this update will deinstall the plugin package to avoid automatic exploitation via PDF embedded in webpages or emails. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3:NonFree: zypper in -t patch openSUSE-2014-12 - openSUSE 12.2:NonFree: zypper in -t patch openSUSE-2014-12 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3:NonFree (noarch): acroread-cmaps-9.4.1-8.1 acroread-fonts-ja-9.4.1-8.1 acroread-fonts-ko-9.4.1-8.1 acroread-fonts-zh_CN-9.4.1-8.1 acroread-fonts-zh_TW-9.4.1-8.1 - openSUSE 12.3:NonFree (i586): acroread-9.5.5-8.1 - openSUSE 12.2:NonFree (noarch): acroread-cmaps-9.4.1-3.16.1 acroread-fonts-ja-9.4.1-3.16.1 acroread-fonts-ko-9.4.1-3.16.1 acroread-fonts-zh_CN-9.4.1-3.16.1 acroread-fonts-zh_TW-9.4.1-3.16.1 - openSUSE 12.2:NonFree (i586): acroread-9.5.5-3.16.1 References: -- . Important security upgrade for openSUSE targeting acroread weaknesses and end ofassistance.. openSUSE Acroread Update, Security Fixes, PDF Exploitation. . Severity: Important. LinuxSecurity.com Team
Jan 03, 2014
•Important
OpenSUSE
91
security advisorygentooremote executionGentoo: GLSA 200907-06 Normal: Adobe Reader Remote Execution Issue
Adobe Reader is vulnerable to remote code execution via crafted PDF files.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200907-06 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Adobe Reader: User-assisted execution of arbitrary code Date: July 12, 2009 Bugs: #267846, #273908 ID: 200907-06 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Adobe Reader is vulnerable to remote code execution via crafted PDF files. Background ========= Adobe Reader is a PDF reader released by Adobe. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-text/acroread < 8.1.6 > = 8.1.6 Description ========== Multiple vulnerabilities have been reported in Adobe Reader: * Alin Rad Pop of Secunia Research reported a heap-based buffer overflow in the JBIG2 filter (CVE-2009-0198). * Mark Dowd of the IBM Internet Security Systems X-Force and Nicolas Joly of VUPEN Security reported multiple heap-based buffer overflows in the JBIG2 filter (CVE-2009-0509, CVE-2009-0510, CVE-2009-0511, CVE-2009-0512, CVE-2009-0888, CVE-2009-0889) * Arr1val reported that multiple methods in the JavaScript API might lead to memory corruption when called with crafted arguments (CVE-2009-1492, CVE-2009-1493). * An anonymous researcher reported a stack-based buffer overflow related to U3D model files with a crafted extension block (CVE-2009-1855). * Jun Mao and Ryan Smith of iDefense Labs reported an integer overflow related to the FlateDecode filter, whichtriggers a heap-based buffer overflow (CVE-2009-1856). * Haifei Li of Fortinet's FortiGuard Global Security Research Team reported a memory corruption vulnerability related to TrueType fonts (CVE-2009-1857). * The Apple Product Security Team reported a memory corruption vulnerability in the JBIG2 filter (CVE-2009-1858). * Matthew Watchinski of Sourcefire VRT reported an unspecified memory corruption (CVE-2009-1859). * Will Dormann of CERT reported multiple heap-based buffer overflows when processing JPX (aka JPEG2000) stream that trigger heap memory corruption (CVE-2009-1861). * Multiple unspecified vulnerabilities have been discovered (CVE-2009-2028). Impact ===== A remote attacker could entice a user to open a specially crafted document, possibly resulting in the execution of arbitrary code with the privileges of the user running the application. Workaround ========= There is no known workaround at this time. Resolution ========= All Adobe Reader users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =app-text/acroread-8.1.6" References ========= [ 1 ] CVE-2009-0198 https://www.cve.org/CVERecord?id=CVE-2009-0198 [ 2 ] CVE-2009-0509 https://www.cve.org/CVERecord?id=CVE-2009-0509 [ 3 ] CVE-2009-0510 https://www.cve.org/CVERecord?id=CVE-2009-0510 [ 4 ] CVE-2009-0511 https://www.cve.org/CVERecord?id=CVE-2009-0511 [ 5 ] CVE-2009-0512 https://www.cve.org/CVERecord?id=CVE-2009-0512 [ 6 ] CVE-2009-0888 https://www.cve.org/CVERecord?id=CVE-2009-0888 [ 7 ] CVE-2009-0889 https://www.cve.org/CVERecord?id=CVE-2009-0889 [ 8 ] CVE-2009-1492 https://www.cve.org/CVERecord?id=CVE-2009-1492 [ 9 ] CVE-2009-1493 https://www.cve.org/CVERecord?id=CVE-2009-1493 [ 10 ] CVE-2009-1855 https://www.cve.org/CVERecord?id=CVE-2009-1855 [ 11 ] CVE-2009-1856 https://www.cve.org/CVERecord?id=CVE-2009-1856 [ 12 ] CVE-2009-1857 https://www.cve.org/CVERecord?id=CVE-2009-1857 [ 13 ] CVE-2009-1858 https://www.cve.org/CVERecord?id=CVE-2009-1858 [ 14 ] CVE-2009-1859 https://www.cve.org/CVERecord?id=CVE-2009-1859 [ 15 ] CVE-2009-1861 https://www.cve.org/CVERecord?id=CVE-2009-1861 [ 16 ] CVE-2009-2028 https://www.cve.org/CVERecord?id=CVE-2009-2028 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200907-06 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Jul 12, 2009
Gentoo
91
security advisoryarbitrary code executionremote threatGentoo Linux: 200306-11 Critical: xpdf Remote Code Execution Threat
Valid PDF files can contain malicious external-type hyperlinks that can execute arbitrary shell commands underneath Unix with various PDF viewers/readers.. - - - --------------------------------------------------------------------- GENTOO LINUX SECURITY ANNOUNCEMENT 200306-11 - - - --------------------------------------------------------------------- PACKAGE : xpdf SUMMARY : arbitrary code execution DATE : 2003-06-25 21:48 UTC EXPLOIT : remote VERSIONS AFFECTED : =xpdf-2.02.1 CVE : CAN-2003-0434 - - - --------------------------------------------------------------------- from advisory: "Valid PDF files can contain malicious external-type hyperlinks that can execute arbitrary shell commands underneath Unix with various PDF viewers/readers. The hyperlinks must be activated or followed for the malicious script to run. The obvious case is for a user to click on one. " Read the full advisory at http://marc.theaimsgroup.com/?l=full-disclosure&m=105555332025253&w=2 SOLUTION It is recommended that all Gentoo Linux users who are running app-text/xpdf upgrade to xpdf-2.02.1 as follows emerge sync emerge xpdf emerge clean - - - ---------------------------------------------------------------------
Jun 27, 2003
•Critical
Gentoo
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!