Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 507
Alerts This Week
Warning Icon 1 507

Stay Secure with the Latest Linux Advisories

Filter%20icon Refine advisories
X Clear Filters
X Clear Filters
View More

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":1,"type":"x","order":4,"pct":100,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Loading...

Explore Latest Linux Security advisories

We found 2 articles for you...
197

Debian 10 Buster: DLA-3750-1 php-phpseclib DoS Issues Details

Security issues were discovered in php-phpseclib, a PHP library for arbitrary-precision integer arithmetic, which could lead to Denial of Service. . ------------------------------------------------------------------------- Debian LTS Advisory DLA-3750-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/lts/security/ Guilhem Moulin March 05, 2024 https://wiki.debian.org/LTS ------------------------------------------------------------------------- Package : php-phpseclib Version : 2.0.30-2~deb10u3 CVE ID : CVE-2024-27354 CVE-2024-27355 Security issues were discovered in php-phpseclib, a PHP library for arbitrary-precision integer arithmetic, which could lead to Denial of Service. CVE-2024-27354 An attacker can construct a malformed certificate containing an extremely large prime to cause a denial of service (CPU consumption for an `isPrime` primality check). This issue was introduced when attempting to fix CVE-2023-27560. CVE-2024-27355 When processing the ASN.1 object identifier of a certificate, a sub identifier may be provided that leads to a denial of service (CPU consumption for `decodeOID`). For Debian 10 buster, these problems have been fixed in version 2.0.30-2~deb10u3. We recommend that you upgrade your php-phpseclib packages. For the detailed security status of php-phpseclib please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/php-phpseclib Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Update to the newest version of php-phpseclib to mitigate Denial of Service vulnerabilities as detailed in Debian LTS DLA-3750-2.. php library, security update, debian lts. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Mar 05, 2024 Critical Debian LTS
197

Debian 10 buster DLA-3718-1: Critical php-phpseclib Terrapin Attack Fix

It was discovered that php-phpseclib, a PHP library for arbitrary-precision integer arithmetic, was vulnerable to the so-called Terrapin Attack. . ------------------------------------------------------------------------- Debian LTS Advisory DLA-3718-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/lts/security/ Guilhem Moulin January 25, 2024 https://wiki.debian.org/LTS ------------------------------------------------------------------------- Package : php-phpseclib Version : 2.0.30-2~deb10u2 CVE ID : CVE-2023-48795 It was discovered that php-phpseclib, a PHP library for arbitrary-precision integer arithmetic, was vulnerable to the so-called Terrapin Attack. The SSH transport protocol with certain OpenSSH extensions, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). For Debian 10 buster, this problem has been fixed in version 2.0.30-2~deb10u2. We recommend that you upgrade your php-phpseclib packages. For the detailed security status of php-phpseclib please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/php-phpseclib Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Critical fix for the php-phpseclib vulnerability to the Terrapin Attack on Debian 10, enhancing SSH security effectively.. php-phpseclib, security advisory, Debian,Terrapin Attack, SSH security. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Jan 25, 2024 Critical Debian LTS
89

Fedora 30 php-robrichards-xmlseclibs1 Vulnerability: Signed Info Flaw

## 1.4.3 (12, Nov 2019) ### Security Improvements: - Insure only a single SignedInfo element exists within a signature during verification. Refs [CVE-2019-3465](https://nvd.nist.gov/vuln/detail/CVE-2019-3465).. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-1b95d7a131 2020-04-13 16:45:10.937085 --------------------------------------------------------------------------------Name : php-robrichards-xmlseclibs1 Product : Fedora 30 Version : 1.4.3 Release : 1.fc30 URL : https://github.com/robrichards/xmlseclibs Summary : A PHP library for XML Security (version 1) Description : xmlseclibs is a library written in PHP for working with XML Encryption and Signatures. NOTE: php-mcrypt will not be automatically installed as a dependency of this package so it will need to be "manually" installed if it is required --specifically for the following XMLSecurityKey encryption types: - XMLSecurityKey::AES128_CBC - XMLSecurityKey::AES192_CBC - XMLSecurityKey::AES256_CBC - XMLSecurityKey::TRIPLEDES_CBC Autoloader: /usr/share/php/robrichards-xmlseclibs/autoload.php --------------------------------------------------------------------------------Update Information: ## 1.4.3 (12, Nov 2019) ### Security Improvements: - Insure only a single SignedInfo element exists within a signature during verification. Refs [CVE-2019-3465](https://nvd.nist.gov/vuln/detail/CVE-2019-3465). --------------------------------------------------------------------------------ChangeLog: * Sun Apr 5 2020 Shawn Iwinski - 1.4.3-1 - Update to 1.4.3 (RHBZ #1771533, CVE-2019-3465) - https://nvd.nist.gov/vuln/detail/CVE-2019-3465 * Thu Jan 30 2020 Fedora Release Engineering - 1.4.2-9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild * Fri Jul 26 2019 Fedora Release Engineering - 1.4.2-8 - Rebuilt forhttps://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild --------------------------------------------------------------------------------References: [ 1 ] Bug #1771533 - php-robrichards-xmlseclibs1-1.4.3 is available https://bugzilla.redhat.com/show_bug.cgi?id=1771533 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-1b95d7a131' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ . Fedora Update Announcement for php-robrichards-xmlseclibs1 outlines enhancements for security and the procedure for applying updates.. php library, xml security, Fedora update, security advisory, signed info. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Apr 13, 2020 Important Fedora
89

Fedora 29 CVE-2019-3465: php-robrichards-xmlseclibs Security Fix

## 2.1.1 CVE-2019-3465 / https://simplesamlphp.org/security/201911-01 ## 2.1.0 Backports changes from 3.0 branch. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2019-81f61cdceb 2019-11-15 03:20:21.101981 --------------------------------------------------------------------------------Name : php-robrichards-xmlseclibs Product : Fedora 29 Version : 2.1.1 Release : 1.fc29 URL : https://github.com/robrichards/xmlseclibs Summary : A PHP library for XML Security Description : xmlseclibs is a library written in PHP for working with XML Encryption and Signatures. NOTE: php-mcrypt will not be automatically installed as a dependency of this package so it will need to be "manually" installed if it is required --specifically for the following XMLSecurityKey encryption types: - XMLSecurityKey::AES128_CBC - XMLSecurityKey::AES192_CBC - XMLSecurityKey::AES256_CBC - XMLSecurityKey::TRIPLEDES_CBC Autoloader: /usr/share/php/RobRichards/XMLSecLibs/autoload.php --------------------------------------------------------------------------------Update Information: ## 2.1.1 CVE-2019-3465 / https://simplesamlphp.org/security/201911-01 ## 2.1.0 Backports changes from 3.0 branch --------------------------------------------------------------------------------ChangeLog: * Wed Nov 6 2019 Shawn Iwinski - 2.1.1-1 - Update to 2.1.1 (CVE-2019-3465) - https://simplesamlphp.org/security/201911-01 * Fri Jul 26 2019 Fedora Release Engineering - 2.0.1-9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild * Sat Feb 2 2019 Fedora Release Engineering - 2.0.1-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2019-81f61cdceb' at the command line. For more information, refer to the dnfdocumentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ . Fedora 29's php-robrichards-xmlseclibs package has a vulnerability (CVE-2019-3465) due to improper XML signature validation. Upgrade to 3.0.3 or later. Fedora Updates, XML Security, php-robrichards, CVE Fixes. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Nov 14, 2019 Important Fedora
89

Fedora 31 php-robrichards-xmlseclibs3 Moderate: Addressing CVE-2019-3465

## 3.0.4 CVE-2019-3465 / https://simplesamlphp.org/security/201911-01. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2019-9a960c8a98 2019-11-15 03:00:50.375473 --------------------------------------------------------------------------------Name : php-robrichards-xmlseclibs3 Product : Fedora 31 Version : 3.0.4 Release : 1.fc31 URL : https://github.com/robrichards/xmlseclibs Summary : A PHP library for XML Security (version 3) Description : xmlseclibs is a library written in PHP for working with XML Encryption and Signatures. Autoloader: /usr/share/php/RobRichards/XMLSecLibs3/autoload.php --------------------------------------------------------------------------------Update Information: ## 3.0.4 CVE-2019-3465 / https://simplesamlphp.org/security/201911-01 --------------------------------------------------------------------------------ChangeLog: * Wed Nov 6 2019 Shawn Iwinski - 3.0.4-1 - Update to 3.0.4 (RHBZ #1769353 / CVE-2019-3465) - https://simplesamlphp.org/security/201911-01 --------------------------------------------------------------------------------References: [ 1 ] Bug #1769353 - php-robrichards-xmlseclibs3-3.0.4 is available https://bugzilla.redhat.com/show_bug.cgi?id=1769353 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2019-9a960c8a98' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribesend an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ . Essential patch for php-robrichards-xmlseclibs3 on Fedora mitigating CVE-2019-3465 security flaws.. fedora update, php xmlseclibs, security advisory, xml security. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Nov 14, 2019 Important Fedora
87

Ubuntu 16.04: USN-3468-1 Important PHPMailer Security Flaw

Dawid Golunski discovered that PHPMailer, a popular library to send email from PHP applications, allowed a remote attacker to execute code if they were able to provide a crafted Sender address. . - ------------------------------------------------------------------------- Debian Security Advisory DSA-3750-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/security/ Thijs Kinkhorst December 31, 2016 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : libphp-phpmailer CVE ID : CVE-2016-10033 Debian Bug : 849365 Dawid Golunski discovered that PHPMailer, a popular library to send email from PHP applications, allowed a remote attacker to execute code if they were able to provide a crafted Sender address. Note that for this issue also CVE-2016-10045 was assigned, which is a regression in the original patch proposed for CVE-2016-10033. Because the origial patch was not applied in Debian, Debian was not vulnerable to CVE-2016-10045. For the stable distribution (jessie), this problem has been fixed in version 5.2.9+dfsg-2+deb8u2. For the unstable distribution (sid), this problem has been fixed in version 5.2.14+dfsg-2.1. We recommend that you upgrade your libphp-phpmailer packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . Debian Security Notice DSA-3751-2: vital OpenSSL patch resolves critical buffer overflow issue. Update immediately. libphp-phpmailer, remote code execution, debian security advisory. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Dec 31, 2016 Important Debian
89

Fedora 23: PHP Simplesamlphp Saml2_1 Moderate: Signature Issue Fix

### v1.10.3 / v2.3.3 - This is a security release fixing an issue with signature validation. Please upgrade as soon as possible. - [201612-01](https://simplesamlphp.org/security/201612-01). -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2016-5c32bae671 2016-12-12 20:33:39.179894 -------------------------------------------------------------------------------- Name : php-simplesamlphp-saml2_1 Product : Fedora 23 Version : 1.10.3 Release : 1.fc23 URL : https://github.com/simplesamlphp/saml2 Summary : SAML2 PHP library from SimpleSAMLphp (version 1) Description : A PHP library for SAML2 related functionality. Extracted from SimpleSAMLphp [1], used by OpenConext [2]. This library started as a collaboration between UNINETT [3] and SURFnet [4] but everyone is invited to contribute. Autoloader: /usr/share/php/SAML2_1/autoload.php [1] https://simplesamlphp.org/ [2] https://openconext.org/ [3] https://sikt.no/ [4] https://www.surf.nl -------------------------------------------------------------------------------- Update Information: ### v1.10.3 / v2.3.3 - This is a security release fixing an issue with signature validation. Please upgrade as soon as possible. - [201612-01](https://simplesamlphp.org/security/201612-01) -------------------------------------------------------------------------------- References: [ 1 ] Bug #1401147 - php-simplesamlphp-saml2-2.3.3 is available https://bugzilla.redhat.com/show_bug.cgi?id=1401147 [ 2 ] Bug #1401148 - php-simplesamlphp-saml2_1-1.10.3 is available https://bugzilla.redhat.com/show_bug.cgi?id=1401148 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade php-simplesamlphp-saml2_1' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signedwith the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. . Critical patch issued for php-simplesamlphp-saml2_1 addressing vulnerabilities in signature verification. Immediate update recommended.. php Simplesamlphp Update, Linux Security Patch, Package Update. . LinuxSecurity.com Team

Calendar%202 Dec 13, 2016 Fedora
89

Fedora 23: php-simplesamlphp-saml2 Security Update Critical: Signature Fix

### v1.10.3 / v2.3.3 - This is a security release fixing an issue with signature validation. Please upgrade as soon as possible. - [201612-01](https://simplesamlphp.org/security/201612-01). -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2016-5c32bae671 2016-12-12 20:33:39.179894 -------------------------------------------------------------------------------- Name : php-simplesamlphp-saml2 Product : Fedora 23 Version : 2.3.3 Release : 1.fc23 URL : https://github.com/simplesamlphp/saml2 Summary : SAML2 PHP library from SimpleSAMLphp Description : A PHP library for SAML2 related functionality. Extracted from SimpleSAMLphp [1], used by OpenConext [2]. This library started as a collaboration between UNINETT [3] and SURFnet [4] but everyone is invited to contribute. Autoloader: /usr/share/php/SAML2/autoload.php [1] https://simplesamlphp.org/ [2] https://openconext.org/ [3] https://sikt.no/ [4] https://www.surf.nl -------------------------------------------------------------------------------- Update Information: ### v1.10.3 / v2.3.3 - This is a security release fixing an issue with signature validation. Please upgrade as soon as possible. - [201612-01](https://simplesamlphp.org/security/201612-01) -------------------------------------------------------------------------------- References: [ 1 ] Bug #1401147 - php-simplesamlphp-saml2-2.3.3 is available https://bugzilla.redhat.com/show_bug.cgi?id=1401147 [ 2 ] Bug #1401148 - php-simplesamlphp-saml2_1-1.10.3 is available https://bugzilla.redhat.com/show_bug.cgi?id=1401148 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade php-simplesamlphp-saml2' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the FedoraProject GPG key. More details on the GPG keys used by the Fedora Project can be found at -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. . Important patch released for php-simplesamlphp-saml2 in Fedora 23. Prompt upgrade advised to address signature verification issue.. Fedora Security Update, PHP SAML Library, Signature Validation Fix. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Dec 13, 2016 Critical Fedora
News Add Esm H240

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":1,"type":"x","order":4,"pct":100,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200