Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found -4 articles for you...
203
security advisorycriticalMageiaMageia: 2023-0077 Critical: pkgconf Unbounded String Issue
In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes. (CVE-2023-24056) . MGASA-2023-0077 - Updated pkgconf packages fix security vulnerability Publication date: 01 Mar 2023 URL: https://advisories.mageia.org/MGASA-2023-0077.html Type: security Affected Mageia releases: 8 CVE: CVE-2023-24056 In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes. (CVE-2023-24056) References: - https://bugs.mageia.org/show_bug.cgi?id=31536 - - https://www.cve.org/CVERecord?id=CVE-2023-24056 SRPMS: - 8/core/pkgconf-1.7.3-2.1.mga8 . Mageia releases an update for pkgconf to address a severe security vulnerability related to unchecked string expansion in all versions prior to 1.9.3.. pkgconf security, Mageia advisory, unbounded expansion, software update. . Severity: Critical. LinuxSecurity.com Team
Mar 01, 2023
•Critical
Mageia
202
security advisorysecurity updatevulnerabilityopenSUSE Backports SLE-15-SP3: 2023-0043-1 Moderate: pkgconf String Issue
An update that fixes one vulnerability is now available. . openSUSE Security Update: Security update for pkgconf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2023:0043-1 Rating: moderate References: #1207394 Cross-References: CVE-2023-24056 CVSS scores: CVE-2023-24056 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2023-24056 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for pkgconf fixes the following issues: - CVE-2023-24056: FIxed variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c (boo#1207394). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2023-43=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): libpkgconf-devel-1.5.3-bp153.2.3.1 libpkgconf3-1.5.3-bp153.2.3.1 pkgconf-1.5.3-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2023-24056.html https://bugzilla.suse.com/1207394 . The recent update for pkgconf on openSUSE addresses a notable vulnerability in string manipulation. Ensure your system remains safe by applying this crucial patch.. openSUSE Security, pkgconf Update, openSUSE Patch, string Expansion Fix. . LinuxSecurity.com Team
Feb 09, 2023
OpenSUSE
89
security advisorycriticalsoftware updateFedora 25: 2017-ea57ed609f Critical: Pkgconf Crash and Logic Fix
# Security fixes - fix crash in edge case where a .pc file has misquoting in a fragment list. # Other bug fixes: - fix logic edge case when comparing relocated paths. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2017-ea57ed609f 2017-09-30 05:49:53.929992 --------------------------------------------------------------------------------Name : pkgconf Product : Fedora 25 Version : 1.3.9 Release : 1.fc25 URL : http://pkgconf.org/ Summary : Package compiler and linker metadata toolkit Description : pkgconf is a program which helps to configure compiler and linker flags for development frameworks. It is similar to pkg-config from freedesktop.org and handles .pc files in a similar manner as pkg-config. --------------------------------------------------------------------------------Update Information: # Security fixes - fix crash in edge case where a .pc file has misquoting in a fragment list. # Other bug fixes: - fix logic edge case when comparing relocated paths --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade pkgconf' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Sep 30, 2017
•Critical
Fedora
89
security advisoryupdateFedoraFedora 27 pkgconf Security Advisory: Fix for Edge Case Crash
# Security fixes - fix crash in edge case where a .pc file has misquoting in a fragment list. # Other bug fixes: - fix logic edge case when comparing relocated paths. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2017-09ac7afad7 2017-09-30 05:57:53.274394 --------------------------------------------------------------------------------Name : pkgconf Product : Fedora 27 Version : 1.3.9 Release : 1.fc27 URL : http://pkgconf.org/ Summary : Package compiler and linker metadata toolkit Description : pkgconf is a program which helps to configure compiler and linker flags for development frameworks. It is similar to pkg-config from freedesktop.org and handles .pc files in a similar manner as pkg-config. --------------------------------------------------------------------------------Update Information: # Security fixes - fix crash in edge case where a .pc file has misquoting in a fragment list. # Other bug fixes: - fix logic edge case when comparing relocated paths --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade pkgconf' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Sep 30, 2017
•Important
Fedora
89
security advisoryFedorabug fixFedora 26 pkgconf Security Advisory: Crash Fix and Logic Updates
# Security fixes - fix crash in edge case where a .pc file has misquoting in a fragment list. # Other bug fixes: - fix logic edge case when comparing relocated paths. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2017-11afc3cde9 2017-09-24 22:32:16.648154 --------------------------------------------------------------------------------Name : pkgconf Product : Fedora 26 Version : 1.3.9 Release : 1.fc26 URL : http://pkgconf.org/ Summary : Package compiler and linker metadata toolkit Description : pkgconf is a program which helps to configure compiler and linker flags for development frameworks. It is similar to pkg-config from freedesktop.org and handles .pc files in a similar manner as pkg-config. --------------------------------------------------------------------------------Update Information: # Security fixes - fix crash in edge case where a .pc file has misquoting in a fragment list. # Other bug fixes: - fix logic edge case when comparing relocated paths --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade pkgconf' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Sep 25, 2017
•Important
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!