Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -4 articles for you...
172
security advisorycriticalremote accessUbuntu 16.04 LTS USN-4702-1 Critical: Pound Information Disclosure
Several security issues were fixed in pound.. =========================================================================Ubuntu Security Notice USN-4702-1 January 25, 2021 pound vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS Summary: Several security issues were fixed in pound. Software Description: - pound: reverse proxy, load balancer and HTTPS front-end for Web servers Details: It was discovered that Pound incorrectly handled certain HTTP requests A remote attacker could use it to retrieve some sensitive information. (CVE-2016-10711, CVE-2018-21245) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS: pound 2.6-6.1ubuntu0.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-4702-1 CVE-2016-10711, CVE-2018-21245 Package Information: https://launchpad.net/ubuntu/+source/pound/2.6-6.1ubuntu0.1 . Mitigation strategies for vulnerabilities in the pound server affecting Ubuntu 16.04 LTS, focusing on reducing risks associated with unauthorized remote access.. Pound Reverse Proxy, Ubuntu Security Updates, HTTP Security Risks. . Severity: Critical. LinuxSecurity.com Team
Jan 25, 2021
•Critical
Ubuntu
197
security advisorydebianload balancerDebian 8: DLA-2196-2 Moderate: Pound CPU Regression Update
A regression has been found in the patch for CVE-2016-10711 of pound, a reverse proxy, load balancer and HTTPS front-end for Web servers. Without the fix pound can be tricked to use 100% CPU. . Package : pound Version : 2.6-6+deb8u3 CVE ID : CVE-2016-10711 A regression has been found in the patch for CVE-2016-10711 of pound, a reverse proxy, load balancer and HTTPS front-end for Web servers. Without the fix pound can be tricked to use 100% CPU. For Debian 8 "Jessie", this problem has been fixed in version 2.6-6+deb8u3. We recommend that you upgrade your pound packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . A flaw in the update for pound impacts processing speed. Update your software to avoid potential complications.. Pound Update, Debian Security, CPU Regression Fix. . LinuxSecurity.com Team
May 03, 2020
Debian LTS
197
security advisoryXSSDebianDebian 8: DLA-2196-1 Moderate: Pound Request Smuggling Threat
An issue has been found in pound, A request smuggling vulnerability was discovered in pound, a everse proxy, load balancer and HTTPS front-end for Web servers, that may allow . Package : pound Version : 2.6-6+deb8u2 CVE ID : CVE-2016-10711 An issue has been found in pound, A request smuggling vulnerability was discovered in pound, a everse proxy, load balancer and HTTPS front-end for Web servers, that may allow attackers to send a specially crafted http request to a web server or reverse proxy while pound may see a different set of requests. This facilitates several possible exploitations, such as partial cache poisoning, bypassing firewall protection and XSS. For Debian 8 "Jessie", this problem has been fixed in version 2.6-6+deb8u2. We recommend that you upgrade your pound packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . A serious security vulnerability in the Pound web server affects Debian LTS users, risking unauthorized access and data leakage through request smuggling. Debian LTS, pound security, request smuggling, exploit mitigation, web server security. . LinuxSecurity.com Team
Apr 30, 2020
Debian LTS
87
security advisorybuffer overflowcriticalDebian: DSA 934-1 Critical: Remote Code Execution in Pound
Two vulnerabilities have been discovered in Pound, a reverse proxy and load balancer for HTTP. The Common Vulnerabilities and Exposures project identifies the following problems:. - --------------------------------------------------------------------------Debian Security Advisory DSA 934-1
Jan 27, 2006
•Critical
Debian
91
security advisorysecurity issuegentooGentoo: GLSA 200504-29 High: Pound Buffer Overflow Risk of Remote Execution
Pound is vulnerable to a buffer overflow that could lead to the remote execution of arbitrary code.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200504-29 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: Pound: Buffer overflow vulnerability Date: April 30, 2005 Bugs: #90851 ID: 200504-29 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Pound is vulnerable to a buffer overflow that could lead to the remote execution of arbitrary code. Background ========= Pound is a reverse proxy, load balancer and HTTPS front-end. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 www-servers/pound < 1.8.3 > = 1.8.3 Description ========== Steven Van Acker has discovered a buffer overflow vulnerability in the "add_port()" function in Pound. Impact ===== A remote attacker could send a request for an overly long hostname parameter, which could lead to the remote execution of arbitrary code with the rights of the Pound daemon process (by default, Gentoo uses the "nobody" user to run the Pound daemon). Workaround ========= There is no known workaround at this time. Resolution ========= All Pound users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =www-servers/pound-1.8.3" References ========= [ 1 ] Original announcement https://david-maucher.ch/pound/ Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200504-29 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Apr 30, 2005
Gentoo
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!