Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -7 articles for you...
202
security advisorysecurity issuebuffer overflowopenSUSE Leap 42.1: 2016:0128-1 Critical: SSH Client Security
An update that fixes two vulnerabilities is now available. An update that fixes two vulnerabilities is now available. An update that fixes two vulnerabilities is now available.. openSUSE Security Update: Security update for openssh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0128-1 Rating: critical References: #961642 #961645 Cross-References: CVE-2016-0777 CVE-2016-0778 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for openssh fixes the following issues: - CVE-2016-0777: A malicious or compromised server could cause the OpenSSH client to expose part or all of the client's private key through the roaming feature (bsc#961642) - CVE-2016-0778: A malicious or compromised server could could trigger a buffer overflow in the OpenSSH client through the roaming feature (bsc#961645) This update disables the undocumented feature supported by the OpenSSH client and a commercial SSH server. This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-38=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): openssh-6.6p1-8.1 openssh-askpass-gnome-6.6p1-8.1 openssh-askpass-gnome-debuginfo-6.6p1-8.1 openssh-cavs-6.6p1-8.1 openssh-cavs-debuginfo-6.6p1-8.1 openssh-debuginfo-6.6p1-8.1 openssh-debugsource-6.6p1-8.1 openssh-fips-6.6p1-8.1 openssh-helpers-6.6p1-8.1 openssh-helpers-debuginfo-6.6p1-8.1 References: https://www.suse.com/security/cve/CVE-2016-0777.html https://www.suse.com/security/cve/CVE-2016-0778.html https://bugzilla.suse.com/show_bug.cgi?id=961642 https://bugzilla.suse.com/show_bug.cgi?id=961645 . Important openSUSE patch for openssh addresses a pair of vulnerabilities aimed at improving system stability and safeguarding user data.. openssh security, openSUSE updates, SSH enhancements. . Severity: Critical. LinuxSecurity.com Team
Jan 15, 2016
•Critical
OpenSUSE
91
security advisorydenial of servicegnupgGentoo: GLSA-201402-24 Normal: GnuPG Libgcrypt Code Execution Risks
Multiple vulnerabilities have been discovered in GnuPG and Libgcrypt, which may result in execution of arbitrary code, Denial of Service, or the disclosure of private keys. [More...]. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201402-24 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: GnuPG, Libgcrypt: Multiple vulnerabilities Date: February 21, 2014 Bugs: #449546, #478184, #484836, #487230, #494658 ID: 201402-24 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities have been discovered in GnuPG and Libgcrypt, which may result in execution of arbitrary code, Denial of Service, or the disclosure of private keys. Background ========= The GNU Privacy Guard, GnuPG, is a free replacement for the PGP suite of cryptographic software. Libgcrypt is a cryptographic library based on GnuPG. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-crypt/gnupg < 2.0.22 *> = 1.4.16 > = 2.0.22 2 dev-libs/libgcrypt < 1.5.3 > = 1.5.3 ------------------------------------------------------------------- 2 affected packages Description ========== Multiple vulnerabilities have been discovered in GnuPG and Libgcrypt. Please review the CVE identifiers referenced below for details. Impact ===== An unauthenticated remote attacker may be able to execute arbitrary code with the privileges of the user running GnuPG, cause a Denial of Servicecondition, or bypass security restrictions. Additionally, a side-channel attack may allow a local attacker to recover a private key, please review "Flush+Reload: a High Resolution, Low Noise, L3 Cache Side-Channel Attack" in the References section for further details. Workaround ========= There is no known workaround at this time. Resolution ========= All GnuPG 2.0 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =app-crypt/gnupg-2.0.22" All GnuPG 1.4 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =app-crypt/gnupg-1.4.16" All Libgcrypt users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =dev-libs/libgcrypt-1.5.3" References ========= [ 1 ] CVE-2012-6085 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6085 [ 2 ] CVE-2013-4242 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4242 [ 3 ] CVE-2013-4351 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4351 [ 4 ] CVE-2013-4402 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4402 [ 5 ] Flush+Reload: a High Resolution, Low Noise, L3 Cache Side-Channel Attack https://eprint.iacr.org/2013/448 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201402-24 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Feb 21, 2014
Gentoo
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!