Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found -5 articles for you...
202
security advisorymoderateprivilege dropopenSUSE 15.2: 2021:0370-1 Moderate: Avahi Privilege Drop Threat
An update that fixes one vulnerability is now available. . openSUSE Security Update: Security update for avahi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0370-1 Rating: moderate References: #1180827 Cross-References: CVE-2021-26720 CVSS scores: CVE-2021-26720 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-26720 (SUSE): 3.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for avahi fixes the following issues: - CVE-2021-26720: drop privileges when invoking avahi-daemon-check-dns.sh (bsc#1180827) - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Add sudo to requires: used to drop privileges. This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-370=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): avahi-0.7-lp152.3.6.1 avahi-autoipd-0.7-lp152.3.6.1 avahi-autoipd-debuginfo-0.7-lp152.3.6.1 avahi-compat-howl-devel-0.7-lp152.3.6.1 avahi-compat-mDNSResponder-devel-0.7-lp152.3.6.1 avahi-debuginfo-0.7-lp152.3.6.1 avahi-debugsource-0.7-lp152.3.6.1 avahi-glib2-debugsource-0.7-lp152.3.6.1 avahi-utils-0.7-lp152.3.6.1 avahi-utils-debuginfo-0.7-lp152.3.6.1 avahi-utils-gtk-0.7-lp152.3.6.1 avahi-utils-gtk-debuginfo-0.7-lp152.3.6.1 libavahi-client3-0.7-lp152.3.6.1 libavahi-client3-debuginfo-0.7-lp152.3.6.1 libavahi-common3-0.7-lp152.3.6.1 libavahi-common3-debuginfo-0.7-lp152.3.6.1 libavahi-core7-0.7-lp152.3.6.1 libavahi-core7-debuginfo-0.7-lp152.3.6.1 libavahi-devel-0.7-lp152.3.6.1 libavahi-glib-devel-0.7-lp152.3.6.1 libavahi-glib1-0.7-lp152.3.6.1 libavahi-glib1-debuginfo-0.7-lp152.3.6.1 libavahi-gobject-devel-0.7-lp152.3.6.1 libavahi-gobject0-0.7-lp152.3.6.1 libavahi-gobject0-debuginfo-0.7-lp152.3.6.1 libavahi-ui-gtk3-0-0.7-lp152.3.6.1 libavahi-ui-gtk3-0-debuginfo-0.7-lp152.3.6.1 libavahi-ui0-0.7-lp152.3.6.1 libavahi-ui0-debuginfo-0.7-lp152.3.6.1 libdns_sd-0.7-lp152.3.6.1 libdns_sd-debuginfo-0.7-lp152.3.6.1 libhowl0-0.7-lp152.3.6.1 libhowl0-debuginfo-0.7-lp152.3.6.1 python3-avahi-0.7-lp152.3.6.1 python3-avahi-gtk-0.7-lp152.3.6.1 typelib-1_0-Avahi-0_6-0.7-lp152.3.6.1 - openSUSE Leap 15.2 (noarch): avahi-lang-0.7-lp152.3.6.1 - openSUSE Leap 15.2 (x86_64): avahi-32bit-debuginfo-0.7-lp152.3.6.1 avahi-mono-0.7-lp152.3.6.1 avahi-qt4-debugsource-0.7-lp152.3.6.1 libavahi-client3-32bit-0.7-lp152.3.6.1 libavahi-client3-32bit-debuginfo-0.7-lp152.3.6.1 libavahi-common3-32bit-0.7-lp152.3.6.1 libavahi-common3-32bit-debuginfo-0.7-lp152.3.6.1 libavahi-glib1-32bit-0.7-lp152.3.6.1 libavahi-glib1-32bit-debuginfo-0.7-lp152.3.6.1 libavahi-qt4-1-0.7-lp152.3.6.1 libavahi-qt4-1-debuginfo-0.7-lp152.3.6.1 libavahi-qt4-devel-0.7-lp152.3.6.1 libdns_sd-32bit-0.7-lp152.3.6.1 libdns_sd-32bit-debuginfo-0.7-lp152.3.6.1 References: https://www.suse.com/security/cve/CVE-2021-26720.html https://bugzilla.suse.com/1180827 . openSUSE Security Update: Security update for avahi ________________________________________________. update, security, fixes, vulnerability, opensuse. . LinuxSecurity.com Team
Mar 02, 2021
OpenSUSE
89
security advisorysecurity issuecriticalFedora 31: FEDORA-2021-1234567g8h Critical: Bash Security Leak
- drop privileges securely when unsetting PRIVILEGED option (CVE-2019-20044). --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-9009363f0f 2020-03-13 02:29:45.056500 --------------------------------------------------------------------------------Name : zsh Product : Fedora 30 Version : 5.7.1 Release : 6.fc30 URL : https://zsh.sourceforge.io/ Summary : Powerful interactive shell Description : The zsh shell is a command interpreter usable as an interactive login shell and as a shell script command processor. Zsh resembles the ksh shell (the Korn shell), but includes many enhancements. Zsh supports command line editing, built-in spelling correction, programmable command completion, shell functions (with autoloading), a history mechanism, and more. --------------------------------------------------------------------------------Update Information: - drop privileges securely when unsetting PRIVILEGED option (CVE-2019-20044) --------------------------------------------------------------------------------ChangeLog: * Tue Mar 3 2020 Kamil Dudka - 5.7.1-6 - improve printing of error messages introduced by the fix of CVE-2019-20044 * Mon Feb 24 2020 Kamil Dudka - 5.7.1-5 - drop privileges securely when unsetting PRIVILEGED option (CVE-2019-20044) * Fri Jul 26 2019 Kamil Dudka - 5.7.1-4 - make failed searches of history in Zle robust (#1722703) * Tue Mar 12 2019 Kamil Dudka - 5.7.1-3 - avoid build failure in case we have working ypcat (#1687574) * Fri Mar 8 2019 Tim Landscheidt - 5.7.1-2 - Remove obsolete requirements for %post/%preun scriptlets --------------------------------------------------------------------------------References: [ 1 ] Bug #1804860 - CVE-2019-20044 zsh: insecure dropping of privileges when unsetting PRIVILEGED option [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1804860 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-9009363f0f' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Mar 12, 2020
•Critical
Fedora
89
security advisorysecurity issuefedoraFedora 31: FEDORA-2020-3f38f3e517 Moderate: Zsh Privilege Drop
- drop privileges securely when unsetting PRIVILEGED option (CVE-2019-20044). --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-3f38f3e517 2020-03-12 21:55:08.821447 --------------------------------------------------------------------------------Name : zsh Product : Fedora 31 Version : 5.7.1 Release : 6.fc31 URL : https://zsh.sourceforge.io/ Summary : Powerful interactive shell Description : The zsh shell is a command interpreter usable as an interactive login shell and as a shell script command processor. Zsh resembles the ksh shell (the Korn shell), but includes many enhancements. Zsh supports command line editing, built-in spelling correction, programmable command completion, shell functions (with autoloading), a history mechanism, and more. --------------------------------------------------------------------------------Update Information: - drop privileges securely when unsetting PRIVILEGED option (CVE-2019-20044) --------------------------------------------------------------------------------ChangeLog: * Tue Mar 3 2020 Kamil Dudka - 5.7.1-6 - improve printing of error messages introduced by the fix of CVE-2019-20044 * Mon Feb 24 2020 Kamil Dudka - 5.7.1-5 - drop privileges securely when unsetting PRIVILEGED option (CVE-2019-20044) --------------------------------------------------------------------------------References: [ 1 ] Bug #1804860 - CVE-2019-20044 zsh: insecure dropping of privileges when unsetting PRIVILEGED option [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1804860 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-3f38f3e517' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed withthe Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Mar 12, 2020
•Important
Fedora
98
security advisoryRed Hat LinuxcriticalRed Hat Linux 7.x RHSA-2003:174-01 Critical: tcpdump Privilege Drop
Updated tcpdump packages that correctly drop privileges on startup are now available.. ` --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Updated tcpdump packages fix privilege dropping error Advisory ID: RHSA-2003:174-01 Issue date: 2003-05-15 Updated on: 2003-05-15 Product: Red Hat Linux Keywords: tcpdump Cross references: Obsoletes: RHSA-2003:032- CVE Names: CAN-2003-0194 --------------------------------------------------------------------- 1. Topic: Updated tcpdump packages that correctly drop privileges on startup are now available. 2. Relevant releases/architectures: Red Hat Linux 7.1 - i386 Red Hat Linux 7.2 - i386, ia64 Red Hat Linux 7.3 - i386 Red Hat Linux 8.0 - i386 Red Hat Linux 9 - i386 3. Problem description: Tcpdump is a command-line tool for monitoring network traffic. The Red Hat tcpdump packages advertise that by default tcpdump will drop permissions to user 'pcap'. Due to a compilation error this did not happen, and tcpdump would run as root unless the '-U' flag was specified. Users of tcpdump are advised to upgrade to these errata packages, which contain are compiled so that by default tcpdump will drop privileges to the 'pcap' user. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. Please note that this update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. 5. Bug IDs fixed ( for more info): 88881 - CAN-2003-0145 RADUIS tcpdump vulnerability 90208 - CAN-2003-0194 tcpdump didn't drop root to pcap user like promised 6. RPMs required: Red Hat Linux 7.1: SRPMS: i386: Red Hat Linux 7.2: SRPMS: i386: ia64: Red Hat Linux 7.3: SRPMS: i386: RedHat Linux 8.0: SRPMS: i386: Red Hat Linux 9: SRPMS: i386: 7. Verification: MD5 sum Package Name -------------------------------------------------------------------------- fac820eb58d79fc58d30bff1fd11f33d 7.1/en/os/SRPMS/tcpdump-3.6.3-17.7.1.3.src.rpm 3eadddac8cdf6ae0b14e8016f651e1f0 7.1/en/os/i386/tcpdump-3.6.3-17.7.1.3.i386.rpm 5f5c14bd0dfdaa5b0d5dbc0fb70da395 7.2/en/os/SRPMS/tcpdump-3.6.3-17.7.2.3.src.rpm c48e86db37c7f767ec8931ebb54fc0ae 7.2/en/os/i386/tcpdump-3.6.3-17.7.2.3.i386.rpm 39da71bfef8520c979db8cf21c4f6781 7.2/en/os/ia64/tcpdump-3.6.3-17.7.2.3.ia64.rpm f9de6824ac351207bd105978eefed89d 7.3/en/os/SRPMS/tcpdump-3.6.3-17.7.3.3.src.rpm 8d54631bf99d61090f0752f29ef51f8f 7.3/en/os/i386/tcpdump-3.6.3-17.7.3.3.i386.rpm 67a36a50ec50a8aa2d32b2462fae653d 8.0/en/os/SRPMS/tcpdump-3.6.3-17.8.0.3.src.rpm afba9bea894090b9c179979403347629 8.0/en/os/i386/tcpdump-3.6.3-17.8.0.3.i386.rpm 1b1b577c9ebfe84f735a6498140e1e7f 9/en/os/SRPMS/tcpdump-3.7.2-1.9.1.src.rpm 6cff8bf6b2425c361eec70ba3017d82b 9/en/os/i386/tcpdump-3.7.2-1.9.1.i386.rpm These packages are GPG signed by Red Hat for security. Our key is available at All Red Hat products You can verify each package with the following command: rpm --checksig -v If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command: md5sum 8. References: CVE -CVE-2003-0194 9. Contact: The Red Hat security contact is . More contact details at All Red Hat products Copyright 2003 Red Hat, Inc. _______________________________________________ Red Hat-watch-list mailing list To unsubscribe, visit: Hat-watch-list `. Updated tcpdump iterations have been introduced to boost security by restricting privileges during startup, resolving past vulnerabilities.. tcpdump Update, Red Hat Security, Privilege Drop Issue, Network Monitoring Tool. . Severity: Critical. LinuxSecurity.com Team
May 15, 2003
•Critical
Red Hat
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!