Security update. Publication date: 07 Jun 2026 URL: https://advisories.mageia.org/MGASA-2026-0179.html Type: security Affected Mageia releases: 9 CVE: CVE-2023-48795 Description: fixes a protocol weakness in the golang.org/x/crypto/ssh package that allowed a MITM attacker to compromise the integrity of the secure channel before it was established, allowing them to prevent transmission of a number of messages immediately after the secure channel was established without either side being aware. The impact of this attack is relatively limited, as it does not compromise confidentiality of the channel. Notably this attack would allow an attacker to prevent the transmission of the SSH2_MSG_EXT_INFO message, disabling a handful of newer security features. References: - https://bugs.mageia.org/show_bug.cgi?id=32674 - https://www.openwall.com/lists/oss-security/2023/12/18/3 - https://www.openwall.com/lists/oss-security/2023/12/19/5 - https://www.openwall.com/lists/oss-security/2023/12/20/3 - https://www.cve.org/CVERecord?id=CVE-2023-48795 SRPMS: - 9/core/golang-x-crypto-0.45.0-1.mga9 - 9/core/golang-x-sys-0.30.0-2.mga9 . A security update addressing a protocol weakness in Mageia's golang-x-crypto package. Critical integrity issue resolved.. Mageia security update protocol integrity golang-x-crypto. . Severity: Important. LinuxSecurity.com Team
New upstream stable branch version 1.42.3. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-8a2d82f65a 2025-05-23 03:24:17.285672+00:00 -------------------------------------------------------------------------------- Name : nbdkit Product : Fedora 42 Version : 1.42.3 Release : 1.fc42 URL : https://gitlab.com/nbdkit/nbdkit Summary : NBD server Description : NBD is a protocol for accessing block devices (hard disks and disk-like things) over the network. nbdkit is a toolkit for creating NBD servers. The key features are: * Multithreaded NBD server written in C with good performance. * Minimal dependencies for the basic server. * Liberal license (BSD) allows nbdkit to be linked to proprietary libraries or included in proprietary code. * Well-documented, simple plugin API with a stable ABI guarantee. Lets you to export "unconventional" block devices easily. * You can write plugins in C or many other languages. * Filters can be stacked in front of plugins to transform the output. * Server can run standalone or can be invoked from other programs. 'nbdkit' is a meta-package which pulls in the core server and a useful subset of plugins and filters with minimal dependencies. If you want just the server, install 'nbdkit-server'. To develop plugins, install the 'nbdkit-devel' package and start by reading the nbdkit(1) and nbdkit-plugin(3) manual pages. -------------------------------------------------------------------------------- Update Information: New upstream stable branch version 1.42.3 -------------------------------------------------------------------------------- ChangeLog: * Sat May 10 2025 Richard W.M. Jones - 1.42.3-1 - New upstream stable branch version 1.42.3 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2365692 - CVE-2025-47711 nbdkit: off-by-one error when processingblock status may lead to a Denial of Service [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2365692 [ 2 ] Bug #2365727 - CVE-2025-47712 nbdkit: Integer overflow triggers an assertion resulting in Denial of Service [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2365727 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-8a2d82f65a' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Rebuild to mitigate CVE-2022-{1705,32148,30631,30633,28131,30635,30632,30630,1962} in golang --- See https://groups.google.com/g/golang-dev/c/frczlF8OFQ0/m/4lrZh5BHDgAJ for more information about the specific vulnerabilities. ---- enable s390x build (rhbz#1971028). --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-37aef44d1e 2022-07-30 01:52:05.591856 --------------------------------------------------------------------------------Name : golang-github-temoto-robotstxt Product : Fedora 36 Version : 1.1.2 Release : 4.fc36 URL : https://github.com/temoto/robotstxt Summary : Robots.txt exclusion protocol implementation Description : The robots.txt exclusion protocol implementation for Go language. --------------------------------------------------------------------------------Update Information: Rebuild to mitigate CVE-2022-{1705,32148,30631,30633,28131,30635,30632,30630,1962} in golang ---See https://groups.google.com/g/golang-dev/c/frczlF8OFQ0/m/4lrZh5BHDgAJ for more information about the specific vulnerabilities. ---- enable s390x build (rhbz#1971028) --------------------------------------------------------------------------------ChangeLog: * Tue Jul 19 2022 Maxwell G - 1.1.2-4 - Rebuild for CVE-2022-{1705,32148,30631,30633,28131,30635,30632,30630,1962} in golang --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-37aef44d1e' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
The container suse/sles12sp4 was updated. The following patches have been included in this update:. SUSE Container Update Advisory: suse/sles12sp4 ----------------------------------------------------------------- Container Advisory ID : SUSE-CU-2021:407-1 Container Tags : suse/sles12sp4:26.358 , suse/sles12sp4:latest Container Release : 26.358 Severity : moderate Type : security References : 1190373 1190374 CVE-2021-22946 CVE-2021-22947 ----------------------------------------------------------------- The container suse/sles12sp4 was updated. The following patches have been included in this update: ----------------------------------------------------------------- Advisory ID: SUSE-SU-2021:3351-1 Released: Tue Oct 12 13:22:51 2021 Summary: Security update for curl Type: security Severity: moderate References: 1190373,1190374,CVE-2021-22946,CVE-2021-22947 This update for curl fixes the following issues: - CVE-2021-22947: Fixed STARTTLS protocol injection via MITM (bsc#1190374). - CVE-2021-22946: Fixed protocol downgrade required TLS bypassed (bsc#1190373). . Explore the SUSE Container Update Advisory for suse/sles12sp4, detailing crucial security patches that bolster system integrity and stability while enhancing performance and compliance. SUSE Container Update, Curl Security, SUSE Updates, Container Security. . LinuxSecurity.com Team
- CVE-2021-22947 - STARTTLS protocol injection via MITM - CVE-2021-22946 - protocol downgrade required TLS bypassed - CVE-2021-22945 - use-after-free and double-free in MQTT sending. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2021-c5584b92d4 2021-09-21 15:31:09.085307 --------------------------------------------------------------------------------Name : curl Product : Fedora 34 Version : 7.76.1 Release : 12.fc34 URL : https://curl.se/ Summary : A utility for getting files from remote servers (FTP, HTTP, and others) Description : curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies, user+password authentication (Basic, Digest, NTLM, Negotiate, kerberos...), file transfer resume, proxy tunneling and a busload of other useful tricks. --------------------------------------------------------------------------------Update Information: - CVE-2021-22947 - STARTTLS protocol injection via MITM - CVE-2021-22946 -protocol downgrade required TLS bypassed - CVE-2021-22945 - use-after-free and double-free in MQTT sending --------------------------------------------------------------------------------ChangeLog: * Fri Sep 17 2021 Kamil Dudka - 7.76.1-12 - fix STARTTLS protocol injection via MITM (CVE-2021-22947) - fix protocol downgrade required TLS bypass (CVE-2021-22946) - fix use-after-free and double-free in MQTT sending (CVE-2021-22945) * Wed Jul 21 2021 Kamil Dudka - 7.76.1-7 - fix TELNET stack contents disclosure again (CVE-2021-22925) - fix bad connection reuse due to flawed path name checks (CVE-2021-22924) * Wed Jul 21 2021 Kamil Dudka - 7.76.1-5 - disable metalink support to fix the following vulnerabilities CVE-2021-22923 - metalinkdownload sends credentials CVE-2021-22922 - wrong content via metalink not discarded --------------------------------------------------------------------------------References: [ 1 ] Bug #2004362 - CVE-2021-22945 curl: use-after-free and double-free in MQTT sending [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2004362 [ 2 ] Bug #2004363 - CVE-2021-22947 curl: STARTTLS protocol injection via MITM [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2004363 [ 3 ] Bug #2004927 - CVE-2021-22946 curl: protocol downgrade required TLS bypassed [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2004927 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2021-c5584b92d4' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Updated gnutls packages fix security vulnerability: A flaw was reported in the DTLS protocol implementation in GnuTLS. The DTLS client would not contribute any randomness to the DTLS negotiation, breaking the security guarantees of the DTLS protocol (CVE-2020-11501). . MGASA-2020-0168 - Updated gnutls packages fix security vulnerability Publication date: 15 Apr 2020 URL: https://advisories.mageia.org/MGASA-2020-0168.html Type: security Affected Mageia releases: 7 CVE: CVE-2020-11501 Updated gnutls packages fix security vulnerability: A flaw was reported in the DTLS protocol implementation in GnuTLS. The DTLS client would not contribute any randomness to the DTLS negotiation, breaking the security guarantees of the DTLS protocol (CVE-2020-11501). References: - https://bugs.mageia.org/show_bug.cgi?id=26444 - https://lists.debian.org/debian-security-announce/2020/msg00055.html - https://www.cve.org/CVERecord?id=CVE-2020-11501 SRPMS: - 7/core/gnutls-3.6.7-1.1.mga7 . A recent update for GnuTLS fixes a vulnerability in the DTLS protocol that impacts Mageia 7, identified as CVE-2020-11501. More information is available within.. Gnutls Security Update,Mageia 7,DTLS Protocol Flaw,Security Fix,April 2020 Advisory. . Severity: Critical. LinuxSecurity.com Team
New version 2.6.6. Security fix for CVE-2019-5716, CVE-2019-5717, CVE-2019-5718, CVE-2019-5719. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2019-866b01407a 2019-01-26 02:14:05.841421 --------------------------------------------------------------------------------Name : wireshark Product : Fedora 29 Version : 2.6.6 Release : 1.fc29 URL : https://www.wireshark.org/ Summary : Network traffic analyzer Description : Wireshark allows you to examine protocol data stored in files or as it is captured from wired or wireless (WiFi or Bluetooth) networks, USB devices, and many other sources. It supports dozens of protocol capture file formats and understands more than a thousand protocols. It has many powerful features including a rich display filter language and the ability to reassemble multiple protocol packets in order to, for example, view a complete TCP stream, save the contents of a file which was transferred over HTTP or CIFS, or play back an RTP audio stream. --------------------------------------------------------------------------------Update Information: New version 2.6.6. Security fix for CVE-2019-5716, CVE-2019-5717, CVE-2019-5718, CVE-2019-5719 --------------------------------------------------------------------------------ChangeLog: * Mon Jan 21 2019 Michal Ruprich - 1:2.6.5-3 - New version 2.6.6 - Contains fixes for CVE-2019-5716, CVE-2019-5717, CVE-2019-5718, CVE-2019-5719 * Thu Jan 3 2019 Michal Ruprich - 1:2.6.5-2 - Adding libnghttp2-devel as BuildRequires - needed for HTTP2 support(rhbz#1512722) * Mon Dec 10 2018 Michal Ruprich - 1:2.6.5-1 - New version 2.6.5 - Contains fixes for CVE-2018-19622, CVE-2018-19623, CVE-2018-19624, CVE-2018-19625, CVE-2018-19626, CVE-2018-19627, CVE-2018-19628 * Mon Nov 12 2018 Michal Ruprich - 1:2.6.4-1 - New version 2.6.4 - Contains fixes for CVE-2018-16056, CVE-2018-16057,CVE-2018-16058 --------------------------------------------------------------------------------References: [ 1 ] Bug #1667593 - CVE-2019-5719 wireshark: ISAKMP dissector crash in epan/dissectors/packet-isakmp.c [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1667593 [ 2 ] Bug #1667587 - CVE-2019-5718 wireshark: RTSE and other ASN.1 dissectors crash in epan/charsets.c [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1667587 [ 3 ] Bug #1667582 - CVE-2019-5717 wireshark: P_MUL dissector crash in epan/dissectors/packet-p_mul.c [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1667582 [ 4 ] Bug #1667580 - CVE-2019-5716 wireshark: 6LoWPAN dissector crash in epan/dissectors/packet-6lowpan.c [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1667580 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2019-866b01407a' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
An update that fixes three vulnerabilities is now available.. openSUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: openSUSE-SU-2018:2587-1 Rating: moderate References: #1106514 Cross-References: CVE-2018-16056 CVE-2018-16057 CVE-2018-16058 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for wireshark to version 2.2.17 fixes the following issues: Security issues fixed (boo#1106514): - CVE-2018-16058: Bluetooth AVDTP dissector crash (wnpa-sec-2018-44) - CVE-2018-16056: Bluetooth Attribute Protocol dissector crash (wnpa-sec-2018-45) - CVE-2018-16057: Radiotap dissector crash (wnpa-sec-2018-46) Further bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-2.2.17.html Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-949=1 Package List: - openSUSE Leap 42.3 (x86_64): wireshark-2.2.17-47.1 wireshark-debuginfo-2.2.17-47.1 wireshark-debugsource-2.2.17-47.1 wireshark-devel-2.2.17-47.1 wireshark-ui-gtk-2.2.17-47.1 wireshark-ui-gtk-debuginfo-2.2.17-47.1 wireshark-ui-qt-2.2.17-47.1 wireshark-ui-qt-debuginfo-2.2.17-47.1 References: https://www.suse.com/security/cve/CVE-2018-16056.html https://www.suse.com/security/cve/CVE-2018-16057.html https://www.suse.com/security/cve/CVE-2018-16058.html https://bugzilla.suse.com/1106514 -- . An openSUSE update addresses three moderate security issues in Wireshark. Usersshould apply these updates promptly to ensure system safety. Follow the instructions to implement fixes:. wireshark Security Update, openSUSE Patch, Protocol Security Issues. . LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.