Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -6 articles for you...
98
security advisoryimportantred hat enterpriseRed Hat OpenStack 6.0 RHSA-2015-2685-01 Important: Remote Exec
Updated openstack-ironic-discoverd packages that fix one security issue are now available for Red Hat Enterprise Linux OpenStack Platform 6.0. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Important: openstack-ironic-discoverd security update Advisory ID: RHSA-2015:2685-01 Product: Red Hat Enterprise Linux OpenStack Platform Advisory URL: https://access.redhat.com/errata/RHSA-2015:2685.html Issue date: 2015-12-21 CVE Names: CVE-2015-5306 ==================================================================== 1. Summary: Updated openstack-ironic-discoverd packages that fix one security issue are now available for Red Hat Enterprise Linux OpenStack Platform 6.0. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux OpenStack Platform 6.0 for RHEL 7 - noarch 3. Description: OpenStack Bare Metal (ironic) is a tool used to provision bare metal (as opposed to virtual) machines. It leverages common technologies such as PXE boot and IPMI to cover a wide range of hardware. It also supports pluggable drivers to allow added, vendor-specific functionality. It was discovered that enabling debug mode in openstack-ironic-discoverd also enabled debug mode in the underlying Flask framework. If errors were encountered while Flask was in debug mode, a user experiencing an error might be able to access the debug console (effectively, a command shell). (CVE-2015-5306) Please note that this package is a Technology Preview and should not be used in production. Allopenstack-ironic-discoverd users are advised to upgrade to these updated packages, which correct this issue. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1273698 - CVE-2015-5306 openstack-ironic-discoverd: potential remote code execution with debug mode enabled 6. Package List: Red Hat Enterprise Linux OpenStack Platform 6.0 for RHEL 7: Source: openstack-ironic-discoverd-0.2.5-2.el7ost.src.rpm noarch: openstack-ironic-discoverd-0.2.5-2.el7ost.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2015-5306 https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFWeFYdXlSAg2UNWIIRAvwUAJ91P5APQMfFyQU26VHg6yV/VoItEwCfeNPf UpcWtj/OopvAKC2J2cxqR/c=olK5 -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list
Dec 21, 2015
•Important
Red Hat
91
security advisorysecurity issuegentooGentoo: 201406-13 Standard: Memcached External Command Execution Issues
Multiple vulnerabilities have been found in memcached, allowing remote attackers to execute arbitrary code or cause Denial of Service.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201406-13 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: memcached: Multiple vulnerabilities Date: June 15, 2014 Bugs: #279386, #452098, #467962, #496506, #498078 ID: 201406-13 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities have been found in memcached, allowing remote attackers to execute arbitrary code or cause Denial of Service. Background ========= memcached is a high-performance, distributed memory object caching system Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-misc/memcached < 1.4.17 > = 1.4.17 Description ========== memcached authentication could be bypassed when using SASL due to a flaw related to SASL authentication state. Also several heap-based buffer overflows due to integer conversions when parsing certain length attributes were discovered. Impact ===== A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition or authenticate with invalid SASL credentials, bypassing memcached authentication completely. Workaround ========= There is no known workaround at this time. Resolution ========= All memcached users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/memcached-1.4.17" References ========= [ 1 ] CVE-2009-2415 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-2415 [ 2 ] CVE-2013-7239 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-7239 [ 3 ] CVE-2011-4971 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4971 [ 4 ] CVE-2013-0179 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0179 [ 5 ] CVE-2013-7290 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-7290 [ 6 ] CVE-2013-7291 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-7291 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201406-13 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Jun 15, 2014
Gentoo
87
security advisorydenial of servicecriticalDebian: DSA 1024-1 Critical: Clamav Multiple Remote Exec Threats
Updated package.. - --------------------------------------------------------------------------Debian Security Advisory DSA 1024-1
Apr 05, 2006
•Critical
Debian
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!