Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -6 articles for you...
98
security advisorymoderateRed HatRed Hat 8.2: RHSA-2020-5417 Moderate: curl Remote Overwrite Issue
An update for curl is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: curl security and bug fix update Advisory ID: RHSA-2020:5417-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2020:5417 Issue date: 2020-12-15 CVE Names: CVE-2020-8177 ==================================================================== 1. Summary: An update for curl is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux BaseOS EUS (v. 8.2) - aarch64, ppc64le, s390x, x86_64 3. Description: The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * curl: Incorrect argument check can allow remote servers to overwrite local files (CVE-2020-8177) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * libcurl: Segfault when HTTPS_PROXY and NO_PROXY is used together (BZ#1900103) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1847915- CVE-2020-8177 curl: Incorrect argument check can allow remote servers to overwrite local files 1900103 - libcurl: Segfault when HTTPS_PROXY and NO_PROXY is used together [rhel-8.2.0.z] 6. Package List: Red Hat Enterprise Linux BaseOS EUS (v.8.2): Source: curl-7.61.1-12.el8_2.2.src.rpm aarch64: curl-7.61.1-12.el8_2.2.aarch64.rpm curl-debuginfo-7.61.1-12.el8_2.2.aarch64.rpm curl-debugsource-7.61.1-12.el8_2.2.aarch64.rpm curl-minimal-debuginfo-7.61.1-12.el8_2.2.aarch64.rpm libcurl-7.61.1-12.el8_2.2.aarch64.rpm libcurl-debuginfo-7.61.1-12.el8_2.2.aarch64.rpm libcurl-devel-7.61.1-12.el8_2.2.aarch64.rpm libcurl-minimal-7.61.1-12.el8_2.2.aarch64.rpm libcurl-minimal-debuginfo-7.61.1-12.el8_2.2.aarch64.rpm ppc64le: curl-7.61.1-12.el8_2.2.ppc64le.rpm curl-debuginfo-7.61.1-12.el8_2.2.ppc64le.rpm curl-debugsource-7.61.1-12.el8_2.2.ppc64le.rpm curl-minimal-debuginfo-7.61.1-12.el8_2.2.ppc64le.rpm libcurl-7.61.1-12.el8_2.2.ppc64le.rpm libcurl-debuginfo-7.61.1-12.el8_2.2.ppc64le.rpm libcurl-devel-7.61.1-12.el8_2.2.ppc64le.rpm libcurl-minimal-7.61.1-12.el8_2.2.ppc64le.rpm libcurl-minimal-debuginfo-7.61.1-12.el8_2.2.ppc64le.rpm s390x: curl-7.61.1-12.el8_2.2.s390x.rpm curl-debuginfo-7.61.1-12.el8_2.2.s390x.rpm curl-debugsource-7.61.1-12.el8_2.2.s390x.rpm curl-minimal-debuginfo-7.61.1-12.el8_2.2.s390x.rpm libcurl-7.61.1-12.el8_2.2.s390x.rpm libcurl-debuginfo-7.61.1-12.el8_2.2.s390x.rpm libcurl-devel-7.61.1-12.el8_2.2.s390x.rpm libcurl-minimal-7.61.1-12.el8_2.2.s390x.rpm libcurl-minimal-debuginfo-7.61.1-12.el8_2.2.s390x.rpm x86_64: curl-7.61.1-12.el8_2.2.x86_64.rpm curl-debuginfo-7.61.1-12.el8_2.2.i686.rpm curl-debuginfo-7.61.1-12.el8_2.2.x86_64.rpm curl-debugsource-7.61.1-12.el8_2.2.i686.rpm curl-debugsource-7.61.1-12.el8_2.2.x86_64.rpm curl-minimal-debuginfo-7.61.1-12.el8_2.2.i686.rpm curl-minimal-debuginfo-7.61.1-12.el8_2.2.x86_64.rpm libcurl-7.61.1-12.el8_2.2.i686.rpm libcurl-7.61.1-12.el8_2.2.x86_64.rpm libcurl-debuginfo-7.61.1-12.el8_2.2.i686.rpm libcurl-debuginfo-7.61.1-12.el8_2.2.x86_64.rpm libcurl-devel-7.61.1-12.el8_2.2.i686.rpm libcurl-devel-7.61.1-12.el8_2.2.x86_64.rpm libcurl-minimal-7.61.1-12.el8_2.2.i686.rpm libcurl-minimal-7.61.1-12.el8_2.2.x86_64.rpm libcurl-minimal-debuginfo-7.61.1-12.el8_2.2.i686.rpm libcurl-minimal-debuginfo-7.61.1-12.el8_2.2.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2020-8177 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBX9h65tzjgjWX9erEAQhl5w//YmKVTzfBdkPw7TFSC0ADA2XJlkXX8OEG 7sBav0zb+5/lJvItXbJT0+DbZGpVGFtfZCTqVWyrVjhKbfQTLnPO6a8vefZwBRmT qZVpEF7C1RGrvn3wozFvqm8dd5OwaohhxRDINBzcJAZy23c0zuJwApBXsOKdP5HL pqfS9jNTfUQNdPgqzOvUDBadXLy0UEDgAS2/jZr/QifhcFn6eKQqCbWJpWf+Adgp fmogAtivYWAdaZvJ7NjAY6BJJ3E+j5UKm8v/gYARA4+FAwiDcfSiLkVQWfaXMkES +vlu5JnXi1olbMsq6qXY17thaTbI9X6sM+TRYnHXd+ADA4XqHTlKNKKD3/7BOhZw s4wawL9zs2x5XAXPZ9cEcwz9UBqVxyrU4EiUuuFPAoYYAXlOYGQtBDE+O6jVJywc TB+LAPtIMaoPani/aiiwoCeEkyPiMkKNoXDeed9s69qRVRNIhdAyes8L/4fvnrSy OTj2Mr/dMr0ws0J2K2LJfc8nkeeT8R/ld7ewEwHnRfTkr/P6B+0sWJthKPp9VHQ3 8iRkuA1411hiITMgMEztRcbGzsflQkDNOi77PnDfULzTolp1NVQ77nIoPCQyed20 Bmo6s0RET5DPQh0C9krynimFrzU2avPl85gWTa/zw+3WvV0QodxJ9k4c44RwNmy1 wQL/vinD7OA=1tPi -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Dec 15, 2020 Red Hat 203
security advisorynetwork threatcurlMageia: 2020-0282 Moderate: Curl Password Leak and Overwrite Risks
Updated curl packages fix security vulnerabilities: libcurl can be tricked to prepend a part of the password to the host name before it resolves it, potentially leaking the partial password over the network and to the DNS server(s) (CVE-2020-8169). . MGASA-2020-0282 - Updated curl packages fix security vulnerability Publication date: 05 Jul 2020 URL: https://advisories.mageia.org/MGASA-2020-0282.html Type: security Affected Mageia releases: 7 CVE: CVE-2020-8169, CVE-2020-8177 Updated curl packages fix security vulnerabilities: libcurl can be tricked to prepend a part of the password to the host name before it resolves it, potentially leaking the partial password over the network and to the DNS server(s) (CVE-2020-8169). curl can be tricked by a malicious server to overwrite a local file when using -J (--remote-header-name) and -i (--include) in the same command line (CVE-2020-8177). The curl package has been updated to version 7.71.0, fixing these issues and other bugs. References: - https://bugs.mageia.org/show_bug.cgi?id=26858 - https://curl.se/docs/CVE-2020-8169.html - https://curl.se/docs/CVE-2020-8177.html - https://curl.se/changes.html - https://www.cve.org/CVERecord?id=CVE-2020-8169 - https://www.cve.org/CVERecord?id=CVE-2020-8177 SRPMS: - 7/core/curl-7.71.0-1.mga7 . The latest iteration of Mageia's curl patch effectively mitigates risks associated with potential password disclosure and remote file overwrite vulnerabilities.. curl Update, Mageia Security, Password Leakage, Network Threat, Remote File Overwrite. . LinuxSecurity.com Team
Jul 05, 2020 Mageia 
202
security advisoryimportant updateopenSUSEopenSUSE: 2017:3154-7 Critical: karchive Security Vulnerability Patch
An update that fixes one vulnerability is now available. An update that fixes one vulnerability is now available. An update that fixes one vulnerability is now available.. openSUSE Security Update: Security update for karchive ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2223-1 Rating: important References: #989698 Cross-References: CVE-2016-6232 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for karchive fixes the following issues: - CVE-2016-6232: A remote attacker could have been able to overwrite arbitrary files when tricking the user into downloading KDE extras such as wallpapers or Plasma Applets (boo#989698) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2016-904=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): karchive-debugsource-5.20.0-6.1 karchive-devel-5.20.0-6.1 libKF5Archive5-5.20.0-6.1 libKF5Archive5-debuginfo-5.20.0-6.1 References: https://www.suse.com/security/cve/CVE-2016-6232.html https://bugzilla.suse.com/989698 . Crucial Fedora patch addresses libarchive vulnerability, bolstering protection against potential unauthorized file access.. openSUSE Security Update,karchive update,remote file overwrite. . Severity: Important. LinuxSecurity.com Team
Sep 02, 2016 •Important OpenSUSE 
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!