Explore top 10 tips to secure your open-source projects now. Read More
×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Is continuous patching actually viable?
Loading...
Explore Latest Linux Security advisories
We found 277 articles for you...
100
security advisorymoderateSuSESUSE: Docker Moderate Access Flaw CVE-2025-54388 Advisory 2025:02914-1
* bsc#1246556 * bsc#1247367 Cross-References: * CVE-2025-54388 . # Security update for docker Announcement ID: SUSE-SU-2025:02914-1 Release Date: 2025-08-19T12:56:06Z Rating: moderate References: * bsc#1246556 * bsc#1247367 Cross-References: * CVE-2025-54388 CVSS scores: * CVE-2025-54388 ( SUSE ): 5.1 CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N * CVE-2025-54388 ( SUSE ): 5.2 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2025-54388 ( NVD ): 5.1 CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affected Products: * Basesystem Module 15-SP7 * Containers Module 15-SP6 * Containers Module 15-SP7 * openSUSE Leap 15.6 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise Desktop 15 SP7 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 * SUSE Linux Enterprise Micro 5.1 * SUSE Linux Enterprise Micro 5.2 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Micro for Rancher 5.2 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Real Time 15 SP7 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS * SUSE Linux Enterprise Server 15 SP5 * SUSE LinuxEnterprise Server 15 SP5 LTSS * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP7 An update that solves one vulnerability and has one security fix can now be installed. ## Description: This update for docker fixes the following issues: * Update to Docker 28.3.3-ce. * CVE-2025-54388: Fixed a bug where firewalld when reloaded can make published container ports accessible from remote hosts. (bsc#1247367) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2025-2914=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2025-2914=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2025-2914=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2025-2914=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2025-2914=1 * SUSE Linux Enterprise Micro 5.5 zypper in -t patch SUSE-SLE-Micro-5.5-2025-2914=1 * Basesystem Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2025-2914=1 * Containers Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Containers-15-SP6-2025-2914=1 * Containers Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Containers-15-SP7-2025-2914=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2025-2914=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2025-2914=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2025-2914=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2025-2914=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2025-2914=1 * SUSE Linux Enterprise Server 15 SP3 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2025-2914=1 * SUSE Linux Enterprise Server 15 SP4 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2025-2914=1 * SUSE Linux Enterprise Server 15 SP5 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2025-2914=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2025-2914=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2025-2914=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2025-2914=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2025-2914=1 * SUSE Linux Enterprise Micro 5.1 zypper in -t patch SUSE-SUSE-MicroOS-5.1-2025-2914=1 * SUSE Linux Enterprise Micro 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2025-2914=1 * SUSE Linux Enterprise Micro for Rancher 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2025-2914=1 ## Package List: * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64) * docker-28.3.3_ce-150000.230.1 * docker-debuginfo-28.3.3_ce-150000.230.1 * openSUSE Leap 15.6 (noarch) * docker-bash-completion-28.3.3_ce-150000.230.1 * docker-rootless-extras-28.3.3_ce-150000.230.1 * docker-zsh-completion-28.3.3_ce-150000.230.1 * docker-fish-completion-28.3.3_ce-150000.230.1 * SUSE Linux Enterprise Micro for Rancher5.3 (aarch64 s390x x86_64) * docker-28.3.3_ce-150000.230.1 * docker-debuginfo-28.3.3_ce-150000.230.1 * SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64) * docker-28.3.3_ce-150000.230.1 * docker-debuginfo-28.3.3_ce-150000.230.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64) * docker-28.3.3_ce-150000.230.1 * docker-debuginfo-28.3.3_ce-150000.230.1 * SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64) * docker-28.3.3_ce-150000.230.1 * docker-debuginfo-28.3.3_ce-150000.230.1 * SUSE Linux Enterprise Micro 5.5 (aarch64 ppc64le s390x x86_64) * docker-28.3.3_ce-150000.230.1 * docker-debuginfo-28.3.3_ce-150000.230.1 * Basesystem Module 15-SP7 (aarch64 ppc64le s390x x86_64) * docker-28.3.3_ce-150000.230.1 * docker-debuginfo-28.3.3_ce-150000.230.1 * Containers Module 15-SP6 (aarch64 ppc64le s390x x86_64) * docker-28.3.3_ce-150000.230.1 * docker-debuginfo-28.3.3_ce-150000.230.1 * Containers Module 15-SP6 (noarch) * docker-bash-completion-28.3.3_ce-150000.230.1 * docker-zsh-completion-28.3.3_ce-150000.230.1 * docker-rootless-extras-28.3.3_ce-150000.230.1 * Containers Module 15-SP7 (noarch) * docker-bash-completion-28.3.3_ce-150000.230.1 * docker-zsh-completion-28.3.3_ce-150000.230.1 * docker-rootless-extras-28.3.3_ce-150000.230.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) * docker-28.3.3_ce-150000.230.1 * docker-debuginfo-28.3.3_ce-150000.230.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch) * docker-bash-completion-28.3.3_ce-150000.230.1 * docker-fish-completion-28.3.3_ce-150000.230.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * docker-28.3.3_ce-150000.230.1 * docker-debuginfo-28.3.3_ce-150000.230.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch) * docker-bash-completion-28.3.3_ce-150000.230.1 *docker-rootless-extras-28.3.3_ce-150000.230.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * docker-28.3.3_ce-150000.230.1 * docker-debuginfo-28.3.3_ce-150000.230.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch) * docker-bash-completion-28.3.3_ce-150000.230.1 * docker-rootless-extras-28.3.3_ce-150000.230.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (aarch64 x86_64) * docker-28.3.3_ce-150000.230.1 * docker-debuginfo-28.3.3_ce-150000.230.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (noarch) * docker-bash-completion-28.3.3_ce-150000.230.1 * docker-rootless-extras-28.3.3_ce-150000.230.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (aarch64 x86_64) * docker-28.3.3_ce-150000.230.1 * docker-debuginfo-28.3.3_ce-150000.230.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (noarch) * docker-bash-completion-28.3.3_ce-150000.230.1 * docker-rootless-extras-28.3.3_ce-150000.230.1 * SUSE Linux Enterprise Server 15 SP3 LTSS (aarch64 ppc64le s390x x86_64) * docker-28.3.3_ce-150000.230.1 * docker-debuginfo-28.3.3_ce-150000.230.1 * SUSE Linux Enterprise Server 15 SP3 LTSS (noarch) * docker-bash-completion-28.3.3_ce-150000.230.1 * docker-fish-completion-28.3.3_ce-150000.230.1 * SUSE Linux Enterprise Server 15 SP4 LTSS (aarch64 ppc64le s390x x86_64) * docker-28.3.3_ce-150000.230.1 * docker-debuginfo-28.3.3_ce-150000.230.1 * SUSE Linux Enterprise Server 15 SP4 LTSS (noarch) * docker-bash-completion-28.3.3_ce-150000.230.1 * docker-rootless-extras-28.3.3_ce-150000.230.1 * SUSE Linux Enterprise Server 15 SP5 LTSS (aarch64 ppc64le s390x x86_64) * docker-28.3.3_ce-150000.230.1 * docker-debuginfo-28.3.3_ce-150000.230.1 * SUSE Linux Enterprise Server 15 SP5 LTSS (noarch) * docker-bash-completion-28.3.3_ce-150000.230.1 * docker-rootless-extras-28.3.3_ce-150000.230.1 * SUSELinux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64) * docker-28.3.3_ce-150000.230.1 * docker-debuginfo-28.3.3_ce-150000.230.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (noarch) * docker-bash-completion-28.3.3_ce-150000.230.1 * docker-fish-completion-28.3.3_ce-150000.230.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * docker-28.3.3_ce-150000.230.1 * docker-debuginfo-28.3.3_ce-150000.230.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch) * docker-bash-completion-28.3.3_ce-150000.230.1 * docker-rootless-extras-28.3.3_ce-150000.230.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 (ppc64le x86_64) * docker-28.3.3_ce-150000.230.1 * docker-debuginfo-28.3.3_ce-150000.230.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 (noarch) * docker-bash-completion-28.3.3_ce-150000.230.1 * docker-rootless-extras-28.3.3_ce-150000.230.1 * SUSE Enterprise Storage 7.1 (aarch64 x86_64) * docker-28.3.3_ce-150000.230.1 * docker-debuginfo-28.3.3_ce-150000.230.1 * SUSE Enterprise Storage 7.1 (noarch) * docker-bash-completion-28.3.3_ce-150000.230.1 * docker-fish-completion-28.3.3_ce-150000.230.1 * SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64) * docker-28.3.3_ce-150000.230.1 * docker-debuginfo-28.3.3_ce-150000.230.1 * SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64) * docker-28.3.3_ce-150000.230.1 * docker-debuginfo-28.3.3_ce-150000.230.1 * SUSE Linux Enterprise Micro for Rancher 5.2 (aarch64 s390x x86_64) * docker-28.3.3_ce-150000.230.1 * docker-debuginfo-28.3.3_ce-150000.230.1 ## References: * https://www.suse.com/security/cve/CVE-2025-54388.html * https://bugzilla.suse.com/show_bug.cgi?id=1246556 * https://bugzilla.suse.com/show_bug.cgi?id=1247367 . Important revision for Docker tackles medium-level access vulnerabilities in SUSE distributions to enhance security measures.. SUSE Docker Security AccessUpdate. . LinuxSecurity.com Team
Aug 19, 2025
SuSE
198
security advisoryhigh severityremote threatArchLinux: 202505-5 High: webkitgtk-6.0 arbitrary code execution
The package webkitgtk-6.0 before version 2.48.2-1 is vulnerable to arbitrary code execution. . Arch Linux Security Advisory ASA-202505-5 ========================================= Severity: High Date : 2025-05-18 CVE-ID : CVE-2023-42875 CVE-2023-42970 Package : webkitgtk-6.0 Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2867 Summary ======= The package webkitgtk-6.0 before version 2.48.2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.48.2-1. # pacman -Syu "webkitgtk-6.0> =2.48.2-1" The problems have been fixed upstream in version 2.48.2. Workaround ========== None. Description =========== - CVE-2023-42875 (arbitrary code execution) Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in arbitrary code execution. The issue was addressed with improved memory handling. - CVE-2023-42970 (arbitrary code execution) Processing malicious web content can cause a use-after-free issue due to improper memory management and result in arbitrary code execution. Impact ====== A remote attacker could craft malicious web content that exploits use- after-free vulnerabilities in WPE WebKit, potentially leading to arbitrary code execution. This can compromise the confidentiality, integrity, and availability of affected systems, especially those rendering untrusted web content through WPE WebKit. References ========== https://webkitgtk.org/security/WSA-2025-0004.html https://wpewebkit.org/security/WSA-2025-0004.html https://webkitgtk.org/security/WSA-2025-0004.html#CVE-2023-42875 https://wpewebkit.org/security/WSA-2025-0004.html#CVE-2023-42875 https://webkitgtk.org/security/WSA-2025-0004.html#CVE-2023-42970 https://wpewebkit.org/security/WSA-2025-0004.html#CVE-2023-42970 https://security.archlinux.org/CVE-2023-42875 https://security.archlinux.org/CVE-2023-42970 . Critical warning issued for Arch Linuxconcerning webkitgtk-6.0 exploits enabling unauthorized code execution.. Arbitrary Execution, Arch Linux, WebkitGTK, Security Advisory, High Severity. . LinuxSecurity.com Team
May 20, 2025
ArchLinux
198
security advisoryhigh severityarbitrary code executionArch Linux: ASA-202505-3 High: webkit2gtk Arbitrary Code Execution
The package webkit2gtk before version 2.48.2-1 is vulnerable to arbitrary code execution. . Arch Linux Security Advisory ASA-202505-3 ========================================= Severity: High Date : 2025-05-18 CVE-ID : CVE-2023-42875 CVE-2023-42970 Package : webkit2gtk Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2869 Summary ======= The package webkit2gtk before version 2.48.2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.48.2-1. # pacman -Syu "webkit2gtk> =2.48.2-1" The problems have been fixed upstream in version 2.48.2. Workaround ========== None. Description =========== - CVE-2023-42875 (arbitrary code execution) Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in arbitrary code execution. The issue was addressed with improved memory handling. - CVE-2023-42970 (arbitrary code execution) Processing malicious web content can cause a use-after-free issue due to improper memory management and result in arbitrary code execution. Impact ====== A remote attacker could craft malicious web content that exploits use- after-free vulnerabilities in WPE WebKit, potentially leading to arbitrary code execution. This can compromise the confidentiality, integrity, and availability of affected systems, especially those rendering untrusted web content through WPE WebKit. References ========== https://webkitgtk.org/security/WSA-2025-0004.html https://wpewebkit.org/security/WSA-2025-0004.html https://webkitgtk.org/security/WSA-2025-0004.html#CVE-2023-42875 https://wpewebkit.org/security/WSA-2025-0004.html#CVE-2023-42875 https://webkitgtk.org/security/WSA-2025-0004.html#CVE-2023-42970 https://wpewebkit.org/security/WSA-2025-0004.html#CVE-2023-42970 https://security.archlinux.org/CVE-2023-42875 https://security.archlinux.org/CVE-2023-42970 . Debian security bulletin DSA-4948-1 warns of criticalvulnerabilities allowing unauthorized access in openssl before version 1.1.1j-1.. Arch Linux Advisory, webkit2gtk, arbitrary code execution, security advisory, high severity. . LinuxSecurity.com Team
May 20, 2025
ArchLinux
198
security advisoryhigh severityarbitrary code executionArch Linux: ASA-202505-2 high: wpewebkit arbitrary code execution
The package wpewebkit before version 2.48.2-1 is vulnerable to arbitrary code execution. . Arch Linux Security Advisory ASA-202505-2 ========================================= Severity: High Date : 2025-05-18 CVE-ID : CVE-2023-42875 CVE-2023-42970 Package : wpewebkit Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2870 Summary ======= The package wpewebkit before version 2.48.2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.48.2-1. # pacman -Syu "wpewebkit> =2.48.2-1" The problems have been fixed upstream in version 2.48.2. Workaround ========== None. Description =========== - CVE-2023-42875 (arbitrary code execution) Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in arbitrary code execution. The issue was addressed with improved memory handling. - CVE-2023-42970 (arbitrary code execution) Processing malicious web content can cause a use-after-free issue due to improper memory management and result in arbitrary code execution. Impact ====== A remote attacker could craft malicious web content that exploits use- after-free vulnerabilities in WPE WebKit, potentially leading to arbitrary code execution. This can compromise the confidentiality, integrity, and availability of affected systems, especially those rendering untrusted web content through WPE WebKit. References ========== https://webkitgtk.org/security/WSA-2025-0004.html https://wpewebkit.org/security/WSA-2025-0004.html https://webkitgtk.org/security/WSA-2025-0004.html#CVE-2023-42875 https://wpewebkit.org/security/WSA-2025-0004.html#CVE-2023-42875 https://webkitgtk.org/security/WSA-2025-0004.html#CVE-2023-42970 https://wpewebkit.org/security/WSA-2025-0004.html#CVE-2023-42970 https://security.archlinux.org/CVE-2023-42875 https://security.archlinux.org/CVE-2023-42970 . The Arch Linux Security Advisory ASA-202505-3 addressescritical concerns stemming from a vulnerability in wpewebkit that could lead to unauthorized code execution.. wpewebkit, security advisory, arbitrary code, execution risk. . LinuxSecurity.com Team
May 20, 2025
ArchLinux
172
security advisoryinformation leakremote threatUbuntu 22.04 LTS USN-7430-1 critical: dino-im information leak
Dino could be made to expose sensitive information over the network.. ========================================================================== Ubuntu Security Notice USN-7430-1 April 09, 2025 dino-im vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS Summary: Dino could be made to expose sensitive information over the network. Software Description: - dino-im: modern XMPP client Details: Kim Alvefur discovered that Dino did not correctly sanitize certain messages. A remote attacker could possibly use this issue to leak sensitive information. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS dino-im 0.3.0-3ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 20.04 LTS dino-im 0.1.0-1ubuntu0.1~esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7430-1 CVE-2023-28686 . Discover the method to resolve the dino-im security vulnerability in Ubuntu which reveals confidential data through network channels.. Ubuntu Security, dino-im, Information Leak, Remote Threat. . Severity: Critical. LinuxSecurity.com Team
Apr 10, 2025
•Critical
Ubuntu
89
security advisoryfedoraupdateFedora 40: FEDORA-2025-a5edb54660 Critical: libtasn1 DoS Fix
Includes CVE fixes.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-a5edb54660 2025-02-26 01:41:52.376662+00:00 -------------------------------------------------------------------------------- Name : libtasn1 Product : Fedora 40 Version : 4.20.0 Release : 1.fc40 URL : Summary : The ASN.1 library used in GNUTLS Description : A library that provides Abstract Syntax Notation One (ASN.1, as specified by the X.680 ITU-T recommendation) parsing and structures management, and Distinguished Encoding Rules (DER, as per X.690) encoding and decoding functions. -------------------------------------------------------------------------------- Update Information: Includes CVE fixes. -------------------------------------------------------------------------------- ChangeLog: * Fri Feb 14 2025 Zoltan Fridrich - 4.20.0-1 - Update to 4.20.0 upstream release -------------------------------------------------------------------------------- References: [ 1 ] Bug #2344196 - libtasn1-4.20.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2344196 [ 2 ] Bug #2344613 - CVE-2024-12133 libtasn1: Inefficient DER Decoding in libtasn1 Leading to Potential Remote DoS [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2344613 [ 3 ] Bug #2344614 - CVE-2024-12133 libtasn1: Inefficient DER Decoding in libtasn1 Leading to Potential Remote DoS [fedora-41] https://bugzilla.redhat.com/show_bug.cgi?id=2344614 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-a5edb54660' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used bythe Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Feb 26, 2025
•Critical
Fedora
172
security advisoryaccess controlUbuntuUbuntu 16.04 LTS USN-7135-1 critical: HAProxy authentication bypass
HAProxy could allow unintended access to network services.. ========================================================================== Ubuntu Security Notice USN-7135-1 December 03, 2024 haproxy vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS Summary: HAProxy could allow unintended access to network services. Software Description: - haproxy: fast and reliable load balancing reverse proxy Details: Bahruz Jabiyev, Anthony Gavazzi, Engin Kirda, Kaan Onarlioglu, Adi Peleg, and Harvey Tuch discovered that HAProxy incorrectly handled empty header names. A remote attacker could possibly use this issue to manipulate headers and bypass certain authentication checks and restrictions. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS haproxy 1.6.3-1ubuntu0.3+esm2 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7135-1 CVE-2023-25725 . An issue with HAProxy on Ubuntu 16.04 LTS may enable unauthorized access to the network. Critical updates have been released.. HAProxy Security Update, Ubuntu 16.04 LTS, Access Control Issue. . Severity: Critical. LinuxSecurity.com Team
Dec 03, 2024
•Critical
Ubuntu
89
security advisoryfedorasoftware updateFedora 40: FEDORA-2024-01127974ec critical: Remote threats in libppd
Fix for remote vulnerabilities against OpenPrinting cups-filters. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2024-01127974ec 2024-09-28 01:26:49.812274 -------------------------------------------------------------------------------- Name : libppd Product : Fedora 40 Version : 2.1~b1 Release : 2.fc40 URL : https://github.com/OpenPrinting/libppd Summary : Library for retro-fitting legacy printer drivers Description : Libppd provides all PPD related function/API which is going to be removed from CUPS 3.X, but are still required for retro-fitting support of legacy printers. The library is meant only for retro-fitting printer applications, any new printer drivers have to be written as native printer application without libppd. -------------------------------------------------------------------------------- Update Information: Fix for remote vulnerabilities against OpenPrinting cups-filters -------------------------------------------------------------------------------- ChangeLog: * Thu Sep 26 2024 Justin M. Forbes - 1:2.1~b1-2 - Fix for CVE-2024-47175 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2314997 - [Major Incident] CVE-2024-47176 cups-browsed: cups-browsed binds on UDP INADDR_ANY:631 trusting any packet from any source [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2314997 [ 2 ] Bug #2315000 - [Major Incident] CVE-2024-47076 libcupsfilters: `cfGetPrinterAttributes` API does not perform sanitization on returned IPP attributes [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2315000 [ 3 ] Bug #2315004 - [Major Incident] CVE-2024-47175 libppd: remote command injection via attacker controlled data in PPD file [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2315004 [ 4 ] Bug #2315005 - [Major Incident] CVE-2024-47177 cups-filters: foomatic-rip incups-filters allows arbitrary command execution via the FoomaticRIPCommandLine PPD parameter [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2315005 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-01127974ec' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Sep 28, 2024
•Critical
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Is continuous patching actually viable?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!