Explore top 10 tips to secure your open-source projects now. Read More
×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 22 articles for you...
100
security advisorySuSEimportantSUSE: Kernel Important Update 2025-03135-1 CVE-2025-38212 Impact on System
* bsc#1231676 * bsc#1231943 * bsc#1237930 * bsc#1245775 * bsc#1246030 . # Security update for the Linux Kernel (Live Patch 61 for SLE 12 SP5) Announcement ID: SUSE-SU-2025:03135-1 Release Date: 2025-09-10T12:34:12Z Rating: important References: * bsc#1231676 * bsc#1231943 * bsc#1237930 * bsc#1245775 * bsc#1246030 Cross-References: * CVE-2022-49053 * CVE-2024-47674 * CVE-2024-47706 * CVE-2025-38000 * CVE-2025-38212 CVSS scores: * CVE-2022-49053 ( SUSE ): 7.3 CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2022-49053 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2022-49053 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-47674 ( SUSE ): 7.3 CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2024-47674 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-47674 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2024-47706 ( SUSE ): 7.3 CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2024-47706 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-47706 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2025-38000 ( SUSE ): 7.3 CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2025-38000 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2025-38212 ( SUSE ): 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2025-38212 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * SUSE Linux Enterprise High Performance Computing 12 SP5 * SUSE Linux Enterprise Live Patching 12-SP5 * SUSE Linux Enterprise Server 12 SP5 * SUSE Linux Enterprise Server for SAP Applications 12 SP5 An update that solves five vulnerabilities can now be installed. ## Description: This update for the Linux Kernel 4.12.14-122_231 fixes several issues. The following security issues werefixed: * CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237930). * CVE-2025-38000: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (bsc#1245775). * CVE-2024-47674: mm: avoid leaving partial pfn mappings around in error case (bsc#1231676). * CVE-2024-47706: block, bfq: fix possible UAF for bfqq-> bic with merge chain (bsc#1231943). * CVE-2025-38212: ipc: fix to protect IPCS lookups using RCU (bsc#1246030). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Live Patching 12-SP5 zypper in -t patch SUSE-SLE-Live-Patching-12-SP5-2025-3136=1 SUSE-SLE-Live- Patching-12-SP5-2025-3137=1 SUSE-SLE-Live-Patching-12-SP5-2025-3135=1 ## Package List: * SUSE Linux Enterprise Live Patching 12-SP5 (ppc64le s390x x86_64) * kgraft-patch-4_12_14-122_231-default-14-2.1 * kgraft-patch-4_12_14-122_228-default-15-2.1 * kgraft-patch-4_12_14-122_225-default-16-2.1 ## References: * https://www.suse.com/security/cve/CVE-2022-49053.html * https://www.suse.com/security/cve/CVE-2024-47674.html * https://www.suse.com/security/cve/CVE-2024-47706.html * https://www.suse.com/security/cve/CVE-2025-38000.html * https://www.suse.com/security/cve/CVE-2025-38212.html * https://bugzilla.suse.com/show_bug.cgi?id=1231676 * https://bugzilla.suse.com/show_bug.cgi?id=1231943 * https://bugzilla.suse.com/show_bug.cgi?id=1237930 * https://bugzilla.suse.com/show_bug.cgi?id=1245775 * https://bugzilla.suse.com/show_bug.cgi?id=1246030 . Critical upgrade for the Linux Kernel tackling various security flaws. Safeguard system stability with this essential fix.. Kernel Patch, SUSE Update, Importance, Security Measures. . Severity: Important. LinuxSecurity.com Team
Sep 10, 2025
•Important
SuSE
219
security advisorycritical updateresource managementRocky Linux 8 RLSA-2025:1612 critical: Node.js Performance Issues
Important: nodejs:22 security update. {"type": "TYPE_SECURITY", "shortCode": "RL", "name": "RLSA-2025:1611", "synopsis": "Important: nodejs:22 security update", "severity": "SEVERITY_IMPORTANT", "topic": "An update is available for module.nodejs-packaging, nodejs-nodemon, nodejs-packaging, module.nodejs-nodemon, nodejs, module.nodejs.\nThis update affects Rocky Linux 8.\nA Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list", "description": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* undici: Undici Uses Insufficiently Random Values (CVE-2025-22150)\n\n* nodejs: Node.js Worker Thread Exposure via Diagnostics Channel (CVE-2025-23083)\n\n* nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "solution": null, "affectedProducts": ["Rocky Linux 8"], "fixes": [{"ticket": "2339176", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2339176", "description": ""}, {"ticket": "2339392", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2339392", "description": ""}, {"ticket": "2342618", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2342618", "description": ""}], "cves": [{"name": "CVE-2025-22150", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2025-22150", "cvss3ScoringVector": "UNKNOWN", "cvss3BaseScore": "UNKNOWN", "cwe": "UNKNOWN"}, {"name": "CVE-2025-23083", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2025-23083", "cvss3ScoringVector": "UNKNOWN", "cvss3BaseScore": "UNKNOWN", "cwe": "UNKNOWN"}, {"name": "CVE-2025-23085", "sourceBy": "MITRE","sourceLink": "https://www.cve.org/CVERecord?id=CVE-2025-23085", "cvss3ScoringVector": "UNKNOWN", "cvss3BaseScore": "UNKNOWN", "cwe": "UNKNOWN"}], "references": [], "publishedAt": "2025-02-26T19:09:52.852483Z", "rpms": {"Rocky Linux 8": {"nvras": ["nodejs-1:22.13.1-1.module+el8.10.0+1935+d3cbe60f.aarch64.rpm", "nodejs-1:22.13.1-1.module+el8.10.0+1935+d3cbe60f.src.rpm", "nodejs-1:22.13.1-1.module+el8.10.0+1935+d3cbe60f.x86_64.rpm", "nodejs-debuginfo-1:22.13.1-1.module+el8.10.0+1935+d3cbe60f.aarch64.rpm", "nodejs-debuginfo-1:22.13.1-1.module+el8.10.0+1935+d3cbe60f.x86_64.rpm", "nodejs-debugsource-1:22.13.1-1.module+el8.10.0+1935+d3cbe60f.aarch64.rpm", "nodejs-debugsource-1:22.13.1-1.module+el8.10.0+1935+d3cbe60f.x86_64.rpm", "nodejs-devel-1:22.13.1-1.module+el8.10.0+1935+d3cbe60f.aarch64.rpm", "nodejs-devel-1:22.13.1-1.module+el8.10.0+1935+d3cbe60f.x86_64.rpm", "nodejs-docs-1:22.13.1-1.module+el8.10.0+1935+d3cbe60f.noarch.rpm", "nodejs-full-i18n-1:22.13.1-1.module+el8.10.0+1935+d3cbe60f.aarch64.rpm", "nodejs-full-i18n-1:22.13.1-1.module+el8.10.0+1935+d3cbe60f.x86_64.rpm", "nodejs-libs-1:22.13.1-1.module+el8.10.0+1935+d3cbe60f.aarch64.rpm", "nodejs-libs-1:22.13.1-1.module+el8.10.0+1935+d3cbe60f.x86_64.rpm", "nodejs-libs-debuginfo-1:22.13.1-1.module+el8.10.0+1935+d3cbe60f.aarch64.rpm", "nodejs-libs-debuginfo-1:22.13.1-1.module+el8.10.0+1935+d3cbe60f.x86_64.rpm", "nodejs-nodemon-0:3.0.1-1.module+el8.10.0+1666+930e28e8.noarch.rpm", "nodejs-nodemon-0:3.0.1-1.module+el8.10.0+1666+930e28e8.src.rpm", "nodejs-packaging-0:2021.06-4.module+el8.10.0+1667+4a788d89.noarch.rpm", "nodejs-packaging-0:2021.06-4.module+el8.10.0+1667+4a788d89.src.rpm", "nodejs-packaging-bundler-0:2021.06-4.module+el8.10.0+1667+4a788d89.noarch.rpm", "npm-1:10.9.2-1.22.13.1.1.module+el8.10.0+1935+d3cbe60f.aarch64.rpm", "npm-1:10.9.2-1.22.13.1.1.module+el8.10.0+1935+d3cbe60f.x86_64.rpm", "v8-12.4-devel-3:12.4.254.21-1.22.13.1.1.module+el8.10.0+1935+d3cbe60f.aarch64.rpm","v8-12.4-devel-3:12.4.254.21-1.22.13.1.1.module+el8.10.0+1935+d3cbe60f.x86_64.rpm"]}}, "rebootSuggested": false, "buildReferences": []}. Latest Node.js security updates for Rocky Linux tackle serious vulnerabilities related to resource handling and randomness deficiencies.. NodeJS Security Update, Rocky Linux Advisories, Important Software Patches. . Severity: Important. LinuxSecurity.com Team
Feb 26, 2025
•Important
Rocky Linux
172
security advisorydenial of servicesoftware patchUbuntu 18.04 LTS: USN-6896-2 Moderate: Linux Kernel Denial Of Service
Several security issues were fixed in the Linux kernel.. ========================================================================== Ubuntu Security Notice USN-6896-2 July 16, 2024 linux-hwe-5.4, linux-oracle-5.4 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS Summary: Several security issues were fixed in the Linux kernel. Software Description: - linux-hwe-5.4: Linux hardware enablement (HWE) kernel - linux-oracle-5.4: Linux kernel for Oracle Cloud systems Details: It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270) It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042) Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099) Gui-Dong Han discovered that the software RAID driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. A privileged attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-23307) It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel when modifying certain settings values through debugfs. A privileged local attacker could use this to cause a denial of service. (CVE-2024-24857, CVE-2024-24858, CVE-2024-24859) Bai Jiaju discovered that the Xceive XC4000 silicon tuner device driver in the Linux kernel contained a race condition, leading to an integeroverflow vulnerability. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-24861) Chenyuan Yang discovered that the Unsorted Block Images (UBI) flash device volume management subsystem did not properly validate logical eraseblock sizes in certain situations. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-25739) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - x86 architecture; - Block layer subsystem; - Accessibility subsystem; - ACPI drivers; - Android drivers; - Bluetooth drivers; - Clock framework and drivers; - Data acquisition framework and drivers; - Cryptographic API; - GPU drivers; - HID subsystem; - I2C subsystem; - IRQ chip drivers; - Multiple devices driver; - Media drivers; - VMware VMCI Driver; - MMC subsystem; - Network drivers; - PCI subsystem; - SCSI drivers; - Freescale SoC drivers; - SPI subsystem; - Media staging drivers; - TTY drivers; - USB subsystem; - VFIO drivers; - Framebuffer layer; - Xen hypervisor drivers; - File systems infrastructure; - BTRFS file system; - Ext4 file system; - FAT file system; - NILFS2 file system; - Diskquota system; - SMB network file system; - UBI file system; - io_uring subsystem; - BPF subsystem; - Core kernel; - Memory management; - B.A.T.M.A.N. meshing protocol; - Bluetooth subsystem; - Networking core; - HSR network protocol; - IPv4 networking; - IPv6 networking; - MAC80211 subsystem; - Netfilter; - NET/ROM layer; - NFC subsystem; - Open vSwitch; - Packet sockets; - RDS protocol; - Network traffic control; - Sun RPC protocol; - Unix domain sockets; - ALSA SH drivers; - USB sound devices; - KVM core; (CVE-2024-27076, CVE-2024-35849, CVE-2024-35899, CVE-2024-27038, CVE-2024-35982, CVE-2024-26687, CVE-2024-26863,CVE-2024-36004, CVE-2024-27004, CVE-2024-27065, CVE-2024-36020, CVE-2024-27000, CVE-2024-26981, CVE-2024-26973, CVE-2024-35922, CVE-2024-35969, CVE-2024-26851, CVE-2023-52880, CVE-2024-35813, CVE-2024-26859, CVE-2024-27078, CVE-2024-27020, CVE-2024-35809, CVE-2024-27001, CVE-2024-26969, CVE-2024-26993, CVE-2024-35935, CVE-2024-35815, CVE-2024-26931, CVE-2024-35823, CVE-2024-26984, CVE-2024-27024, CVE-2024-27419, CVE-2024-27008, CVE-2024-35825, CVE-2023-52644, CVE-2024-35933, CVE-2024-35830, CVE-2024-35900, CVE-2024-27046, CVE-2024-26651, CVE-2024-27013, CVE-2024-27437, CVE-2024-26966, CVE-2024-26974, CVE-2024-26889, CVE-2024-26862, CVE-2024-27043, CVE-2024-35852, CVE-2024-35821, CVE-2024-35886, CVE-2024-35888, CVE-2023-52699, CVE-2024-35997, CVE-2024-26586, CVE-2024-35898, CVE-2024-26934, CVE-2024-35915, CVE-2024-35897, CVE-2024-35973, CVE-2024-27028, CVE-2024-26874, CVE-2024-26923, CVE-2024-26937, CVE-2024-26857, CVE-2024-26855, CVE-2024-35893, CVE-2024-26810, CVE-2024-35910, CVE-2024-26820, CVE-2024-27075, CVE-2024-26816, CVE-2024-26642, CVE-2024-35936, CVE-2024-27073, CVE-2024-35853, CVE-2024-26965, CVE-2023-52650, CVE-2024-27396, CVE-2024-26999, CVE-2024-35855, CVE-2024-26880, CVE-2024-26901, CVE-2024-26894, CVE-2024-26884, CVE-2024-35950, CVE-2024-26957, CVE-2024-27395, CVE-2024-35819, CVE-2024-35978, CVE-2024-36007, CVE-2024-35805, CVE-2024-27436, CVE-2023-52620, CVE-2023-52656, CVE-2024-36006, CVE-2024-35877, CVE-2024-26898, CVE-2024-26935, CVE-2024-35828, CVE-2024-26875, CVE-2024-26654, CVE-2024-35930, CVE-2024-26817, CVE-2024-27388, CVE-2024-26828, CVE-2024-35984, CVE-2024-26812, CVE-2024-35807, CVE-2024-35854, CVE-2024-26878, CVE-2024-26883, CVE-2024-27077, CVE-2024-26922, CVE-2024-27059, CVE-2024-35955, CVE-2024-26903, CVE-2024-35895, CVE-2024-35925, CVE-2024-26882, CVE-2022-48627, CVE-2024-35847, CVE-2024-26813, CVE-2024-26994, CVE-2024-35806, CVE-2024-26926, CVE-2024-35822, CVE-2024-27074, CVE-2024-26976, CVE-2024-26955, CVE-2024-27044, CVE-2024-35789, CVE-2024-27030, CVE-2024-26852, CVE-2024-27053,CVE-2024-35960, CVE-2024-26956, CVE-2024-35944) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS linux-image-5.4.0-1127-oracle 5.4.0-1127.136~18.04.1 Available with Ubuntu Pro linux-image-5.4.0-189-generic 5.4.0-189.209~18.04.1 Available with Ubuntu Pro linux-image-5.4.0-189-lowlatency 5.4.0-189.209~18.04.1 Available with Ubuntu Pro linux-image-generic-hwe-18.04 5.4.0.189.209~18.04.1 Available with Ubuntu Pro linux-image-lowlatency-hwe-18.04 5.4.0.189.209~18.04.1 Available with Ubuntu Pro linux-image-oem 5.4.0.189.209~18.04.1 Available with Ubuntu Pro linux-image-oem-osp1 5.4.0.189.209~18.04.1 Available with Ubuntu Pro linux-image-oracle 5.4.0.1127.136~18.04.1 Available with Ubuntu Pro linux-image-snapdragon-hwe-18.04 5.4.0.189.209~18.04.1 Available with Ubuntu Pro linux-image-virtual-hwe-18.04 5.4.0.189.209~18.04.1 Available with Ubuntu Pro After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well. References: https://ubuntu.com/security/notices/USN-6896-2 https://ubuntu.com/security/notices/USN-6896-1 CVE-2022-48627, CVE-2023-52620, CVE-2023-52644, CVE-2023-52650, CVE-2023-52656, CVE-2023-52699, CVE-2023-52880, CVE-2023-6270, CVE-2023-7042, CVE-2024-22099, CVE-2024-23307, CVE-2024-24857, CVE-2024-24858, CVE-2024-24859, CVE-2024-24861, CVE-2024-25739, CVE-2024-26586, CVE-2024-26642, CVE-2024-26651, CVE-2024-26654, CVE-2024-26687,CVE-2024-26810, CVE-2024-26812, CVE-2024-26813, CVE-2024-26816, CVE-2024-26817, CVE-2024-26820, CVE-2024-26828, CVE-2024-26851, CVE-2024-26852, CVE-2024-26855, CVE-2024-26857, CVE-2024-26859, CVE-2024-26862, CVE-2024-26863, CVE-2024-26874, CVE-2024-26875, CVE-2024-26878, CVE-2024-26880, CVE-2024-26882, CVE-2024-26883, CVE-2024-26884, CVE-2024-26889, CVE-2024-26894, CVE-2024-26898, CVE-2024-26901, CVE-2024-26903, CVE-2024-26922, CVE-2024-26923, CVE-2024-26926, CVE-2024-26931, CVE-2024-26934, CVE-2024-26935, CVE-2024-26937, CVE-2024-26955, CVE-2024-26956, CVE-2024-26957, CVE-2024-26965, CVE-2024-26966, CVE-2024-26969, CVE-2024-26973, CVE-2024-26974, CVE-2024-26976, CVE-2024-26981, CVE-2024-26984, CVE-2024-26993, CVE-2024-26994, CVE-2024-26999, CVE-2024-27000, CVE-2024-27001, CVE-2024-27004, CVE-2024-27008, CVE-2024-27013, CVE-2024-27020, CVE-2024-27024, CVE-2024-27028, CVE-2024-27030, CVE-2024-27038, CVE-2024-27043, CVE-2024-27044, CVE-2024-27046, CVE-2024-27053, CVE-2024-27059, CVE-2024-27065, CVE-2024-27073, CVE-2024-27074, CVE-2024-27075, CVE-2024-27076, CVE-2024-27077, CVE-2024-27078, CVE-2024-27388, CVE-2024-27395, CVE-2024-27396, CVE-2024-27419, CVE-2024-27436, CVE-2024-27437, CVE-2024-35789, CVE-2024-35805, CVE-2024-35806, CVE-2024-35807, CVE-2024-35809, CVE-2024-35813, CVE-2024-35815, CVE-2024-35819, CVE-2024-35821, CVE-2024-35822, CVE-2024-35823, CVE-2024-35825, CVE-2024-35828, CVE-2024-35830, CVE-2024-35847, CVE-2024-35849, CVE-2024-35852, CVE-2024-35853, CVE-2024-35854, CVE-2024-35855, CVE-2024-35877, CVE-2024-35886, CVE-2024-35888, CVE-2024-35893, CVE-2024-35895, CVE-2024-35897, CVE-2024-35898, CVE-2024-35899, CVE-2024-35900, CVE-2024-35910, CVE-2024-35915, CVE-2024-35922, CVE-2024-35925, CVE-2024-35930, CVE-2024-35933, CVE-2024-35935, CVE-2024-35936, CVE-2024-35944, CVE-2024-35950, CVE-2024-35955, CVE-2024-35960, CVE-2024-35969, CVE-2024-35973, CVE-2024-35978, CVE-2024-35982, CVE-2024-35984, CVE-2024-35997, CVE-2024-36004, CVE-2024-36006,CVE-2024-36007, CVE-2024-36020 . The Linux Security Bulletin details vulnerabilities within the kernel and recommends critical patches to safeguard systems from various risks.. Ubuntu Updates, Kernel Security Advisory, Denial of Service Fixes. . LinuxSecurity.com Team
Jul 16, 2024
Ubuntu
172
security advisorydenial of servicesecurity issueUbuntu 24.04 LTS USN-6837-1 Moderate: Rack Denial Of Service
Several security issues were fixed in Rack.. ========================================================================== Ubuntu Security Notice USN-6837-1 June 17, 2024 ruby-rack vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.04 LTS - Ubuntu 23.10 Summary: Several security issues were fixed in Rack. Software Description: - ruby-rack: modular Ruby webserver interface Details: It was discovered that Rack incorrectly handled Multipart MIME parsing. A remote attacker could possibly use this issue to cause Rack to consume resources, leading to a denial of service. This issue only affected Ubuntu 23.10. (CVE-2023-27530) It was discovered that Rack incorrectly parsed certain media types. A remote attacker could possibly use this issue to cause Rack to consume resources, leading to a denial of service. (CVE-2024-25126) It was discovered that Rack incorrectly handled certain Range headers. A remote attacker could possibly use this issue to cause Rack to create large responses, leading to a denial of service. This issue only affected Ubuntu 24.04 LTS. (CVE-2024-26141) It was discovered that Rack incorrectly handled certain crafted headers. A remote attacker could possibly use this issue to cause Rack to consume resources, leading to a denial of service. This issue only affected Ubuntu 24.04 LTS. (CVE-2024-26146) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 24.04 LTS ruby-rack 2.2.7-1ubuntu0.1 Ubuntu 23.10 ruby-rack 2.2.4-3ubuntu0.2 After a standard system update you need to restart any applications using Rack to make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6837-1 CVE-2023-27530, CVE-2024-25126, CVE-2024-26141, CVE-2024-26146 Package Information: https://launchpad.net/ubuntu/+source/ruby-rack/2.2.7-1ubuntu0.1 https://launchpad.net/ubuntu/+source/ruby-rack/2.2.4-3ubuntu0.2 . Multiple vulnerabilities impacting Ruby Rack in Ubuntu 24.04 LTS and 23.10 necessitate urgent action to ensure security.. rack security,ruby vulnerability,ubuntu update,denial of service,resource management. . Severity: Important. LinuxSecurity.com Team
Jun 17, 2024
•Important
Ubuntu
87
security advisorydenial of servicedebianDebian 12: DSA-5665-1 critical: tomcat10 request smuggling and dos
Several security vulnerabilities have been discovered in the Tomcat servlet and JSP engine. CVE-2023-46589 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-5665-1
Apr 17, 2024
•Critical
Debian
203
security advisorydenial of serviceinput validationMageia 9: 2024-0090 Critical: Apache Tomcat DoS for WebSocket Clients
Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption. (CVE-2024-23672) Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if . MGASA-2024-0090 - Updated tomcat packages fix security vulnerabilities Publication date: 26 Mar 2024 URL: https://advisories.mageia.org/MGASA-2024-0090.html Type: security Affected Mageia releases: 9 CVE: CVE-2024-23672, CVE-2024-24549 Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption. (CVE-2024-23672) Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed. (CVE-2024-24549) References: - https://bugs.mageia.org/show_bug.cgi?id=32980 - https://www.openwall.com/lists/oss-security/2024/03/13/3 - https://www.openwall.com/lists/oss-security/2024/03/13/4 - https://www.cve.org/CVERecord?id=CVE-2024-23672 - https://www.cve.org/CVERecord?id=CVE-2024-24549 SRPMS: - 9/core/tomcat-9.0.87-1.mga9 . Revised Apache folders tackle vulnerabilities, enhancing operational efficiency and guaranteeing more secure WebSocket interactions.. Mageia Security Advisory, Apache Tomcat Update, Denial of Service Fix, Input Validation Improvement. . Severity: Critical. LinuxSecurity.com Team
Mar 26, 2024
•Critical
Mageia
172
security advisorycriticalDoSUbuntu 23.10: USN-6657-1 Critical Dnsmasq Denial of Service
Several security issues were fixed in Dnsmasq.. ========================================================================== Ubuntu Security Notice USN-6657-1 February 26, 2024 dnsmasq vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 23.10 - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS Summary: Several security issues were fixed in Dnsmasq. Software Description: - dnsmasq: Small caching DNS proxy and DHCP/TFTP server Details: Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered that Dnsmasq icorrectly handled validating DNSSEC messages. A remote attacker could possibly use this issue to cause Dnsmasq to consume resources, leading to a denial of service. (CVE-2023-50387) It was discovered that Dnsmasq incorrectly handled preparing an NSEC3 closest encloser proof. A remote attacker could possibly use this issue to cause Dnsmasq to consume resources, leading to a denial of service. (CVE-2023-50868) It was discovered that Dnsmasq incorrectly set the maximum EDNS.0 UDP packet size as required by DNS Flag Day 2020. This issue only affected Ubuntu 23.10. (CVE-2023-28450) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 23.10: dnsmasq-base 2.90-0ubuntu0.23.10.1 Ubuntu 22.04 LTS: dnsmasq-base 2.90-0ubuntu0.22.04.1 Ubuntu 20.04 LTS: dnsmasq-base 2.90-0ubuntu0.20.04.1 This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to reboot your computer to make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6657-1 CVE-2023-28450, CVE-2023-50387, CVE-2023-50868 Package Information: https://launchpad.net/ubuntu/+source/dnsmasq/2.90-0ubuntu0.23.10.1 . Protect your Ubuntu systemfrom vulnerabilities by implementing essential Dnsmasq security protocols. Follow these urgent update steps for enhanced safety. dnsmasq vulnerabilities,Ubuntu security update,dnsmasq DoS,Ubuntu dnsmasq patch,system security advisory. . Severity: Critical. LinuxSecurity.com Team
Feb 26, 2024
•Critical
Ubuntu
172
security advisorymoderatedenial of serviceUbuntu 20.04: USN-6642-2 Addresses Moderate Security Flaws in Bind
Several security issues were fixed in Bind.. ========================================================================== Ubuntu Security Notice USN-6642-1 February 19, 2024 bind9 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.04 LTS Summary: Several security issues were fixed in Bind. Software Description: - bind9: Internet Domain Name Server Details: Shoham Danino, Anat Bremler-Barr, Yehuda Afek, and Yuval Shavitt discovered that Bind incorrectly handled parsing large DNS messages. A remote attacker could possibly use this issue to cause Bind to consume resources, leading to a denial of service. (CVE-2023-4408) Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered that Bind icorrectly handled validating DNSSEC messages. A remote attacker could possibly use this issue to cause Bind to consume resources, leading to a denial of service. (CVE-2023-50387) It was discovered that Bind incorrectly handled preparing an NSEC3 closest encloser proof. A remote attacker could possibly use this issue to cause Bind to consume resources, leading to a denial of service. (CVE-2023-50868) It was discovered that Bind incorrectly handled reverse zone queries when nxdomain-redirect is enabled. A remote attacker could possibly use this issue to cause Bind to crash, leading to a denial of service. (CVE-2023-5517) It was discovered that Bind incorrectly handled certain specific recursive query patterns. A remote attacker could possibly use this issue to cause Bind to consume memory, leading to a denial of service. (CVE-2023-6516) Bind has been updated to 9.6.48. In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes. Please see the following for more information: https://downloads.isc.org/isc/bind9/9.16.48/doc/arm/html/notes.html Update instructions: Theproblem can be corrected by updating your system to the following package versions: Ubuntu 20.04 LTS: bind9 1:9.16.48-0ubuntu0.20.04.1 This update uses a new upstream release, which includes additional bug fixes. In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6642-1 CVE-2023-4408, CVE-2023-50387, CVE-2023-50868, CVE-2023-5517, CVE-2023-6516 Package Information: https://launchpad.net/ubuntu/+source/bind9/1:9.16.48-0ubuntu0.20.04.1 . Several Bind security flaws discovered in Ubuntu 20.04 LTS could result in possible denial of service; system updates advised.. Bind Security Advisory, DNS Management, Ubuntu Updates. . LinuxSecurity.com Team
Feb 19, 2024
Ubuntu
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!