Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -6 articles for you...
98
security advisorysecurity issuememory corruptionRed Hat Enterprise Linux 7 RHSA-2015:2237-03 Low: Memory Crash Risk
Updated rest packages that fix one security issue are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Low: rest security update Advisory ID: RHSA-2015:2237-03 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2015:2237.html Issue date: 2015-11-19 CVE Names: CVE-2015-2675 ==================================================================== 1. Summary: Updated rest packages that fix one security issue are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - aarch64, ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - aarch64, ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 3. Description: The rest library was designed to make it easier to access web services that claim to be RESTful. A RESTful service should have URLs that represent remote objects, which methods can then be called on. It was found that the OAuth implementation in librest, a helper library for RESTful services, incorrectly truncated the pointer returned by the rest_proxy_call_get_url call. An attacker could use thisflaw to crash an application using the librest library. (CVE-2015-2675) All users of rest are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, all applications using librest must be restarted for the update to take effect. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1183982 - Memory corruption when using oauth because of implicit declaration of rest_proxy_call_get_url 1199049 - CVE-2015-2675 rest: memory corruption when using oauth because of implicit declaration of rest_proxy_call_get_url 6. Package List: Red Hat Enterprise Linux Client (v. 7): Source: rest-0.7.92-3.el7.src.rpm x86_64: rest-0.7.92-3.el7.i686.rpm rest-0.7.92-3.el7.x86_64.rpm rest-debuginfo-0.7.92-3.el7.i686.rpm rest-debuginfo-0.7.92-3.el7.x86_64.rpm Red Hat Enterprise Linux Client Optional (v. 7): x86_64: rest-debuginfo-0.7.92-3.el7.i686.rpm rest-debuginfo-0.7.92-3.el7.x86_64.rpm rest-devel-0.7.92-3.el7.i686.rpm rest-devel-0.7.92-3.el7.x86_64.rpm Red Hat Enterprise Linux ComputeNode (v. 7): Source: rest-0.7.92-3.el7.src.rpm x86_64: rest-0.7.92-3.el7.i686.rpm rest-0.7.92-3.el7.x86_64.rpm rest-debuginfo-0.7.92-3.el7.i686.rpm rest-debuginfo-0.7.92-3.el7.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): x86_64: rest-debuginfo-0.7.92-3.el7.i686.rpm rest-debuginfo-0.7.92-3.el7.x86_64.rpm rest-devel-0.7.92-3.el7.i686.rpm rest-devel-0.7.92-3.el7.x86_64.rpm Red Hat Enterprise Linux Server (v.7): Source: rest-0.7.92-3.el7.src.rpm aarch64: rest-0.7.92-3.el7.aarch64.rpm rest-debuginfo-0.7.92-3.el7.aarch64.rpm ppc64: rest-0.7.92-3.el7.ppc.rpm rest-0.7.92-3.el7.ppc64.rpm rest-debuginfo-0.7.92-3.el7.ppc.rpm rest-debuginfo-0.7.92-3.el7.ppc64.rpm ppc64le: rest-0.7.92-3.el7.ppc64le.rpm rest-debuginfo-0.7.92-3.el7.ppc64le.rpm s390x: rest-0.7.92-3.el7.s390.rpm rest-0.7.92-3.el7.s390x.rpm rest-debuginfo-0.7.92-3.el7.s390.rpm rest-debuginfo-0.7.92-3.el7.s390x.rpm x86_64: rest-0.7.92-3.el7.i686.rpm rest-0.7.92-3.el7.x86_64.rpm rest-debuginfo-0.7.92-3.el7.i686.rpm rest-debuginfo-0.7.92-3.el7.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): aarch64: rest-debuginfo-0.7.92-3.el7.aarch64.rpm rest-devel-0.7.92-3.el7.aarch64.rpm ppc64: rest-debuginfo-0.7.92-3.el7.ppc.rpm rest-debuginfo-0.7.92-3.el7.ppc64.rpm rest-devel-0.7.92-3.el7.ppc.rpm rest-devel-0.7.92-3.el7.ppc64.rpm ppc64le: rest-debuginfo-0.7.92-3.el7.ppc64le.rpm rest-devel-0.7.92-3.el7.ppc64le.rpm s390x: rest-debuginfo-0.7.92-3.el7.s390.rpm rest-debuginfo-0.7.92-3.el7.s390x.rpm rest-devel-0.7.92-3.el7.s390.rpm rest-devel-0.7.92-3.el7.s390x.rpm x86_64: rest-debuginfo-0.7.92-3.el7.i686.rpm rest-debuginfo-0.7.92-3.el7.x86_64.rpm rest-devel-0.7.92-3.el7.i686.rpm rest-devel-0.7.92-3.el7.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: rest-0.7.92-3.el7.src.rpm x86_64: rest-0.7.92-3.el7.i686.rpm rest-0.7.92-3.el7.x86_64.rpm rest-debuginfo-0.7.92-3.el7.i686.rpm rest-debuginfo-0.7.92-3.el7.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): x86_64: rest-debuginfo-0.7.92-3.el7.i686.rpm rest-debuginfo-0.7.92-3.el7.x86_64.rpm rest-devel-0.7.92-3.el7.i686.rpm rest-devel-0.7.92-3.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-2675 https://access.redhat.com/security/updates/classification/#low 8. Contact: The Red Hatsecurity contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFWTkFrXlSAg2UNWIIRAs4WAJ4lqg3HGVnkd8q2pF+zRdV2+SbU4wCgoOOa y+cnHn+FcL0VgTqgVr0YUKk=bSun -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list
Nov 19, 2015
•Low
Red Hat
89
security advisoryFedoramemory corruptionFedora 22: FEDORA-2016-5812 Moderate: Heap Buffer Overflow Vulnerability
CVE-2015-2675 rest: memory corruption when using oauth because of implicit declaration of rest_proxy_call_get_url. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2015-4596 2015-03-26 16:40:29 -------------------------------------------------------------------------------- Name : rest Product : Fedora 21 Version : 0.7.93 Release : 1.fc21 URL : https://www.gnome.org/ Summary : A library for access to RESTful web services Description : This library was designed to make it easier to access web services that claim to be "RESTful". A RESTful service should have urls that represent remote objects, which methods can then be called on. The majority of services don't actually adhere to this strict definition. Instead, their RESTful end point usually has an API that is just simpler to use compared to other types of APIs they may support (XML-RPC, for instance). It is this kind of API that this library is attempting to support. -------------------------------------------------------------------------------- Update Information: CVE-2015-2675 rest: memory corruption when using oauth because of implicit declaration of rest_proxy_call_get_url -------------------------------------------------------------------------------- ChangeLog: * Wed Mar 18 2015 Kalev Lember - 0.7.93-1 - Update to 0.7.93 - Tighten deps with the _isa macro - Don't manually require pkgconfig; rpmbuild generates this automatically - Use license macro for the COPYING file * Fri Jan 9 2015 Debarshi Ray 0.7.92-6 - Backport upstream patch to fix a memory error (GNOME #742644) -------------------------------------------------------------------------------- References: [ 1 ] Bug #1112497 - Please update to librest 0.7.91 in f20 https://bugzilla.redhat.com/show_bug.cgi?id=1112497 [ 2 ] Bug #1204682 - rest: memory corruption when using oauth because of implicit declaration of rest_proxy_call_get_url [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1204682 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update rest' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Apr 18, 2015
Fedora
89
security advisoryFedoramemory corruptionFedora 20: 2015-4554 Moderate: Rest OAuth Memory Corruption
CVE-2015-2675 rest: memory corruption when using oauth because of implicit declaration of rest_proxy_call_get_url. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2015-4554 2015-03-26 16:38:36 -------------------------------------------------------------------------------- Name : rest Product : Fedora 20 Version : 0.7.93 Release : 1.fc20 URL : https://www.gnome.org/ Summary : A library for access to RESTful web services Description : This library was designed to make it easier to access web services that claim to be "RESTful". A RESTful service should have urls that represent remote objects, which methods can then be called on. The majority of services don't actually adhere to this strict definition. Instead, their RESTful end point usually has an API that is just simpler to use compared to other types of APIs they may support (XML-RPC, for instance). It is this kind of API that this library is attempting to support. -------------------------------------------------------------------------------- Update Information: CVE-2015-2675 rest: memory corruption when using oauth because of implicit declaration of rest_proxy_call_get_url -------------------------------------------------------------------------------- ChangeLog: * Wed Mar 18 2015 Kalev Lember - 0.7.93-1 - Update to 0.7.93 - Tighten deps with the _isa macro - Don't manually require pkgconfig; rpmbuild generates this automatically - Use license macro for the COPYING file * Fri Jan 9 2015 Debarshi Ray 0.7.92-6 - Backport upstream patch to fix a memory error (GNOME #742644) * Wed Sep 3 2014 Peter Robinson 0.7.92-5 - Update to 0.7.92 * Sun Aug 17 2014 Fedora Release Engineering - 0.7.91-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild * Wed Aug 6 2014 Peter Robinson 0.7.91-4 - Drop old patch that doesn't appear to be needed any more and causes build issues * Tue Jul 22 2014 Kalev Lember - 0.7.91-3 - Rebuilt forgobject-introspection 1.41.4 * Sun Jun 8 2014 Fedora Release Engineering - 0.7.91-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild * Tue Mar 11 2014 Richard Hughes - 0.7.91-1 - Update to 0.7.91 -------------------------------------------------------------------------------- References: [ 1 ] Bug #1112497 - Please update to librest 0.7.91 in f20 https://bugzilla.redhat.com/show_bug.cgi?id=1112497 [ 2 ] Bug #1204682 - rest: memory corruption when using oauth because of implicit declaration of rest_proxy_call_get_url [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1204682 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update rest' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Apr 18, 2015
•Important
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!