Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 524
Alerts This Week
Warning Icon 1 524

Stay Secure with the Latest Linux Advisories

Opensuse Large Esm H800
openSUSE

openSUSE go1.25-openssl Important Security Issues 2026-3151-1

Calendar White Jul 21, 2026
Important
Opensuse Large Esm H900
openSUSE

openSUSE aws-nitro-enclaves-cli Important Issues Advisory 2026-3152-1

Calendar White Jul 21, 2026
Important
Opensuse Large Esm H900
openSUSE

openSUSE nghttp2 Moderate HTTP Request Smuggling Issue 2026-3153-1

Calendar White Jul 21, 2026
moderate
Opensuse Large Esm H800
openSUSE

openSUSE python-tornado6 Moderate Credential Leak Vulnerability 2026-3155-1

Calendar White Jul 21, 2026
moderate
Opensuse Large Esm H900
openSUSE

openSUSE Kernel Important Security Update Vulnerability Fix 2026-3156-1

Calendar White Jul 21, 2026
Important
Opensuse Large Esm H900
openSUSE

openSUSE php7 Moderate Buffer Vulnerability Resolution SUSE-SU-2026-3165-1

Calendar White Jul 21, 2026
moderate
Opensuse Large Esm H800
openSUSE

openSUSE libkrun Important Patch 2026-0255-1 for 8 Issues

Calendar White Jul 21, 2026
Important
Rockylinux Esm H900
Rocky

Rocky Linux httpd Important Denial of Service Fix RLSA-2026-42828

Calendar White Jul 21, 2026
Important
Ubuntu Large Esm H900
Ubuntu

Ubuntu 20.04 AccountsService Critical Exec Command Threat USN-8580-2

Calendar White Jul 21, 2026
Critical
Filter%20icon Refine advisories
X Clear Filters
X Clear Filters
View More

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

More Polls

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":1,"type":"x","order":4,"pct":100,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Loading...

Explore Latest Linux Security advisories

We found 5 articles for you...
172
Ls Advisories Ubuntu Esm H240
Price Tag%201security advisorydenial of serviceUbuntu

Ubuntu 22.04: RubyGems Potential ReDoS Vulnerability USN-7747-2

RubyGems could be made to consume resources if it received specially crafted input.. ========================================================================== Ubuntu Security Notice USN-7747-1 September 15, 2025 rubygems vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS Summary: RubyGems could be made to consume resources if it received specially crafted input. Software Description: - rubygems: package management framework for Ruby libraries/applications Details: It was discovered that RubyGems incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause RubyGems to consume resources, leading to a regular expression denial of service (ReDoS). Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS ruby-bundler 2.3.5-2ubuntu1.2 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7747-1 CVE-2023-36617 Package Information: . Ubuntu Security Notice USN-7747-1 highlights a RubyGems issue that could lead to resource consumption and ReDoS.. RubyGems Update, ReDoS Attack Prevention, Ubuntu Security Advisory, System Improvement. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Sep 15, 2025 •Important Ubuntu
172
Ls Advisories Ubuntu Esm H240
Price Tag%201security advisorycriticalUbuntu

RubyGems Critical DoS Vulnerabilities in Ubuntu 22.04 LTS USN-7735-1

Several security issues were fixed in RubyGems.. ========================================================================== Ubuntu Security Notice USN-7735-1 September 03, 2025 rubygems vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 25.04 - Ubuntu 22.04 LTS Summary: Several security issues were fixed in RubyGems. Software Description: - rubygems: package management framework for Ruby libraries/applications Details: It was discovered that RubyGems incorrectly handled certain regular expressions. An attacker could use this issue to cause RubyGems to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2023-28755) It was discovered that RubyGems incorrectly handled decompressed domain names within a DNS packet. An attacker could use this issue to cause RubyGems to crash, resulting in a denial of service. This issue only affected Ubuntu 25.04. (CVE-2025-24294) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 25.04 ruby-rubygems 3.6.3-1ubuntu0.1 Ubuntu 22.04 LTS ruby-rubygems 3.3.5-2ubuntu1.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7735-1 CVE-2023-28755, CVE-2025-24294 Package Information: https://launchpad.net/ubuntu/+source/rubygems/3.6.3-1ubuntu0.1 https://launchpad.net/ubuntu/+source/rubygems/3.3.5-2ubuntu1.1 . Critical issues have been resolved in RubyGems for Ubuntu 22.04 LTS and 25.04. Prompt updates are recommended.. RubyGems Security, Denial of Service, Ubuntu 22.04, Ubuntu 25.04 Security. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Sep 04, 2025 •Critical Ubuntu
Banner 2 1028x280 1708121730 1 1771599631
197
Ls Advisories Deblts Esm H240
Price Tag%201security advisorycode executionDebian

Debian 11: DLA-4163-1 critical: rubygems code execution risks

Multiple vulnerabilities were found in rubygems, which contains a package management framework for Ruby and a dependency manager for Ruby applications. CVE-2021-43809 . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4163-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/lts/security/ Lucas Kanashiro May 12, 2025 https://wiki.debian.org/LTS - ------------------------------------------------------------------------- Package : rubygems Version : 3.2.5-2+deb11u1 CVE ID : CVE-2021-43809 CVE-2023-28755 CVE-2025-27221 Multiple vulnerabilities were found in rubygems, which contains a package management framework for Ruby and a dependency manager for Ruby applications. CVE-2021-43809 In bundler versions before 2.2.33, when working with untrusted and apparently harmless `Gemfile`'s, it is not expected that they lead to execution of external code, unless that's explicit in the ruby code inside the `Gemfile` itself. However, if the `Gemfile` includes `gem` entries that use the `git` option with invalid, but seemingly harmless, values with a leading dash, this can be false. To handle dependencies that come from a Git repository instead of a registry, Bundler uses various commands, such as `git clone`. These commands are being constructed using user input (e.g. the repository URL). When building the commands, Bundler versions before 2.2.33 correctly avoid Command Injection vulnerabilities by passing an array of arguments instead of a command string. However, there is the possibility that a user input starts with a dash (`-`) and is therefore treated as an optional argument instead of a positional one. This can lead to Code Execution because some of the commands have options that can be leveraged to run arbitrary executables. CVE-2023-28755 A ReDoS issue was discovered in the URI component through 0.12.0 inRuby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. CVE-2025-27221 The URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host. For Debian 11 bullseye, these problems have been fixed in version 3.2.5-2+deb11u1. We recommend that you upgrade your rubygems packages. For the detailed security status of rubygems please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/rubygems Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Numerous vulnerabilities discovered in gem packages pose threats of unauthorized execution and sensitive data exposure. Promptly upgrade for enhanced security.. rubygems security update, Debian advisory, code execution risks, Redos issue, authentication leakage. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 May 12, 2025 •Critical Debian LTS
197
Ls Advisories Deblts Esm H240
Price Tag%201security advisorycriticaldebian

Debian 8 Jessie DLA-1735-1 Critical Ruby2.1 Escape Injection Threat

Several vulnerabilities have been discovered in rubygems embedded in ruby2.1, the interpreted scripting language. . Package : ruby2.1 Version : 2.1.5-2+deb8u7 CVE ID : CVE-2019-8320 CVE-2019-8322 CVE-2019-8323 CVE-2019-8324 CVE-2019-8325 Several vulnerabilities have been discovered in rubygems embedded in ruby2.1, the interpreted scripting language. CVE-2019-8320 A Directory Traversal issue was discovered in RubyGems. Before making new directories or touching files (which now include path-checking code for symlinks), it would delete the target destination. CVE-2019-8322 The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur. CVE-2019-8323 Gem::GemcutterUtilities#with_response may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur. CVE-2019-8324 A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensure_loadable_spec during the preinstall check. CVE-2019-8325 An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without escaping, escape sequence injection is possible. (There are many ways to cause an error.) For Debian 8 "Jessie", these problems have been fixed in version 2.1.5-2+deb8u7. We recommend that you upgrade your ruby2.1 packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Package : ruby2.1 Version : 2.1.5-2+deb8u7 CVE ID : CVE-2019-8320 CVE-2019-8322 CVE-2019-8323 CVE-20. vulnerabilities, rubygems, embedded, ruby2, interpreted, script. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Mar 29, 2019 •Critical Debian LTS
Banner 2 1028x280 1708121730 1 1771599631
197
Ls Advisories Deblts Esm H240
Price Tag%201security advisorycriticaldebian

Debian LTS: DLA-1336-1 Critical Rubygems Update for Multiple Issues

Multiple vulnerabilities were found in rubygems, a package management framework for Ruby. CVE-2018-1000075 . Package : rubygems Version : 1.8.24-1+deb7u2 CVE ID : CVE-2018-1000075 CVE-2018-1000076 CVE-2018-1000077 CVE-2018-1000078 Multiple vulnerabilities were found in rubygems, a package management framework for Ruby. CVE-2018-1000075 A negative size vulnerability in ruby gem package tar header that could cause an infinite loop. CVE-2018-1000076 Ruby gems package improperly verifies cryptographic signatures. A mis-signed gem could be installed if the tarball contains multiple gem signatures. CVE-2018-1000077 An improper input validation vulnerability in ruby gems specification homepage attribute could allow malicious gem to set an invalid homepage URL. CVE-2018-1000078 Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute For Debian 7 "Wheezy", these problems have been fixed in version 1.8.24-1+deb7u2. We recommend that you upgrade your rubygems packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Several vulnerabilities addressed in Ruby's gem management tool, rubygems. Update to version 1.8.24-1+deb7u2 to enhance your system's security.. rubygems Update,Debian Security Advisory,Ruby Package Manager. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Apr 01, 2018 •Critical Debian LTS
197
Ls Advisories Deblts Esm H240
Price Tag%201security advisorymoderatesoftware update

Debian 7 Wheezy DLA-1112-1 Moderate: Rubygems DoS and File Overwrite

Some vulnerabilities were found in the Rubygems package that affects the LTS distribution. CVE-2017-0900 . Hash: SHA256 Package : rubygems Version : 1.8.24-1+deb7u1 CVE ID : CVE-2017-0900 CVE-2017-0901 Debian Bug : 873802 Some vulnerabilities were found in the Rubygems package that affects the LTS distribution. CVE-2017-0900 DOS vulernerability in the query command CVE-2017-0901 gem installer allows a malicious gem to overwrite arbitrary files For Debian 7 "Wheezy", these problems have been fixed in version 1.8.24-1+deb7u1. We recommend that you upgrade your rubygems packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Upgrade Rubygems on Debian 7 Wheezy to improve security against DOS and file overwrite vulnerabilities with easy steps to follow for effective results. Debian,Rubygems,Security Update,DOS Threat,File Overwrite. . LinuxSecurity.com Team

Calendar%202 Sep 27, 2017 Debian LTS
Banner 2 1028x280 1708121730 1 1771599631
89
Ls Advisories Fedora Esm H240
Price Tag%201security advisorysoftware updateFedora

Fedora 21 Security Advisory: Rubygems DNS Hijacking Issue Critical Update

Update to RubyGems 2.2.5.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2015-13157 2015-08-10 22:53:54 -------------------------------------------------------------------------------- Name : rubygems Product : Fedora 21 Version : 2.2.5 Release : 100.fc21 URL : https://rubygems.org/ Summary : The Ruby standard for packaging ruby libraries Description : RubyGems is the Ruby standard for publishing and managing third party libraries. -------------------------------------------------------------------------------- Update Information: Update to RubyGems 2.2.5. -------------------------------------------------------------------------------- ChangeLog: * Thu Aug 6 2015 Vít Ondruch - 2.2.5-100 - Update to RubyGems 2.2.5. -------------------------------------------------------------------------------- References: [ 1 ] Bug #1236116 - CVE-2015-3900 rubygems: DNS hijacking vulnerability in api_endpoint() https://bugzilla.redhat.com/show_bug.cgi?id=1236116 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update rubygems' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. https://lists.fedoraproject.org/admin/lists/package-announce.lists.fedoraproject.org/ . Rubygems has released version 2.2.5, which fixes a critical DNS hijacking vulnerability. Fedora 21 users should immediately update to protect their installations. Rubygems Update,Fedora Security Advisory,RubyGems DNS Fix,FedoraPackages Management. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Aug 19, 2015 •Critical Fedora
89
Ls Advisories Fedora Esm H240
Price Tag%201security advisoryfedoracritical

Fedora 22 FEDORA-2015-12574 Critical: RubyGems DNS Hijacking

Update to RubyGems 2.4.8.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2015-12574 2015-08-01 00:12:18 -------------------------------------------------------------------------------- Name : rubygems Product : Fedora 22 Version : 2.4.8 Release : 100.fc22 URL : https://rubygems.org/ Summary : The Ruby standard for packaging ruby libraries Description : RubyGems is the Ruby standard for publishing and managing third party libraries. -------------------------------------------------------------------------------- Update Information: Update to RubyGems 2.4.8. -------------------------------------------------------------------------------- ChangeLog: * Fri Jul 10 2015 Vít Ondruch - 2.4.8-100 - Update to RubyGems 2.4.8. -------------------------------------------------------------------------------- References: [ 1 ] Bug #1236116 - CVE-2015-3900 rubygems: DNS hijacking vulnerability in api_endpoint() https://bugzilla.redhat.com/show_bug.cgi?id=1236116 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update rubygems' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. https://lists.fedoraproject.org/admin/lists/package-announce.lists.fedoraproject.org/ . Upgrade to RubyGems version 2.4.8 within Fedora 22 to tackle security vulnerabilities and enhance the management of libraries.. RubyGems Update, Fedora Security, DNS Hijacking Fix. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Aug 11, 2015 •Critical Fedora
Banner 2 1028x280 1708121730 1 1771599631
News Add Esm H240

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

More Polls

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":1,"type":"x","order":4,"pct":100,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200

Search Topics