Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found 1 articles for you...
219
security advisorysecurity updatepackage updateRocky Linux 9 RLSA-2024:4212 Moderate: Golang Security Update
Moderate: golang security update. {"type": "TYPE_SECURITY", "shortCode": "RL", "name": "RLSA-2024:4212", "synopsis": "Moderate: golang security update", "severity": "SEVERITY_MODERATE", "topic": "An update is available for golang.\nThis update affects Rocky Linux 9.\nA Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list", "description": "The golang packages provide the Go programming language compiler.\n\nSecurity Fix(es):\n\n* golang: archive/zip: Incorrect handling of certain ZIP files (CVE-2024-24789)\n\n* golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "solution": null, "affectedProducts": ["Rocky Linux 9"], "fixes": [{"ticket": "2292668", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2292668", "description": ""}, {"ticket": "2292787", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2292787", "description": ""}], "cves": [{"name": "CVE-2024-24789", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2024-24789", "cvss3ScoringVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvss3BaseScore": "7.5", "cwe": "CWE-20"}, {"name": "CVE-2024-24790", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2024-24790", "cvss3ScoringVector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "cvss3BaseScore": "6.7", "cwe": "CWE-115"}], "references": [], "publishedAt": "2024-07-15T12:18:45.298153Z", "rpms": {"Rocky Linux 9": {"nvras": ["golang-0:1.21.11-1.el9_4.aarch64.rpm", "golang-0:1.21.11-1.el9_4.ppc64le.rpm", "golang-0:1.21.11-1.el9_4.s390x.rpm", "golang-0:1.21.11-1.el9_4.src.rpm", "golang-0:1.21.11-1.el9_4.x86_64.rpm", "golang-bin-0:1.21.11-1.el9_4.aarch64.rpm","golang-bin-0:1.21.11-1.el9_4.ppc64le.rpm", "golang-bin-0:1.21.11-1.el9_4.s390x.rpm", "golang-bin-0:1.21.11-1.el9_4.x86_64.rpm", "golang-docs-0:1.21.11-1.el9_4.noarch.rpm", "golang-misc-0:1.21.11-1.el9_4.noarch.rpm", "golang-src-0:1.21.11-1.el9_4.noarch.rpm", "golang-tests-0:1.21.11-1.el9_4.noarch.rpm", "go-toolset-0:1.21.11-1.el9_4.aarch64.rpm", "go-toolset-0:1.21.11-1.el9_4.ppc64le.rpm", "go-toolset-0:1.21.11-1.el9_4.s390x.rpm", "go-toolset-0:1.21.11-1.el9_4.x86_64.rpm"]}}, "rebootSuggested": false, "buildReferences": []}. Critical GoLang patch released for Rocky Linux 9 to fix vulnerabilities in package management and execution environments. Prioritize your security!. Golang Security Update, Rocky Linux Advisory, Package Security, Security Fixes, Runtime Issues. . LinuxSecurity.com Team
Jul 15, 2024
Rocky Linux
217
security advisorysecurity updateapplication securityOracle Linux 9 ELSA-2024-0807 Critical: Dotnet Runtime Security Update
The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: . Oracle Linux Security Advisory ELSA-2024-0807 https://linux.oracle.com/errata/ELSA-2024-0807.html The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: x86_64: aspnetcore-runtime-6.0-6.0.27-1.0.1.el9_3.x86_64.rpm aspnetcore-targeting-pack-6.0-6.0.27-1.0.1.el9_3.x86_64.rpm dotnet-apphost-pack-6.0-6.0.27-1.0.1.el9_3.x86_64.rpm dotnet-hostfxr-6.0-6.0.27-1.0.1.el9_3.x86_64.rpm dotnet-runtime-6.0-6.0.27-1.0.1.el9_3.x86_64.rpm dotnet-sdk-6.0-6.0.127-1.0.1.el9_3.x86_64.rpm dotnet-targeting-pack-6.0-6.0.27-1.0.1.el9_3.x86_64.rpm dotnet-templates-6.0-6.0.127-1.0.1.el9_3.x86_64.rpm dotnet-sdk-6.0-source-built-artifacts-6.0.127-1.0.1.el9_3.x86_64.rpm aarch64: aspnetcore-runtime-6.0-6.0.27-1.0.1.el9_3.aarch64.rpm aspnetcore-targeting-pack-6.0-6.0.27-1.0.1.el9_3.aarch64.rpm dotnet-apphost-pack-6.0-6.0.27-1.0.1.el9_3.aarch64.rpm dotnet-hostfxr-6.0-6.0.27-1.0.1.el9_3.aarch64.rpm dotnet-runtime-6.0-6.0.27-1.0.1.el9_3.aarch64.rpm dotnet-sdk-6.0-6.0.127-1.0.1.el9_3.aarch64.rpm dotnet-targeting-pack-6.0-6.0.27-1.0.1.el9_3.aarch64.rpm dotnet-templates-6.0-6.0.127-1.0.1.el9_3.aarch64.rpm dotnet-sdk-6.0-source-built-artifacts-6.0.127-1.0.1.el9_3.aarch64.rpm SRPMS: https://oss.oracle.com:443/ol9/SRPMS-updates//dotnet6.0-6.0.127-1.0.1.el9_3.src.rpm Related CVEs: CVE-2024-21386 CVE-2024-21404 Description of changes: [6.0.127-1.0.1] - Update to .NET SDK 6.0.127 and Runtime 6.0.27 _______________________________________________ El-errata mailing list
Feb 16, 2024
•Critical
Oracle
99
security advisorydenial of servicecritical fixSlackware 15.0 Critical Update: Expat Denial Of Service Fix
New expat packages are available for Slackware 15.0 and -current to fix security issues. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] expat (SSA:2024-038-01) New expat packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: +--------------------------+ patches/packages/expat-2.6.0-i586-1_slack15.0.txz: Upgraded. This update fixes security issues: Fix quadratic runtime issues with big tokens that can cause denial of service. Fix billion laughs attacks for users compiling *without* XML_DTD defined (which is not common). For more information, see: https://www.cve.org/CVERecord?id=CVE-2023-52425 https://www.cve.org/CVERecord?id=CVE-2023-52426 (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ Thanks to the friendly folks at the OSU Open Source Lab (https://osuosl.org/) for donating FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://www.slackware.com/ for additional mirror sites near you. Updated package for Slackware 15.0: Updated package for Slackware x86_64 15.0: Updated package for Slackware -current: Updated package for Slackware x86_64 -current: MD5 signatures: +-------------+ Slackware 15.0 package: 5fc9ee070934b620f18f25589161af50 expat-2.6.0-i586-1_slack15.0.txz Slackware x86_64 15.0 package: 4d154e83a4c7aa16e9ec3b13883d0541 expat-2.6.0-x86_64-1_slack15.0.txz Slackware -current package: 0a52eddf970a67cde7db5c3e0b22936a l/expat-2.6.0-i586-1.txz Slackware x86_64 -current package: ff61e2750bcbb0ac9255f48be240dd8d l/expat-2.6.0-x86_64-1.txz Installation instructions: +------------------------+ Upgrade the package as root: # upgradepkg expat-2.6.0-i586-1_slack15.0.txz +-----+ . Latest updates for Arch Linux address vulnerabilities in recent packages. Discover essential patches and enhancements.. Expat Security, Slackware Update, Package Security. .Severity: Critical. LinuxSecurity.com Team
Feb 07, 2024
•Critical
Slackware
197
security advisorydebianruntime issueDebian 10: DLA-3497-1 Moderate: PyPDF2 Runtime Issue Resolution
Quadratic runtime with malformed PDFs missing xref marker has been fixed in PyPDF2, a pure Python PDF library. For Debian 10 buster, this problem has been fixed in version . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3497-1
Jul 14, 2023
Debian LTS
87
security advisorydenial of servicecriticalDebian: DSA-5162-1 Critical: Containerd Denial Of Service
Two vulnerabilities were discovered that the containerd container runtime, which could result in denial of service or incomplete restriction of capabilities. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-5162-1
Jun 12, 2022
•Critical
Debian
89
security advisorysoftware updateFedoraFedora 35: FEDORA-2022-c4071e3dc7 Moderate: Memory Corruption Issue in Rust
Update the thread_local crate to version 1.1.4. This includes a fix for [RUSTSEC-2022-0006](https://rustsec.org/advisories/RUSTSEC-2022-0006.html) (possible memory corruption caused by a data race). All applications that statically link thread_local have been rebuilt for this version. Additionally, all rebuilt applications now include the fix for. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-c4071e3dc7 2022-01-29 06:37:20.624357 --------------------------------------------------------------------------------Name : rust-python-launcher Product : Fedora 35 Version : 1.0.0 Release : 4.fc35 URL : Summary : Python launcher for Unix Description : The Python Launcher for Unix. Launch your Python interpreter the lazy/smart way! This launcher is an implementation of the py command for Unix-based platforms. The goal is to have py become the cross-platform command that Python users typically use to launch an interpreter while doing development. By having a command that is version-agnostic when it comes to Python, it side-steps the "what should the python command point to?" debate by clearly specifying that upfront (i.e. the newest version of Python that can be found). This also unifies the suggested command to document for launching Python on both Windows as Unix as py has existed as the preferred command on Windows since 2012 with the release of Python 3.3. Typical usage would be: py -m venv .venv py ... # Whatever you would normally use `python` for during development. This creates a virtual environment in a .venv directory using the latest version of Python installed. Subsequent uses of py will then use that virtual environment as long as it is in the current (or higher) directory; no environment activation required (although the Python Launcher supports activated environments as well)! A non-goal of this launcher is to become the way to launch thePython interpreter all the time. If you know the exact interpreter you want to launch then you should launch it directly; same goes for when you have requirements on the type of interpreter you want. The Python Launcher should be viewed as a tool of convenience, not necessity. --------------------------------------------------------------------------------Update Information: Update the thread_local crate to version 1.1.4. This includes a fix for [RUSTSEC-2022-0006](https://rustsec.org/advisories/RUSTSEC-2022-0006.html) (possible memory corruption caused by a data race). All applications that statically link thread_local have been rebuilt for this version. Additionally, all rebuilt applications now include the fix for [CVE-2022-21658](https://rustsec.org/advisories/CVE-2022-21658.html) (Time-of-check Time-of-use race condition in `std::fs::remove_dir_all` from the Rust standard library). --------------------------------------------------------------------------------ChangeLog: * Tue Jan 25 2022 Fabio Valentini 1.0.0-4 - Rebuild with thread_local 1.1.4 for RUSTSEC-2022-0006 * Fri Jan 21 2022 Fedora Release Engineering 1.0.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-c4071e3dc7' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Jan 29, 2022
Fedora
89
security advisorysecurity updatecriticalFedora 28: FEDORA-2018-4d58785bcd Critical: OpenJDK Runtime Issue
Security critical patch update for OpenJDK (July CPU). See https://www.oracle.com/security-alerts/cpujul2018.html. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2018-4d58785bcd 2018-07-29 03:19:11.836617 --------------------------------------------------------------------------------Name : java-1.8.0-openjdk Product : Fedora 28 Version : 1.8.0.181 Release : 7.b13.fc28 URL : https://openjdk.org/ Summary : OpenJDK Runtime Environment 8 Description : The OpenJDK runtime environment. --------------------------------------------------------------------------------Update Information: Security critical patch update for OpenJDK (July CPU). See https://www.oracle.com/security-alerts/cpujul2018.html --------------------------------------------------------------------------------ChangeLog: * Mon Jul 23 2018 Jiri Vanek - 11:1.8.0.181-7.b13 - updated to u181 - patches aligned according to rhel7 (full credit to gnu_andrew) - removed upstreamed patch104 pr3458-rh1540242-aarch64.patch - removed upstreamed patch568 8187577-pr3578.patch * Tue Jul 17 2018 Jiri Vanek - 11:1.8.0.172-16.b11 - added Recommends gtk2 for main package - added Suggests lksctp-tools, pcsc-lite-devel, cups for headless package - see RHBZ1598152 * Tue Jul 10 2018 Severin Gehwolf - 1:1.8.0.172-13.b11 - Fix hook to show hs_err*.log files on failures. * Mon Jul 2 2018 Severin Gehwolf - 1:1.8.0.172-12.b11 - Fix requires/provides filters for internal libs. See RHBZ#1590796 * Wed Jun 20 2018 Andrew Hughes - 1:1.8.0.172-11.b11 - Add additional fix (PR3601) to fix -Wreturn-type failures introduced by 8061651 - Backport 8064786 (PR3601) to fix -Wreturn-type failure on debug builds. - Bring in PR3519 from IcedTea 3.7.0 to fix remaining -Wreturn-type failure on AArch64. - Sync with IcedTea 3.8.0 patches to use -Wreturn-type. - Add backports of 8141570, 8143245, 8197981 & 8062808. - Drop pr3458-rh1540242-zero.patchwhich is covered by 8143245. * Wed Jun 20 2018 Jiri Vanek - 11:1.8.0.172-10.b11 - jsa files changed to 444 to pass rpm verification * Mon Jun 18 2018 Severin Gehwolf - 1:1.8.0.172-9.b11 - Filter private provides/requires: 'lib.so(SUNWprivate_.*' * Thu Jun 14 2018 Severin Gehwolf - 1:1.8.0.172-8.b11 - Add provides/requires for libjvm.so back. See RHBZ#1591215. * Wed Jun 13 2018 Severin Gehwolf - 1:1.8.0.172-7.b11 - Fix reg-ex for filtering private libraries' provides/requires. * Wed Jun 13 2018 Andrew Hughes - 1:1.8.0.172-6.b11 - Remove build flags exemption for aarch64 now the platform is more mature and can bootstrap OpenJDK with these flags. - Remove duplicate -fstack-protector-strong; it is provided by the RHEL cflags. - Add missing changelog credits * Mon Jun 11 2018 Jiri Vanek - 1:1.8.0.172-5.b11 - Merge changes from RHEL 7 * Mon Jun 11 2018 Andrew Hughes - 1:1.8.0.172-5.b11 - Read jssecacerts file prior to trying either cacerts file (system or local) (PR3575) * Mon Jun 11 2018 Andrew Hughes - 1:1.8.0.172-5.b11 - Fix a number of bad bug identifiers (PR3546 should be PR3578, PR3456 should be PR3546) * Thu Jun 7 2018 Andrew Hughes - 1:1.8.0.172-5.b11 - Update Shenandoah tarball to include 2018-05-15 merge. - Split PR3458/RH1540242 fix into AArch64 & Zero sections, so former can be skipped on Shenandoah builds. - Drop PR3573 patch applied upstream. - Restrict 8187577 fix to non-Shenandoah builds, as it's included in the new tarball. * Thu Jun 7 2018 Andrew Hughes - 1:1.8.0.172-5.b11 - Sync with IcedTea 3.8.0. - Label architecture-specific fixes with architecture concerned - x86: S8199936, PR3533: HotSpot generates code with unaligned stack, crashes on SSE operations (-mstackrealign workaround) - PR3539, RH1548475: Pass EXTRA_LDFLAGS to HotSpot build - 8171000, PR3542, RH1402819: Robot.createScreenCapture() crashes in wayland mode - 8197546, PR3542, RH1402819: Fix for 8171000 breaks Solaris + Linux builds - 8185723, PR3553: Zero: segfaults on Power PC32-bit - 8186461, PR3557: Zero's atomic_copy64() should use SPE instructions on linux-powerpcspe - PR3559: Use ldrexd for atomic reads on ARMv7. - 8187577, PR3578: JVM crash during gc doing concurrent marking - 8201509, PR3579: Zero: S390 31bit atomic_copy64 inline assembler is wrong - 8165489, PR3589: Missing G1 barrier in Unsafe_GetObjectVolatile - PR3591: Fix for bug 3533 doesn't add -mstackrealign to JDK code - 8184309, PR3596: Build warnings from GCC 7.1 on Fedora 26 * Wed Jun 6 2018 Jiri Vanek - 1:1.8.0.172-1.b11 - updated to u172-b11 - removed patches: - patch207 8200556-pr3566.patch - patch104 pr3458-rh1540242.patch - patch209 8035496-hotspot.patch - patch700 pr3573.patch * Thu May 17 2018 Severin Gehwolf - 1:1.8.0.171-6.b10 - Move to javapackages-filesystem over javapackages-tools for directory ownership. Resolves RHBZ#1500288. * Fri May 4 2018 Severin Gehwolf - 1:1.8.0.171-5.b10 - Remove duplicate patch rhbz_1538767_fix_linking2.patch. Just use rhbz_1538767_fix_linking.patch. * Wed Apr 25 2018 Severin Gehwolf - 1:1.8.0.171-4.b10 - Enable hardened build unconditionally (also for Zero). Resolves RHBZ#1290936. * Tue Apr 24 2018 Severin Gehwolf - 1:1.8.0.171-3.b10 - Enable hardened build for Aarch64. * Tue Apr 24 2018 Severin Gehwolf - 1:1.8.0.171-2.b10 - Update rhbz1548475-LDFLAGSusage.patch to also set linker flags for libsaproc.so and libjsig.so. * Wed Apr 18 2018 Jiri Vanek - 1:1.8.0.171-1.b10 - Update to aarch64-jdk8u171-b10 and aarch64-shenandoah-jdk8u171-b10. - Fix jconsole.desktop.in subcategory, replacing "Monitor" with "Profiling" (PR3550) (gnu_andrew) - Fix invalid license 'LGPL+' (should be LGPLv2+ for ECC code) and add misisng ones (gnu_andrew) * Wed Apr 18 2018 Jiri Vanek - 1:1.8.0.162-7.b12 - added ownership of policy dir and subdirs - removed ignored attributes for classes.jsa * Tue Apr 10 2018 Severin Gehwolf - 1:1.8.0.162-6.b12 - Use correct patch for RHBZ#1538767 (JDK-8196516) * Mon Apr 2 2018 Andrew Hughes -1:1.8.0.162-5.b12 - Cleanup from previous commit. - Remove unused upstream patch 8167200.hotspotAarch64.patch. --------------------------------------------------------------------------------References: [ 1 ] Bug #1509371 - JDK UseCGroupMemoryLimitForHeap not systemd compatible https://bugzilla.redhat.com/show_bug.cgi?id=1509371 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2018-4d58785bcd' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Jul 29, 2018
•Critical
Fedora
89
security advisorysecurity updateFedoraFedora 22 FEDORA-2015-8226 Moderate: OpenJDK Runtime Update
updated to 8u45-b14. fixes rhbz#1123870. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2015-8226 2015-05-14 20:23:38 -------------------------------------------------------------------------------- Name : java-1.8.0-openjdk Product : Fedora 22 Version : 1.8.0.45 Release : 38.b14.fc22 URL : https://openjdk.org/ Summary : OpenJDK Runtime Environment Description : The OpenJDK runtime environment. -------------------------------------------------------------------------------- Update Information: updated to 8u45-b14. fixes rhbz#1123870 -------------------------------------------------------------------------------- ChangeLog: * Wed May 13 2015 Jiri Vanek - 1:1.8.0.45-38.b14 - updated to 8u45-b14 with hope to fix rhbz#1123870 * Wed May 13 2015 Jiri Vanek - 1:1.8.0.45-37.b13 - added runtime requires for tzdata - Remove reference to tz.properties which is no longer used (by gnu.andrew) -------------------------------------------------------------------------------- References: [ 1 ] Bug #1123870 - CVE-2015-0383 OpenJDK: insecure hsperfdata temporary file handling (Hotspot, 8050807) https://bugzilla.redhat.com/show_bug.cgi?id=1123870 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update java-1.8.0-openjdk' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
May 26, 2015
•Important
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!