Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Stay Secure with the Latest Linux Advisories

Fedora Large Esm H800
Fedora

Fedora 43 Kernel Important Security Fix for net/can 2026-f1fc7772c3

Calendar White Jul 21, 2026
Important
Fedora Large Esm H900
Fedora

Fedora 43 Nuclei Important Cross-site Scripting DoS Threat 2026-d36ca2dd19

Calendar White Jul 21, 2026
Important
Fedora Large Esm H900
Fedora

Fedora 43 perl-Crypt-OpenSSL-X509 Important Fix CVE-2026-58101

Calendar White Jul 21, 2026
Critical
Fedora Large Esm H800
Fedora

Fedora 43 rust-syslog Critical Path Traversal DoS Vuln 2026-659cb50390

Calendar White Jul 21, 2026
Important
Fedora Large Esm H900
Fedora

Fedora 43 Rust RPKI Critical Path Traversal Issues Fix 2026-659cb50390

Calendar White Jul 21, 2026
Important
Fedora Large Esm H900
Fedora

Fedora 43 Routinator Important Security Fixes CVE-2026-49232 to 49235

Calendar White Jul 21, 2026
Important
Fedora Large Esm H800
Fedora

Fedora 43 rust-fern Important Path Traversal Fix Advisory 2026-659cb50390

Calendar White Jul 21, 2026
Important
Fedora Large Esm H900
Fedora

Fedora 44 Kernel Important Net CAN Issue Fix Advisory 2026-2dd8b600bb

Calendar White Jul 21, 2026
Important
Fedora Large Esm H900
Fedora

Fedora 44 btrbk Critical Update Snapshot Tool Fix CVE-2026-62943

Calendar White Jul 21, 2026
Important
Filter%20icon Refine advisories
X Clear Filters
X Clear Filters
View More

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

More Polls

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":1,"type":"x","order":4,"pct":100,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Loading...

Explore Latest Linux Security advisories

We found -4 articles for you...
98
Ls Advisories Redhat Esm H240
Price Tag%201security advisorymoderatedenial of service

Red Hat Enterprise Linux 8 Advisory RHSA-2020:4497-01 Moderate SASL DoS

An update for cyrus-sasl is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: cyrus-sasl security, bug fix, and enhancement update Advisory ID: RHSA-2020:4497-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2020:4497 Issue date: 2020-11-03 CVE Names: CVE-2019-19906 ==================================================================== 1. Summary: An update for cyrus-sasl is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, ppc64le, s390x, x86_64 3. Description: The cyrus-sasl packages contain the Cyrus implementation of Simple Authentication and Security Layer (SASL). SASL is a method for adding authentication support to connection-based protocols. Security Fix(es): * cyrus-sasl: denial of service in _sasl_add_string function (CVE-2019-19906) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from the References section. 4.Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1791854 - CVE-2019-19906 cyrus-sasl: denial of service in _sasl_add_string function 1817054 - RFE: support for Channel Bindings in SASL/GSSAPI 1822133 - Fix GSS-SPNEGO in TLS with maxssf=0 to work against Windows servers 6. Package List: Red Hat Enterprise Linux AppStream (v.8): aarch64: cyrus-sasl-debuginfo-2.1.27-5.el8.aarch64.rpm cyrus-sasl-debugsource-2.1.27-5.el8.aarch64.rpm cyrus-sasl-devel-debuginfo-2.1.27-5.el8.aarch64.rpm cyrus-sasl-gs2-debuginfo-2.1.27-5.el8.aarch64.rpm cyrus-sasl-gssapi-debuginfo-2.1.27-5.el8.aarch64.rpm cyrus-sasl-ldap-debuginfo-2.1.27-5.el8.aarch64.rpm cyrus-sasl-lib-debuginfo-2.1.27-5.el8.aarch64.rpm cyrus-sasl-md5-debuginfo-2.1.27-5.el8.aarch64.rpm cyrus-sasl-ntlm-debuginfo-2.1.27-5.el8.aarch64.rpm cyrus-sasl-plain-debuginfo-2.1.27-5.el8.aarch64.rpm cyrus-sasl-scram-debuginfo-2.1.27-5.el8.aarch64.rpm cyrus-sasl-sql-2.1.27-5.el8.aarch64.rpm cyrus-sasl-sql-debuginfo-2.1.27-5.el8.aarch64.rpm ppc64le: cyrus-sasl-debuginfo-2.1.27-5.el8.ppc64le.rpm cyrus-sasl-debugsource-2.1.27-5.el8.ppc64le.rpm cyrus-sasl-devel-debuginfo-2.1.27-5.el8.ppc64le.rpm cyrus-sasl-gs2-debuginfo-2.1.27-5.el8.ppc64le.rpm cyrus-sasl-gssapi-debuginfo-2.1.27-5.el8.ppc64le.rpm cyrus-sasl-ldap-debuginfo-2.1.27-5.el8.ppc64le.rpm cyrus-sasl-lib-debuginfo-2.1.27-5.el8.ppc64le.rpm cyrus-sasl-md5-debuginfo-2.1.27-5.el8.ppc64le.rpm cyrus-sasl-ntlm-debuginfo-2.1.27-5.el8.ppc64le.rpm cyrus-sasl-plain-debuginfo-2.1.27-5.el8.ppc64le.rpm cyrus-sasl-scram-debuginfo-2.1.27-5.el8.ppc64le.rpm cyrus-sasl-sql-2.1.27-5.el8.ppc64le.rpm cyrus-sasl-sql-debuginfo-2.1.27-5.el8.ppc64le.rpm s390x: cyrus-sasl-debuginfo-2.1.27-5.el8.s390x.rpm cyrus-sasl-debugsource-2.1.27-5.el8.s390x.rpm cyrus-sasl-devel-debuginfo-2.1.27-5.el8.s390x.rpm cyrus-sasl-gs2-debuginfo-2.1.27-5.el8.s390x.rpm cyrus-sasl-gssapi-debuginfo-2.1.27-5.el8.s390x.rpm cyrus-sasl-ldap-debuginfo-2.1.27-5.el8.s390x.rpm cyrus-sasl-lib-debuginfo-2.1.27-5.el8.s390x.rpm cyrus-sasl-md5-debuginfo-2.1.27-5.el8.s390x.rpm cyrus-sasl-ntlm-debuginfo-2.1.27-5.el8.s390x.rpm cyrus-sasl-plain-debuginfo-2.1.27-5.el8.s390x.rpm cyrus-sasl-scram-debuginfo-2.1.27-5.el8.s390x.rpm cyrus-sasl-sql-2.1.27-5.el8.s390x.rpm cyrus-sasl-sql-debuginfo-2.1.27-5.el8.s390x.rpm x86_64: cyrus-sasl-debuginfo-2.1.27-5.el8.i686.rpm cyrus-sasl-debuginfo-2.1.27-5.el8.x86_64.rpm cyrus-sasl-debugsource-2.1.27-5.el8.i686.rpm cyrus-sasl-debugsource-2.1.27-5.el8.x86_64.rpm cyrus-sasl-devel-debuginfo-2.1.27-5.el8.i686.rpm cyrus-sasl-devel-debuginfo-2.1.27-5.el8.x86_64.rpm cyrus-sasl-gs2-debuginfo-2.1.27-5.el8.i686.rpm cyrus-sasl-gs2-debuginfo-2.1.27-5.el8.x86_64.rpm cyrus-sasl-gssapi-debuginfo-2.1.27-5.el8.i686.rpm cyrus-sasl-gssapi-debuginfo-2.1.27-5.el8.x86_64.rpm cyrus-sasl-ldap-debuginfo-2.1.27-5.el8.i686.rpm cyrus-sasl-ldap-debuginfo-2.1.27-5.el8.x86_64.rpm cyrus-sasl-lib-debuginfo-2.1.27-5.el8.i686.rpm cyrus-sasl-lib-debuginfo-2.1.27-5.el8.x86_64.rpm cyrus-sasl-md5-debuginfo-2.1.27-5.el8.i686.rpm cyrus-sasl-md5-debuginfo-2.1.27-5.el8.x86_64.rpm cyrus-sasl-ntlm-debuginfo-2.1.27-5.el8.i686.rpm cyrus-sasl-ntlm-debuginfo-2.1.27-5.el8.x86_64.rpm cyrus-sasl-plain-debuginfo-2.1.27-5.el8.i686.rpm cyrus-sasl-plain-debuginfo-2.1.27-5.el8.x86_64.rpm cyrus-sasl-scram-debuginfo-2.1.27-5.el8.i686.rpm cyrus-sasl-scram-debuginfo-2.1.27-5.el8.x86_64.rpm cyrus-sasl-sql-2.1.27-5.el8.i686.rpm cyrus-sasl-sql-2.1.27-5.el8.x86_64.rpm cyrus-sasl-sql-debuginfo-2.1.27-5.el8.i686.rpm cyrus-sasl-sql-debuginfo-2.1.27-5.el8.x86_64.rpm Red Hat Enterprise Linux BaseOS (v.8): Source: cyrus-sasl-2.1.27-5.el8.src.rpm aarch64: cyrus-sasl-2.1.27-5.el8.aarch64.rpm cyrus-sasl-debuginfo-2.1.27-5.el8.aarch64.rpm cyrus-sasl-debugsource-2.1.27-5.el8.aarch64.rpm cyrus-sasl-devel-2.1.27-5.el8.aarch64.rpm cyrus-sasl-devel-debuginfo-2.1.27-5.el8.aarch64.rpm cyrus-sasl-gs2-2.1.27-5.el8.aarch64.rpm cyrus-sasl-gs2-debuginfo-2.1.27-5.el8.aarch64.rpm cyrus-sasl-gssapi-2.1.27-5.el8.aarch64.rpm cyrus-sasl-gssapi-debuginfo-2.1.27-5.el8.aarch64.rpm cyrus-sasl-ldap-2.1.27-5.el8.aarch64.rpm cyrus-sasl-ldap-debuginfo-2.1.27-5.el8.aarch64.rpm cyrus-sasl-lib-2.1.27-5.el8.aarch64.rpm cyrus-sasl-lib-debuginfo-2.1.27-5.el8.aarch64.rpm cyrus-sasl-md5-2.1.27-5.el8.aarch64.rpm cyrus-sasl-md5-debuginfo-2.1.27-5.el8.aarch64.rpm cyrus-sasl-ntlm-2.1.27-5.el8.aarch64.rpm cyrus-sasl-ntlm-debuginfo-2.1.27-5.el8.aarch64.rpm cyrus-sasl-plain-2.1.27-5.el8.aarch64.rpm cyrus-sasl-plain-debuginfo-2.1.27-5.el8.aarch64.rpm cyrus-sasl-scram-2.1.27-5.el8.aarch64.rpm cyrus-sasl-scram-debuginfo-2.1.27-5.el8.aarch64.rpm cyrus-sasl-sql-debuginfo-2.1.27-5.el8.aarch64.rpm ppc64le: cyrus-sasl-2.1.27-5.el8.ppc64le.rpm cyrus-sasl-debuginfo-2.1.27-5.el8.ppc64le.rpm cyrus-sasl-debugsource-2.1.27-5.el8.ppc64le.rpm cyrus-sasl-devel-2.1.27-5.el8.ppc64le.rpm cyrus-sasl-devel-debuginfo-2.1.27-5.el8.ppc64le.rpm cyrus-sasl-gs2-2.1.27-5.el8.ppc64le.rpm cyrus-sasl-gs2-debuginfo-2.1.27-5.el8.ppc64le.rpm cyrus-sasl-gssapi-2.1.27-5.el8.ppc64le.rpm cyrus-sasl-gssapi-debuginfo-2.1.27-5.el8.ppc64le.rpm cyrus-sasl-ldap-2.1.27-5.el8.ppc64le.rpm cyrus-sasl-ldap-debuginfo-2.1.27-5.el8.ppc64le.rpm cyrus-sasl-lib-2.1.27-5.el8.ppc64le.rpm cyrus-sasl-lib-debuginfo-2.1.27-5.el8.ppc64le.rpm cyrus-sasl-md5-2.1.27-5.el8.ppc64le.rpm cyrus-sasl-md5-debuginfo-2.1.27-5.el8.ppc64le.rpm cyrus-sasl-ntlm-2.1.27-5.el8.ppc64le.rpm cyrus-sasl-ntlm-debuginfo-2.1.27-5.el8.ppc64le.rpm cyrus-sasl-plain-2.1.27-5.el8.ppc64le.rpm cyrus-sasl-plain-debuginfo-2.1.27-5.el8.ppc64le.rpm cyrus-sasl-scram-2.1.27-5.el8.ppc64le.rpm cyrus-sasl-scram-debuginfo-2.1.27-5.el8.ppc64le.rpm cyrus-sasl-sql-debuginfo-2.1.27-5.el8.ppc64le.rpm s390x: cyrus-sasl-2.1.27-5.el8.s390x.rpm cyrus-sasl-debuginfo-2.1.27-5.el8.s390x.rpm cyrus-sasl-debugsource-2.1.27-5.el8.s390x.rpm cyrus-sasl-devel-2.1.27-5.el8.s390x.rpm cyrus-sasl-devel-debuginfo-2.1.27-5.el8.s390x.rpm cyrus-sasl-gs2-2.1.27-5.el8.s390x.rpm cyrus-sasl-gs2-debuginfo-2.1.27-5.el8.s390x.rpm cyrus-sasl-gssapi-2.1.27-5.el8.s390x.rpm cyrus-sasl-gssapi-debuginfo-2.1.27-5.el8.s390x.rpm cyrus-sasl-ldap-2.1.27-5.el8.s390x.rpm cyrus-sasl-ldap-debuginfo-2.1.27-5.el8.s390x.rpm cyrus-sasl-lib-2.1.27-5.el8.s390x.rpm cyrus-sasl-lib-debuginfo-2.1.27-5.el8.s390x.rpm cyrus-sasl-md5-2.1.27-5.el8.s390x.rpm cyrus-sasl-md5-debuginfo-2.1.27-5.el8.s390x.rpm cyrus-sasl-ntlm-2.1.27-5.el8.s390x.rpm cyrus-sasl-ntlm-debuginfo-2.1.27-5.el8.s390x.rpm cyrus-sasl-plain-2.1.27-5.el8.s390x.rpm cyrus-sasl-plain-debuginfo-2.1.27-5.el8.s390x.rpm cyrus-sasl-scram-2.1.27-5.el8.s390x.rpm cyrus-sasl-scram-debuginfo-2.1.27-5.el8.s390x.rpm cyrus-sasl-sql-debuginfo-2.1.27-5.el8.s390x.rpm x86_64: cyrus-sasl-2.1.27-5.el8.i686.rpm cyrus-sasl-2.1.27-5.el8.x86_64.rpm cyrus-sasl-debuginfo-2.1.27-5.el8.i686.rpm cyrus-sasl-debuginfo-2.1.27-5.el8.x86_64.rpm cyrus-sasl-debugsource-2.1.27-5.el8.i686.rpm cyrus-sasl-debugsource-2.1.27-5.el8.x86_64.rpm cyrus-sasl-devel-2.1.27-5.el8.i686.rpm cyrus-sasl-devel-2.1.27-5.el8.x86_64.rpm cyrus-sasl-devel-debuginfo-2.1.27-5.el8.i686.rpm cyrus-sasl-devel-debuginfo-2.1.27-5.el8.x86_64.rpm cyrus-sasl-gs2-2.1.27-5.el8.i686.rpm cyrus-sasl-gs2-2.1.27-5.el8.x86_64.rpm cyrus-sasl-gs2-debuginfo-2.1.27-5.el8.i686.rpm cyrus-sasl-gs2-debuginfo-2.1.27-5.el8.x86_64.rpm cyrus-sasl-gssapi-2.1.27-5.el8.i686.rpm cyrus-sasl-gssapi-2.1.27-5.el8.x86_64.rpm cyrus-sasl-gssapi-debuginfo-2.1.27-5.el8.i686.rpm cyrus-sasl-gssapi-debuginfo-2.1.27-5.el8.x86_64.rpm cyrus-sasl-ldap-2.1.27-5.el8.i686.rpm cyrus-sasl-ldap-2.1.27-5.el8.x86_64.rpm cyrus-sasl-ldap-debuginfo-2.1.27-5.el8.i686.rpm cyrus-sasl-ldap-debuginfo-2.1.27-5.el8.x86_64.rpm cyrus-sasl-lib-2.1.27-5.el8.i686.rpm cyrus-sasl-lib-2.1.27-5.el8.x86_64.rpm cyrus-sasl-lib-debuginfo-2.1.27-5.el8.i686.rpm cyrus-sasl-lib-debuginfo-2.1.27-5.el8.x86_64.rpm cyrus-sasl-md5-2.1.27-5.el8.i686.rpm cyrus-sasl-md5-2.1.27-5.el8.x86_64.rpm cyrus-sasl-md5-debuginfo-2.1.27-5.el8.i686.rpm cyrus-sasl-md5-debuginfo-2.1.27-5.el8.x86_64.rpm cyrus-sasl-ntlm-2.1.27-5.el8.i686.rpm cyrus-sasl-ntlm-2.1.27-5.el8.x86_64.rpm cyrus-sasl-ntlm-debuginfo-2.1.27-5.el8.i686.rpm cyrus-sasl-ntlm-debuginfo-2.1.27-5.el8.x86_64.rpm cyrus-sasl-plain-2.1.27-5.el8.i686.rpm cyrus-sasl-plain-2.1.27-5.el8.x86_64.rpm cyrus-sasl-plain-debuginfo-2.1.27-5.el8.i686.rpm cyrus-sasl-plain-debuginfo-2.1.27-5.el8.x86_64.rpm cyrus-sasl-scram-2.1.27-5.el8.i686.rpm cyrus-sasl-scram-2.1.27-5.el8.x86_64.rpm cyrus-sasl-scram-debuginfo-2.1.27-5.el8.i686.rpm cyrus-sasl-scram-debuginfo-2.1.27-5.el8.x86_64.rpm cyrus-sasl-sql-debuginfo-2.1.27-5.el8.i686.rpm cyrus-sasl-sql-debuginfo-2.1.27-5.el8.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2019-19906 https://access.redhat.com/security/updates/classification#moderate https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/8.3_release_notes/index 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBX6IyudzjgjWX9erEAQiCchAAk9UcA1A60Ye4AUEN/OmG2f6Hy5r+SmzR 0YAj08OcsXQytuhblmMueb3qqPdm6nidIWDm9TLV+R5v599FHRJL+idM8ltQILXu py3GpKJpAkr2Z8dtnPjDw3Mn9/vO9DEjaBecDj+Bnwa6oGA4yb2JPHGdyxxITH9z PaMZVzfFzROptye6EHv3NfZ4Ci4Tlk2wnJtvuvdffyvq+uMvTwDktyshmZNAXfeu O/YHZaGjcnSG7g481s5wlD7aQFgMqN/re9GI5N5Ub6x4Ah13HfrEJ+FgDbu7S5yJ wsnOICbyCP7omRaz9BUE8tHKv4+1tInH1grpys/OwSEhrddJajeaRVjst1Se1Dtt WKzSnFbXJn+pM9BvNrU532rTszyuCbbTPOTfABE6TNiDeLilX8Ehs92zqyJfP9WI 7BFywYyVhZ1itG6wDQ2si8qzrzA4+tSHyGnFDyFJF+tjlBd/NCEwsAsEAzDzGoHl akWbqxzDNtfJHM8Mlv1AB4omVQcxIJU+BN+gGEt6ibNzUqFxK1b6Vc/EUEhOv6fs omHD+rfpJIidV+4K9GWiH8wGuvh+Glgwe0NtyQZYzBVXay/CH7GMeaK+z3JAeVFp 9DKKJARpaxoXy+uzaIREOSApq/0zzZbD+zvqV7aUPsGpNEgY+5ZZjRy0NoX3qkY4 J9dasIlxe08=/h9c -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . Cautionary alert issued regarding cyrus-sasl within Red Hat Enterprise Linux 8, detailing recent updates, patches, and improved features.. Cyrus-sasl update, Red Hat security, service attack fix. . LinuxSecurity.com Team

Calendar%202 Nov 03, 2020 Red Hat
203
Ls Advisories Mageia Esm H240
Price Tag%201security advisorysecurity issuesasl

Mageia: 2019-0206 Moderate Security Risk in Irssi Use After Free

Irssi before 1.0.8 and 1.2.x before 1.2.1, when SASL is enabled, has a use after free when sending SASL login to the server (CVE-2019-13045). References: - https://bugs.mageia.org/show_bug.cgi?id=25025 . MGASA-2019-0206 - Updated irssi package fixes security vulnerability Publication date: 10 Jul 2019 URL: https://advisories.mageia.org/MGASA-2019-0206.html Type: security Affected Mageia releases: 6, 7 CVE: CVE-2019-13045 Irssi before 1.0.8 and 1.2.x before 1.2.1, when SASL is enabled, has a use after free when sending SASL login to the server (CVE-2019-13045). References: - https://bugs.mageia.org/show_bug.cgi?id=25025 - https://irssi.org/security/irssi_sa_2019_06.txt - https://www.cve.org/CVERecord?id=CVE-2019-13045 SRPMS: - 7/core/irssi-1.2.1-1.mga7 - 6/core/irssi-1.0.8-1.mga6 . The recent Irssi patch resolves a critical use after free vulnerability related to SASL, boosting the security framework in Mageia versions 6 and 7.. Irssi Update, Mageia Security, SASL Vulnerability, Linux Security. . LinuxSecurity.com Team

Calendar%202 Jul 10, 2019 Mageia
Banner 4 1028x280 1708121825 1771600306
87
Ls Advisories Debian Esm H240
Price Tag%201security advisoryunauthorized accessdebian

Debian: DSA-4001-1 Critical: Jabberd2 Unauthorized SASL Connections

It was discovered that jabberd2, a Jabber instant messenger server, allowed anonymous SASL connections, even if disabled in the configuration. . - ------------------------------------------------------------------------- Debian Security Advisory DSA-3902-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/security/ Salvatore Bonaccorso July 05, 2017 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : jabberd2 CVE ID : CVE-2017-10807 Debian Bug : 867032 It was discovered that jabberd2, a Jabber instant messenger server, allowed anonymous SASL connections, even if disabled in the configuration. For the stable distribution (stretch), this problem has been fixed in version 2.4.0-3+deb9u1. We recommend that you upgrade your jabberd2 packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . Critical patch for jabberd2 addresses security vulnerability permitting unauthorized SASL access. Users are urged to upgrade immediately.. Jabberd2 Security Update, Unauthorized Access, Debian Advisory. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Jul 05, 2017 •Critical Debian
98
Ls Advisories Redhat Esm H240
Price Tag%201security advisorymoderatebuffer overflow

Red Hat: RHSA-2011:0843-01 Moderate: Postfix SASL Crash

Updated postfix packages that fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: postfix security update Advisory ID: RHSA-2011:0843-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2011:0843.html Issue date: 2011-05-31 CVE Names: CVE-2011-1720 ==================================================================== 1. Summary: Updated postfix packages that fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Optional (v.6) - i386, x86_64 3. Description: Postfix is a Mail Transport Agent (MTA), supporting LDAP, SMTP AUTH (SASL), and TLS. A heap-based buffer over-read flaw was found in the way Postfix performed SASL handlers management for SMTP sessions, when Cyrus SASL authentication was enabled. A remote attacker could use this flaw to cause the Postfix smtpd server to crash via a specially-crafted SASL authentication request. The smtpd process was automatically restarted by the postfix master process after the time configured with service_throttle_time elapsed. (CVE-2011-1720) Note: Cyrus SASL authentication for Postfix is not enabled by default. Red Hat would like to thank the CERT/CC for reporting this issue. Upstream acknowledges Thomas Jarosch of Intra2net AG as the original reporter. Users of Postfix are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing this update, the postfix service will be restarted automatically. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/kb/docs/DOC-11259 5. Bugs fixed (http://bugzilla.redhat.com/): 699035 - CVE-2011-1720 postfix (smtpd): Crash due to improper management of SASL handlers for SMTP sessions 6. Package List: Red Hat Enterprise Linux AS version4: Source: i386: postfix-2.2.10-1.5.el4.i386.rpm postfix-debuginfo-2.2.10-1.5.el4.i386.rpm postfix-pflogsumm-2.2.10-1.5.el4.i386.rpm ia64: postfix-2.2.10-1.5.el4.ia64.rpm postfix-debuginfo-2.2.10-1.5.el4.ia64.rpm postfix-pflogsumm-2.2.10-1.5.el4.ia64.rpm ppc: postfix-2.2.10-1.5.el4.ppc.rpm postfix-debuginfo-2.2.10-1.5.el4.ppc.rpm postfix-pflogsumm-2.2.10-1.5.el4.ppc.rpm s390: postfix-2.2.10-1.5.el4.s390.rpm postfix-debuginfo-2.2.10-1.5.el4.s390.rpm postfix-pflogsumm-2.2.10-1.5.el4.s390.rpm s390x: postfix-2.2.10-1.5.el4.s390x.rpm postfix-debuginfo-2.2.10-1.5.el4.s390x.rpm postfix-pflogsumm-2.2.10-1.5.el4.s390x.rpm x86_64: postfix-2.2.10-1.5.el4.x86_64.rpm postfix-debuginfo-2.2.10-1.5.el4.x86_64.rpm postfix-pflogsumm-2.2.10-1.5.el4.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: Source: i386: postfix-2.2.10-1.5.el4.i386.rpm postfix-debuginfo-2.2.10-1.5.el4.i386.rpm postfix-pflogsumm-2.2.10-1.5.el4.i386.rpm x86_64: postfix-2.2.10-1.5.el4.x86_64.rpm postfix-debuginfo-2.2.10-1.5.el4.x86_64.rpm postfix-pflogsumm-2.2.10-1.5.el4.x86_64.rpm Red Hat Enterprise Linux ES version 4: Source: i386: postfix-2.2.10-1.5.el4.i386.rpm postfix-debuginfo-2.2.10-1.5.el4.i386.rpm postfix-pflogsumm-2.2.10-1.5.el4.i386.rpm ia64: postfix-2.2.10-1.5.el4.ia64.rpm postfix-debuginfo-2.2.10-1.5.el4.ia64.rpm postfix-pflogsumm-2.2.10-1.5.el4.ia64.rpm x86_64: postfix-2.2.10-1.5.el4.x86_64.rpm postfix-debuginfo-2.2.10-1.5.el4.x86_64.rpm postfix-pflogsumm-2.2.10-1.5.el4.x86_64.rpm Red Hat Enterprise Linux WS version 4: Source: i386: postfix-2.2.10-1.5.el4.i386.rpm postfix-debuginfo-2.2.10-1.5.el4.i386.rpm postfix-pflogsumm-2.2.10-1.5.el4.i386.rpm ia64: postfix-2.2.10-1.5.el4.ia64.rpm postfix-debuginfo-2.2.10-1.5.el4.ia64.rpm postfix-pflogsumm-2.2.10-1.5.el4.ia64.rpm x86_64: postfix-2.2.10-1.5.el4.x86_64.rpm postfix-debuginfo-2.2.10-1.5.el4.x86_64.rpm postfix-pflogsumm-2.2.10-1.5.el4.x86_64.rpm Red Hat Enterprise Linux Desktop (v. 5client): Source: i386: postfix-2.3.3-2.3.el5_6.i386.rpm postfix-debuginfo-2.3.3-2.3.el5_6.i386.rpm postfix-pflogsumm-2.3.3-2.3.el5_6.i386.rpm x86_64: postfix-2.3.3-2.3.el5_6.x86_64.rpm postfix-debuginfo-2.3.3-2.3.el5_6.x86_64.rpm postfix-pflogsumm-2.3.3-2.3.el5_6.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): Source: i386: postfix-2.3.3-2.3.el5_6.i386.rpm postfix-debuginfo-2.3.3-2.3.el5_6.i386.rpm postfix-pflogsumm-2.3.3-2.3.el5_6.i386.rpm ia64: postfix-2.3.3-2.3.el5_6.ia64.rpm postfix-debuginfo-2.3.3-2.3.el5_6.ia64.rpm postfix-pflogsumm-2.3.3-2.3.el5_6.ia64.rpm ppc: postfix-2.3.3-2.3.el5_6.ppc.rpm postfix-debuginfo-2.3.3-2.3.el5_6.ppc.rpm postfix-pflogsumm-2.3.3-2.3.el5_6.ppc.rpm s390x: postfix-2.3.3-2.3.el5_6.s390x.rpm postfix-debuginfo-2.3.3-2.3.el5_6.s390x.rpm postfix-pflogsumm-2.3.3-2.3.el5_6.s390x.rpm x86_64: postfix-2.3.3-2.3.el5_6.x86_64.rpm postfix-debuginfo-2.3.3-2.3.el5_6.x86_64.rpm postfix-pflogsumm-2.3.3-2.3.el5_6.x86_64.rpm Red Hat Enterprise Linux Desktop (v. 6): Source: i386: postfix-2.6.6-2.2.el6_1.i686.rpm postfix-debuginfo-2.6.6-2.2.el6_1.i686.rpm x86_64: postfix-2.6.6-2.2.el6_1.x86_64.rpm postfix-debuginfo-2.6.6-2.2.el6_1.x86_64.rpm Red Hat Enterprise Linux Desktop Optional (v. 6): Source: i386: postfix-debuginfo-2.6.6-2.2.el6_1.i686.rpm postfix-perl-scripts-2.6.6-2.2.el6_1.i686.rpm x86_64: postfix-debuginfo-2.6.6-2.2.el6_1.x86_64.rpm postfix-perl-scripts-2.6.6-2.2.el6_1.x86_64.rpm Red Hat Enterprise Linux HPC Node (v. 6): Source: x86_64: postfix-2.6.6-2.2.el6_1.x86_64.rpm postfix-debuginfo-2.6.6-2.2.el6_1.x86_64.rpm Red Hat Enterprise Linux HPC Node Optional (v. 6): Source: x86_64: postfix-debuginfo-2.6.6-2.2.el6_1.x86_64.rpm postfix-perl-scripts-2.6.6-2.2.el6_1.x86_64.rpm Red Hat Enterprise Linux Server (v.6): Source: i386: postfix-2.6.6-2.2.el6_1.i686.rpm postfix-debuginfo-2.6.6-2.2.el6_1.i686.rpm ppc64: postfix-2.6.6-2.2.el6_1.ppc64.rpm postfix-debuginfo-2.6.6-2.2.el6_1.ppc64.rpm s390x: postfix-2.6.6-2.2.el6_1.s390x.rpm postfix-debuginfo-2.6.6-2.2.el6_1.s390x.rpm x86_64: postfix-2.6.6-2.2.el6_1.x86_64.rpm postfix-debuginfo-2.6.6-2.2.el6_1.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 6): Source: i386: postfix-debuginfo-2.6.6-2.2.el6_1.i686.rpm postfix-perl-scripts-2.6.6-2.2.el6_1.i686.rpm ppc64: postfix-debuginfo-2.6.6-2.2.el6_1.ppc64.rpm postfix-perl-scripts-2.6.6-2.2.el6_1.ppc64.rpm s390x: postfix-debuginfo-2.6.6-2.2.el6_1.s390x.rpm postfix-perl-scripts-2.6.6-2.2.el6_1.s390x.rpm x86_64: postfix-debuginfo-2.6.6-2.2.el6_1.x86_64.rpm postfix-perl-scripts-2.6.6-2.2.el6_1.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: i386: postfix-2.6.6-2.2.el6_1.i686.rpm postfix-debuginfo-2.6.6-2.2.el6_1.i686.rpm x86_64: postfix-2.6.6-2.2.el6_1.x86_64.rpm postfix-debuginfo-2.6.6-2.2.el6_1.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 6): Source: i386: postfix-debuginfo-2.6.6-2.2.el6_1.i686.rpm postfix-perl-scripts-2.6.6-2.2.el6_1.i686.rpm x86_64: postfix-debuginfo-2.6.6-2.2.el6_1.x86_64.rpm postfix-perl-scripts-2.6.6-2.2.el6_1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key#package 7. References: https://access.redhat.com/security/cve/CVE-2011-1720 https://access.redhat.com/security/updates/classification#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2011 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFN5Q+zXlSAg2UNWIIRAnNJAJ9+kzFv8T5mFcOL0cP6TOKtt5A/rQCgn9WN fXvwjl2pb9anlkEY59xkzUI=OfHv -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . The recentsecurity patch for Postfix on Red Hat delivers a noteworthy enhancement to the efficiency of the mail transfer system, addressing moderate vulnerabilities.. Postfix Security Update, Red Hat Security Fix, Mail Transport Agent, SASL Authentication. . LinuxSecurity.com Team

Calendar%202 May 31, 2011 Red Hat
Banner 4 1028x280 1708121825 1771600306
87
Ls Advisories Debian Esm H240
Price Tag%201security advisorycriticaldebian

Debian 3.0: DSA 568-1 Critical: SASL Arbitrary Code Execution

A vulnerability has been discovered in the Cyrus implementation of the SASL library, the Simple Authentication and Security Layer, a method for adding authentication support to connection-based protocols.. -------------------------------------------------------------------------- Debian Security Advisory DSA 568-1 This email address is being protected from spambots. You need JavaScript enabled to view it. Debian -- Security Information Martin Schulze October 16th, 2004 Debian -- Debian security FAQ -------------------------------------------------------------------------- Package : cyrus-sasl-mit Vulnerability : unsanitised input Problem-Type : local Debian-specific: no CVE ID : CAN-2004-0884 Debian Bug : 275498 A vulnerability has been discovered in the Cyrus implementation of the SASL library, the Simple Authentication and Security Layer, a method for adding authentication support to connection-based protocols. The library honors the environment variable SASL_PATH blindly, which allows a local user to link against a malicious library to run arbitrary code with the privileges of a setuid or setgid application. The MIT version of the Cyrus implementation of the SASL library provides bindings against MIT GSSAPI and MIT Kerberos4. For the stable distribution (woody) this problem has been fixed in version 1.5.24-15woody3. For the unstable distribution (sid) this problem will be fixed soon. We recommend that you upgrade your libsasl packages. Upgrade Instructions -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 3.0 alias woody -------------------------------- Sourcearchives: Size/MD5 checksum: 737 c28b9688bbb9de9f920594ba8ac2b9d5 Size/MD5 checksum: 125280 324fed374135082dce487d78f46db72f Size/MD5 checksum: 494457 ac3837c071c258b80021325936db2583 Alpha architecture: Size/MD5 checksum: 38780 daa298d1425c5381e5d223c04fd16312 Size/MD5 checksum: 30282 d6b4f4eb7a96a320094ea8ff698a68bd ARM architecture: Size/MD5 checksum: 37270 85d60315293f4115f5b8469262a8e839 Size/MD5 checksum: 28368 834ab3c7b7db63e7b6420986ecbcfe02 Intel IA-32 architecture: Size/MD5 checksum: 37012 0a70a5abb8a75f9407a492f7342360be Size/MD5 checksum: 28188 8e472ccc4076d9ce7596363e53c4401f Intel IA-64 architecture: Size/MD5 checksum: 41274 fa2ef8e398ca8c1cf733ea86f017a8ea Size/MD5 checksum: 32360 4933dc10dcc21dd22968a7eb9ecee6a7 HP Precision architecture: Size/MD5 checksum: 38502 07c04f8e1709650cfc8a9dcf06dcca82 Size/MD5 checksum: 29204 fa6282350f600ab5aacc0cdc9c1ee808 Motorola 680x0 architecture: Size/MD5 checksum: 36788 bad1e3f4176662fba63453703e211257 Size/MD5 checksum: 27630 628baec08c7e6a80aff4488a51f02cad Big endian MIPS architecture: Size/MD5 checksum: 37782 c2f35e650480997a46e5b4c1cc296e7e Size/MD5 checksum: 28908 ff69ef3da95dbfd5cf864ade8dac62f0 Little endian MIPS architecture: Size/MD5 checksum: 37832 b31c15dd670ad1904774a57dd095f415 Size/MD5 checksum: 29040 bc88918a756dd4377b48be517ccea2a7 PowerPC architecture: Size/MD5 checksum: 37638 7396523c424cd0b03d58d63e7ca536cb Size/MD5 checksum: 28244 7e39eabb00f2233e62e7bdefca914700 IBM S/390 architecture: Size/MD5 checksum: 37572 c9e5305655d96d335c215b4536c0f32f Size/MD5 checksum: 28434 ff0cff9f384c417691d0203514c36b73 Sun Sparc architecture: Size/MD5 checksum: 36976 ab2a53ba08000123584eb0ccbaeeb07f Size/MD5 checksum: 27950 abd92b81a11ac1bdd3cc585c961b3ba6 These files will probably be moved into the stable distribution on its next update. --------------------------------------------------------------------------------- For apt-get: deb Debian -- Security Information stable/updates main For dpkg-ftp: dists/stable/updates/main Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. Package info: `apt-cache show ' and https://www.debian.org/distrib/packages . -------------------------------------------------------------------------- Debian Security Advisory . vulnerability, cyrus, library, simple. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Oct 16, 2004 •Critical Debian
News Add Esm H240

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

More Polls

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":1,"type":"x","order":4,"pct":100,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200

Search Topics