Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 1 articles for you...
202
security advisorymoderateaccess controlopenSUSE Tomcat11 Moderate Script and Access Issues Vuln 2026-3087-1
An update that solves six vulnerabilities and has one security fix can now be installed.. # Security update for tomcat11 Announcement ID: SUSE-SU-2026:3087-1 Release Date: 2026-07-16T17:56:56Z Rating: moderate References: * bsc#1232390 * bsc#1269791 * bsc#1269824 * bsc#1269907 * bsc#1269908 * bsc#1269909 * bsc#1269910 Cross-References: * CVE-2026-50229 * CVE-2026-53404 * CVE-2026-53434 * CVE-2026-55276 * CVE-2026-55955 * CVE-2026-55956 CVSS scores: * CVE-2026-50229 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N * CVE-2026-50229 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2026-50229 ( NVD ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2026-53404 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-53404 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-53404 ( NVD ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2026-53434 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-53434 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-53434 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2026-55276 ( SUSE ): 4.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-55276 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N * CVE-2026-55276 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2026-55955 ( SUSE ): 2.3 CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-55955 ( SUSE ): 4.2 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-55955 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-55956 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-55956 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-55956 ( NVD ): 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Affected Products: * openSUSE Leap 15.6 * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15 SP7 * Web and Scripting Module 15-SP7 An update that solves six vulnerabilities and has one security fix can now be installed. ## Description: This update for tomcat11 fixes the following issues Update to Tomcat 11.0.23. Security issues fixed: * CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example (bsc#1269791). * CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve caused non-OR conditions to be skipped if the first condition in an OR chain matched (bsc#1269910). * CVE-2026-53434: error condition not handled when configuring CRLs for a FFM based connector (bsc#1269824). * CVE-2026-55276: always-incorrect control flow implementation caused special roles and empty authorization constraints to not be included when the effective web.xml was logged (bsc#1269909). * CVE-2026-55955: improper authentication allows a replay attack against the EncryptionInterceptor in the cluster component (bsc#1269908). * CVE-2026-55956: improper authorization leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint (bsc#1269907). Other updates and bugfixes: * Upgrade libtcnative to v2 (bsc#1232390). * Tomcat 11.0.23: * Catalina * Add: Add support for literal '%' characters in access log output. Based on pull request #1002 by Fabian Hahn. (markt) * Fix: Lower the log level to debug when OpenSSL initialization fails in OpenSSLLifecycleListener to avoid stack traces when libssl.so is not present and to align the behavior of the isAvailable() check with the AprLifecycleListener and gracefully fail when natives are not present. (csutherl) * Fix: 70038: Cookie.clone() should also clone the internal attribute map. (markt) * Code: Remove unnecessary code from the SSI processing engine that was duplicating some of the normalisation checks. (markt) * Fix: Cleaner handling of invalid SPNEGO tokens. (remm) * Fix: Avoid some NPEs in the Connector class on an uninitialize protocol. (remm) * Fix: Incorrect session average life calculation. (remm) * Fix: Improve robustness on using Pipeline.setBasic on a running pipeline. (remm) * Fix: Avoid any init parameter updates when conflicts are found for filters, similar to what is done for servlets, as required by the servlet specification. (remm) * Fix: Fix container event cleanups in some edge cases. (remm) * Fix: Check for last-modified header in ExpiresFilter when a servlet uses addDateHeader to avoid wrongly considering it has been set. (remm) * Fix: Fix hour unit used by ExpiresFilter. (remm) * Fix: Remove exception swallowing in DataSourceStore to align it with FileStore and avoid session loss on errors. (remm) * Fix: Add support for single-quote escaped literal as well as quoted literals in DateFormatCache. (schultz) * Fix: On JAAS logout, clear out role principals on the subject that were added on commit, as recommended by the JAAS specification. (remm) * Fix: MemoryRealm should not add a dummy role when none is specified in the configuration. (remm) * Fix: DataSourceUserDatabase should return a null principal on a non existing user. (remm) * Fix: Fix shared lock expiration in WebDAV. (remm) * Fix: Inaccurate session exipration statistics when using the persistent manager. (remm) * Fix: Skip BOM when serving files with UTF-32 encoding. (remm) * Fix: Mixup of WrapperListener and WrapperLifecycle elements in storeconfig. (remm) * Fix: Incorrect processing of modified users in DataSourceUserDatabase. (remm) * Update: Clarify behavior in the UserDatabase for user, role and group creation that it does not immediately override existing elements. Removal (or update) needs to be used instead. (remm) * Fix: 70049:Align the web application class loader with parent class loaders and swallow any errors caused by invalid paths when looking up resources and behave as if the resources were not found in that case. (markt) * Fix: Improve validation of Range and Content-Range parsers so invalid ranges trigger a 4xx response rather than a 500 response. Pull request #1012 provided by Sahana Surendra Bogar. (markt) * Fix: Fix connection leak in ProxyErrorReportValve. (remm) * Fix: When using the RewriteValve, %{SSL:HTTPS} now returns on or off rather than true or false to align with httpd. (markt) * Fix: Reset the encoding used for query string parameters between requests in case an application changed the encoding in a previous request. (markt) * Fix: When encoding URLs with the CsrfPreventionFilter, don't add the nonce to URLs that are known not to require it. (markt) * Fix: Fix SSO cookie partitioned configuration. (remm) * Fix: Fix CombinedRealm isAvailable, it allows authentication if at least one sub realm is available. (remm) * Fix: 70048: Correctly handle asynchronous requests in PersistentValve. (markt) * Fix: Improve the detection of cross-context dispatches when using a RequestDispatcher. (markt) * Fix: Fix various instances of double decoding of URL patterns configured either programmatically or in web.xml. (remm/markt) * Fix: Align the rewrite conditions ornext flag processing with mod_rewrite, which follows a purely sequential evaluation strategy. (remm) * Fix: Update default web.xml version to match supported Servlet specification version. (markt) * Fix: Change the default for the useRedirect attribute of the ProxyErrorReportValve from true to false. (markt) * Add: Add support for the showReport attribute in JsonErrorReportValve and ProxyErrorReportValve. When set to false, detailed error information (message, description, stack trace) is suppressed from error responses. (dsoumis) * Fix: Avoid a NoClassDefFoundError at startup when catalina-tribes.jar isremoved but catalina-ha.jar is present and the Cluster element is enabled in server.xml. Cluster digester rules are now fully conditional on both JARs being available. (dsoumis) * Fix: Fix a potential deadlock when copying resources using WebDAV. (markt) * Fix: Add jakarta., org.apache.catalina. and org.apache.tomcat.to the list of reserved prefixes for SSI variables and request attributes. (markt) * Fix: Missing URL decoding when processing addMapping on a Servlet registration. (remm) * Fix: The Timeout WebDAV header allows comma separated values (according to the examples in the RFC). Use the first acceptable value. (remm) * Fix: Fix various issues when logging the effective web.xml for a web application. Empty sections are no longer logged. Special roles and empty authorisation constraints are included. All session cookie attributes are included. (markt) * Fix: Expand the write lock for the save process in the MemoryUserDatabase to avoid concurrency issues with the file save operations. (markt) * Fix: Ensure atomic session persistence in FileStore. Based on pull request #1016 by sahvx655-wq. (markt) * Fix: Do not ignore methods configured on security constraints that map to the default servlet. (markt) * Cluster * Fix: Expand wording and increase visibility of log message when cloud membership is configured without a trust store as all certificates will be trusted in this configuration. (markt) * Fix: Ensure listeners are correctly added and removed when configuring the channel coordinator. (markt) * Fix: Fix some concurrency issues in FragmentationInterceptor. (markt) * Fix: Fix some concurrency issues in OrderInterceptor. (markt) * Fix: Fix some concurrency issues in TwoPhaseCommitInterceptor. (markt) * Fix: Fix concurrency issues generating MD5 digests in the CloudMembershipProvider implementations. (markt) * Add: Add replay protection to the EncryptInterceptor. This us a breaking change for the EncryptInterceptor.(markt) * Coyote * Add:Log a suitable warning if an encrypted PEM file is detected using an insecure form for encryption. (markt) * Fix: If TLS groups have been configured, use the configured groups rather than using OpenSSL's default TLS groups when using Tomcat Native with OpenSSL based connectors. (markt) * Fix: For HTTP/2, ensure that any in progress request body reads are cancelled if the container resets the associated stream. This prevents delays waiting for reads to time out when it is known that no more data will be received. (markt) * Fix: Ensure that malformed HTTP/2 messages that should trigger a stream reset do so, rather than triggered a connection close. (markt) * Fix: Improve enforcement of header trailer allow list for HTTP/2. (remm) * Fix: 70050: Avoid NPE when no header frame is processed in HTTP/2, following refactor clean-up of header buffer. (remm) * Fix: Properly use pollerThreadPriority for the NIO poller thread. (remm) * Fix: Fix MessageByte.equals if called on a null MB. (remm) * Fix: Call the delegate key manager in JSSE to retrieve the server key. (remm) * Fix: Avoid overflow scenarios in Asn1Parser. (remm) * Fix: 70091: Add a new attribute, allowSchemeMismatch to Http2Protocol that allows the consistency check for the scheme provided by the user agent to be bypassed. (markt) * Fix: isTrailerFieldsReady was always returning true. (remm) * Fix: Align OpenSSL/Panama TLS implementation with other implementations and throw an exception if there is an error loading the provided CRL(s). (markt) * Fix: Parsing of OpenSSL format cipher expressions incorrectly stopped if @STRENGTH was encountered, ignoring any subsequent expressions. (markt) * Fix: Handle the case where the HTTP/2 payload length is insufficient for the mandatory data required by the flags set in the header. (markt) * Fix: 70102: Correct expected size of ticket keys when calling setSessionTicketKeys with an FFM connector. (markt) * Fix: 69988: Fix post handshake authentication for TLS1.3. It was broken by a breaking change in OpenSSL between 1.1.1 and 3.0.0. (markt) * Fix: When processing an OpenSSL cipher specification, fully align the order of the resulting ciphers with the order produced by OpenSSL. (markt) * Add: Add support for Brainpool TLS groups. Patch provided by YStankov. (schultz) * Update: Update both the minimum and recommended version for Tomcat Native 2.x to 2.0.15. (markt) * Update: Update the minimum version for Tomcat Native 1.x to 1.3.8. (markt) * Jasper * Fix: Fix possible EL argument mismatch when it was set to null. (remm) * Fix: Fix thread safety of TagPluginManager. (remm) * Fix: Correctly use flush on JSP include. (remm) * Web applications * Add: Manager: Add checks to ensure that any uploaded files are uploaded to the expected location. (markt) * Add: Manager: Add checks to ensure that the requested context path for a deployed WAR, directory or descriptor file is valid. (markt) * Add: Documentation: Expand the description of some of the attributes of the CrawlerSessionManagerValve. (markt) * Fix: Documentation: Clearer description and correct documented default for ocspSoftFail. (markt) * Fix: Fix double escaping in the context names for the JSON mode of the manager servlet. (remm) * Fix: Manager: Ensure automatic deployment does not trigger an undeployment during a Manager triggered web application reload. (markt) * Fix: Documentation: Provide better documentation for the scheme and secure attributes of a Connector. (markt) * Websocket * Fix: Incorrect Future.isDone() return by AsyncChannelWrapperSecure. (remm) * Fix: Trigger standard WebSocket error handling if a call to Endpoint.onOpen() fails for a programmatic endpoint. (markt) * Fix: 70110: Fix memory leak if a call to Endpoint.onOpen() fails for a programmatic endpoint. Test case provided by uabdur. (markt) * Fix: If a client presents invalid parameters when negotiating a WebSocket extension, decline the negotiation offer thatincludes the invalid parameters rather than failing the connection. Pull request #1019 provided by sahvx655-wq. (markt) * Other * Fix: Use per connection authenticator when executing an Ant task. (remm/markt) * Update: Update Commons Daemon to 1.6.1. (markt) * Fix: Prevent duplicate log messages when clustering JARs are not present on startup. (csutherl) * Update: Improvements to French translations. (remm) * Update: Improvements to Japanese translations provided by tak7iji. (markt) * Update: Update the packaged version of the Tomcat Migration Tool for Jakarta EE to 1.0.12. (markt) * Update: Update Tomcat Native to 2.0.15. (markt) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * Web and Scripting Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP7-2026-3087=1 * openSUSE Leap 15.6 zypper in -t patch SUSE-2026-3087=1 ## Package List: * Web and Scripting Module 15-SP7 (noarch) * tomcat11-11.0.23-150600.13.24.1 * tomcat11-el-6_0-api-11.0.23-150600.13.24.1 * tomcat11-servlet-6_1-api-11.0.23-150600.13.24.1 * tomcat11-lib-11.0.23-150600.13.24.1 * tomcat11-admin-webapps-11.0.23-150600.13.24.1 * tomcat11-jsp-4_0-api-11.0.23-150600.13.24.1 * tomcat11-webapps-11.0.23-150600.13.24.1 * openSUSE Leap 15.6 (noarch) * tomcat11-jsvc-11.0.23-150600.13.24.1 * tomcat11-docs-webapp-11.0.23-150600.13.24.1 * tomcat11-11.0.23-150600.13.24.1 * tomcat11-el-6_0-api-11.0.23-150600.13.24.1 * tomcat11-servlet-6_1-api-11.0.23-150600.13.24.1 * tomcat11-lib-11.0.23-150600.13.24.1 * tomcat11-admin-webapps-11.0.23-150600.13.24.1 * tomcat11-jsp-4_0-api-11.0.23-150600.13.24.1 * tomcat11-webapps-11.0.23-150600.13.24.1 * tomcat11-embed-11.0.23-150600.13.24.1 * tomcat11-doc-11.0.23-150600.13.24.1 ## References: *https://www.suse.com/security/cve/CVE-2026-50229.html * https://www.suse.com/security/cve/CVE-2026-53404.html * https://www.suse.com/security/cve/CVE-2026-53434.html * https://www.suse.com/security/cve/CVE-2026-55276.html * https://www.suse.com/security/cve/CVE-2026-55955.html * https://www.suse.com/security/cve/CVE-2026-55956.html * https://bugzilla.suse.com/show_bug.cgi?id=1232390 * https://bugzilla.suse.com/show_bug.cgi?id=1269791 * https://bugzilla.suse.com/show_bug.cgi?id=1269824 * https://bugzilla.suse.com/show_bug.cgi?id=1269907 * https://bugzilla.suse.com/show_bug.cgi?id=1269908 * https://bugzilla.suse.com/show_bug.cgi?id=1269909 * https://bugzilla.suse.com/show_bug.cgi?id=1269910 . This update fixes six vulnerabilities in Tomcat 11 and includes one security patch. Get the details and patch instructions.. opensuse tomcat11 moderate update security patch. . Severity: moderate. LinuxSecurity.com Team
Jul 17, 2026
•moderate
OpenSUSE
197
security advisoryupdateDebianDebian: DLA-2857-2 Update Addressing Postgis Regression Issue
The regression of postgresql-9.6-postgis-2.3-scripts being empty in 2.3.1+dfsg-2+deb9u1 has been fixed. For Debian 9 stretch, this problem has been fixed in version . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-2857-2
Dec 29, 2021
•Important
Debian LTS
203
security advisorythunderbirdmemory safetyMageia 7: MGASA-2020-0320 Moderate: Thunderbird Data Leak & Memory Safety
Potential leak of redirect targets when loading scripts in a worker. (CVE-2020-15652) WebRTC data channel leaks internal address to peer. (CVE-2020-6514) . MGASA-2020-0320 - Updated thunderbird packages fix security vulnerability Publication date: 18 Aug 2020 URL: https://advisories.mageia.org/MGASA-2020-0320.html Type: security Affected Mageia releases: 7 CVE: CVE-2020-6463, CVE-2020-6514, CVE-2020-15652, CVE-2020-15659 Potential leak of redirect targets when loading scripts in a worker. (CVE-2020-15652) WebRTC data channel leaks internal address to peer. (CVE-2020-6514) Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture. (CVE-2020-6463) Memory safety bugs fixed in Thunderbird 68.11. (CVE-2020-15659) References: - https://bugs.mageia.org/show_bug.cgi?id=27025 - https://www.thunderbird.net/en-US/thunderbird/68.11.0/releasenotes/ - https://www.mozilla.org/en-US/security/advisories/mfsa2020-35/ - https://access.redhat.com/errata/RHSA-2020:3344 - https://www.cve.org/CVERecord?id=CVE-2020-6463 - https://www.cve.org/CVERecord?id=CVE-2020-6514 - https://www.cve.org/CVERecord?id=CVE-2020-15652 - https://www.cve.org/CVERecord?id=CVE-2020-15659 SRPMS: - 7/core/thunderbird-68.11.0-1.mga7 - 7/core/thunderbird-l10n-68.11.0-1.mga7 . Revised Thunderbird builds mitigate risks of leaks and safeguard memory vulnerabilities, essential for Mageia 7 adopters.. Thunderbird Security Update, Mageia 7, Data Leak Fix, Memory Safety Fix. . LinuxSecurity.com Team
Aug 18, 2020
Mageia
89
security advisorysoftware updateFedoraFedora 28: 2019-8e7c71f45b Critical: Nodejs Simple Markdown Script Issue
Update to latest upstream release, fix CVE-2019-9844 (rhbz#1695304,. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2019-8e7c71f45b 2019-04-13 01:29:51.120150 --------------------------------------------------------------------------------Name : nodejs-simple-markdown Product : Fedora 28 Version : 0.4.4 Release : 1.fc28 URL : https://www.npmjs.com/package/simple-markdown Summary : Javascript markdown parsing, made simple Description : simple-markdown is a markdown-like parser designed for simplicity and extensibility. --------------------------------------------------------------------------------Update Information: Update to latest upstream release, fix CVE-2019-9844 (rhbz#1695304, --------------------------------------------------------------------------------ChangeLog: * Tue Apr 2 2019 Ben Rosser - 0.4.4-1 - Update to latest upstream release, fix CVE-2019-9844 (rhbz#1695304, rhbz#1695303). * Fri Feb 1 2019 Fedora Release Engineering - 0.4.1-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild * Fri Jul 13 2018 Fedora Release Engineering - 0.4.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild * Mon May 21 2018 Ben Rosser - 0.4.1-1 - Updated to latest upstream release (rhbz#1579339). * Mon Apr 30 2018 Ben Rosser - 0.4.0-1 - Updated to latest upstream release (#1554105). * Tue Mar 6 2018 Ben Rosser - 0.3.2-1 - Updated to latest upstream release (#1531831). * Thu Feb 8 2018 Fedora Release Engineering - 0.3.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild --------------------------------------------------------------------------------References: [ 1 ] Bug #1695303 - CVE-2019-9844 nodejs-simple-markdown: Cross-site script through the data of a vbscript link https://bugzilla.redhat.com/show_bug.cgi?id=1695303 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2019-8e7c71f45b' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Apr 12, 2019
•Critical
Fedora
172
security advisorycriticalcode executionUbuntu 18.04 LTS USN-3764-1 Critical Zsh Code Execution Risk
Zsh could be made to execute arbitrary code if it received a specially crafted script.. =========================================================================Ubuntu Security Notice USN-3764-1 September 11, 2018 zsh vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: Zsh could be made to execute arbitrary code if it received a specially crafted script. Software Description: - zsh: shell with lots of features Details: It was discovered that Zsh incorrectly handled certain scripts. An attacker could possibly use this issue to execute arbitrary code. (CVE-2018-0502, CVE-2018-13259) Richard Maciel Costa discovered that Zsh incorrectly handled certain scripts. An attacker could possibly use this issue to execute arbitrary code. (CVE-2018-1100) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS: zsh 5.4.2-3ubuntu3.1 Ubuntu 16.04 LTS: zsh 5.1.1-1ubuntu2.3 Ubuntu 14.04 LTS: zsh 5.0.2-3ubuntu6.3 After a standard system update you need to restart Zsh to make all the necessary changes. References: https://ubuntu.com/security/notices/USN-3764-1 CVE-2018-0502, CVE-2018-1100, CVE-2018-13259 Package Information: https://launchpad.net/ubuntu/+source/zsh/5.4.2-3ubuntu3.1 https://launchpad.net/ubuntu/+source/zsh/5.1.1-1ubuntu2.3 https://launchpad.net/ubuntu/+source/zsh/5.0.2-3ubuntu6.3 . Exploits in Zsh may lead to unauthorized code execution. Ensure your Ubuntu installations are updated immediately to safeguard against these threats.. Zsh vulnerabilities, Ubuntu security, code execution risks. . Severity: Critical.LinuxSecurity.com Team
Sep 11, 2018
•Critical
Ubuntu
100
security advisorycritical updateSUSESUSE: 2018:2686-1 Important: Vulnerabilities in zsh Execve Addressed
An update that fixes two vulnerabilities is now available. . SUSE Security Update: Security update for zsh ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:2686-1 Rating: important References: #1107294 #1107296 Cross-References: CVE-2018-0502 CVE-2018-13259 Affected Products: SUSE Linux Enterprise Module for Basesystem 15 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for zsh to version 5.6 fixes the following security issues: - CVE-2018-0502: The beginning of a #! script file was mishandled, potentially leading to an execve call to a program named on the second line (bsc#1107296). - CVE-2018-13259: Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program name that is a substring of the intended one (bsc#1107294). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Basesystem 15: zypper in -t patch SUSE-SLE-Module-Basesystem-15-2018-1880=1 Package List: - SUSE Linux Enterprise Module for Basesystem 15 (aarch64 ppc64le s390x x86_64): zsh-5.6-3.6.1 zsh-debuginfo-5.6-3.6.1 zsh-debugsource-5.6-3.6.1 References: https://www.suse.com/security/cve/CVE-2018-0502.html https://www.suse.com/security/cve/CVE-2018-13259.html https://bugzilla.suse.com/1107294 https://bugzilla.suse.com/1107296 _______________________________________________ sle-security-updates mailing list
Sep 11, 2018
•Important
SuSE
87
security advisorydebianmemory issueDebian 8 DSA-3776-1 Critical: Chromium Browser Cross-Site Issues
Several vulnerabilities have been discovered in the chromium web browser. CVE-2017-5006 . - ------------------------------------------------------------------------- Debian Security Advisory DSA-3776-1
Jan 31, 2017
•Critical
Debian
200
security advisoryupdatelow severityScientific Linux: Low Severity Yum-Autoupdate Update Security Advisory
Low: yum-autoupdate update. Date: Tue, 25 Sep 2012 08:50:06 -0500 Reply-To: Pat Riehecky Sender: Security Errata for Scientific Linux From: Pat Riehecky Organization: Fermilab Subject: FASTBUGS for SL 5x i386, x86_64 now available MIME-Version: 1.0 The following FASTBUGS have been uploaded to i386: perl-LDAP-0.33-4.el5_8.noarch.rpm x86_64: perl-LDAP-0.33-4.el5_8.noarch.rpm Date: Tue, 25 Sep 2012 08:50:08 -0500 Reply-To: Pat Riehecky Sender: Security Errata for Scientific Linux From: Pat Riehecky Organization: Fermilab Subject: FASTBUGS for SL 6x i386, x86_64 now available MIME-Version: 1.0 The following FASTBUGS have been uploadedto i386: cvs-1.11.23-15.el6.i686.rpm cvs-inetd-1.11.23-15.el6.noarch.rpm graphviz-2.26.0-10.el6.i686.rpm graphviz-devel-2.26.0-10.el6.i686.rpm graphviz-doc-2.26.0-10.el6.i686.rpm graphviz-gd-2.26.0-10.el6.i686.rpm graphviz-graphs-2.26.0-10.el6.i686.rpm graphviz-guile-2.26.0-10.el6.i686.rpm graphviz-java-2.26.0-10.el6.i686.rpm graphviz-lua-2.26.0-10.el6.i686.rpm graphviz-perl-2.26.0-10.el6.i686.rpm graphviz-php-2.26.0-10.el6.i686.rpm graphviz-python-2.26.0-10.el6.i686.rpm graphviz-ruby-2.26.0-10.el6.i686.rpm graphviz-tcl-2.26.0-10.el6.i686.rpm krb5-devel-1.9-33.el6_3.3.i686.rpm krb5-libs-1.9-33.el6_3.3.i686.rpm krb5-pkinit-openssl-1.9-33.el6_3.3.i686.rpm krb5-server-1.9-33.el6_3.3.i686.rpm krb5-server-ldap-1.9-33.el6_3.3.i686.rpm krb5-workstation-1.9-33.el6_3.3.i686.rpm openswan-2.6.32-19.el6_3.i686.rpm openswan-doc-2.6.32-19.el6_3.i686.rpm squid-3.1.10-9.el6_3.i686.rpm x86_64: cvs-1.11.23-15.el6.x86_64.rpm cvs-inetd-1.11.23-15.el6.noarch.rpm graphviz-2.26.0-10.el6.i686.rpm graphviz-2.26.0-10.el6.x86_64.rpm graphviz-devel-2.26.0-10.el6.i686.rpm graphviz-devel-2.26.0-10.el6.x86_64.rpm graphviz-doc-2.26.0-10.el6.x86_64.rpm graphviz-gd-2.26.0-10.el6.i686.rpm graphviz-gd-2.26.0-10.el6.x86_64.rpm graphviz-graphs-2.26.0-10.el6.x86_64.rpm graphviz-guile-2.26.0-10.el6.x86_64.rpm graphviz-java-2.26.0-10.el6.x86_64.rpm graphviz-lua-2.26.0-10.el6.x86_64.rpm graphviz-perl-2.26.0-10.el6.x86_64.rpm graphviz-php-2.26.0-10.el6.x86_64.rpm graphviz-python-2.26.0-10.el6.x86_64.rpm graphviz-ruby-2.26.0-10.el6.x86_64.rpm graphviz-tcl-2.26.0-10.el6.x86_64.rpm krb5-devel-1.9-33.el6_3.3.i686.rpm krb5-devel-1.9-33.el6_3.3.x86_64.rpm krb5-libs-1.9-33.el6_3.3.i686.rpm krb5-libs-1.9-33.el6_3.3.x86_64.rpm krb5-pkinit-openssl-1.9-33.el6_3.3.x86_64.rpm krb5-server-1.9-33.el6_3.3.x86_64.rpm krb5-server-ldap-1.9-33.el6_3.3.i686.rpm krb5-server-ldap-1.9-33.el6_3.3.x86_64.rpm krb5-workstation-1.9-33.el6_3.3.x86_64.rpm openswan-2.6.32-19.el6_3.x86_64.rpm openswan-doc-2.6.32-19.el6_3.x86_64.rpm squid-3.1.10-9.el6_3.x86_64.rpm Date: Tue, 25 Sep2012 11:42:51 -0500 Reply-To: Pat Riehecky Sender: Security Errata for Scientific Linux From: Pat Riehecky Organization: Fermilab Subject: Security ERRATA Low: yum-autoupdate update on SL5.x, SL6.x i386/x86_64 MIME-Version: 1.0 Synopsis: Low: yum-autoupdate update Issue date: 2012-09-25 The Scientific Linux team was made aware of a problem with the use of temp files in the yum-autoupdate script by Elias Persson. The problem should be corrected in these packages. These packages also include some minor feature updates for each release. For SL5, the script now includes the 'PRERUN' and 'POSTRUN' functionality first provided in SL5.8 and SL6. The script is still configured as before, in the /etc/yum.d/ directory. The new features were added to the /etc/yum.d/yum.cron.updateexec config file. For SL6, the package now includes an augeas lense for possible automated configuration. Augeas is a configuration file editing tool. This lense allows augeas to read your configuration file so that you can customize it through that program. Typically augeas is used for automated configuration file edits. This lense should allow you to script out any changes you wish to make at your site. Automated tools such as puppet can use augeas as native tool for configuration file edits. These packages were placed in testing for two weeks before their release. There were no reported problems. SL5: i386: yum-autoupdate-1.2-2.SL.noarch.rpm x86_64: yum-autoupdate-1.2-2.SL.noarch.rpm SL6: i386: yum-autoupdate-2-5.0.noarch.rpm x86_64: yum-autoupdate-2-5.0.noarch.rpm . A new yum-autoupdate release has been published for Scientific Linux, rectifying a minor script-related concern while introducing improved functionalities.. yum-autoupdate, Scientific Linux, security advisory, software update. . Severity: Low. LinuxSecurity.com Team
Sep 25, 2012
•Low
Scientific Linux
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!