Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found -6 articles for you...
98
security advisoryfile overwriteRed Hat Enterprise LinuxCentOS Security Advisory: CESA-2023:4567-01 Urgent: CGI Script Exploit
Temporary files were being created without taking adequate precautions, and therefore a local user could potentially overwrite files with the privileges of the user running emacs.. Red Hat Security Advisory Synopsis: Updated semi packages fix flim vulnerability Advisory ID: RHSA-2004:344-01 Issue date: 2004-08-18 Updated on: 2004-08-18 Product: Red Hat Enterprise Linux CVE Names: CAN-2004-0422 - --------------------------------------------------------------------- 1. Summary: Updated semi packages that fix vulnerabilities in flim temporary file handling are now available. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - noarch Red Hat Linux Advanced Workstation 2.1 - noarch Red Hat Enterprise Linux ES version 2.1 - noarch Red Hat Enterprise Linux WS version 2.1 - noarch 3. Problem description: The semi package includes a MIME library for GNU Emacs and XEmacs used by the wl mail package. Tatsuya Kinoshita discovered a vulnerability in flim, an emacs library for working with Internet messages included in the semi package. Temporary files were being created without taking adequate precautions, and therefore a local user could potentially overwrite files with the privileges of the user running emacs. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0422 to this issue. Users of semi are advised to upgrade to these packages, which contain a backported patch fixing this issue. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command: up2date For information on how to install packages manually, refer to the following Web page for the System Administration or Customization guide specific to your system: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/ 5. Bug IDs fixed (http://bugzilla.redhat.com/ for more info): 124396 - CAN-2004-0422 flim temporary file vulnerability affects semi packages 6. RPMs required: Red Hat Enterprise Linux AS (Advanced Server) version 2.1: SRPMS: dfcfc66f790902402b72eedd3a806284 semi-1.14.3-8.72.EL.1.src.rpm noarch: 23c1b96f8d9fc3d3aefa21812adbd5a1 semi-1.14.3-8.72.EL.1.noarch.rpm 2e5dc06d5aadf594ae7222706e230e0e semi-xemacs-1.14.3-8.72.EL.1.noarch.rpm Red Hat Linux Advanced Workstation 2.1: SRPMS: dfcfc66f790902402b72eedd3a806284 semi-1.14.3-8.72.EL.1.src.rpm noarch: 23c1b96f8d9fc3d3aefa21812adbd5a1 semi-1.14.3-8.72.EL.1.noarch.rpm 2e5dc06d5aadf594ae7222706e230e0e semi-xemacs-1.14.3-8.72.EL.1.noarch.rpm Red Hat Enterprise Linux ES version 2.1: SRPMS: dfcfc66f790902402b72eedd3a806284 semi-1.14.3-8.72.EL.1.src.rpm noarch: 23c1b96f8d9fc3d3aefa21812adbd5a1 semi-1.14.3-8.72.EL.1.noarch.rpm 2e5dc06d5aadf594ae7222706e230e0e semi-xemacs-1.14.3-8.72.EL.1.noarch.rpm Red Hat Enterprise Linux WS version 2.1: SRPMS: dfcfc66f790902402b72eedd3a806284 semi-1.14.3-8.72.EL.1.src.rpm noarch: 23c1b96f8d9fc3d3aefa21812adbd5a1 semi-1.14.3-8.72.EL.1.noarch.rpm 2e5dc06d5aadf594ae7222706e230e0e semi-xemacs-1.14.3-8.72.EL.1.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from 7. References: Debian -- Security Information -- DSA-500-1 flim CVE -CVE-2004-0422 8. Contact: The Red Hat security contact is . More contact details at Copyright 2004 Red Hat, Inc. . Boost your Emacs proficiency on RHEL by refining semi package settings, implementing strict file management, adjusting backup options, and guiding users to avoid unintentional file overwrites. Red Hat Advisory,Flim Security,Temporary File Fix,Semi Package Update. . Severity: Critical. LinuxSecurity.com Team
Aug 19, 2004
•Critical
Red Hat
98
security advisoryRed Hat Linuxfile overwriteRed Hat Linux: RHSA-2003:234-01 Critical: Semi Package Overwrite Risk
A vulnerability in semi version 1.14.3 and earlier allows an attackerto overwrite arbitrary files with potentially arbitrary contents using theprivileges of the user running Emacs and semi.. - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Updated semi packages fix vulnerability Advisory ID: RHSA-2003:234-01 Issue date: 2003-07-23 Updated on: 2003-07-23 Product: Red Hat Linux Keywords: Cross references: Obsoletes: CVE Names: CAN-2003-0440 - --------------------------------------------------------------------- 1. Topic: Updated semi packages that fix vulnerabilities in semi's temporary file handling are now available for Red Hat Linux 7.1, 7.2, and 7.3. 2. Relevant releases/architectures: Red Hat Linux 7.1 - noarch Red Hat Linux 7.1 for iSeries (64 bit) - noarch Red Hat Linux 7.1 for pSeries (64 bit) - noarch Red Hat Linux 7.2 - noarch Red Hat Linux 7.3 - noarch Red Hat Linux 8.0 - noarch Red Hat Linux 9 - noarch 3. Problem description: semi is a MIME library for GNU Emacs and XEmacs used by the wl mail package. A vulnerability in semi version 1.14.3 and earlier allows an attacker to overwrite arbitrary files with potentially arbitrary contents using the privileges of the user running Emacs and semi. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0440 to this issue. Users of semi are advised to upgrade to these packages, which contain a backported patch correcting this issue. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can alsouse wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via Red Hat Network. Many people find this an easier way to apply updates. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. 5. RPMs required: Red Hat Linux 7.1: SRPMS: noarch: Red Hat Linux 7.1 for iSeries (64 bit): SRPMS: noarch: Red Hat Linux 7.1 for pSeries (64 bit): SRPMS: noarch: Red Hat Linux 7.2: SRPMS: noarch: Red Hat Linux 7.3: SRPMS: noarch: Red Hat Linux 8.0: SRPMS: noarch: Red Hat Linux 9: SRPMS: noarch: 6. Verification: MD5 sum Package Name - -------------------------------------------------------------------------- 442949226f8868df1a9350d8cc4cd1d6 7.1/en/os/SRPMS/semi-1.13.7-10.src.rpm e042ec88e785f8b376b454cdfd192707 7.1/en/os/noarch/semi-1.13.7-10.noarch.rpm 442949226f8868df1a9350d8cc4cd1d6 7.1/en/os/iSeries/SRPMS/semi-1.13.7-10.src.rpm e042ec88e785f8b376b454cdfd192707 7.1/en/os/iSeries/noarch/semi-1.13.7-10.noarch.rpm 442949226f8868df1a9350d8cc4cd1d6 7.1/en/os/pSeries/SRPMS/semi-1.13.7-10.src.rpm e042ec88e785f8b376b454cdfd192707 7.1/en/os/pSeries/noarch/semi-1.13.7-10.noarch.rpm da8628629ed020b2bc9e06abf1524af3 7.2/en/os/SRPMS/semi-1.14.3-8.72.src.rpm c1e66bb252d95a81f63b0098ecdb5f83 7.2/en/os/noarch/semi-1.14.3-8.72.noarch.rpm 7653ba36b625f4f786e39573be802dfa 7.2/en/os/noarch/semi-xemacs-1.14.3-8.72.noarch.rpm 729f691aea3136030a34ebd1eadb9c23 7.3/en/os/SRPMS/semi-1.14.3-15.src.rpm 3c28749f6c99fc6d50f79fead6b8187b 7.3/en/os/noarch/semi-1.14.3-15.noarch.rpm b95c368e446ceda1e96a7ea747944cf5 7.3/en/os/noarch/semi-xemacs-1.14.3-15.noarch.rpm f085d6869ce59765fa72da26cec6b1f2 8.0/en/os/SRPMS/wl-2.8.1-9.src.rpm 84834aecf01ec7f0d7ce3ce9be830f648.0/en/os/noarch/wl-2.8.1-9.noarch.rpm 8e6719831cb4f5a68c92f497a61a414c 8.0/en/os/noarch/wl-common-2.8.1-9.noarch.rpm 6ff8d828af3407e6e7000f2b8d787f82 8.0/en/os/noarch/wl-xemacs-2.8.1-9.noarch.rpm 3f2c94d3cc527ec7e54532931eb524b3 9/en/os/SRPMS/wl-2.10.1-1.1.src.rpm b9fe8fb05a04fffa558a7e656746e603 9/en/os/noarch/wl-2.10.1-1.1.noarch.rpm d1f67f532368aba67910fb4ce7f7042d 9/en/os/noarch/wl-common-2.10.1-1.1.noarch.rpm 7122676e3a598eb8bb003e9d6c1ac3b6 9/en/os/noarch/wl-xemacs-2.10.1-1.1.noarch.rpm These packages are GPG signed by Red Hat for security. Our key is available from Product Signing Keys - Red Hat Customer Portal You can verify each package with the following command: rpm --checksig -v If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command: md5sum 7. References: Debian -- Security Information -- DSA-339-1 semi CVE -CVE-2003-0440 8. Contact: The Red Hat security contact is . More contact details at All Red Hat products Copyright 2003 Red Hat, Inc. . The notification issued by Canonical highlights a critical update for the core application suite, addressing security flaws that may allow remote code execution.. Red Hat SecOps, Semi Package Fix, Arbitrary Code Risk. . Severity: Critical. LinuxSecurity.com Team
Jul 24, 2003
•Critical
Red Hat
87
security advisorydebianlocal issueDebian: DSA 337-1 Moderate: Insecure File Management in Semi and Wemi
semi, a MIME library for GNU Emacs, does not take appropriate security precautions when creating temporary files.. - -------------------------------------------------------------------------- Debian Security Advisory DSA 337-1
Jul 07, 2003
Debian
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!