Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -7 articles for you...
91
security advisorysubversiongentooGentoo: GLSA-201610-05 Normal: Subversion And Serf Code Execution
Multiple vulnerabilities have been found in Subversion and Serf, the worst of which could lead to execution of arbitrary code.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201610-05 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Subversion, Serf: Multiple Vulnerabilities Date: October 11, 2016 Bugs: #500482, #518716, #519202, #545348, #556076, #567810, #581448, #586046 ID: 201610-05 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities have been found in Subversion and Serf, the worst of which could lead to execution of arbitrary code. Background ========= Subversion is a version control system intended to eventually replace CVS. Like CVS, it has an optional client-server architecture (where the server can be an Apache server running mod_svn, or an ssh program as in CVS's :ext: method). In addition to supporting the features found in CVS, Subversion also provides support for moving and copying files and directories. The serf library is a high performance C-based HTTP client library built upon the Apache Portable Runtime (APR) library. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-vcs/subversion < 1.9.4 > = 1.9.4 *> 1.8.16 2 net-libs/serf < 1.3.7 > = 1.3.7 ------------------------------------------------------------------- 2 affected packages Description ========== Multiple vulnerabilitieshave been discovered in Subversion and Serf. Please review the CVE identifiers referenced below for details Impact ===== A remote attacker could possibly execute arbitrary code with the privileges of the process, conduct a man-in-the-middle attack, obtain sensitive information, or cause a Denial of Service Condition. Workaround ========= There is no known workaround at this time. Resolution ========= All Subversion users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =dev-vcs/subversion-1.9.4" All Serf users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =net-libs/serf-1.3.7" References ========= [ 1 ] CVE-2014-0032 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0032 [ 2 ] CVE-2014-3504 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3504 [ 3 ] CVE-2014-3522 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3522 [ 4 ] CVE-2014-3528 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3528 [ 5 ] CVE-2015-0202 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0202 [ 6 ] CVE-2015-0248 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0248 [ 7 ] CVE-2015-0251 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0251 [ 8 ] CVE-2015-3184 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3184 [ 9 ] CVE-2015-3187 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3187 [ 10 ] CVE-2015-5259 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5259 [ 11 ] CVE-2016-2167 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2167 [ 12 ] CVE-2016-2168 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2168 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201610-05 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Oct 11, 2016
Gentoo
172
security advisoryubuntusensitive informationUbuntu 14.04 LTS: USN-2315-1 Moderate: Serf Man In The Middle Attack
Fraudulent security certificates could allow sensitive information to be exposed when accessing the Internet.. =========================================================================Ubuntu Security Notice USN-2315-1 August 14, 2014 serf vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS Summary: Fraudulent security certificates could allow sensitive information to be exposed when accessing the Internet. Software Description: - serf: high-performance asynchronous HTTP client library Details: Ben Reser discovered that serf did not correctly handle SSL certificates with NUL bytes in the CommonName or SubjectAltNames fields. A remote attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 14.04 LTS: libserf-1-1 1.3.3-1ubuntu0.1 Ubuntu 12.04 LTS: libserf1 1.0.0-2ubuntu0.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-2315-1 CVE-2014-3504 Package Information: https://launchpad.net/ubuntu/+source/serf/1.3.3-1ubuntu0.1 https://launchpad.net/ubuntu/+source/serf/1.0.0-2ubuntu0.1 . Deceptive encryption keys in serf may jeopardize confidential data, impacting Debian 8 and 7 releases.. serf exploit, ubuntu vulnerability, SSL certificate, man in the middle. . Severity: Important. LinuxSecurity.com Team
Aug 14, 2014
•Important
Ubuntu
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!