Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -7 articles for you...
202
security advisorycriticalimportantopenSUSE Leap 15.5: 2024:1301-1 Important: Nodejs20 Security Update
This update for nodejs20 fixes the following issues: Update to 20.12.1. # Security update for nodejs20 Announcement ID: SUSE-SU-2024:1301-1 Rating: important References: * bsc#1220053 * bsc#1222244 * bsc#1222384 * bsc#1222530 * bsc#1222603 Cross-References: * CVE-2024-24806 * CVE-2024-27982 * CVE-2024-27983 * CVE-2024-30260 * CVE-2024-30261 CVSS scores: * CVE-2024-24806 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2024-24806 ( NVD ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2024-27982 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2024-27983 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-30260 ( SUSE ): 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N * CVE-2024-30261 ( SUSE ): 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N Affected Products: * openSUSE Leap 15.5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * Web and Scripting Module 15-SP5 An update that solves five vulnerabilities can now be installed. ## Description: This update for nodejs20 fixes the following issues: Update to 20.12.1 Security fixes: * CVE-2024-27983: Fixed failed assertion in node::http2::Http2Session::~Http2Session() that could lead to HTTP/2 server crash (bsc#1222244) * CVE-2024-27982: Fixed HTTP Request Smuggling via Content Length Obfuscation (bsc#1222384) * CVE-2024-30260: Fixed proxy-authorization header not cleared on cross-origin redirect in undici (bsc#1222530) * CVE-2024-30261: Fixed fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect in undici (bsc#1222603) * CVE-2024-24806: Fixed improper domain lookup that potentially leads to SSRF attacks in libuv (bsc#1220053) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaSTonline_update or "zypper patch". Alternatively you can run the command listed for your product: * Web and Scripting Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP5-2024-1301=1 * openSUSE Leap 15.5 zypper in -t patch SUSE-2024-1301=1 openSUSE-SLE-15.5-2024-1301=1 ## Package List: * Web and Scripting Module 15-SP5 (aarch64 ppc64le s390x x86_64) * nodejs20-debugsource-20.12.1-150500.11.9.2 * nodejs20-debuginfo-20.12.1-150500.11.9.2 * nodejs20-devel-20.12.1-150500.11.9.2 * npm20-20.12.1-150500.11.9.2 * nodejs20-20.12.1-150500.11.9.2 * Web and Scripting Module 15-SP5 (noarch) * nodejs20-docs-20.12.1-150500.11.9.2 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * nodejs20-debugsource-20.12.1-150500.11.9.2 * corepack20-20.12.1-150500.11.9.2 * nodejs20-debuginfo-20.12.1-150500.11.9.2 * nodejs20-devel-20.12.1-150500.11.9.2 * npm20-20.12.1-150500.11.9.2 * nodejs20-20.12.1-150500.11.9.2 * openSUSE Leap 15.5 (noarch) * nodejs20-docs-20.12.1-150500.11.9.2 ## References: * https://www.suse.com/security/cve/CVE-2024-24806.html * https://www.suse.com/security/cve/CVE-2024-27982.html * https://www.suse.com/security/cve/CVE-2024-27983.html * https://www.suse.com/security/cve/CVE-2024-30260.html * https://www.suse.com/security/cve/CVE-2024-30261.html * https://bugzilla.suse.com/show_bug.cgi?id=1220053 * https://bugzilla.suse.com/show_bug.cgi?id=1222244 * https://bugzilla.suse.com/show_bug.cgi?id=1222384 * https://bugzilla.suse.com/show_bug.cgi?id=1222530 * https://bugzilla.suse.com/show_bug.cgi?id=1222603 . Node.js 20 release introduced to address severe vulnerabilities, boost reliability, and promote more secure coding practices for Fedora users.. Node.js Security Update, openSUSE Security Advisory, Important Node.js Fixes. . Severity: Important. LinuxSecurity.com Team
Apr 16, 2024
•Important
OpenSUSE
99
security advisorydenial of servicesecurity updateSlackware: 2009-214-01 Critical: Httpd Denial-Of-Service
New httpd packages are available for Slackware 12.0, 12.1, 12.2, and -current to fix security issues. More details about these issues may be found in the Common Vulnerabilities and Exposures (CVE) database: . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] httpd (SSA:2009-214-01) New httpd packages are available for Slackware 12.0, 12.1, 12.2, and -current to fix security issues. More details about these issues may be found in the Common Vulnerabilities and Exposures (CVE) database: https://www.cve.org/CVERecord?id=CVE-2009-1891 https://www.cve.org/CVERecord?id=CVE-2009-1195 https://www.cve.org/CVERecord?id=CVE-2009-1890 https://www.cve.org/CVERecord?id=CVE-2009-1191 https://www.cve.org/CVERecord?id=CVE-2009-0023 https://www.cve.org/CVERecord?id=CVE-2009-1955 https://www.cve.org/CVERecord?id=CVE-2009-1956 Here are the details from the Slackware 12.2 ChangeLog: +--------------------------+ patches/packages/httpd-2.2.12-i486-1_slack12.2.tgz: Upgraded. This update fixes some security issues (from the CHANGES file): *) SECURITY: CVE-2009-1891 (cve.mitre.org) Fix a potential Denial-of-Service attack against mod_deflate or other modules, by forcing the server to consume CPU time in compressing a large file after a client disconnects. PR 39605. [Joe Orton, Ruediger Pluem] *) SECURITY: CVE-2009-1195 (cve.mitre.org) Prevent the "Includes" Option from being enabled in an .htaccess file if the AllowOverride restrictions do not permit it. [Jonathan Peatfield , Joe Orton, Ruediger Pluem, Jeff Trawick] *) SECURITY: CVE-2009-1890 (cve.mitre.org) Fix a potential Denial-of-Service attack against mod_proxy in a reverse proxy configuration, where a remote attacker can force a proxy process to consume CPU time indefinitely. [Nick Kew, Joe Orton] *) SECURITY: CVE-2009-1191 (cve.mitre.org) mod_proxy_ajp: Avoid delivering content from a previous request which failed to send a request body. PR 46949 [Ruediger Pluem] *)SECURITY: CVE-2009-0023, CVE-2009-1955, CVE-2009-1956 (cve.mitre.org) The bundled copy of the APR-util library has been updated, fixing three different security issues which may affect particular configurations and third-party modules. These last three CVEs were addressed in Slackware previously with an update to new system apr and apr-util packages. For more information, see: https://www.cve.org/CVERecord?id=CVE-2009-1891 https://www.cve.org/CVERecord?id=CVE-2009-1195 https://www.cve.org/CVERecord?id=CVE-2009-1890 https://www.cve.org/CVERecord?id=CVE-2009-1191 https://www.cve.org/CVERecord?id=CVE-2009-0023 https://www.cve.org/CVERecord?id=CVE-2009-1955 https://www.cve.org/CVERecord?id=CVE-2009-1956 (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ HINT: Getting slow download speeds from ftp.slackware.com? Give slackware.osuosl.org a try. This is another primary FTP site for Slackware that can be considerably faster than downloading directly from ftp.slackware.com. Thanks to the friendly folks at the OSU Open Source Lab (https://osuosl.org/) for donating additional FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://www.slackware.com/ for additional mirror sites near you. Updated package for Slackware 12.0: Updated package for Slackware 12.1: Updated package for Slackware 12.2: Updated package for Slackware -current: Updated package for Slackware64 -current: MD5 signatures: +-------------+ Slackware 12.0 package: 1ef7c8d65f8d7398abfcde3dd46aed7f httpd-2.2.12-i486-1_slack12.0.tgz Slackware 12.1 package: 349f4437fb4c2573a134c3485dda0265 httpd-2.2.12-i486-1_slack12.1.tgz Slackware 12.2 package: 253406ed8801276a635008d7749db55f httpd-2.2.12-i486-1_slack12.2.tgz Slackware -current package: 4a2ffd0ef9184fed93f651b83f6eaf6a httpd-2.2.12-i486-1.txz Slackware64 -current package: 560b607f09a934a46fc3112a2659b06b httpd-2.2.12-x86_64-1.txz Installation instructions: +------------------------+ Upgrade the package as root: # upgradepkg httpd-2.2.12-i486-1_slack12.2.tgz Then, restart the httpd server. +-----+ . Updated HTTPD versions for Slackware 12.x are now available to address significant security vulnerabilities and enhance server performance.. Slackware Httpd Update, Security Patch, Denial of Service Fix, Server Update. . Severity: Critical. LinuxSecurity.com Team
Aug 02, 2009
•Critical
Slackware
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!