Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -5 articles for you...
172
security advisoryremote accessmoderate severityUbuntu 21.04: USN-4966-1 Moderate: libx11 Remote Access
libx11 could allow unintended access to services.. =========================================================================Ubuntu Security Notice USN-4966-1 May 25, 2021 libx11 vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 21.04 - Ubuntu 20.10 - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: libx11 could allow unintended access to services. Software Description: - libx11: X11 client-side library Details: It was discovered that libx11 incorrectly validated certain parameter lengths. A remote attacker could possibly use this issue to trick libx11 into emitting extra X protocol requests. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 21.04: libx11-6 2:1.7.0-2ubuntu0.1 Ubuntu 20.10: libx11-6 2:1.6.12-1ubuntu0.1 Ubuntu 20.04 LTS: libx11-6 2:1.6.9-2ubuntu1.2 Ubuntu 18.04 LTS: libx11-6 2:1.6.4-3ubuntu0.4 After a standard system update you need to reboot your computer to make all the necessary changes. References: https://ubuntu.com/security/notices/USN-4966-1 CVE-2021-31535 Package Information: https://launchpad.net/ubuntu/+source/libx11/2:1.7.0-2ubuntu0.1 https://launchpad.net/ubuntu/+source/libx11/2:1.6.12-1ubuntu0.1 https://launchpad.net/ubuntu/+source/libx11/2:1.6.9-2ubuntu1.2 https://launchpad.net/ubuntu/+source/libx11/2:1.6.4-3ubuntu0.4 . libx11 weakness impacts various Ubuntu versions. Adhere to update guidelines to prevent unauthorized service access.. libx11 update, remote access issue, Ubuntu security advisory. . LinuxSecurity.com Team
May 25, 2021
Ubuntu
98
security advisoryRed HatDoSRedHat: RHSA-2020-2413 moderate: OpenShift Platform 4.5 Security Update
An update for machine-config-daemon and openshift is now available for Red Hat OpenShift Container Platform 4.5. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: OpenShift Container Platform 4.5 package security update Advisory ID: RHSA-2020:2413-01 Product: Red Hat OpenShift Enterprise Advisory URL: https://access.redhat.com/errata/RHSA-2020:2413 Issue date: 2020-07-13 CVE Names: CVE-2019-11254 CVE-2020-8558 CVE-2020-8945 ==================================================================== 1. Summary: An update for machine-config-daemon and openshift is now available for Red Hat OpenShift Container Platform 4.5. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat OpenShift Container Platform 4.5 - x86_64 3. Description: Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. Security Fix(es): * kubernetes: Denial of service in API server via crafted YAML payloads by authorized users (CVE-2019-11254) * kubernetes: node localhost services reachable via martian packets (CVE-2020-8558) * proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For OpenShift Container Platform 4.5see the following documentation, which will be updated shortly for release 4.5.1, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.5/html/release_notes/ocp-4-5-release-notes Details on how to access this content are available at - -cli.html. 5. Bugs fixed (https://bugzilla.redhat.com/): 1795838 - CVE-2020-8945 proglottis/gpgme: Use-after-free in GPGME bindings during container image pull 1819486 - CVE-2019-11254 kubernetes: Denial of service in API server via crafted YAML payloads by authorized users1843358 - CVE-2020-8558 kubernetes: node localhost services reachable via martian packets 6. Package List: Red Hat OpenShift Container Platform 4.5: Source: openshift-4.5.0-202007012112.p0.git.0.582d7fc.el7.src.rpm x86_64: openshift-hyperkube-4.5.0-202007012112.p0.git.0.582d7fc.el7.x86_64.rpm Red Hat OpenShift Container Platform 4.5: Source: machine-config-daemon-4.5.0-202007012112.p0.git.2527.d12c3da.el8.src.rpm openshift-4.5.0-202007012112.p0.git.0.582d7fc.el8.src.rpm x86_64: machine-config-daemon-4.5.0-202007012112.p0.git.2527.d12c3da.el8.x86_64.rpm openshift-hyperkube-4.5.0-202007012112.p0.git.0.582d7fc.el8.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2019-11254 https://access.redhat.com/security/cve/CVE-2020-8558 https://access.redhat.com/security/cve/CVE-2020-8945 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBXwyP2tzjgjWX9erEAQhPsBAAlryPnT2I2IKUvpXsexBAGTfNn+fkZu6h 4du/Qqipe9eDt2YLlobruw1Zhpy7OmDGgJ7aJSwCyLo/+ZkAx0Yj6+6XPuv2xtJV fVM5IN1w9g71f73T1sX846XWwjHCBHMbeEFuOSkMkE1mVYMDOQu3RbVOWNJ2xuVf x72qFeAt2EHDMCD3MisNY39Tzu5QpHUDFwxmOpYj1ezUBDrrGn7WJCMHaof2PGwh WjDOxMqazRu1Ll90NuG0i5A5qALkEvfOFGHTgSJdFuA7dUnr2+Mw66WbKE/A169q XuIj6OjDtfc9ZgV8okoesPzqM/yub4eP+uIja2a/y85WGpS1RHTPkgppfbq3JzKS 4wUEShhtxZ9kI0az8uGv6u6Sj5qkKcq+tgDuWx7FBQl8V/5JUsAl9ckJ551CbcDH /eM23C/leMfuOm4j7iAptPlwMpzkAcuq8yV47Yvf4Bk+odN/9lKj71den7HbstOb bYVIJ/C5EgWJDTYRBkL7eNk9E2W1haJawRgkWfXi2r8TUjhby9V4JBIqyigBT2Js uWbbC/8lq4RKjuEEunFf6vW2RvlO34VpOTrLJ84gqiD+mAYxa09SEw3dpsxHCsB6 S/qpF3ZeIJzwU9GGdj79ApghMWA3+RInLtDDSGsHBXY3QV3bAzrDhG4uI9BIVq3e UcLrX1YbL/g=jYhI -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Jul 13, 2020
Red Hat
172
security advisorymoderateUbuntuUbuntu 19.04, 18.10, 18.04, 16.04 LTS: 4015-1 Moderate: DBus Access Issue
DBus could allow unintended access to services.. =========================================================================Ubuntu Security Notice USN-4015-1 June 11, 2019 dbus vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 19.04 - Ubuntu 18.10 - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: DBus could allow unintended access to services. Software Description: - dbus: simple interprocess messaging system Details: Joe Vennix discovered that DBus incorrectly handled DBUS_COOKIE_SHA1 authentication. A local attacker could possibly use this issue to bypass authentication and connect to DBus servers with elevated privileges. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 19.04: dbus 1.12.12-1ubuntu1.1 libdbus-1-3 1.12.12-1ubuntu1.1 Ubuntu 18.10: dbus 1.12.10-1ubuntu2.1 libdbus-1-3 1.12.10-1ubuntu2.1 Ubuntu 18.04 LTS: dbus 1.12.2-1ubuntu1.1 libdbus-1-3 1.12.2-1ubuntu1.1 Ubuntu 16.04 LTS: dbus 1.10.6-1ubuntu3.4 libdbus-1-3 1.10.6-1ubuntu3.4 After a standard system update you need to reboot your computer to make all the necessary changes. References: https://ubuntu.com/security/notices/USN-4015-1 CVE-2019-12749 Package Information: https://launchpad.net/ubuntu/+source/dbus/1.12.12-1ubuntu1.1 https://launchpad.net/ubuntu/+source/dbus/1.12.10-1ubuntu2.1 https://launchpad.net/ubuntu/+source/dbus/1.12.2-1ubuntu1.1 https://launchpad.net/ubuntu/+source/dbus/1.10.6-1ubuntu3.4 . Ensure your Ubuntu installation is current to mitigate the recent DBus security flaw that allows unauthorized service access and authentication circumvention.. DBusVulnerability, Ubuntu Security Notice, Service Access Issue. . LinuxSecurity.com Team
Jun 11, 2019
Ubuntu
98
security advisoryRed Hat Enterprise Linuximportant security impactRed Hat Enterprise Linux 5: RHSA-2008:1001-01 Important Security Alert
Updated tog-pegasus packages that fix security issues are now available for Red Hat Enterprise Linux 5. Red Hat defines additional security enhancements for OpenGroup Pegasus WBEM services in addition to those defined by the upstream OpenGroup Pegasus release. For details regarding these enhancements, refer to the file "README.RedHat.Security", included in the Red Hat tog-pegasus package. This update has been rated as having important security impact by the Red Hat Security Response Team. . ==================================================================== Red Hat Security Advisory Synopsis: Important: tog-pegasus security update Advisory ID: RHSA-2008:1001-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2008:1001.html Issue date: 2008-11-25 CVE Names: CVE-2008-4313 CVE-2008-4315 ==================================================================== 1. Summary: Updated tog-pegasus packages that fix security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Description: The tog-pegasus packages provide OpenPegasus Web-Based Enterprise Management (WBEM) services. WBEM is a platform and resource independent Distributed Management Task Force (DMTF) standard that defines a common information model and communication protocol for monitoring and controlling resources. Red Hat defines additional security enhancements for OpenGroup Pegasus WBEM services in addition to those defined by the upstream OpenGroup Pegasus release. For details regarding these enhancements, refer to the file "README.RedHat.Security", included in the Red Hat tog-pegasus package. After re-basing to version 2.7.0 ofthe OpenGroup Pegasus code, these additional security enhancements were no longer being applied. As a consequence, access to OpenPegasus WBEM services was not restricted to the dedicated users as described in README.RedHat.Security. An attacker able to authenticate using a valid user account could use this flaw to send requests to WBEM services. (CVE-2008-4313) Note: default SELinux policy prevents tog-pegasus from modifying system files. This flaw's impact depends on whether or not tog-pegasus is confined by SELinux, and on any additional CMPI providers installed and enabled on a particular system. Failed authentication attempts against the OpenPegasus CIM server were not logged to the system log as documented in README.RedHat.Security. An attacker could use this flaw to perform password guessing attacks against a user account without leaving traces in the system log. (CVE-2008-4315) All tog-pegasus users are advised to upgrade to these updated packages, which contain patches to correct these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at 5. Bugs fixed (http://bugzilla.redhat.com/): 459217 - CVE-2008-4313 tog-pegasus: WBEM services access not restricted to dedicated user after 2.7.0 rebase 472017 - CVE-2008-4315 tog-pegasus: failed authentication attempts not logged via PAM 6. Package List: Red Hat Enterprise Linux Desktop (v. 5client): Source: i386: tog-pegasus-2.7.0-2.el5_2.1.i386.rpm tog-pegasus-debuginfo-2.7.0-2.el5_2.1.i386.rpm tog-pegasus-devel-2.7.0-2.el5_2.1.i386.rpm x86_64: tog-pegasus-2.7.0-2.el5_2.1.i386.rpm tog-pegasus-2.7.0-2.el5_2.1.x86_64.rpm tog-pegasus-debuginfo-2.7.0-2.el5_2.1.i386.rpm tog-pegasus-debuginfo-2.7.0-2.el5_2.1.x86_64.rpm tog-pegasus-devel-2.7.0-2.el5_2.1.i386.rpm tog-pegasus-devel-2.7.0-2.el5_2.1.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): Source: i386: tog-pegasus-2.7.0-2.el5_2.1.i386.rpm tog-pegasus-debuginfo-2.7.0-2.el5_2.1.i386.rpm tog-pegasus-devel-2.7.0-2.el5_2.1.i386.rpm ia64: tog-pegasus-2.7.0-2.el5_2.1.ia64.rpm tog-pegasus-debuginfo-2.7.0-2.el5_2.1.ia64.rpm tog-pegasus-devel-2.7.0-2.el5_2.1.ia64.rpm ppc: tog-pegasus-2.7.0-2.el5_2.1.ppc.rpm tog-pegasus-2.7.0-2.el5_2.1.ppc64.rpm tog-pegasus-debuginfo-2.7.0-2.el5_2.1.ppc.rpm tog-pegasus-debuginfo-2.7.0-2.el5_2.1.ppc64.rpm tog-pegasus-devel-2.7.0-2.el5_2.1.ppc.rpm tog-pegasus-devel-2.7.0-2.el5_2.1.ppc64.rpm s390x: tog-pegasus-2.7.0-2.el5_2.1.s390.rpm tog-pegasus-2.7.0-2.el5_2.1.s390x.rpm tog-pegasus-debuginfo-2.7.0-2.el5_2.1.s390.rpm tog-pegasus-debuginfo-2.7.0-2.el5_2.1.s390x.rpm tog-pegasus-devel-2.7.0-2.el5_2.1.s390.rpm tog-pegasus-devel-2.7.0-2.el5_2.1.s390x.rpm x86_64: tog-pegasus-2.7.0-2.el5_2.1.i386.rpm tog-pegasus-2.7.0-2.el5_2.1.x86_64.rpm tog-pegasus-debuginfo-2.7.0-2.el5_2.1.i386.rpm tog-pegasus-debuginfo-2.7.0-2.el5_2.1.x86_64.rpm tog-pegasus-devel-2.7.0-2.el5_2.1.i386.rpm tog-pegasus-devel-2.7.0-2.el5_2.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key#package 7. References: https://www.cve.org/CVERecord?id=CVE-2008-4313 https://www.cve.org/CVERecord?id=CVE-2008-4315 https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details athttps://access.redhat.com/security/team/contact Copyright 2008 Red Hat, Inc. . Crucial security patch for tog-pegasus modules in Red Hat tackles vulnerabilities in authentication and limits access controls.. tog-pegasus update, Red Hat security, Linux server security. . Severity: Important. LinuxSecurity.com Team
Nov 25, 2008
•Important
Red Hat
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!