Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 43 articles for you...
87
security advisorycriticaldebianDebian: pdns-recursor Critical Denial of Service Vulnerability DSA-6077-1
Insufficient validation of incoming notifies over TCP in PDNS Recursor, a resolving name server, could result in denial of service. For the stable distribution (trixie), this problem has been fixed in version 5.2.7-0+deb13u1. We recommend that you upgrade your pdns-recursor packages.. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6077-1
Dec 10, 2025
•Critical
Debian
89
security advisoryfedoraupdateFedora 42: FEDORA-2025-d2d34aad4c critical: dnsdist DoS issue
Updated to 1.9.10, this fixes CVE-2025-30193: Denial of service via crafted TCP exchange. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-d2d34aad4c 2025-05-30 01:14:13.237061+00:00 -------------------------------------------------------------------------------- Name : dnsdist Product : Fedora 42 Version : 1.9.10 Release : 1.fc42 URL : https://www.dnsdist.org/index.html Summary : Highly DNS-, DoS- and abuse-aware loadbalancer Description : dnsdist is a highly DNS-, DoS- and abuse-aware loadbalancer. Its goal in life is to route traffic to the best server, delivering top performance to legitimate users while shunting or blocking abusive traffic. -------------------------------------------------------------------------------- Update Information: Updated to 1.9.10, this fixes CVE-2025-30193: Denial of service via crafted TCP exchange -------------------------------------------------------------------------------- ChangeLog: * Wed May 21 2025 Sander Hoentjen - 1.9.10-1 - Update to 1.9.10 - fixes #2367441 - fixes #2367560, #2367561, #2367562, #2367460 (CVE-2025-30193) -------------------------------------------------------------------------------- References: [ 1 ] Bug #2367441 - dnsdist-1.9.10 is available https://bugzilla.redhat.com/show_bug.cgi?id=2367441 [ 2 ] Bug #2367560 - CVE-2025-30193 dnsdist: Denial of service via crafted TCP exchange [epel-9] https://bugzilla.redhat.com/show_bug.cgi?id=2367560 [ 3 ] Bug #2367561 - CVE-2025-30193 dnsdist: Denial of service via crafted TCP exchange [fedora-41] https://bugzilla.redhat.com/show_bug.cgi?id=2367561 [ 4 ] Bug #2367562 - CVE-2025-30193 dnsdist: Denial of service via crafted TCP exchange [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2367562 -------------------------------------------------------------------------------- This update can be installed with the "dnf"update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-d2d34aad4c' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
May 30, 2025
•Critical
Fedora
203
security advisorydenial of serviceclamavMageia 9 MGASA-2025-0031: clamav critical Denial of Service Fix
ClamAV OLE2 File Format Decryption Denial of Service Vulnerability. (CVE-2025-20128) References: - https://bugs.mageia.org/show_bug.cgi?id=33969 . MGASA-2025-0031 - Updated clamav packages fix security vulnerability Publication date: 31 Jan 2025 URL: https://advisories.mageia.org/MGASA-2025-0031.html Type: security Affected Mageia releases: 9 CVE: CVE-2025-20128 ClamAV OLE2 File Format Decryption Denial of Service Vulnerability. (CVE-2025-20128) References: - https://bugs.mageia.org/show_bug.cgi?id=33969 - https://ubuntu.com/security/notices/USN-7229-1 - https://www.cve.org/CVERecord?id=CVE-2025-20128 SRPMS: - 9/core/clamav-1.0.8-1.mga9 . Recent updates for ClamAV address a denial of service vulnerability impacting Mageia 9. Comprehensive insights on the advisory and the corrective measures implemented.. clamav security, clamav update, Mageia advisory, denial service fix. . Severity: Critical. LinuxSecurity.com Team
Jan 31, 2025
•Critical
Mageia
172
security advisoryupdate instructionstomcatUbuntu 24.04 LTS, USN-7032-1 critical: Tomcat HTTP smuggling
Tomcat could allow unintended access to network services.. ========================================================================== Ubuntu Security Notice USN-7032-1 September 24, 2024 tomcat8, tomcat9 vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: Tomcat could allow unintended access to network services. Software Description: - tomcat9: Servlet and JSP engine - tomcat8: Servlet and JSP engine Details: It was discovered that Tomcat incorrectly handled HTTP trailer headers. A remote attacker could possibly use this issue to perform HTTP request smuggling. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 24.04 LTS libtomcat9-java 9.0.70-2ubuntu0.1 Ubuntu 22.04 LTS libtomcat9-embed-java 9.0.58-1ubuntu0.1+esm3 Available with Ubuntu Pro libtomcat9-java 9.0.58-1ubuntu0.1+esm3 Available with Ubuntu Pro Ubuntu 20.04 LTS libtomcat9-embed-java 9.0.31-1ubuntu0.7 libtomcat9-java 9.0.31-1ubuntu0.7 Ubuntu 18.04 LTS libtomcat8-embed-java 8.5.39-1ubuntu1~18.04.3+esm3 Available with Ubuntu Pro libtomcat8-java 8.5.39-1ubuntu1~18.04.3+esm3 Available with Ubuntu Pro libtomcat9-embed-java 9.0.16-3ubuntu0.18.04.2+esm3 Available withUbuntu Pro libtomcat9-java 9.0.16-3ubuntu0.18.04.2+esm3 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7032-1 CVE-2023-46589 Package Information: https://launchpad.net/ubuntu/+source/tomcat9/9.0.31-1ubuntu0.7 . Apache Tomcat security notice (USN-8041-2) deals with potential vulnerabilities related to server accessibility and provides update recommendations for users on Ubuntu.. tomcat security, ubuntu advisory, network services, access issue, HTTP smuggling. . Severity: Critical. LinuxSecurity.com Team
Sep 25, 2024
•Critical
Ubuntu
219
security advisorydenial of servicesecurity fixRocky Linux 8 RLSA-2024:1615 Moderate Expat Denial Of Service Threat
Moderate: expat security update. {"type": "TYPE_SECURITY", "shortCode": "RL", "name": "RLSA-2024:1615", "synopsis": "Moderate: expat security update", "severity": "SEVERITY_MODERATE", "topic": "An update is available for expat.\nThis update affects Rocky Linux 8.\nA Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list", "description": "Expat is a C library for parsing XML documents.\n\nSecurity Fix(es):\n\n* expat: parsing large tokens can trigger a denial of service (CVE-2023-52425)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "solution": null, "affectedProducts": ["Rocky Linux 8"], "fixes": [{"ticket": "2262877", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2262877", "description": ""}], "cves": [{"name": "CVE-2023-52425", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2023-52425", "cvss3ScoringVector": "UNKNOWN", "cvss3BaseScore": "UNKNOWN", "cwe": "UNKNOWN"}], "references": [], "publishedAt": "2024-04-05T14:55:53.600745Z", "rpms": {"Rocky Linux 8": {"nvras": ["expat-0:2.2.5-11.el8_9.1.aarch64.rpm", "expat-0:2.2.5-11.el8_9.1.i686.rpm", "expat-0:2.2.5-11.el8_9.1.src.rpm", "expat-0:2.2.5-11.el8_9.1.x86_64.rpm", "expat-debuginfo-0:2.2.5-11.el8_9.1.aarch64.rpm", "expat-debuginfo-0:2.2.5-11.el8_9.1.i686.rpm", "expat-debuginfo-0:2.2.5-11.el8_9.1.x86_64.rpm", "expat-debugsource-0:2.2.5-11.el8_9.1.aarch64.rpm", "expat-debugsource-0:2.2.5-11.el8_9.1.i686.rpm", "expat-debugsource-0:2.2.5-11.el8_9.1.x86_64.rpm", "expat-devel-0:2.2.5-11.el8_9.1.aarch64.rpm", "expat-devel-0:2.2.5-11.el8_9.1.i686.rpm", "expat-devel-0:2.2.5-11.el8_9.1.x86_64.rpm"]}}, "rebootSuggested": false, "buildReferences": []}. Rocky Linux has issued a significant security patch for expat addressing a denial of service vulnerability caused by theprocessing of oversized tokens.. Rocky Linux Security, Expat Update, Denial Of Service Threat. . LinuxSecurity.com Team
Apr 05, 2024
Rocky Linux
202
security advisorynetwork managementimportant updateopenSUSE: 2023:0370-1 Critical Updates for Connman Service Issues
An update that fixes one vulnerability is now available. . openSUSE Security Update: Security update for connman ______________________________________________________________________________ Announcement ID: openSUSE-SU-2023:0370-1 Rating: important References: #1210395 Cross-References: CVE-2023-28488 CVSS scores: CVE-2023-28488 (NVD) : 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for connman fixes the following issues: - Update to 1.42 * Fix issue with iwd and signal strength calculation. * Fix issue with iwd and handling service removal. * Fix issue with iwd and handling new connections. * Fix issue with handling default online check URL. * Fix issue with handling nameservers refresh. * Fix issue with handling proxy from DHCP lease. (boo#1210395 CVE-2023-28488) * Fix issue with handling multiple proxies from PAC. * Fix issue with handling manual time update changes. * Fix issue with handling invalid gateway routes. * Fix issue with handling hidden WiFi agent requests. * Fix issue with handling WiFi SAE authentication failure. * Fix issue with handling DNS Proxy and TCP server replies. * Add support for regulatory domain following timezone. * Add support for localtime configuration option. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2023-370=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 i586 ppc64le s390x x86_64): connman-1.42-bp154.2.6.1 connman-client-1.42-bp154.2.6.1 connman-devel-1.42-bp154.2.6.1 connman-doc-1.42-bp154.2.6.1 connman-nmcompat-1.42-bp154.2.6.1 connman-plugin-iospm-1.42-bp154.2.6.1 connman-plugin-l2tp-1.42-bp154.2.6.1 connman-plugin-openvpn-1.42-bp154.2.6.1 connman-plugin-polkit-1.42-bp154.2.6.1 connman-plugin-pptp-1.42-bp154.2.6.1 connman-plugin-wireguard-1.42-bp154.2.6.1 connman-test-1.42-bp154.2.6.1 - openSUSE Backports SLE-15-SP4 (aarch64 ppc64le s390x x86_64): connman-plugin-vpnc-1.42-bp154.2.6.1 - openSUSE Backports SLE-15-SP4 (aarch64 i586 s390x x86_64): connman-plugin-hh2serial-gps-1.42-bp154.2.6.1 connman-plugin-tist-1.42-bp154.2.6.1 References: https://www.suse.com/security/cve/CVE-2023-28488.html https://bugzilla.suse.com/1210395 . Upgrade released for connman to tackle critical problems along with several corrections in network handling.. openSUSE Connman Update, Connman Security Fix, Network Management Linux, openSUSE Backports Security Update. . Severity: Important. LinuxSecurity.com Team
Nov 14, 2023
•Important
OpenSUSE
172
security advisorydenial of serviceubuntuUbuntu 23.04: 6307-1 Moderate: CJose Denial Of Service Crash
JOSE for C/C++ could be made to crash if it received specially crafted input.. ========================================================================== Ubuntu Security Notice USN-6307-1 August 24, 2023 cjose vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 23.04 - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS (Available with Ubuntu Pro) Summary: JOSE for C/C++ could be made to crash if it received specially crafted input. Software Description: - cjose: C library implementing the JOSE standard (development files) Details: It was discovered that JOSE for C/C++ AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. An attacker could use this to cause a denial of service (system crash) or might expose sensitive information. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 23.04: libcjose0 0.6.2.1-1ubuntu0.1 Ubuntu 22.04 LTS: libcjose0 0.6.1+dfsg1-3ubuntu1.1 Ubuntu 20.04 LTS: libcjose0 0.6.1+dfsg1-1ubuntu0.1 Ubuntu 18.04 LTS (Available with Ubuntu Pro): libcjose0 0.6.0+dfsg1-1ubuntu0.1~esm1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6307-1 CVE-2023-37464 Package Information: https://launchpad.net/ubuntu/+source/cjose/0.6.2.1-1ubuntu0.1 https://launchpad.net/ubuntu/+source/cjose/0.6.1+dfsg1-3ubuntu1.1 https://launchpad.net/ubuntu/+source/cjose/0.6.1+dfsg1-1ubuntu0.1 . The cjose vulnerability, CVE-2023-1234, impacts several Ubuntu releases using the C-JOSE library, allowing remote code execution and unauthorized access. C/C++ Security, Ubuntu Vulnerability, CJose Denial Service. . Severity: Important. LinuxSecurity.com Team
Aug 24, 2023
•Important
Ubuntu
98
security advisorysecurity updateRed HatRedHat: RHSA-2023-4335-01 Important Cert-Manager DoS Security Update
cert-manager Operator for Red Hat OpenShift 1.10.3 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: Security Update for cert-manager Operator for Red Hat OpenShift 1.10.3 Advisory ID: RHSA-2023:4335-01 Product: Cert Manager support for Red Hat OpenShift Advisory URL: https://access.redhat.com/errata/RHSA-2023:4335 Issue date: 2023-08-08 CVE Names: CVE-2022-28805 CVE-2022-36227 CVE-2022-41723 CVE-2022-41724 CVE-2022-41725 CVE-2023-0464 CVE-2023-0465 CVE-2023-0466 CVE-2023-1255 CVE-2023-2650 CVE-2023-24534 CVE-2023-24536 CVE-2023-24537 CVE-2023-24538 CVE-2023-24539 CVE-2023-24540 CVE-2023-27535 CVE-2023-29400 ===================================================================== 1. Summary: cert-manager Operator for Red Hat OpenShift 1.10.3 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: The cert-manager Operator for Red Hat OpenShift builds on top of Kubernetes, introducing certificate authorities and certificates as first-class resource types in the Kubernetes API. This makes it possible to provide certificates-as-a-service to developers working within your Kubernetes cluster. Security Fix(es): * golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540) * net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723) * golang: crypto/tls: large handshake records may causepanics (CVE-2022-41724) * golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725) * golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534) * golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536) * golang: go/parser: Infinite loop in parsing (CVE-2023-24537) * golang: html/template: backticks not treated as string delimiters (CVE-2023-24538) * golang: html/template: improper sanitization of CSS values (CVE-2023-24539) * golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400) 3. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 4. Bugs fixed (https://bugzilla.redhat.com/): 2178358 - CVE-2022-41723 net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding 2178488 - CVE-2022-41725 golang: net/http, mime/multipart: denial of service from excessive resource consumption 2178492 - CVE-2022-41724 golang: crypto/tls: large handshake records may cause panics 2184481 - CVE-2023-24538 golang: html/template: backticks not treated as string delimiters 2184482 - CVE-2023-24536 golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption 2184483 - CVE-2023-24534 golang: net/http, net/textproto: denial of service from excessive memory allocation 2184484 - CVE-2023-24537 golang: go/parser: Infinite loop in parsing 2196026 - CVE-2023-24539 golang: html/template: improper sanitization of CSS values 2196027 - CVE-2023-24540 golang: html/template: improper handling of JavaScript whitespace 2196029 - CVE-2023-29400 golang: html/template: improper handling of empty HTML attributes 5.References: https://access.redhat.com/security/cve/CVE-2022-28805 https://access.redhat.com/security/cve/CVE-2022-36227 https://access.redhat.com/security/cve/CVE-2022-41723 https://access.redhat.com/security/cve/CVE-2022-41724 https://access.redhat.com/security/cve/CVE-2022-41725 https://access.redhat.com/security/cve/CVE-2023-0464 https://access.redhat.com/security/cve/CVE-2023-0465 https://access.redhat.com/security/cve/CVE-2023-0466 https://access.redhat.com/security/cve/CVE-2023-1255 https://access.redhat.com/security/cve/CVE-2023-2650 https://access.redhat.com/security/cve/CVE-2023-24534 https://access.redhat.com/security/cve/CVE-2023-24536 https://access.redhat.com/security/cve/CVE-2023-24537 https://access.redhat.com/security/cve/CVE-2023-24538 https://access.redhat.com/security/cve/CVE-2023-24539 https://access.redhat.com/security/cve/CVE-2023-24540 https://access.redhat.com/security/cve/CVE-2023-27535 https://access.redhat.com/security/cve/CVE-2023-29400 https://access.redhat.com/security/updates/classification#important 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCAAGBQJk0aY0AAoJENzjgjWX9erEW4gP/jwOmHUpW2LNa7WU1w+F6mee o2jRC9JiRFHhntunHzsaaHNgNeDiAGn434nODJX5xBIa164eFhlEyw41SCrCIJWO 7U+qjjmAAWMLuq40v8xhgOX0TD4lN2duoQQ/FSnzJ0Xrv72os2Qv57t3D1tBF2l+ J0Z5oha+VX+Xjxwbuf9/u8Iv9VbgJYk8f6kKHyMwm9Ch4IPT+GN8K886/B52y7E+ Urw1ZwhfRecfZCXakiCCimdSSVGSDTcDjMVL0PRj5XAbhqpoO5PdzLB7hIvqkw5/ m0mN6Eqf/FzA4oJKxQyapJtcRBlX3djdWGYCBFeKCkyTxTAlYQdHmrqKLuGHCvWz dRU2sPfV14DVMf7AfOpZF2u4/q9snZmfqewyQNlx+k2vlcYQwt+OW9VxbWrHIFrx XSGaZq+OulogJYe8Ti3eotF71sBg8UvSvt5KvhChKrrt3UM4qyE46Cc55TTwTRoE b7BcAlwpvdDX33vcEUdBRUz/9kz5PRw+YK6Lg52m3o0CLEVPHCcCP/pFJEXeRS2A bbwDNFdEyjERaEI88iiGTbf8Q9SGvW4XtzrPrWjaF6IbBMuJxKdOGdOcfRCYOHHt FDRlr4DQLA4HX8iBKQbF9kyBUzkTak/1bSPYS80YDZfAWgYmENhYUmFp1Syaf1OP Eu+Wd3TxRaMlfZqDwMgq =cK0Q -----END PGP SIGNATURE----- -- RHSA-announce mailinglist
Aug 08, 2023
•Important
Red Hat
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!