Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -3 articles for you...
98
security advisorymoderatesecurity updateRed Hat JBoss EAP 7.3.6 Security Update: RHSA-2021:0872-01 Moderate
A security update is now available for Red Hat JBoss Enterprise Application Platform 7.3 for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat JBoss Enterprise Application Platform 7.3.6 security update Advisory ID: RHSA-2021:0872-01 Product: Red Hat JBoss Enterprise Application Platform Advisory URL: https://access.redhat.com/errata/RHSA-2021:0872 Issue date: 2021-03-16 CVE Names: CVE-2020-8908 CVE-2020-10687 CVE-2020-28052 CVE-2020-35510 CVE-2021-20220 CVE-2021-20250 ==================================================================== 1. Summary: A security update is now available for Red Hat JBoss Enterprise Application Platform 7.3 for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat JBoss EAP 7.3 for RHEL 6 Server - noarch 3. Description: Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.3.6 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.3.5, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.3.6 Release Notes for information about the most significant bug fixes and enhancements included in this release. Security Fix(es): * jboss-remoting: Threads hold up forever in the EJB server by suppressing the ack from an EJBclient (CVE-2020-35510) * bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible (CVE-2020-28052) * wildfly-undertow: undertow: Possible regression in fix for CVE-2020-10687 (CVE-2021-20220) * jboss-ejb-client: wildfly: Information disclosure due to publicly accessible privileged actions in JBoss EJB Client (CVE-2021-20250) * guava: local information disclosure via temporary directory created with unsafe permissions (CVE-2020-8908) 4. Solution: Before applying this update, ensure all previously released errata relevant to your system have been applied. For details about how to apply this update, see: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1905796 - CVE-2020-35510 jboss-remoting: Threads hold up forever in the EJB server by suppressing the ack from an EJB client 1906919 - CVE-2020-8908 guava: local information disclosure via temporary directory created with unsafe permissions 1912881 - CVE-2020-28052 bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible 1923133 - CVE-2021-20220 undertow: Possible regression in fix for CVE-2020-10687 1929479 - CVE-2021-20250 wildfly: Information disclosure due to publicly accessible privileged actions in JBoss EJB Client 6. JIRA issues fixed (https://redhat.atlassian.net/jira/projects): JBEAP-20336 - (7.3.z) Upgrade Bouncy Castle from 1.65.0.redhat-00001 to 1.68.0.redhat-00001 JBEAP-20628 - [GSS] (7.3.z) Upgrade undertow from 2.0.33.SP2-redhat-00001 to 2.0.34.SP1-redhat-00001 JBEAP-20672 - [GSS](7.3.z) Upgrade Artemis from 2.9.0.redhat-00017 to 2.9.0.redhat-00019 JBEAP-20694 - (7.3.z) Upgrade WildFly Galleon Plugins from 4.2.8.Final to 4.2.10.Final JBEAP-20695 - (7.3.z) (WF-Core) Upgrade WildFly Galleon Plugins from 4.2.8.Final to 4.2.10.Final JBEAP-20715 - Tracker bug for the EAP 7.3.6 release for RHEL-6 JBEAP-20762 - [GSS](7.3.z) Upgrade jboss-ejb-client from 4.0.37.Final-redhat-00001 to 4.0.39.SP1-redhat-00001 JBEAP-20791 - (7.3.z) Upgrade WildFly Elytron from1.10.10.Final-redhat-00001 to 1.10.11.Final-redhat-00001 JBEAP-20795 - [GSS](7.3.z) Upgrade HAL from 3.2.12.Final-redhat-00001 to 3.2.13.Final-redhat-00001 JBEAP-20802 - (7.3.z) Upgrade Narayana from 5.9.10.Final-redhat-00001 to 5.9.11.Final-redhat-00001 JBEAP-20805 - (7.3.z) Upgrade guava from 25.0.redhat-1 to 30.1.0.redhat-00001 JBEAP-20815 - [GSS](7.3.z) Upgrade JBoss Remoting from 5.0.20.Final-redhat-00001 to 5.0.20.SP1-redhat-00001 JBEAP-20816 - [GSS](7.3.z) Upgrade wildfly-http-client from 1.0.24.Final-redhat-00001 to 1.0.25.Final-redhat-00001 JBEAP-20883 - [GSS](7.3.z) Upgrade wildfly-naming-client from 1.0.13.Final-redhat-00001 to 1.0.14.Final-redhat-00001 JBEAP-20887 - (7.3.z) Upgrade IronJacamar from 1.4.22.Final-redhat-00001 to 1.4.27.Final-redhat-00001 JBEAP-20908 - (7.3.z)(wf-core) Upgrade guava from 20.0 to 30.1.0.redhat-00001 JBEAP-20918 - (7.3.z) Upgrade jboss-logmanager from 2.1.17.Final-redhat-00001 to 2.1.18.Final-redhat-00001 JBEAP-20941 - (7.3.z)(wf-core) Upgrade Bouncy Castle from 1.65 to 1.68 7. Package List: Red Hat JBoss EAP 7.3 for RHEL 6Server: Source: eap7-activemq-artemis-2.9.0-9.redhat_00019.1.el6eap.src.rpm eap7-bouncycastle-1.68.0-1.redhat_00001.1.el6eap.src.rpm eap7-guava-failureaccess-1.0.1-1.redhat_00002.1.el6eap.src.rpm eap7-guava-libraries-30.1.0-1.redhat_00001.1.el6eap.src.rpm eap7-hal-console-3.2.13-1.Final_redhat_00001.1.el6eap.src.rpm eap7-ironjacamar-1.4.27-1.Final_redhat_00001.1.el6eap.src.rpm eap7-jboss-ejb-client-4.0.39-1.SP1_redhat_00001.1.el6eap.src.rpm eap7-jboss-logmanager-2.1.18-1.Final_redhat_00001.1.el6eap.src.rpm eap7-jboss-remoting-5.0.20-2.SP1_redhat_00001.1.el6eap.src.rpm eap7-jboss-server-migration-1.7.2-5.Final_redhat_00006.1.el6eap.src.rpm eap7-narayana-5.9.11-1.Final_redhat_00001.1.el6eap.src.rpm eap7-undertow-2.0.34-1.SP1_redhat_00001.1.el6eap.src.rpm eap7-wildfly-7.3.6-1.GA_redhat_00002.1.el6eap.src.rpm eap7-wildfly-elytron-1.10.11-1.Final_redhat_00001.1.el6eap.src.rpm eap7-wildfly-http-client-1.0.25-1.Final_redhat_00001.1.el6eap.src.rpm eap7-wildfly-naming-client-1.0.14-1.Final_redhat_00001.1.el6eap.src.rpm noarch: eap7-activemq-artemis-2.9.0-9.redhat_00019.1.el6eap.noarch.rpm eap7-activemq-artemis-cli-2.9.0-9.redhat_00019.1.el6eap.noarch.rpm eap7-activemq-artemis-commons-2.9.0-9.redhat_00019.1.el6eap.noarch.rpm eap7-activemq-artemis-core-client-2.9.0-9.redhat_00019.1.el6eap.noarch.rpm eap7-activemq-artemis-dto-2.9.0-9.redhat_00019.1.el6eap.noarch.rpm eap7-activemq-artemis-hornetq-protocol-2.9.0-9.redhat_00019.1.el6eap.noarch.rpm eap7-activemq-artemis-hqclient-protocol-2.9.0-9.redhat_00019.1.el6eap.noarch.rpm eap7-activemq-artemis-jdbc-store-2.9.0-9.redhat_00019.1.el6eap.noarch.rpm eap7-activemq-artemis-jms-client-2.9.0-9.redhat_00019.1.el6eap.noarch.rpm eap7-activemq-artemis-jms-server-2.9.0-9.redhat_00019.1.el6eap.noarch.rpm eap7-activemq-artemis-journal-2.9.0-9.redhat_00019.1.el6eap.noarch.rpm eap7-activemq-artemis-ra-2.9.0-9.redhat_00019.1.el6eap.noarch.rpm eap7-activemq-artemis-selector-2.9.0-9.redhat_00019.1.el6eap.noarch.rpm eap7-activemq-artemis-server-2.9.0-9.redhat_00019.1.el6eap.noarch.rpm eap7-activemq-artemis-service-extensions-2.9.0-9.redhat_00019.1.el6eap.noarch.rpm eap7-activemq-artemis-tools-2.9.0-9.redhat_00019.1.el6eap.noarch.rpm eap7-bouncycastle-1.68.0-1.redhat_00001.1.el6eap.noarch.rpm eap7-bouncycastle-mail-1.68.0-1.redhat_00001.1.el6eap.noarch.rpm eap7-bouncycastle-pkix-1.68.0-1.redhat_00001.1.el6eap.noarch.rpm eap7-bouncycastle-prov-1.68.0-1.redhat_00001.1.el6eap.noarch.rpm eap7-guava-30.1.0-1.redhat_00001.1.el6eap.noarch.rpm eap7-guava-failureaccess-1.0.1-1.redhat_00002.1.el6eap.noarch.rpm eap7-guava-libraries-30.1.0-1.redhat_00001.1.el6eap.noarch.rpm eap7-hal-console-3.2.13-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-ironjacamar-1.4.27-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-ironjacamar-common-api-1.4.27-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-ironjacamar-common-impl-1.4.27-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-ironjacamar-common-spi-1.4.27-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-ironjacamar-core-api-1.4.27-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-ironjacamar-core-impl-1.4.27-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-ironjacamar-deployers-common-1.4.27-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-ironjacamar-jdbc-1.4.27-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-ironjacamar-validator-1.4.27-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-jboss-ejb-client-4.0.39-1.SP1_redhat_00001.1.el6eap.noarch.rpm eap7-jboss-logmanager-2.1.18-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-jboss-remoting-5.0.20-2.SP1_redhat_00001.1.el6eap.noarch.rpm eap7-jboss-server-migration-1.7.2-5.Final_redhat_00006.1.el6eap.noarch.rpm eap7-jboss-server-migration-cli-1.7.2-5.Final_redhat_00006.1.el6eap.noarch.rpm eap7-jboss-server-migration-core-1.7.2-5.Final_redhat_00006.1.el6eap.noarch.rpm eap7-jboss-server-migration-eap6.4-1.7.2-5.Final_redhat_00006.1.el6eap.noarch.rpm eap7-jboss-server-migration-eap6.4-to-eap7.3-1.7.2-5.Final_redhat_00006.1.el6eap.noarch.rpm eap7-jboss-server-migration-eap7.0-1.7.2-5.Final_redhat_00006.1.el6eap.noarch.rpm eap7-jboss-server-migration-eap7.1-1.7.2-5.Final_redhat_00006.1.el6eap.noarch.rpm eap7-jboss-server-migration-eap7.2-1.7.2-5.Final_redhat_00006.1.el6eap.noarch.rpm eap7-jboss-server-migration-eap7.2-to-eap7.3-1.7.2-5.Final_redhat_00006.1.el6eap.noarch.rpm eap7-jboss-server-migration-eap7.3-server-1.7.2-5.Final_redhat_00006.1.el6eap.noarch.rpm eap7-jboss-server-migration-wildfly10.0-1.7.2-5.Final_redhat_00006.1.el6eap.noarch.rpm eap7-jboss-server-migration-wildfly10.1-1.7.2-5.Final_redhat_00006.1.el6eap.noarch.rpm eap7-jboss-server-migration-wildfly11.0-1.7.2-5.Final_redhat_00006.1.el6eap.noarch.rpm eap7-jboss-server-migration-wildfly12.0-1.7.2-5.Final_redhat_00006.1.el6eap.noarch.rpm eap7-jboss-server-migration-wildfly13.0-server-1.7.2-5.Final_redhat_00006.1.el6eap.noarch.rpm eap7-jboss-server-migration-wildfly14.0-server-1.7.2-5.Final_redhat_00006.1.el6eap.noarch.rpm eap7-jboss-server-migration-wildfly15.0-server-1.7.2-5.Final_redhat_00006.1.el6eap.noarch.rpm eap7-jboss-server-migration-wildfly16.0-server-1.7.2-5.Final_redhat_00006.1.el6eap.noarch.rpm eap7-jboss-server-migration-wildfly17.0-server-1.7.2-5.Final_redhat_00006.1.el6eap.noarch.rpm eap7-jboss-server-migration-wildfly18.0-server-1.7.2-5.Final_redhat_00006.1.el6eap.noarch.rpm eap7-jboss-server-migration-wildfly8.2-1.7.2-5.Final_redhat_00006.1.el6eap.noarch.rpm eap7-jboss-server-migration-wildfly9.0-1.7.2-5.Final_redhat_00006.1.el6eap.noarch.rpm eap7-narayana-5.9.11-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-narayana-compensations-5.9.11-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-narayana-jbosstxbridge-5.9.11-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-narayana-jbossxts-5.9.11-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-narayana-jts-idlj-5.9.11-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-narayana-jts-integration-5.9.11-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-narayana-restat-api-5.9.11-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-narayana-restat-bridge-5.9.11-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-narayana-restat-integration-5.9.11-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-narayana-restat-util-5.9.11-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-narayana-txframework-5.9.11-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-undertow-2.0.34-1.SP1_redhat_00001.1.el6eap.noarch.rpm eap7-wildfly-7.3.6-1.GA_redhat_00002.1.el6eap.noarch.rpm eap7-wildfly-elytron-1.10.11-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-wildfly-elytron-tool-1.10.11-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-wildfly-http-client-common-1.0.25-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-wildfly-http-ejb-client-1.0.25-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-wildfly-http-naming-client-1.0.25-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-wildfly-http-transaction-client-1.0.25-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-wildfly-javadocs-7.3.6-1.GA_redhat_00002.1.el6eap.noarch.rpm eap7-wildfly-modules-7.3.6-1.GA_redhat_00002.1.el6eap.noarch.rpm eap7-wildfly-naming-client-1.0.14-1.Final_redhat_00001.1.el6eap.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 8. References: https://access.redhat.com/security/cve/CVE-2020-8908 https://access.redhat.com/security/cve/CVE-2020-10687 https://access.redhat.com/security/cve/CVE-2020-28052 https://access.redhat.com/security/cve/CVE-2020-35510 https://access.redhat.com/security/cve/CVE-2021-20220 https://access.redhat.com/security/cve/CVE-2021-20250 https://access.redhat.com/security/updates/classification#moderate https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3 https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/index 9. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBYFC6DdzjgjWX9erEAQinwA//QQioMLdx/TEKxOQZTvYT8u6B9lAP8WWc J4N8LNGdcFToicJ+6+HrSASoTO2cAP+smsoum2EthY+9pQQZnKbkYzZVIxHkb5Ob sAbBli3aYUNe1PWjjOXtPtcfZq06obphJf6k0uy6Xj6+hRN+Rhg+j92Aq6drEIEr 1C2AbrZ5WZtMWbwWk/cKpLyntjETGE/2Ulh7UBzmlfPZwpS9+AsthwbPKfk3sgOl IVu70V/fSYtsJ+hBJF62fliC1DRFVZmdtHk5mCcy/6GLKx6gu7KfRuKcn/+r8jG5 pmMxOno2nNQI1kbTD7K1Z7yFWx1H2/mc1LNXlFzu+raT6sNpzHCS63OpwVrsjyzr wRdqno2gEXWaqipkfD7X0v7/n7T9sKRTD8hTCYb4ACVtiT7BSEvjRPjjInkRhuLs t2/JYFD33pECUL3+Kpra+golkGW+cCfZk0xP7Mq3GiOK9ve/kEQoyM9UpyUpZ/Pt onKGc/xQD2hwBMwITU68oHnkZSwb4aGQA/gpkYED5t2oiqWsN8mIdRrkerEet8/K K8A0e0ycQFRZPVfHJy1adGvZhYCmnQBAuhNu+2UZjXoeZgQ6TB/nOKDNXtbGxy4b p0abGao+HJ7iCm5NQgqW2TULyqsWYiDRGNjYbOi+HTGn9lTF/LmhI64bnaTBIUnL F8BNkuUT5+0=fyBq -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Mar 16, 2021
Red Hat
172
security advisorydenial of serviceubuntuUbuntu 14.04 LTS: 3843-1 Critical: Pixman Denial of Service
pixman could be made to crash or run programs if it processed specially crafted instructions.. =========================================================================Ubuntu Security Notice USN-3843-1 December 11, 2018 pixman vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 14.04 LTS Summary: pixman could be made to crash or run programs if it processed specially crafted instructions. Software Description: - pixman: pixel-manipulation library for X and cairo Details: It was discovered that pixman incorrectly handled the general_composite_rect function. A remote attacker could use this issue to cause pixman to crash, resulting in a denial of service, or possibly execute arbitrary code. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 14.04 LTS: libpixman-1-0 0.30.2-2ubuntu1.2 After a standard system update you need to restart your session to make all the necessary changes. References: https://ubuntu.com/security/notices/USN-3843-1 CVE-2015-5297 Package Information: https://launchpad.net/ubuntu/+source/pixman/0.30.2-2ubuntu1.2 . Ubuntu 14.04 LTS has a critical pixman library vulnerability allowing code execution by non-privileged users. Update your system now to mitigate risks. Pixman Issue, Ubuntu 14.04 Advisory, Security Notice. . Severity: Critical. LinuxSecurity.com Team
Dec 11, 2018
•Critical
Ubuntu
89
security advisorymoderatedenial of serviceFedora 22: 2015-15589 Moderate: jakarta-commons-httpclient DDoS Risk
This update fixes CVE-2015-5262 denial of service security vulnerability by respectinc configured SO_TIMEOUT parameter during SSL handshake.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2015-15589 2015-10-01 15:59:58.767242 -------------------------------------------------------------------------------- Name : jakarta-commons-httpclient Product : Fedora 22 Version : 3.1 Release : 23.fc22 URL : https://hc.apache.org/httpclient-legacy/ Summary : Jakarta Commons HTTPClient implements the client side of HTTP standards Description : The Hyper-Text Transfer Protocol (HTTP) is perhaps the most significant protocol used on the Internet today. Web services, network-enabled appliances and the growth of network computing continue to expand the role of the HTTP protocol beyond user-driven web browsers, and increase the number of applications that may require HTTP support. Although the java.net package provides basic support for accessing resources via HTTP, it doesn't provide the full flexibility or functionality needed by many applications. The Jakarta Commons HTTP Client component seeks to fill this void by providing an efficient, up-to-date, and feature-rich package implementing the client side of the most recent HTTP standards and recommendations. Designed for extension while providing robust support for the base HTTP protocol, the HTTP Client component may be of interest to anyone building HTTP-aware client applications such as web browsers, web service clients, or systems that leverage or extend the HTTP protocol for distributed communication. -------------------------------------------------------------------------------- Update Information: This update fixes CVE-2015-5262 denial of service security vulnerability by respectinc configured SO_TIMEOUT parameter during SSL handshake. -------------------------------------------------------------------------------- References: [ 1 ] Bug #1261538 - CVE-2015-5262jakarta-commons-httpclient, httpcomponents-core: missing HTTPS connection timeout https://bugzilla.redhat.com/show_bug.cgi?id=1261538 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update jakarta-commons-httpclient' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Oct 01, 2015
Fedora
91
security advisoryremote code executionservice outageGentoo: 201112-04 High: TinTin++ Remote Code Execution Issue
Multiple vulnerabilities have been reported in TinTin++ which could allow a remote attacker to conduct several attacks, including the execution of arbitrary code and Denial of Service. [More...]. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201111-07 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: TinTin++: Multiple vulnerabilities Date: November 20, 2011 Bugs: #209903 ID: 201111-07 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities have been reported in TinTin++ which could allow a remote attacker to conduct several attacks, including the execution of arbitrary code and Denial of Service. Background ========= TinTin++ is a free MUD gaming client. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 games-mud/tintin < 1.98.0 > = 1.98.0 Description ========== Multiple vulnerabilities have been discovered in TinTin++. Please review the CVE identifiers referenced below for details. Impact ===== Remote unauthenticated attackers may be able to execute arbitrary code with the privileges of the TinTin++ process, cause a Denial of Service, or truncate arbitrary files in the top level of the home directory belonging to the user running the TinTin++ process. Workaround ========= There is no known workaround at this time. Resolution ========= All TinTin++ users should upgrade to the latest stable version: # emerge --sync # emerge --ask --oneshot --verbose "> =games-mud/tintin-1.98.0" NOTE: This is a legacy GLSA. Updatesfor all affected architectures are available since March 25, 2008. It is likely that your system is already no longer affected by this issue. References ========= [ 1 ] CVE-2008-0671 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-0671 [ 2 ] CVE-2008-0672 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-0672 [ 3 ] CVE-2008-0673 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-0673 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201111-07 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Nov 20, 2011
Gentoo
89
security advisorycritical issueFedoraFedora Core 5: 2007-576 Critical: mod_perl Denial of Service
This update fixes a security issue in mod_perl. An issue was found in the "namespace_from_uri" method of the ModPerl::RegistryCooker class. If a server implemented a mod_perl registry module using this method, a remote attacker requesting a carefully crafted URI can cause resource consumption, which could lead to a denial of service. (CVE-2007-1349). ---------------------------------------------------------------------Fedora Update Notification FEDORA-2007-576 2007-06-11 ---------------------------------------------------------------------Product : Fedora Core 5 Name : mod_perl Version : 2.0.2 Release : 5.2.fc5 Summary : An embedded Perl interpreter for the Apache Web server Description : Mod_perl incorporates a Perl interpreter into the Apache web server, so that the Apache web server can directly execute Perl code. Mod_perl links the Perl runtime library into the Apache web server and provides an object-oriented Perl interface for Apache's C language API. The end result is a quicker CGI script turnaround process, since no external Perl interpreter has to be started. Install mod_perl if you're installing the Apache web server and you'd like for it to directly incorporate a Perl interpreter. ---------------------------------------------------------------------Update Information: This update fixes a security issue in mod_perl. An issue was found in the "namespace_from_uri" method of the ModPerl::RegistryCooker class. If a server implemented a mod_perl registry module using this method, a remote attacker requesting a carefully crafted URI can cause resource consumption, which could lead to a denial of service. (CVE-2007-1349) ---------------------------------------------------------------------* Fri Jun 8 2007 Joe Orton 2.0.2-5.2.fc5 - add security fix for CVE-2007-1349 - drop perl(warnings) provide (#228429) - drop perl(HTTP::Request::Common) provide ---------------------------------------------------------------------This update can bedownloaded from: 1b92c1ea6bd0f91f41ec010ecb55804c551afd74 SRPMS/mod_perl-2.0.2-5.2.fc5.src.rpm 1b92c1ea6bd0f91f41ec010ecb55804c551afd74 noarch/mod_perl-2.0.2-5.2.fc5.src.rpm c29bde551de3e22168d7ec13270632980ab35db7 ppc/debug/mod_perl-debuginfo-2.0.2-5.2.fc5.ppc.rpm f66643fd198d576dec55ed72617b019a171ab1f6 ppc/mod_perl-devel-2.0.2-5.2.fc5.ppc.rpm 56dba75ca6a4f68116c9803e21996b7e3c7e4a9a ppc/mod_perl-2.0.2-5.2.fc5.ppc.rpm 9bf9a6e3ee0e700da174cca618e30ac84b5ec4e2 x86_64/mod_perl-devel-2.0.2-5.2.fc5.x86_64.rpm b3ab3711356698f8aa9d626c25f78edbe0d3190a x86_64/mod_perl-2.0.2-5.2.fc5.x86_64.rpm b3801f05e3ec4e061b5ac70ecf958fbdfd61fbeb x86_64/debug/mod_perl-debuginfo-2.0.2-5.2.fc5.x86_64.rpm d59cb0f72b48b7e5a28e4ad4d6d7469aed05d12c i386/mod_perl-devel-2.0.2-5.2.fc5.i386.rpm 4fd5523eee7cfea55321c6630be82e9bce971b88 i386/debug/mod_perl-debuginfo-2.0.2-5.2.fc5.i386.rpm d41ac0744c6a69d7266accd3a6336d9861bebd4b i386/mod_perl-2.0.2-5.2.fc5.i386.rpm This update can be installed with the 'yum' update program. Use 'yum update package-name' at the command line. For more information, refer to 'Managing Software with yum,' available at . ---------------------------------------------------------------------_______________________________________________ Fedora-package-announce mailing list
Jun 11, 2007
•Critical
Fedora
87
security advisorycode executiondebianDebian: DSA 1069-1 Critical: Kernel Flaws Lead To Code Execution Risk
Updated package.. - --------------------------------------------------------------------------Debian Security Advisory DSA 1069-1
May 21, 2006
•Critical
Debian
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!