Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -5 articles for you...
100
security advisorysoftware updateimportantSUSE: 2024:3184-1 Critical: Remote Exploit Vulnerability in Python-3_8_0
* bsc#1228046 * bsc#1228047 * bsc#1228048 * bsc#1228050 * bsc#1228051 . # Security update for java-1_8_0-ibm Announcement ID: SUSE-SU-2024:3183-1 Rating: important References: * bsc#1228046 * bsc#1228047 * bsc#1228048 * bsc#1228050 * bsc#1228051 * bsc#1228052 * bsc#1228346 * bsc#1229224 Cross-References: * CVE-2024-21131 * CVE-2024-21138 * CVE-2024-21140 * CVE-2024-21144 * CVE-2024-21145 * CVE-2024-21147 * CVE-2024-27267 CVSS scores: * CVE-2024-21131 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2024-21138 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2024-21140 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2024-21144 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2024-21145 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2024-21147 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2024-27267 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * SUSE Linux Enterprise High Performance Computing 12 SP5 * SUSE Linux Enterprise Server 12 SP5 * SUSE Linux Enterprise Server for SAP Applications 12 SP5 * SUSE Linux Enterprise Software Development Kit 12 SP5 An update that solves seven vulnerabilities and has one security fix can now be installed. ## Description: This update for java-1_8_0-ibm fixes the following issues: * Update to Java 8.0 Service Refresh 8 Fix Pack 30 (bsc#1228346) * CVE-2024-21147: Fixed an array index overflow in RangeCheckElimination. (bsc#1228052) * CVE-2024-21145: Fixed an out-of-bounds access in 2D image handling. (bsc#1228051) * CVE-2024-21140: Fixed a range check elimination pre-loop limit overflow. (bsc#1228048) * CVE-2024-21144: Pack200 increase loading time due to improper header validation. (bsc#1228050) * CVE-2024-21138: Fixed an issue where excessive symbol length can lead to infinite loop. (bsc#1228047) * CVE-2024-21131: Fixed apotential UTF8 size overflow. (bsc#1228046) * CVE-2024-27267: Fixed an Object Request Broker (ORB) remote denial of service. (bsc#1229224) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Software Development Kit 12 SP5 zypper in -t patch SUSE-SLE-SDK-12-SP5-2024-3183=1 * SUSE Linux Enterprise Server for SAP Applications 12 SP5 zypper in -t patch SUSE-SLE-SERVER-12-SP5-2024-3183=1 * SUSE Linux Enterprise Server 12 SP5 zypper in -t patch SUSE-SLE-SERVER-12-SP5-2024-3183=1 * SUSE Linux Enterprise High Performance Computing 12 SP5 zypper in -t patch SUSE-SLE-SERVER-12-SP5-2024-3183=1 ## Package List: * SUSE Linux Enterprise Software Development Kit 12 SP5 (nosrc) * java-1_8_0-ibm-1.8.0_sr8.30-30.126.1 * SUSE Linux Enterprise Software Development Kit 12 SP5 (ppc64le s390x x86_64) * java-1_8_0-ibm-devel-1.8.0_sr8.30-30.126.1 * SUSE Linux Enterprise Server for SAP Applications 12 SP5 (nosrc ppc64le x86_64) * java-1_8_0-ibm-1.8.0_sr8.30-30.126.1 * SUSE Linux Enterprise Server for SAP Applications 12 SP5 (ppc64le x86_64) * java-1_8_0-ibm-devel-1.8.0_sr8.30-30.126.1 * SUSE Linux Enterprise Server for SAP Applications 12 SP5 (x86_64) * java-1_8_0-ibm-plugin-1.8.0_sr8.30-30.126.1 * java-1_8_0-ibm-alsa-1.8.0_sr8.30-30.126.1 * SUSE Linux Enterprise Server 12 SP5 (nosrc ppc64le s390x x86_64) * java-1_8_0-ibm-1.8.0_sr8.30-30.126.1 * SUSE Linux Enterprise Server 12 SP5 (ppc64le s390x x86_64) * java-1_8_0-ibm-devel-1.8.0_sr8.30-30.126.1 * SUSE Linux Enterprise Server 12 SP5 (x86_64) * java-1_8_0-ibm-plugin-1.8.0_sr8.30-30.126.1 * java-1_8_0-ibm-alsa-1.8.0_sr8.30-30.126.1 * SUSE Linux Enterprise High Performance Computing 12 SP5 (nosrc x86_64) * java-1_8_0-ibm-1.8.0_sr8.30-30.126.1 * SUSE Linux Enterprise High Performance Computing 12 SP5(x86_64) * java-1_8_0-ibm-devel-1.8.0_sr8.30-30.126.1 * java-1_8_0-ibm-plugin-1.8.0_sr8.30-30.126.1 * java-1_8_0-ibm-alsa-1.8.0_sr8.30-30.126.1 ## References: * https://www.suse.com/security/cve/CVE-2024-21131.html * https://www.suse.com/security/cve/CVE-2024-21138.html * https://www.suse.com/security/cve/CVE-2024-21140.html * https://www.suse.com/security/cve/CVE-2024-21144.html * https://www.suse.com/security/cve/CVE-2024-21145.html * https://www.suse.com/security/cve/CVE-2024-21147.html * https://www.suse.com/security/cve/CVE-2024-27267.html * https://bugzilla.suse.com/show_bug.cgi?id=1228046 * https://bugzilla.suse.com/show_bug.cgi?id=1228047 * https://bugzilla.suse.com/show_bug.cgi?id=1228048 * https://bugzilla.suse.com/show_bug.cgi?id=1228050 * https://bugzilla.suse.com/show_bug.cgi?id=1228051 * https://bugzilla.suse.com/show_bug.cgi?id=1228052 * https://bugzilla.suse.com/show_bug.cgi?id=1228346 * https://bugzilla.suse.com/show_bug.cgi?id=1229224 . A critical security patch has been released by SUSE for java-1_8_0-ibm, which resolves several vulnerabilities and provides essential enhancements for the latest service updates.. SUSE Linux Enterprise, Java Security, Software Update, Remote Attack. . Severity: Important. LinuxSecurity.com Team
Sep 10, 2024
•Important
SuSE
89
security advisoryFedoraupdate informationFedora: 2020-e2deb72e0f Critical Update for .NET Core 3.1 Released
This update updates .NET Core 3.1 to SDK 3.1.108 and Runtime 3.1.8. This update includes a fix for CVE-2020-1045 Release Notes: https://github.com/dotnet/core/blob/main/release-notes/3.1/3.1.8/3.1.8.md. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-e2deb72e0f 2020-09-16 14:43:48.853155 --------------------------------------------------------------------------------Name : dotnet3.1 Product : Fedora 32 Version : 3.1.108 Release : 1.fc32 URL : https://github.com/dotnet/ Summary : .NET Core Runtime and SDK Description : .NET Core is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET Core contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. --------------------------------------------------------------------------------Update Information: This update updates .NET Core 3.1 to SDK 3.1.108 and Runtime 3.1.8. This update includes a fix for CVE-2020-1045 Release Notes: https://github.com/dotnet/core/blob/main/release-notes/3.1/3.1.8/3.1.8.md --------------------------------------------------------------------------------ChangeLog: * Fri Sep 11 2020 Omair Majid - 3.1.108-1 - Update to .NET Core SDK 3.1.108 and Runtime 3.1.8 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-e2deb72e0f' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Sep 16, 2020
•Critical
Fedora
100
security advisoryupdatecriticalSUSE: 2010-061 Critical Update for IBM Java 1.4.2 Remote Code Exec
IBM Java 1.4.2 was updated to Service Release 13 Fix Pack 6 to fix IBM Java 1.4.2 was updated to Service Release 13 Fix Pack 6 to fix various bugs and security issues. various bugs and security issues. Following CVEs are tracked for this update: CVE-2009-3555 CVE-2010-3541 CVE-2010-3548 CVE-2010-3549 CVE-2010-3551 CVE-2010-3553 CVE-2010-3556 CVE-2010-3557 CVE-2010-3562 CVE-2010-3565 CVE-2010-3568 [More...]. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Announcement Package: java-1_4_2-ibm,IBMJava2-JRE Announcement ID: SUSE-SA:2010:061 Date: Fri, 17 Dec 2010 11:00:00 +0000 Affected Products: SUSE SLES 9 Open Enterprise Server Novell Linux POS 9 SLE SDK 10 SP3 SUSE Linux Enterprise Java 10 SP3 SUSE Linux Enterprise Server 10 SP3 SUSE Linux Enterprise Software Development Kit 11 SP1 SUSE Linux Enterprise Java 11 SP1 SUSE Linux Enterprise Server 11 SP1 Vulnerability Type: remote code execution CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) SUSE Default Package: yes Cross-References: CVE-2009-3555, CVE-2010-3541, CVE-2010-3548 CVE-2010-3549, CVE-2010-3551, CVE-2010-3553 CVE-2010-3556, CVE-2010-3557, CVE-2010-3562 CVE-2010-3565, CVE-2010-3568, CVE-2010-3569 CVE-2010-3571, CVE-2010-3572 Content of This Advisory: 1) Security Vulnerability Resolved: IBM Java 1.4.2 security update Problem Description 2) Solution or Work-Around 3) SpecialInstructions and Notes 4) Package Location and Checksums 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. 6) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Problem Description and Brief Discussion IBM Java 1.4.2 was updated to Service Release 13 Fix Pack 6 to fix various bugs and security issues. Following CVEs are tracked for this update: CVE-2009-3555 CVE-2010-3541 CVE-2010-3548 CVE-2010-3549 CVE-2010-3551 CVE-2010-3553 CVE-2010-3556 CVE-2010-3557 CVE-2010-3562 CVE-2010-3565 CVE-2010-3568 CVE-2010-3569 CVE-2010-3571 CVE-2010-3572 Please also see https://www.ibm.com/support/pages/java-sdk/ for more information. 2) Solution or Work-Around There is no known workaround, please install the update packages. 3) Special Instructions and Notes Please restart applications using IBM Java 1.4.2. 4) Package Location and Checksums The preferred method for installing security updates is to use the YaST "Online Update" module or the "zypper" commandline tool. The package and patch management stack will detect which updates are required and automatically perform the necessary steps to verify and install them. Alternatively, download the update packages for your distribution manually and verify their integrity by the methods listed in Section 6 of this announcement. Then install the packages using the command rpm -Fhv to apply the update, replacing with the filename of the downloaded RPM package. Our maintenance customers are notified individually. The packages are offered for installation from the maintenance web: SLE SDK 10 SP3 SUSE Linux Enterprise Server 10 SP3 SUSE Linux Enterprise Java 10 SP3 SUSE Linux Enterprise Server 11 SP1 SUSE Linux Enterprise Java 11 SP1 SUSE Linux Enterprise Software Development Kit 11SP1 Open Enterprise Server Novell Linux POS 9 SUSE SLES 9 ______________________________________________________________________________ 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. ______________________________________________________________________________ 6) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify replacing with the name of the file where you saved the announcement. The output for a valid signature looks like: gpg: Signature made using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team " where is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and the integrity of a package needs to be verified to ensure that it has not been tampered with. The internal rpm package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig to verify the signature of the package, replacing with the filename of the RPM package downloaded. The package is unmodified if it containsa valid signature from
Dec 17, 2010
•Critical
SuSE
100
security advisoryremote code executionSUSESUSE 2009-019: Oracle JDK 7 Update 40 Low: Denial of Service Vulnerability
The IBM Java 1.4.2 JDK and JRE were brought to Service Release 13 The IBM Java 1.4.2 JDK and JRE were brought to Service Release 13 and the IBM JDK and JRE 6 were brought to Service Release 4. and the IBM JDK and JRE 6 were brought to Service Release 4. These updates fix lots of bugs and various security issues: CVE-2008-5350: A security vulnerability in the Java Runtime Environment (JRE) may al [More...]. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Announcement Package: IBM Java 1.4.2 and 6 Announcement ID: SUSE-SA:2009:018 Date: Tue, 07 Apr 2009 13:00:00 +0000 Affected Products: SUSE SLES 9 Open Enterprise Server Novell Linux POS 9 SLE SDK 10 SP2 SUSE Linux Enterprise Server 10 SP2 SLES 11 DEBUGINFO SLE 11 SLES 11 Vulnerability Type: remote code execution Severity (1-10): 7 SUSE Default Package: yes Cross-References: CVE-2008-2086, CVE-2008-5339, CVE-2008-5340 CVE-2008-5341, CVE-2008-5342, CVE-2008-5343 CVE-2008-5344, CVE-2008-5345, CVE-2008-5346 CVE-2008-5348, CVE-2008-5350, CVE-2008-5351 CVE-2008-5353, CVE-2008-5354, CVE-2008-5356 CVE-2008-5357, CVE-2008-5358, CVE-2008-5359 CVE-2008-5360 Content of This Advisory: 1) Security Vulnerability Resolved: IBM Java Security update Problem Description 2) Solution or Work-Around 3) Special Instructions and Notes 4) Package Location and Checksums 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. 6) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Problem Description and Brief Discussion The IBM Java 1.4.2 JDK and JRE were brought to Service Release 13 and the IBM JDK and JRE 6 were brought to Service Release 4. These updates fix lots of bugs and various security issues: CVE-2008-5350: A security vulnerability in the Java Runtime Environment (JRE) may allow an untrusted applet or application to list the contents of the home directory of the user running the applet or application. CVE-2008-5346: A security vulnerability in the Java Runtime Environment (JRE) with parsing zip files may allow an untrusted applet or application to read arbitrary memory locations in the process that the applet or application is running in. CVE-2008-5343: A vulnerability in Java Web Start and Java Plug-in may allow hidden code on a host to make network connections to that host and to hijack HTTP sessions using cookies stored in the browser. CVE-2008-5344: A vulnerability in the Java Runtime Environment (JRE) with applet classloading may allow an untrusted applet to read arbitrary files on a system that the applet runs on and make network connections to hosts other than the host it was loaded from. CVE-2008-5359: A buffer overflow vulnerability in the Java Runtime Environment (JRE) image processing code may allow an untrusted applet or application to escalate privileges. For example, an untrusted applet may grant itself permissions to read and write local files or execute local applications that are accessible to the user running the untrusted applet. CVE-2008-5339: A vulnerability in the Java Runtime Environment (JRE) may allow an untrusted Java Web Start application to make network connections to hosts other than the host that the applicationis downloaded from. CVE-2008-5340: A vulnerability in the Java Runtime Environment with launching Java Web Start applications may allow an untrusted Java Web Start application to escalate privileges. For example, an untrusted application may grant itself permissions to read and write local files or execute local applications that are accessible to the user running the untrusted application. CVE-2008-5348: A security vulnerability in the Java Runtime Environment (JRE) with authenticating users through Kerberos may lead to a Denial of Service (DoS) to the system as a whole, due to excessive consumption of operating system resources. CVE-2008-2086: A vulnerability in Java Web Start may allow certain trusted operations to be performed, such as modifying system properties. CVE-2008-5345: The Java Runtime Environment (JRE) allows code loaded from the local filesystem to access localhost. This may allow code that is maliciously placed on the local filesystem and then subsequently run, to have network access to localhost that would not otherwise be allowed if the code were loaded from a remote host. This may be leveraged to steal cookies and hijack sessions (for domains that map a name to the localhost). CVE-2008-5351: The UTF-8 (Unicode Transformation Format-8) decoder in the Java Runtime Environment (JRE) accepts encodings that are longer than the "shortest" form. This behavior is not a vulnerability in Java SE. However, it may be leveraged to exploit systems running software that relies on the JRE UTF-8 decoder to reject non-shortest form sequences. For example, non-shortest form sequences may be decoded into illegal URIs, which may then allow files that are not otherwise accessible to be read, if the URIs are not checked following UTF-8 decoding. CVE-2008-5360: The Java Runtime Environment creates temporary files with insufficiently random names. This may be leveraged to write JAR files which may then be loadedas untrusted applets and Java Web Start applications to access and provide services from localhost and hence steal cookies. CVE-2008-5353: A security vulnerability in the Java Runtime Environment (JRE) related to deserializing calendar objects may allow an untrusted applet or application to escalate privileges. For example, an untrusted applet may grant itself permissions to read and write local files or execute local applications that are accessible to the user running the untrusted applet. CVE-2008-5356: A buffer vulnerability in the Java Runtime Environment (JRE) with processing fonts may allow an untrusted applet or Java Web Start application to escalate privileges. For example, an untrusted applet may grant itself permissions to read and write local files or execute local applications that are accessible to the user running the untrusted applet. CVE-2008-5354: A buffer overflow vulnerability in the Java Runtime Environment (JRE) may allow an untrusted Java application that is launched through the command line to escalate privileges. For example, the untrusted Java application may grant itself permissions to read and write local files or execute local applications that are accessible to the user running the untrusted Java application. This vulnerability cannot be exploited by an applet or Java Web Start application. CVE-2008-5357: A buffer vulnerability in the Java Runtime Environment (JRE) with processing fonts may allow an untrusted applet or Java Web Start application to escalate privileges. For example, an untrusted applet may grant itself permissions to read and write local files or execute local applications that are accessible to the user running the untrusted applet. CVE-2008-5342: A security vulnerability in the the Java Web Start BasicService allows untrusted applications that are downloaded from another system to request local files to be displayed by the browser of the user running the untrustedapplication. 2) Solution or Work-Around There is no known workaround, please install the update packages. 3) Special Instructions and Notes Please close and restart all running instances of programs using IBM Java after the update. 4) Package Location and Checksums The preferred method for installing security updates is to use the YaST Online Update (YOU) tool. YOU detects which updates are required and automatically performs the necessary steps to verify and install them. Alternatively, download the update packages for your distribution manually and verify their integrity by the methods listed in Section 6 of this announcement. Then install the packages using the command rpm -Fhv to apply the update, replacing with the filename of the downloaded RPM package. Our maintenance customers are notified individually. The packages are offered for installation from the maintenance web: SUSE Linux Enterprise Server 10 SP2 https://login.microfocus.com/nidp/app/login?sid=0 SLE SDK 10 SP2 https://login.microfocus.com/nidp/app/login?sid=0 SLES 11 https://login.microfocus.com/nidp/app/login?sid=0 https://login.microfocus.com/nidp/app/login?sid=0 SLE 11 https://login.microfocus.com/nidp/app/login?sid=0 https://login.microfocus.com/nidp/app/login?sid=0 SLES 11 DEBUGINFO https://login.microfocus.com/nidp/app/login?sid=0 Open Enterprise Server https://login.microfocus.com/nidp/app/login?sid=0 Novell Linux POS 9 https://login.microfocus.com/nidp/app/login?sid=0 SUSE SLES 9 https://login.microfocus.com/nidp/app/login?sid=0 ______________________________________________________________________________ 5) Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report. ______________________________________________________________________________ 6) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE securityannouncements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify replacing with the name of the file where you saved the announcement. The output for a valid signature looks like: gpg: Signature made using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team " where is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and the integrity of a package needs to be verified to ensure that it has not been tampered with. The internal rpm package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig to verify the signature of the package, replacing with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from
Apr 07, 2009
•Low
SuSE
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!