Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found -3 articles for you...
91
security advisorygentoomultiple threatsGentoo: GLSA 202408-11 Normal: Aiohttp Threats Explained
Multiple vulnerabilities have been discovered in aiohttp, the worst of which could lead to service compromise.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202408-11 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: aiohttp: Multiple Vulnerabilities Date: August 07, 2024 Bugs: #918541, #918968, #931097 ID: 202408-11 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been discovered in aiohttp, the worst of which could lead to service compromise. Background ========== aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Affected packages ================= Package Vulnerable Unaffected ------------------ ------------ ------------ dev-python/aiohttp < 3.9.4 > = 3.9.4 Description =========== Multiple vulnerabilities have been discovered in aiohttp. Please review the CVE identifiers referenced below for details. Impact ====== Please review the referenced CVE identifiers for details. Workaround ========== There is no known workaround at this time. Resolution ========== All aiohttp users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =dev-python/aiohttp-3.9.4" References ========== [ 1 ] CVE-2023-47641 https://nvd.nist.gov/vuln/detail/CVE-2023-47641 [ 2 ] CVE-2023-49082 https://nvd.nist.gov/vuln/detail/CVE-2023-49082 [ 3 ] CVE-2024-30251 https://nvd.nist.gov/vuln/detail/CVE-2024-30251 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202408-11 Concerns? ========= Security is a primary focus of Gentoo Linux andensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Aug 07, 2024
Gentoo
172
security advisorydenial of servicekernel updateUbuntu 20.04 LTS USN-6605-1: Moderate Kernel Denial of Service Threats
Several security issues were fixed in the Linux kernel.. ========================================================================== Ubuntu Security Notice USN-6605-1 January 25, 2024 linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-bluefield, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-iot, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4, linux-xilinx-zynqmp vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS (Available with Ubuntu Pro) Summary: Several security issues were fixed in the Linux kernel. Software Description: - linux: Linux kernel - linux-aws: Linux kernel for Amazon Web Services (AWS) systems - linux-azure: Linux kernel for Microsoft Azure Cloud systems - linux-bluefield: Linux kernel for NVIDIA BlueField platforms - linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems - linux-gkeop: Linux kernel for Google Container Engine (GKE) systems - linux-ibm: Linux kernel for IBM cloud systems - linux-iot: Linux kernel for IoT platforms - linux-oracle: Linux kernel for Oracle Cloud systems - linux-raspi: Linux kernel for Raspberry Pi systems - linux-xilinx-zynqmp: Linux kernel for Xilinx ZynqMP processors - linux-aws-5.4: Linux kernel for Amazon Web Services (AWS) systems - linux-azure-5.4: Linux kernel for Microsoft Azure cloud systems - linux-gcp-5.4: Linux kernel for Google Cloud Platform (GCP) systems - linux-hwe-5.4: Linux hardware enablement (HWE) kernel - linux-ibm-5.4: Linux kernel for IBM cloud systems - linux-oracle-5.4: Linux kernel for Oracle Cloud systems - linux-raspi-5.4: Linux kernel for Raspberry Pi systems Details: Lin Ma discovered that the netfilter subsystem in the Linux kernel did not properly validate network family support while creating a new netfilter table. A local attacker could use this to cause adenial of service or possibly execute arbitrary code. (CVE-2023-6040) It was discovered that the CIFS network file system implementation in the Linux kernel did not properly validate the server frame size in certain situation, leading to an out-of-bounds read vulnerability. An attacker could use this to construct a malicious CIFS image that, when operated on, could cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-6606) Budimir Markovic, Lucas De Marchi, and Pengfei Xu discovered that the perf subsystem in the Linux kernel did not properly validate all event sizes when attaching new events, leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-6931) It was discovered that the IGMP protocol implementation in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-6932) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 20.04 LTS: linux-image-5.4.0-1029-iot 5.4.0-1029.30 linux-image-5.4.0-1036-xilinx-zynqmp 5.4.0-1036.40 linux-image-5.4.0-1064-ibm 5.4.0-1064.69 linux-image-5.4.0-1077-bluefield 5.4.0-1077.83 linux-image-5.4.0-1084-gkeop 5.4.0-1084.88 linux-image-5.4.0-1101-raspi 5.4.0-1101.113 linux-image-5.4.0-1116-oracle 5.4.0-1116.125 linux-image-5.4.0-1117-aws 5.4.0-1117.127 linux-image-5.4.0-1121-gcp 5.4.0-1121.130 linux-image-5.4.0-1122-azure 5.4.0-1122.129 linux-image-5.4.0-170-generic 5.4.0-170.188 linux-image-5.4.0-170-generic-lpae 5.4.0-170.188 linux-image-5.4.0-170-lowlatency 5.4.0-170.188 linux-image-aws-lts-20.04 5.4.0.1117.114 linux-image-azure-lts-20.04 5.4.0.1122.115 linux-image-bluefield 5.4.0.1077.72 linux-image-gcp-lts-20.04 5.4.0.1121.123 linux-image-generic 5.4.0.170.168 linux-image-generic-lpae 5.4.0.170.168 linux-image-gkeop 5.4.0.1084.82 linux-image-gkeop-5.4 5.4.0.1084.82 linux-image-ibm-lts-20.04 5.4.0.1064.93 linux-image-lowlatency 5.4.0.170.168 linux-image-oem 5.4.0.170.168 linux-image-oem-osp1 5.4.0.170.168 linux-image-oracle-lts-20.04 5.4.0.1116.109 linux-image-raspi 5.4.0.1101.131 linux-image-raspi2 5.4.0.1101.131 linux-image-virtual 5.4.0.170.168 linux-image-xilinx-zynqmp 5.4.0.1036.36 Ubuntu 18.04 LTS (Available with Ubuntu Pro): linux-image-5.4.0-1064-ibm 5.4.0-1064.69~18.04.1 linux-image-5.4.0-1101-raspi 5.4.0-1101.113~18.04.1 linux-image-5.4.0-1116-oracle 5.4.0-1116.125~18.04.1 linux-image-5.4.0-1117-aws 5.4.0-1117.127~18.04.1 linux-image-5.4.0-1121-gcp 5.4.0-1121.130~18.04.1 linux-image-5.4.0-1122-azure 5.4.0-1122.129~18.04.1 linux-image-5.4.0-170-generic 5.4.0-170.188~18.04.1 linux-image-5.4.0-170-lowlatency 5.4.0-170.188~18.04.1 linux-image-aws 5.4.0.1117.95 linux-image-azure 5.4.0.1122.95 linux-image-gcp 5.4.0.1121.97 linux-image-generic-hwe-18.04 5.4.0.170.188~18.04.138 linux-image-ibm 5.4.0.1064.74 linux-image-lowlatency-hwe-18.04 5.4.0.170.188~18.04.138 linux-image-oem 5.4.0.170.188~18.04.138 linux-image-oem-osp1 5.4.0.170.188~18.04.138 linux-image-oracle 5.4.0.1116.125~18.04.88 linux-image-raspi-hwe-18.04 5.4.0.1101.98 linux-image-snapdragon-hwe-18.04 5.4.0.170.188~18.04.138 linux-image-virtual-hwe-18.04 5.4.0.170.188~18.04.138 After a standard system update you need to reboot your computer to make all the necessarychanges. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well. References: https://ubuntu.com/security/notices/USN-6605-1 CVE-2023-6040, CVE-2023-6606, CVE-2023-6931, CVE-2023-6932 Package Information: https://launchpad.net/ubuntu/+source/linux/5.4.0-170.188 https://launchpad.net/ubuntu/+source/linux-aws/5.4.0-1117.127 https://launchpad.net/ubuntu/+source/linux-azure/5.4.0-1122.129 https://launchpad.net/ubuntu/+source/linux-bluefield/5.4.0-1077.83 https://launchpad.net/ubuntu/+source/linux-gcp/5.4.0-1121.130 https://launchpad.net/ubuntu/+source/linux-gkeop/5.4.0-1084.88 https://launchpad.net/ubuntu/+source/linux-ibm/5.4.0-1064.69 https://launchpad.net/ubuntu/+source/linux-iot/5.4.0-1029.30 https://launchpad.net/ubuntu/+source/linux-oracle/5.4.0-1116.125 https://launchpad.net/ubuntu/+source/linux-raspi/5.4.0-1101.113 https://launchpad.net/ubuntu/+source/linux-xilinx-zynqmp/5.4.0-1036.40 . Several security flaws within the Linux kernel have been addressed to prevent possible crashes and safeguard against data exposure.. Linux Kernel Fixes, Ubuntu Security Updates, System Crash Prevention. . Severity: Important. LinuxSecurity.com Team
Jan 25, 2024
•Important
Ubuntu
91
security advisoryGentoonormal severityGentoo: 202209-01 Update: sqlalchemy Detected Vulnerability Risks
Multiple vulnerabilities have been discovered in lxml, the worst of which could result in denial of service.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202208-06 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: lxml: Multiple Vulnerabilities Date: August 10, 2022 Bugs: #777579, #829053, #856598 ID: 202208-06 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities have been discovered in lxml, the worst of which could result in denial of service. Background ========= lxml is a Pythonic binding for the libxml2 and libxslt libraries. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-python/lxml < 4.9.1 > = 4.9.1 Description ========== Multiple vulnerabilities have been discovered in lxml. Please review the CVE identifiers referenced below for details. Impact ===== Please review the referenced CVE identifiers for details. Workaround ========= There is no known workaround at this time. Resolution ========= All lxml users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =dev-python/lxml-4.9.1" References ========= [ 1 ] CVE-2021-28957 https://nvd.nist.gov/vuln/detail/CVE-2021-28957 [ 2 ] CVE-2021-43818 https://nvd.nist.gov/vuln/detail/CVE-2021-43818 [ 3 ] CVE-2022-2309 https://nvd.nist.gov/vuln/detail/CVE-2022-2309 [ 4 ] GHSL-2021-1037 [ 5 ] GHSL-2021-1038 Availability =========== This GLSA and any updates to it are available for viewing at theGentoo Security Website: https://security.gentoo.org/glsa/202208-06 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Aug 09, 2022
Gentoo
172
security advisorydenial of servicesoftware updateUbuntu 17.04: USN-3349-1 Critical: NTP Denial Of Service Threats
Several security issues were fixed in NTP.. =========================================================================Ubuntu Security Notice USN-3349-1 July 05, 2017 ntp vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 17.04 - Ubuntu 16.10 - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: Several security issues were fixed in NTP. Software Description: - ntp: Network Time Protocol daemon and utility programs Details: Yihan Lian discovered that NTP incorrectly handled certain large request data values. A remote attacker could possibly use this issue to cause NTP to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-2519) Miroslav Lichvar discovered that NTP incorrectly handled certain spoofed addresses when performing rate limiting. A remote attacker could possibly use this issue to perform a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 16.10. (CVE-2016-7426) Matthew Van Gundy discovered that NTP incorrectly handled certain crafted broadcast mode packets. A remote attacker could possibly use this issue to perform a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 16.10. (CVE-2016-7427, CVE-2016-7428) Miroslav Lichvar discovered that NTP incorrectly handled certain responses. A remote attacker could possibly use this issue to perform a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 16.10. (CVE-2016-7429) Sharon Goldberg and Aanchal Malhotra discovered that NTP incorrectly handled origin timestamps of zero. A remote attacker could possibly use this issue to bypass the origin timestamp protection mechanism. This issue only affected Ubuntu 16.10. (CVE-2016-7431) Brian Utterback, Sharon Goldberg and Aanchal Malhotra discovered that NTP incorrectly performed initial synccalculations. This issue only applied to Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-7433) Magnus Stubman discovered that NTP incorrectly handled certain mrulist queries. A remote attacker could possibly use this issue to cause NTP to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-7434) Matthew Van Gund discovered that NTP incorrectly handled origin timestamp checks. A remote attacker could possibly use this issue to perform a denial of service. This issue only affected Ubuntu Ubuntu 16.10, and Ubuntu 17.04. (CVE-2016-9042) Matthew Van Gundy discovered that NTP incorrectly handled certain control mode packets. A remote attacker could use this issue to set or unset traps. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-9310) Matthew Van Gundy discovered that NTP incorrectly handled the trap service. A remote attacker could possibly use this issue to cause NTP to crash, resulting in a denial of service. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-9311) It was discovered that NTP incorrectly handled memory when processing long variables. A remote authenticated user could possibly use this issue to cause NTP to crash, resulting in a denial of service. (CVE-2017-6458) It was discovered that NTP incorrectly handled memory when processing long variables. A remote authenticated user could possibly use this issue to cause NTP to crash, resulting in a denial of service. This issue only applied to Ubuntu 16.04 LTS, Ubuntu 16.10 and Ubuntu 17.04. (CVE-2017-6460) It was discovered that the NTP legacy DPTS refclock driver incorrectly handled the /dev/datum device. A local attacker could possibly use this issue to cause a denial of service. (CVE-2017-6462) It was discovered that NTP incorrectly handled certain invalid settings in a :config directive. A remote authenticated user could possibly use this issue to cause NTP to crash,resulting in a denial of service. (CVE-2017-6463) It was discovered that NTP incorrectly handled certain invalid mode configuration directives. A remote authenticated user could possibly use this issue to cause NTP to crash, resulting in a denial of service. (CVE-2017-6464) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 17.04: ntp 1:4.2.8p9+dfsg-2ubuntu1.1 Ubuntu 16.10: ntp 1:4.2.8p8+dfsg-1ubuntu2.1 Ubuntu 16.04 LTS: ntp 1:4.2.8p4+dfsg-3ubuntu5.5 Ubuntu 14.04 LTS: ntp 1:4.2.6.p5+dfsg-3ubuntu2.14.04.11 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-3349-1 CVE-2016-2519, CVE-2016-7426, CVE-2016-7427, CVE-2016-7428, CVE-2016-7429, CVE-2016-7431, CVE-2016-7433, CVE-2016-7434, CVE-2016-9042, CVE-2016-9310, CVE-2016-9311, CVE-2017-6458, CVE-2017-6460, CVE-2017-6462, CVE-2017-6463, CVE-2017-6464 Package Information: https://launchpad.net/ubuntu/+source/ntp/1:4.2.8p9+dfsg-2ubuntu1.1 https://launchpad.net/ubuntu/+source/ntp/1:4.2.8p8+dfsg-1ubuntu2.1 https://launchpad.net/ubuntu/+source/ntp/1:4.2.8p4+dfsg-3ubuntu5.5 https://launchpad.net/ubuntu/+source/ntp/1:4.2.6.p5+dfsg-3ubuntu2.14.04.11 . Numerous NTP security flaws identified across several Ubuntu iterations necessitate immediate updates to safeguard against potential denial of service attacks.. NTP Vulnerabilities, Denial Of Service, Ubuntu Advisory, Network Time Protocol. . Severity: Critical. LinuxSecurity.com Team
Jul 05, 2017
•Critical
Ubuntu
89
security advisorymoderateFedoraFedora 23: 2016-1c10ab3c35 Moderate: Moodle XSS Service Threat
Security update.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2016-1c10ab3c35 2016-01-30 14:54:08.581740 -------------------------------------------------------------------------------- Name : moodle Product : Fedora 23 Version : 2.9.4 Release : 1.fc23 URL : https://moodle.org/ Summary : A Course Management System Description : Moodle is a course management system (CMS) - a free, Open Source software package designed using sound pedagogical principles, to help educators create effective online learning communities. -------------------------------------------------------------------------------- Update Information: Security update. -------------------------------------------------------------------------------- References: [ 1 ] Bug #1299363 - CVE-2016-0724 moodle: two enrolment-related web services don't check course visibility [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1299363 [ 2 ] Bug #1299355 - CVE-2016-0725 moodle: XSS vulnerability in course management search [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1299355 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update moodle' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Jan 30, 2016
Fedora
100
security advisorymoderate severitysecurity patchSUSE 9.x: 2005-053 Moderate: Squid Remote DoS Threat Advisory
This update of the Squid web-proxy fixes two remotely exploitable denial This update of the Squid web-proxy fixes two remotely exploitable denial of service vulnerabilities. of service vulnerabilities. One can be triggered by aborting a request (CAN-2005-2794) due to a faulty assertion. The other one occurs in sslConnectTimeout while handling malformated. -----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SUSE Security Announcement Package: squid Announcement ID: SUSE-SA:2005:053 Date: Fri, 16 Sep 2005 14:28:00 +0000 Affected Products: 9.0, 9.1, 9.2, 9.3 SUSE Linux Enterprise Server 8, 9 Open Enterprise Server 9 Vulnerability Type: remote denial of service Severity (1-10): 4 SUSE Default Package: no Cross-References: CAN-2005-2794 CAN-2005-2796 Content of This Advisory: 1) Security Vulnerability Resolved: - remote denial of service Problem Description 2) Solution or Work-Around 3) Special Instructions and Notes 4) Package Location and Checksums 5) Pending Vulnerabilities, Solutions, and Workarounds: none 6) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Problem Description and Brief Discussion This update of the Squid web-proxy fixes two remotely exploitable denial of service vulnerabilities. One can be triggered by aborting a request (CAN-2005-2794) due to a faulty assertion. The other one occurs in sslConnectTimeout while handling malformated requests (CAN-2005-2796). The latter one does not affect SUSE LINUX 9.3. 2) Solution or Workaround There are no workarounds known. 3) SpecialInstructions and Notes Please restart the Squid web-proxy after the update. 4) Package Location and Checksums The preferred method for installing security updates is to use the YaST Online Update (YOU) tool. YOU detects which updates are required and automatically performs the necessary steps to verify and install them. Alternatively, download the update packages for your distribution manually and verify their integrity by the methods listed in Section 6 of this announcement. Then install the packages using the command rpm -Fhv to apply the update, replacing with the filename of the downloaded RPM package. Our maintenance customers are notified individually. The packages are offered for installation from the maintenance web. x86 Platform: SUSE Linux 9.3: eea572b10ecf573753af16ecf1fbdaa7 patch rpm(s): becf331a849332d734d72f90801d8338 source rpm(s): 8c0ffeccd0c8fd64418164f275adbd27 SUSE Linux 9.2: 93720922d4f7ae4370b2c4e493fae592 patch rpm(s): 9e4d07f1f11c8c1cbf7564c8d2164ca7 source rpm(s): 236cb11582b4983350ef81e5e8508c39 SUSE Linux 9.1: dc9848a817367dfe278a6f3954c6677f patch rpm(s): 5c534d9df125a3ff02c5fa32bf216f64 source rpm(s): 4dd683495e578ec59bd34260caf9a565 SUSE Linux 9.0: 6d094da21806166dde5f6da8307ca2a2 patch rpm(s): 02172274b15a28b918c54d470203d029 source rpm(s): 3cfae65a6cee24e6cfe8adc4226fa601 x86-64 Platform: SUSE Linux 9.3: d07ae04a018a3abb082cd0b130c145a0 patch rpm(s): cbcb39ccc9ee0340692ae3cf048453ff source rpm(s): 8c0ffeccd0c8fd64418164f275adbd27 SUSE Linux 9.2: 915b0b2955f878a2e89b171d1335274c patch rpm(s): c488ab4031de911b6675a785a4d2a4dd source rpm(s): 236cb11582b4983350ef81e5e8508c39 SUSE Linux 9.1: 6fc9746898681ee217f884f6aaca8e68 patch rpm(s): 37ada616c159242b53e2dfbf5f94597c source rpm(s): 310321fd1232ea45ccb06fd5b24ba664 SUSE Linux 9.0: f39071c7802d8bb77ed00038e095a6af patch rpm(s): 05f996332331ddebf848cc2726fcbc87 source rpm(s): 3c7e8fc9a5e0cf4c6638d57fed2fdf53 ______________________________________________________________________________ 5) Pending Vulnerabilities, Solutions, and Workarounds: See SUSE Security Summary Report. ______________________________________________________________________________ 6) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify replacing with the name of the file where you saved the announcement. The output for a valid signature looks like: gpg: Signature made using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team " where is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and the integrity of a package needs to be verified to ensure that it has not been tampered with. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or RPM package: 1) Using the internal gpgsignatures of the rpm package 2) MD5 checksums as provided in this announcement 1) The internal rpm package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig to verify the signature of the package, replacing with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from
Sep 16, 2005
SuSE
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!