Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -6 articles for you...
197
security advisorydebianattackDebian 8 Security Update: DLA-1942-1 Addresses phpBB3 CSRF Token Flaw
In phpBB, includes/acp/acp_bbcodes.php had improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack was possible if an attacker also managed to retrieve . Package : phpbb3 Version : 3.0.12-5+deb8u4 CVE ID : CVE-2019-16993 In phpBB, includes/acp/acp_bbcodes.php had improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack was possible if an attacker also managed to retrieve the session id of a reauthenticated administrator prior to targeting them. The description in this DLA does not match what has been documented in the changelog.Debian.gz of this package version. After the upload of phpbb3 3.0.12-5+deb8u4, it became evident that CVE-2019-13776 has not yet been fixed. The correct fix for CVE-2019-13776 has been identified and will be shipped in a soon-to-come follow-up security release of phpbb3. For Debian 8 "Jessie", these problems have been fixed in version 3.0.12-5+deb8u4. We recommend that you upgrade your phpbb3 packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS -- mike gabriel aka sunweaver (Debian Developer) fon: +49 (1520) 1976 148 GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22 0782 9AF4 6B30 2577 1B31 mail:
Sep 30, 2019
•Critical
Debian LTS
89
security advisoryupdatecriticalFedora 21: 2015-8788 Critical Advisory for pcs Session Security
Fix for CVE-2015-1848, CVE-2015-3983 (sessions not signed). -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2015-8788 2015-05-25 20:39:54 -------------------------------------------------------------------------------- Name : pcs Product : Fedora 21 Version : 0.9.137 Release : 4.fc21 URL : https://github.com/ClusterLabs/pcs Summary : Pacemaker Configuration System Description : pcs is a corosync and pacemaker configuration tool. It permits users to easily view, modify and created pacemaker based clusters. -------------------------------------------------------------------------------- Update Information: Fix for CVE-2015-1848, CVE-2015-3983 (sessions not signed) -------------------------------------------------------------------------------- ChangeLog: * Fri May 22 2015 Tomas Jelinek - 0.9.137-4 - Fix for CVE-2015-1848, CVE-2015-3983 (sessions not signed) * Fri Mar 27 2015 Tomas Jelinek - 0.9.137-3 - Fixed postinstall, preuninstall and postuinstall scripts (rhbz#1096224) * Wed Dec 17 2014 Chris Feist - 0.9.137-2 - Bind to 0.0.0.0 instead of ipv6 address by default * Tue Dec 16 2014 Chris Feist - 0.9.137-1 - Re-synced to upstream sources -------------------------------------------------------------------------------- References: [ 1 ] Bug #1208294 - CVE-2015-1848 CVE-2015-3983 pcs: improper web session variable signing https://bugzilla.redhat.com/show_bug.cgi?id=1208294 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update pcs' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Jun 04, 2015
•Critical
Fedora
98
security advisoryRed HatimportantRed Hat RHSA-2009:1164 Important: Tomcat Session Hijack and DoS Issues
Updated tomcat packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team.. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Important: tomcat security update Advisory ID: RHSA-2009:1164-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2009:1164.html Issue date: 2009-07-21 Keywords: Security CVE Names: CVE-2007-5333 CVE-2008-5515 CVE-2009-0033 CVE-2009-0580 CVE-2009-0781 CVE-2009-0783 ==================================================================== 1. Summary: Updated tomcat packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Description: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. It was discovered that the Red Hat Security Advisory RHSA-2007:0871 did not address all possible flaws in the way Tomcat handles certain characters and character sequences in cookie values. A remote attacker could use this flaw to obtain sensitive information, such as session IDs, and then use this information for session hijacking attacks. (CVE-2007-5333) Note: The fix for the CVE-2007-5333 flaw changes the default cookie processing behavior: with this update, version 0 cookies that contain values that must be quoted to be valid are automatically changed to version 1 cookies. To reactivate the previous, but insecure behavior, addthe following entry to the "/etc/tomcat5/catalina.properties" file: org.apache.tomcat.util.http.ServerCookie.VERSION_SWITCH=false It was discovered that request dispatchers did not properly normalize user requests that have trailing query strings, allowing remote attackers to send specially-crafted requests that would cause an information leak. (CVE-2008-5515) A flaw was found in the way the Tomcat AJP (Apache JServ Protocol) connector processes AJP connections. An attacker could use this flaw to send specially-crafted requests that would cause a temporary denial of service. (CVE-2009-0033) It was discovered that the error checking methods of certain authentication classes did not have sufficient error checking, allowing remote attackersto enumerate (via brute force methods) usernames registered with applications running on Tomcat when FORM-based authentication was used. (CVE-2009-0580) A cross-site scripting (XSS) flaw was found in the examples calendar application. With some web browsers, remote attackers could use this flaw to inject arbitrary web script or HTML via the "time" parameter. (CVE-2009-0781) It was discovered that web applications containing their own XML parserscould replace the XML parser Tomcat uses to parse configuration files. A malicious web application running on a Tomcat instance could read or, potentially, modify the configuration and XML-based data of other web applications deployed on the same Tomcat instance. (CVE-2009-0783) Users of Tomcat should upgrade to these updated packages, which contain backported patches to resolve these issues. Tomcat must be restarted for this update to take effect. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at 5. Bugs fixed (http://bugzilla.redhat.com/): 427766 - CVE-2007-5333 Improve cookie parsing for tomcat5 489028 - CVE-2009-0781tomcat: XSS in Apache Tomcat calendar application 493381 - CVE-2009-0033 tomcat6 Denial-Of-Service with AJP connection 503978 - CVE-2009-0580 tomcat6 Information disclosure in authentication classes 504153 - CVE-2009-0783 tomcat XML parser information disclosure 504753 - CVE-2008-5515 tomcat request dispatcher information disclosure vulnerability 6. Package List: Red Hat Enterprise Linux Desktop (v. 5 client): Source: i386: tomcat5-debuginfo-5.5.23-0jpp.7.el5_3.2.i386.rpm tomcat5-jsp-2.0-api-5.5.23-0jpp.7.el5_3.2.i386.rpm tomcat5-servlet-2.4-api-5.5.23-0jpp.7.el5_3.2.i386.rpm x86_64: tomcat5-debuginfo-5.5.23-0jpp.7.el5_3.2.x86_64.rpm tomcat5-jsp-2.0-api-5.5.23-0jpp.7.el5_3.2.x86_64.rpm tomcat5-servlet-2.4-api-5.5.23-0jpp.7.el5_3.2.x86_64.rpm RHEL Desktop Workstation (v. 5 client): Source: i386: tomcat5-5.5.23-0jpp.7.el5_3.2.i386.rpm tomcat5-admin-webapps-5.5.23-0jpp.7.el5_3.2.i386.rpm tomcat5-common-lib-5.5.23-0jpp.7.el5_3.2.i386.rpm tomcat5-debuginfo-5.5.23-0jpp.7.el5_3.2.i386.rpm tomcat5-jasper-5.5.23-0jpp.7.el5_3.2.i386.rpm tomcat5-jasper-javadoc-5.5.23-0jpp.7.el5_3.2.i386.rpm tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp.7.el5_3.2.i386.rpm tomcat5-server-lib-5.5.23-0jpp.7.el5_3.2.i386.rpm tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp.7.el5_3.2.i386.rpm tomcat5-webapps-5.5.23-0jpp.7.el5_3.2.i386.rpm x86_64: tomcat5-5.5.23-0jpp.7.el5_3.2.x86_64.rpm tomcat5-admin-webapps-5.5.23-0jpp.7.el5_3.2.x86_64.rpm tomcat5-common-lib-5.5.23-0jpp.7.el5_3.2.x86_64.rpm tomcat5-debuginfo-5.5.23-0jpp.7.el5_3.2.x86_64.rpm tomcat5-jasper-5.5.23-0jpp.7.el5_3.2.x86_64.rpm tomcat5-jasper-javadoc-5.5.23-0jpp.7.el5_3.2.x86_64.rpm tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp.7.el5_3.2.x86_64.rpm tomcat5-server-lib-5.5.23-0jpp.7.el5_3.2.x86_64.rpm tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp.7.el5_3.2.x86_64.rpm tomcat5-webapps-5.5.23-0jpp.7.el5_3.2.x86_64.rpm Red Hat Enterprise Linux (v. 5server): Source: i386: tomcat5-5.5.23-0jpp.7.el5_3.2.i386.rpm tomcat5-admin-webapps-5.5.23-0jpp.7.el5_3.2.i386.rpm tomcat5-common-lib-5.5.23-0jpp.7.el5_3.2.i386.rpm tomcat5-debuginfo-5.5.23-0jpp.7.el5_3.2.i386.rpm tomcat5-jasper-5.5.23-0jpp.7.el5_3.2.i386.rpm tomcat5-jasper-javadoc-5.5.23-0jpp.7.el5_3.2.i386.rpm tomcat5-jsp-2.0-api-5.5.23-0jpp.7.el5_3.2.i386.rpm tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp.7.el5_3.2.i386.rpm tomcat5-server-lib-5.5.23-0jpp.7.el5_3.2.i386.rpm tomcat5-servlet-2.4-api-5.5.23-0jpp.7.el5_3.2.i386.rpm tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp.7.el5_3.2.i386.rpm tomcat5-webapps-5.5.23-0jpp.7.el5_3.2.i386.rpm ia64: tomcat5-5.5.23-0jpp.7.el5_3.2.ia64.rpm tomcat5-admin-webapps-5.5.23-0jpp.7.el5_3.2.ia64.rpm tomcat5-common-lib-5.5.23-0jpp.7.el5_3.2.ia64.rpm tomcat5-debuginfo-5.5.23-0jpp.7.el5_3.2.ia64.rpm tomcat5-jasper-5.5.23-0jpp.7.el5_3.2.ia64.rpm tomcat5-jasper-javadoc-5.5.23-0jpp.7.el5_3.2.ia64.rpm tomcat5-jsp-2.0-api-5.5.23-0jpp.7.el5_3.2.ia64.rpm tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp.7.el5_3.2.ia64.rpm tomcat5-server-lib-5.5.23-0jpp.7.el5_3.2.ia64.rpm tomcat5-servlet-2.4-api-5.5.23-0jpp.7.el5_3.2.ia64.rpm tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp.7.el5_3.2.ia64.rpm tomcat5-webapps-5.5.23-0jpp.7.el5_3.2.ia64.rpm ppc: tomcat5-5.5.23-0jpp.7.el5_3.2.ppc.rpm tomcat5-5.5.23-0jpp.7.el5_3.2.ppc64.rpm tomcat5-admin-webapps-5.5.23-0jpp.7.el5_3.2.ppc.rpm tomcat5-common-lib-5.5.23-0jpp.7.el5_3.2.ppc.rpm tomcat5-debuginfo-5.5.23-0jpp.7.el5_3.2.ppc.rpm tomcat5-debuginfo-5.5.23-0jpp.7.el5_3.2.ppc64.rpm tomcat5-jasper-5.5.23-0jpp.7.el5_3.2.ppc.rpm tomcat5-jasper-javadoc-5.5.23-0jpp.7.el5_3.2.ppc.rpm tomcat5-jsp-2.0-api-5.5.23-0jpp.7.el5_3.2.ppc.rpm tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp.7.el5_3.2.ppc.rpm tomcat5-server-lib-5.5.23-0jpp.7.el5_3.2.ppc.rpm tomcat5-servlet-2.4-api-5.5.23-0jpp.7.el5_3.2.ppc.rpm tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp.7.el5_3.2.ppc.rpm tomcat5-webapps-5.5.23-0jpp.7.el5_3.2.ppc.rpm s390x: tomcat5-5.5.23-0jpp.7.el5_3.2.s390x.rpm tomcat5-admin-webapps-5.5.23-0jpp.7.el5_3.2.s390x.rpm tomcat5-common-lib-5.5.23-0jpp.7.el5_3.2.s390x.rpm tomcat5-debuginfo-5.5.23-0jpp.7.el5_3.2.s390x.rpm tomcat5-jasper-5.5.23-0jpp.7.el5_3.2.s390x.rpm tomcat5-jasper-javadoc-5.5.23-0jpp.7.el5_3.2.s390x.rpm tomcat5-jsp-2.0-api-5.5.23-0jpp.7.el5_3.2.s390x.rpm tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp.7.el5_3.2.s390x.rpm tomcat5-server-lib-5.5.23-0jpp.7.el5_3.2.s390x.rpm tomcat5-servlet-2.4-api-5.5.23-0jpp.7.el5_3.2.s390x.rpm tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp.7.el5_3.2.s390x.rpm tomcat5-webapps-5.5.23-0jpp.7.el5_3.2.s390x.rpm x86_64: tomcat5-5.5.23-0jpp.7.el5_3.2.x86_64.rpm tomcat5-admin-webapps-5.5.23-0jpp.7.el5_3.2.x86_64.rpm tomcat5-common-lib-5.5.23-0jpp.7.el5_3.2.x86_64.rpm tomcat5-debuginfo-5.5.23-0jpp.7.el5_3.2.x86_64.rpm tomcat5-jasper-5.5.23-0jpp.7.el5_3.2.x86_64.rpm tomcat5-jasper-javadoc-5.5.23-0jpp.7.el5_3.2.x86_64.rpm tomcat5-jsp-2.0-api-5.5.23-0jpp.7.el5_3.2.x86_64.rpm tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp.7.el5_3.2.x86_64.rpm tomcat5-server-lib-5.5.23-0jpp.7.el5_3.2.x86_64.rpm tomcat5-servlet-2.4-api-5.5.23-0jpp.7.el5_3.2.x86_64.rpm tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp.7.el5_3.2.x86_64.rpm tomcat5-webapps-5.5.23-0jpp.7.el5_3.2.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.cve.org/CVERecord?id=CVE-2007-5333 https://www.cve.org/CVERecord?id=CVE-2008-5515 https://www.cve.org/CVERecord?id=CVE-2009-0033 https://www.cve.org/CVERecord?id=CVE-2009-0580 https://www.cve.org/CVERecord?id=CVE-2009-0781 https://www.cve.org/CVERecord?id=CVE-2009-0783 https://tomcat.apache.org/security-5.html https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2009 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4(GNU/Linux) iD8DBQFKZmwkXlSAg2UNWIIRAuiZAKCl0RGKySFNZXzn2yP++DUeo8UV/wCfc/yd gciYRj4h4oJ7znufBR/BjDk=wR3r -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list
Jul 22, 2009
•Important
Red Hat
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!