Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 511
Alerts This Week
Warning Icon 1 511

Stay Secure with the Latest Linux Advisories

Ubuntu Large Esm H800
Ubuntu

Ubuntu OpenSSH Critical Network Access Issue CVE-2026-35414 USN-8577-1

Calendar White Jul 21, 2026
Critical
Ubuntu Large Esm H900
Ubuntu

Ubuntu 16.04 CUPS Critical Control Character Injection CVE-2026-34980

Calendar White Jul 21, 2026
Critical
Ubuntu Large Esm H900
Ubuntu

Ubuntu 26.04 Snapd Critical Security Issues July 2026 USN-8579-1

Calendar White Jul 21, 2026
Critical
Debianlts Large Esm H800
Debian LTS

Debian rtpengine Critical Origin Validation Issue DLA-4691-1 CVE-2025-53399

Calendar White Jul 21, 2026
Critical
Opensuse Large Esm H900
openSUSE

openSUSE Leap 16.0 Beets Moderate Web Issue Fix SUSE-SU-2026-21383-1

Calendar White Jul 21, 2026
moderate
Opensuse Large Esm H900
openSUSE

openSUSE Chromium Important Use After Free Issues Fix 2026-21382-1

Calendar White Jul 21, 2026
Important
Opensuse Large Esm H800
openSUSE

openSUSE Leap 16.0 opam Important Security Update 2026-21380-1

Calendar White Jul 21, 2026
Important
Opensuse Large Esm H900
openSUSE

openSUSE Leap 16.0 ID 21374 Vim Important Code Execution Issues

Calendar White Jul 21, 2026
Important
Opensuse Large Esm H900
openSUSE

openSUSE Python-Aiohttp Important Resource Issues Vuln 2026-21372-1

Calendar White Jul 21, 2026
Important
Filter%20icon Refine advisories
X Clear Filters
X Clear Filters
View More

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

More Polls

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":1,"type":"x","order":4,"pct":100,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Loading...

Explore Latest Linux Security advisories

We found 29 articles for you...
203
Ls Advisories Mageia Esm H240
Price Tag%201security advisorysoftware updatesignature forgery

Mageia: 2025-0154 moderate: libreoffice PDF signature forgery

PDF signature forgery with adbe.pkcs7.sha1 SubFilter. (CVE-2025-2866) References: - https://bugs.mageia.org/show_bug.cgi?id=34234 - https://lists.debian.org/debian-security-announce/2025/msg00070.html . MGASA-2025-0154 - Updated libreoffice packages fix security vulnerability Publication date: 11 May 2025 URL: https://advisories.mageia.org/MGASA-2025-0154.html Type: security Affected Mageia releases: 9 CVE: CVE-2025-2866 PDF signature forgery with adbe.pkcs7.sha1 SubFilter. (CVE-2025-2866) References: - https://bugs.mageia.org/show_bug.cgi?id=34234 - https://lists.debian.org/debian-security-announce/2025/msg00070.html - - https://www.cve.org/CVERecord?id=CVE-2025-2866 SRPMS: - 9/core/libreoffice-24.2.7.2-1.3.mga9 . Recent LibreOffice updates for Mageia address a PDF signature tampering vulnerability, highlighting the critical need for strong cybersecurity protocols.. libreoffice security, Mageia update, PDF forgery fix, Mageia CVE advisory. . LinuxSecurity.com Team

Calendar%202 May 11, 2025 Mageia
100
Ls Advisories Suse Esm H240
Price Tag%201security advisorymoderateupdate

SUSE: 2025:1434-1 moderate: poppler signature forgery risk

* bsc#1241620 Cross-References: * CVE-2025-43903 . # Security update for poppler Announcement ID: SUSE-SU-2025:1434-1 Release Date: 2025-05-02T10:37:11Z Rating: moderate References: * bsc#1241620 Cross-References: * CVE-2025-43903 CVSS scores: * CVE-2025-43903 ( SUSE ): 4.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N * CVE-2025-43903 ( NVD ): 4.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N Affected Products: * Basesystem Module 15-SP6 * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Package Hub 15 15-SP6 An update that solves one vulnerability can now be installed. ## Description: This update for poppler fixes the following issues: * CVE-2025-43903: improper verification of adbe.pkcs7.sha1 signatures allows for signature forgeries. (bsc#1241620) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch SUSE-2025-1434=1 openSUSE-SLE-15.6-2025-1434=1 * Basesystem Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP6-2025-1434=1 * SUSE Package Hub 15 15-SP6 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2025-1434=1 ## Package List: * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586) * poppler-tools-24.03.0-150600.3.13.1 * poppler-tools-debuginfo-24.03.0-150600.3.13.1 * libpoppler135-24.03.0-150600.3.13.1 * libpoppler135-debuginfo-24.03.0-150600.3.13.1 * libpoppler-glib8-debuginfo-24.03.0-150600.3.13.1 * poppler-qt6-debugsource-24.03.0-150600.3.13.1 * typelib-1_0-Poppler-0_18-24.03.0-150600.3.13.1 * poppler-debugsource-24.03.0-150600.3.13.1 * libpoppler-qt6-3-24.03.0-150600.3.13.1 *libpoppler-cpp0-24.03.0-150600.3.13.1 * libpoppler-qt5-devel-24.03.0-150600.3.13.1 * libpoppler-devel-24.03.0-150600.3.13.1 * libpoppler-cpp0-debuginfo-24.03.0-150600.3.13.1 * libpoppler-qt5-1-24.03.0-150600.3.13.1 * libpoppler-qt6-devel-24.03.0-150600.3.13.1 * poppler-qt5-debugsource-24.03.0-150600.3.13.1 * libpoppler-qt5-1-debuginfo-24.03.0-150600.3.13.1 * libpoppler-glib8-24.03.0-150600.3.13.1 * libpoppler-qt6-3-debuginfo-24.03.0-150600.3.13.1 * libpoppler-glib-devel-24.03.0-150600.3.13.1 * openSUSE Leap 15.6 (x86_64) * libpoppler135-32bit-24.03.0-150600.3.13.1 * libpoppler-glib8-32bit-24.03.0-150600.3.13.1 * libpoppler-cpp0-32bit-24.03.0-150600.3.13.1 * libpoppler-glib8-32bit-debuginfo-24.03.0-150600.3.13.1 * libpoppler-qt5-1-32bit-24.03.0-150600.3.13.1 * libpoppler135-32bit-debuginfo-24.03.0-150600.3.13.1 * libpoppler-qt5-1-32bit-debuginfo-24.03.0-150600.3.13.1 * libpoppler-cpp0-32bit-debuginfo-24.03.0-150600.3.13.1 * openSUSE Leap 15.6 (aarch64_ilp32) * libpoppler-cpp0-64bit-debuginfo-24.03.0-150600.3.13.1 * libpoppler-qt5-1-64bit-24.03.0-150600.3.13.1 * libpoppler-glib8-64bit-24.03.0-150600.3.13.1 * libpoppler-cpp0-64bit-24.03.0-150600.3.13.1 * libpoppler-glib8-64bit-debuginfo-24.03.0-150600.3.13.1 * libpoppler-qt5-1-64bit-debuginfo-24.03.0-150600.3.13.1 * libpoppler135-64bit-debuginfo-24.03.0-150600.3.13.1 * libpoppler135-64bit-24.03.0-150600.3.13.1 * Basesystem Module 15-SP6 (aarch64 ppc64le s390x x86_64) * poppler-tools-24.03.0-150600.3.13.1 * poppler-tools-debuginfo-24.03.0-150600.3.13.1 * libpoppler135-24.03.0-150600.3.13.1 * libpoppler135-debuginfo-24.03.0-150600.3.13.1 * libpoppler-glib8-debuginfo-24.03.0-150600.3.13.1 * typelib-1_0-Poppler-0_18-24.03.0-150600.3.13.1 * poppler-debugsource-24.03.0-150600.3.13.1 * libpoppler-cpp0-24.03.0-150600.3.13.1 * libpoppler-devel-24.03.0-150600.3.13.1 * libpoppler-cpp0-debuginfo-24.03.0-150600.3.13.1 *libpoppler-glib8-24.03.0-150600.3.13.1 * libpoppler-glib-devel-24.03.0-150600.3.13.1 * SUSE Package Hub 15 15-SP6 (aarch64 ppc64le s390x x86_64) * poppler-qt6-debugsource-24.03.0-150600.3.13.1 * libpoppler-qt6-3-24.03.0-150600.3.13.1 * poppler-debugsource-24.03.0-150600.3.13.1 * libpoppler-cpp0-24.03.0-150600.3.13.1 * libpoppler-qt5-devel-24.03.0-150600.3.13.1 * libpoppler-devel-24.03.0-150600.3.13.1 * libpoppler-cpp0-debuginfo-24.03.0-150600.3.13.1 * libpoppler-qt5-1-24.03.0-150600.3.13.1 * libpoppler-qt6-devel-24.03.0-150600.3.13.1 * poppler-qt5-debugsource-24.03.0-150600.3.13.1 * libpoppler-qt5-1-debuginfo-24.03.0-150600.3.13.1 * libpoppler-qt6-3-debuginfo-24.03.0-150600.3.13.1 * SUSE Package Hub 15 15-SP6 (x86_64) * libpoppler135-32bit-debuginfo-24.03.0-150600.3.13.1 * libpoppler-glib8-32bit-debuginfo-24.03.0-150600.3.13.1 * libpoppler135-32bit-24.03.0-150600.3.13.1 * libpoppler-glib8-32bit-24.03.0-150600.3.13.1 ## References: * https://www.suse.com/security/cve/CVE-2025-43903.html * https://bugzilla.suse.com/show_bug.cgi?id=1241620 . SUSE has rolled out a crucial update to tackle a security flaw in poppler. This patch is essential for safeguarding systems against potential signature forgery threats.. SUSE Security Update, Poppler Update, Signature Forgery Fix. . LinuxSecurity.com Team

Calendar%202 May 02, 2025 SuSE
Banner 3 1028x280 1708121785 1771599793
202
Ls Advisories Opensuse Esm H240
Price Tag%201security advisorymoderatepatch

openSUSE 15.6: SUSE-SU-2025:1434-1 moderate: poppler signature forgery

An update that solves one vulnerability can now be installed.. # Security update for poppler Announcement ID: SUSE-SU-2025:1434-1 Release Date: 2025-05-02T10:37:11Z Rating: moderate References: * bsc#1241620 Cross-References: * CVE-2025-43903 CVSS scores: * CVE-2025-43903 ( SUSE ): 4.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N * CVE-2025-43903 ( NVD ): 4.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N Affected Products: * Basesystem Module 15-SP6 * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Package Hub 15 15-SP6 An update that solves one vulnerability can now be installed. ## Description: This update for poppler fixes the following issues: * CVE-2025-43903: improper verification of adbe.pkcs7.sha1 signatures allows for signature forgeries. (bsc#1241620) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch SUSE-2025-1434=1 openSUSE-SLE-15.6-2025-1434=1 * Basesystem Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP6-2025-1434=1 * SUSE Package Hub 15 15-SP6 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2025-1434=1 ## Package List: * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586) * poppler-tools-24.03.0-150600.3.13.1 * poppler-tools-debuginfo-24.03.0-150600.3.13.1 * libpoppler135-24.03.0-150600.3.13.1 * libpoppler135-debuginfo-24.03.0-150600.3.13.1 * libpoppler-glib8-debuginfo-24.03.0-150600.3.13.1 * poppler-qt6-debugsource-24.03.0-150600.3.13.1 * typelib-1_0-Poppler-0_18-24.03.0-150600.3.13.1 * poppler-debugsource-24.03.0-150600.3.13.1 * libpoppler-qt6-3-24.03.0-150600.3.13.1 *libpoppler-cpp0-24.03.0-150600.3.13.1 * libpoppler-qt5-devel-24.03.0-150600.3.13.1 * libpoppler-devel-24.03.0-150600.3.13.1 * libpoppler-cpp0-debuginfo-24.03.0-150600.3.13.1 * libpoppler-qt5-1-24.03.0-150600.3.13.1 * libpoppler-qt6-devel-24.03.0-150600.3.13.1 * poppler-qt5-debugsource-24.03.0-150600.3.13.1 * libpoppler-qt5-1-debuginfo-24.03.0-150600.3.13.1 * libpoppler-glib8-24.03.0-150600.3.13.1 * libpoppler-qt6-3-debuginfo-24.03.0-150600.3.13.1 * libpoppler-glib-devel-24.03.0-150600.3.13.1 * openSUSE Leap 15.6 (x86_64) * libpoppler135-32bit-24.03.0-150600.3.13.1 * libpoppler-glib8-32bit-24.03.0-150600.3.13.1 * libpoppler-cpp0-32bit-24.03.0-150600.3.13.1 * libpoppler-glib8-32bit-debuginfo-24.03.0-150600.3.13.1 * libpoppler-qt5-1-32bit-24.03.0-150600.3.13.1 * libpoppler135-32bit-debuginfo-24.03.0-150600.3.13.1 * libpoppler-qt5-1-32bit-debuginfo-24.03.0-150600.3.13.1 * libpoppler-cpp0-32bit-debuginfo-24.03.0-150600.3.13.1 * openSUSE Leap 15.6 (aarch64_ilp32) * libpoppler-cpp0-64bit-debuginfo-24.03.0-150600.3.13.1 * libpoppler-qt5-1-64bit-24.03.0-150600.3.13.1 * libpoppler-glib8-64bit-24.03.0-150600.3.13.1 * libpoppler-cpp0-64bit-24.03.0-150600.3.13.1 * libpoppler-glib8-64bit-debuginfo-24.03.0-150600.3.13.1 * libpoppler-qt5-1-64bit-debuginfo-24.03.0-150600.3.13.1 * libpoppler135-64bit-debuginfo-24.03.0-150600.3.13.1 * libpoppler135-64bit-24.03.0-150600.3.13.1 * Basesystem Module 15-SP6 (aarch64 ppc64le s390x x86_64) * poppler-tools-24.03.0-150600.3.13.1 * poppler-tools-debuginfo-24.03.0-150600.3.13.1 * libpoppler135-24.03.0-150600.3.13.1 * libpoppler135-debuginfo-24.03.0-150600.3.13.1 * libpoppler-glib8-debuginfo-24.03.0-150600.3.13.1 * typelib-1_0-Poppler-0_18-24.03.0-150600.3.13.1 * poppler-debugsource-24.03.0-150600.3.13.1 * libpoppler-cpp0-24.03.0-150600.3.13.1 * libpoppler-devel-24.03.0-150600.3.13.1 * libpoppler-cpp0-debuginfo-24.03.0-150600.3.13.1 *libpoppler-glib8-24.03.0-150600.3.13.1 * libpoppler-glib-devel-24.03.0-150600.3.13.1 * SUSE Package Hub 15 15-SP6 (aarch64 ppc64le s390x x86_64) * poppler-qt6-debugsource-24.03.0-150600.3.13.1 * libpoppler-qt6-3-24.03.0-150600.3.13.1 * poppler-debugsource-24.03.0-150600.3.13.1 * libpoppler-cpp0-24.03.0-150600.3.13.1 * libpoppler-qt5-devel-24.03.0-150600.3.13.1 * libpoppler-devel-24.03.0-150600.3.13.1 * libpoppler-cpp0-debuginfo-24.03.0-150600.3.13.1 * libpoppler-qt5-1-24.03.0-150600.3.13.1 * libpoppler-qt6-devel-24.03.0-150600.3.13.1 * poppler-qt5-debugsource-24.03.0-150600.3.13.1 * libpoppler-qt5-1-debuginfo-24.03.0-150600.3.13.1 * libpoppler-qt6-3-debuginfo-24.03.0-150600.3.13.1 * SUSE Package Hub 15 15-SP6 (x86_64) * libpoppler135-32bit-debuginfo-24.03.0-150600.3.13.1 * libpoppler-glib8-32bit-debuginfo-24.03.0-150600.3.13.1 * libpoppler135-32bit-24.03.0-150600.3.13.1 * libpoppler-glib8-32bit-24.03.0-150600.3.13.1 ## References: * https://www.suse.com/security/cve/CVE-2025-43903.html * https://bugzilla.suse.com/show_bug.cgi?id=1241620 . A medium-level security notice has been issued for openSUSE users concerning vulnerabilities in poppler that could impact various systems. Users are advised to follow the update guidelines.. openSUSE security, poppler update, moderate vulnerability, system patch. . LinuxSecurity.com Team

Calendar%202 May 02, 2025 OpenSUSE
172
Ls Advisories Ubuntu Esm H240
Price Tag%201security advisoryUbuntusignature forgery

Ubuntu 23.10: USN-6801-1 Alert for Moderate Node-Express-Security Flaw

browserify-sign could allow unintended access if it opened a specially crafted file.. ========================================================================== Ubuntu Security Notice USN-6800-1 May 30, 2024 node-browserify-sign vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 23.10 - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: browserify-sign could allow unintended access if it opened a specially crafted file. Software Description: - node-browserify-sign: createSign and createVerify in your browser Details: It was discovered that browserify-sign incorrectly handled an upper bound check in signature verification. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to perform a signature forgery attack. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 23.10 node-browserify-sign 4.2.1-3ubuntu0.1 Ubuntu 22.04 LTS node-browserify-sign 4.2.1-2ubuntu0.1 Ubuntu 20.04 LTS node-browserify-sign 4.0.4-2ubuntu0.20.04.1 Ubuntu 18.04 LTS node-browserify-sign 4.0.4-2ubuntu0.18.04.1~esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6800-1 CVE-2023-46234 Package Information: https://launchpad.net/ubuntu/+source/node-browserify-sign/4.2.1-3ubuntu0.1 https://launchpad.net/ubuntu/+source/node-browserify-sign/4.2.1-2ubuntu0.1 https://launchpad.net/ubuntu/+source/node-browserify-sign/4.0.4-2ubuntu0.20.04.1 . A critical vulnerability in the browserify-sign package affects Ubuntu 20.04, 21.10, and 22.04, needing immediate updates to ensure system security.browserify-sign, Node-Browserify-Sign, access control, signature forgery. . LinuxSecurity.com Team

Calendar%202 May 30, 2024 Ubuntu
Banner 3 1028x280 1708121785 1771599793
89
Ls Advisories Fedora Esm H240
Price Tag%201security advisorycriticalsoftware update

Fedora 39: FEDORA-2024-6dff351234 Urgent: Nodejs Library Exploit Alert

Update to 1.22.21, add fixes for CVE-2022-37599, CVE-2023-26136, CVE-2023-46234.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2024-5ecc250449 2024-02-28 01:40:29.293733 -------------------------------------------------------------------------------- Name : yarnpkg Product : Fedora 38 Version : 1.22.21 Release : 2.fc38 URL : https://github.com/yarnpkg/yarn Summary : Fast, reliable, and secure dependency management. Description : Fast, reliable, and secure dependency management. -------------------------------------------------------------------------------- Update Information: Update to 1.22.21, add fixes for CVE-2022-37599, CVE-2023-26136, CVE-2023-46234. -------------------------------------------------------------------------------- ChangeLog: * Mon Feb 19 2024 Sandro Mani - 1.22.21-2 - Backport patches for CVE-2022-37599, CVE-2023-26136, CVE-2023-46234 * Fri Feb 16 2024 Sandro Mani - 1.22.21-1 - Update to 1.22.21 * Sat Jan 27 2024 Fedora Release Engineering - 1.22.19-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild * Sat Jul 22 2023 Fedora Release Engineering - 1.22.19-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild * Wed May 3 2023 Sandro Mani - 1.22.19-6 - Rebuild (nodejs20) -------------------------------------------------------------------------------- References: [ 1 ] Bug #2209317 - CVE-2022-37599 yarnpkg: loader-utils: regular expression denial of service in interpolateName.js [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2209317 [ 2 ] Bug #2220682 - CVE-2023-26136 yarnpkg: tough-cookie: prototype pollution in cookie memstore [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2220682 [ 3 ] Bug #2246633 - CVE-2023-46234 yarnpkg: browserify-sign: upper bound check issue in dsaVerify leads to a signature forgery attack [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2246633 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-5ecc250449' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ Do not reply to spam, report it: . Debian 12 upgrade for npm 8.19.2 resolves significant security vulnerabilities, enhancing stability and efficiency.. Fedora Updates,Yarnpkg 1.22.21,Security Notifications. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Feb 28, 2024 •Critical Fedora
89
Ls Advisories Fedora Esm H240
Price Tag%201security advisorydenial of servicecritical

Fedora 39: FEDORA-2024-28fc0c2ef4 Critical: yarnpkg Denial Of Service

Update to 1.22.21, add fixes for CVE-2022-37599, CVE-2023-26136, CVE-2023-46234.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2024-28fc0c2ef4 2024-02-28 01:07:06.086715 -------------------------------------------------------------------------------- Name : yarnpkg Product : Fedora 39 Version : 1.22.21 Release : 2.fc39 URL : https://github.com/yarnpkg/yarn Summary : Fast, reliable, and secure dependency management. Description : Fast, reliable, and secure dependency management. -------------------------------------------------------------------------------- Update Information: Update to 1.22.21, add fixes for CVE-2022-37599, CVE-2023-26136, CVE-2023-46234. -------------------------------------------------------------------------------- ChangeLog: * Mon Feb 19 2024 Sandro Mani - 1.22.21-2 - Backport patches for CVE-2022-37599, CVE-2023-26136, CVE-2023-46234 * Fri Feb 16 2024 Sandro Mani - 1.22.21-1 - Update to 1.22.21 * Sat Jan 27 2024 Fedora Release Engineering - 1.22.19-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2209317 - CVE-2022-37599 yarnpkg: loader-utils: regular expression denial of service in interpolateName.js [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2209317 [ 2 ] Bug #2220682 - CVE-2023-26136 yarnpkg: tough-cookie: prototype pollution in cookie memstore [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2220682 [ 3 ] Bug #2246633 - CVE-2023-46234 yarnpkg: browserify-sign: upper bound check issue in dsaVerify leads to a signature forgery attack [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2246633 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade--advisory FEDORA-2024-28fc0c2ef4' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ Do not reply to spam, report it: . Fedora 39 Upgrade for yarnpkg 1.22.21 tackling significant security vulnerabilities, such as denial of service and prototype pollution threats.. Fedora Updates,Yarnpkg Security,Denial of Service,Prototype Pollution. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Feb 28, 2024 •Critical Fedora
Banner 3 1028x280 1708121785 1771599793
87
Ls Advisories Debian Esm H240
Price Tag%201security advisoryupdatecritical

Debian: DSA-5539-1 Critical: Node-Browserify-Sign Signature Forgery

It was reported that incorrect bound checks in the dsaVerify function in node-browserify-sign, a Node.js library which adds crypto signing for browsers, allows an attacker to perform signature forgery attacks by constructing signatures that can be successfully verified by any . - ------------------------------------------------------------------------- Debian Security Advisory DSA-5539-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/security/ Salvatore Bonaccorso October 30, 2023 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : node-browserify-sign CVE ID : CVE-2023-46234 Debian Bug : 1054667 It was reported that incorrect bound checks in the dsaVerify function in node-browserify-sign, a Node.js library which adds crypto signing for browsers, allows an attacker to perform signature forgery attacks by constructing signatures that can be successfully verified by any public key. For the oldstable distribution (bullseye), this problem has been fixed in version 4.2.1-1+deb11u1. For the stable distribution (bookworm), this problem has been fixed in version 4.2.1-3+deb12u1. We recommend that you upgrade your node-browserify-sign packages. For the detailed security status of node-browserify-sign please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/node-browserify-sign Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . The latest update in Debian Security Advisory DSA-5539-1 tackles serious security flaws found in node-browserify-sign and provides recommendations for patch implementation.. Debian Security Advisory,node-browserify-sign,signature forgery,crypto signing,security update. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Oct 30, 2023 •Critical Debian
197
Ls Advisories Deblts Esm H240
Price Tag%201security advisorycriticaldebian

Debian 10 DLA-3635-1 Critical: Node-Browserify-Sign Signature Issue

An upper bound check issue in `dsaVerify` function has been discovered in node-browserify-sign. This allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack. . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3635-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/lts/security/ Yadd October 29, 2023 https://wiki.debian.org/LTS - ------------------------------------------------------------------------- Package : node-browserify-sign Version : 4.0.4-2+deb10u1 CVE ID : CVE-2023-46234 Debian Bug : 1054667 An upper bound check issue in `dsaVerify` function has been discovered in node-browserify-sign. This allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack. For Debian 10 buster, this problem has been fixed in version 4.0.4-2+deb10u1. We recommend that you upgrade your node-browserify-sign packages. For the detailed security status of node-browserify-sign please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/node-browserify-sign Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Debian LTS Advisory DLA-3636-1 pertains to a security vulnerability in node-crypto-js leading to potential data exposure.. Node-Browserify-Sign Update, Debian LTS Security, Signature Forgery Fix. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Oct 29, 2023 •Critical Debian LTS
Banner 3 1028x280 1708121785 1771599793
News Add Esm H240

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

More Polls

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":1,"type":"x","order":4,"pct":100,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200

Search Topics