Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -6 articles for you...
89
security advisoryfedoraconfigurationFedora 44 xrdp Critical Socket Closure Advisory 2026-9a3a98bc24
Close TCP socket in default configuration, because we want just Unix domain socket connections to Xvnc.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-9a3a98bc24 2026-05-30 00:54:46.011421+00:00 -------------------------------------------------------------------------------- Name : xrdp Product : Fedora 44 Version : 0.10.6 Release : 2.fc44 URL : http://www.xrdp.org/ Summary : Open source remote desktop protocol (RDP) server Description : xrdp provides a fully functional RDP server compatible with a wide range of RDP clients, including FreeRDP and Microsoft RDP client. -------------------------------------------------------------------------------- Update Information: Close TCP socket in default configuration, because we want just Unix domain socket connections to Xvnc. -------------------------------------------------------------------------------- ChangeLog: * Fri May 22 2026 Bojan Smojver - 1:0.10.6-2 - close TCP port in default Xvnc config, Unix domain socket only -------------------------------------------------------------------------------- References: [ 1 ] Bug #2480423 - no authentication required to connect to Xvnc https://bugzilla.redhat.com/show_bug.cgi?id=2480423 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-9a3a98bc24' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list--
May 30, 2026
•Critical
Fedora
172
security advisorykerberosubuntuUbuntu: 4223-1 Critical: OpenJDK Multiple Security Fixes
Several security issues were fixed in OpenJDK.. =========================================================================Ubuntu Security Notice USN-4223-1 December 17, 2019 openjdk-8, openjdk-lts vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 19.10 - Ubuntu 19.04 - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Several security issues were fixed in OpenJDK. Software Description: - openjdk-lts: Open Source Java implementation - openjdk-8: Open Source Java implementation Details: Jan Jancar, Petr Svenda, and Vladimir Sedlacek discovered that a side- channel vulnerability existed in the ECDSA implementation in OpenJDK. An Attacker could use this to expose sensitive information. (CVE-2019-2894) It was discovered that the Socket implementation in OpenJDK did not properly restrict the creation of subclasses with a custom Socket implementation. An attacker could use this to specially create a Java class that could possibly bypass Java sandbox restrictions. (CVE-2019-2945) Rob Hamm discovered that the Kerberos implementation in OpenJDK did not properly handle proxy credentials. An attacker could possibly use this to impersonate another user. (CVE-2019-2949) It was discovered that a NULL pointer dereference existed in the font handling implementation in OpenJDK. An attacker could use this to cause a denial of service (application crash). (CVE-2019-2962) It was discovered that the Concurrency subsystem in OpenJDK did not properly bound stack consumption when compiling regular expressions. An attacker could use this to cause a denial of service (application crash). (CVE-2019-2964) It was discovered that the JAXP subsystem in OpenJDK did not properly handle XPath expressions in some situations. An attacker could use this to cause a denial of service (application crash). (CVE-2019-2973, CVE-2019-2981) It was discovered that the Nashorn JavaScript subcomponent in OpenJDK did not properlyhandle regular expressions in some situations. An attacker could use this to cause a denial of service (application crash). (CVE-2019-2975) It was discovered that the String class in OpenJDK contained an out-of-bounds access vulnerability. An attacker could use this to cause a denial of service (application crash) or possibly expose sensitive information. This issue only affected OpenJDK 11 in Ubuntu 18.04 LTS, Ubuntu 19.04, and Ubuntu 19.10. (CVE-2019-2977) It was discovered that the Jar URL handler in OpenJDK did not properly handled nested Jar URLs in some situations. An attacker could use this to cause a denial of service (application crash). (CVE-2019-2978) It was discovered that the Serialization component of OpenJDK did not properly handle deserialization of certain object attributes. An attacker could use this to cause a denial of service (application crash). (CVE-2019-2983) It was discovered that the FreetypeFontScaler class in OpenJDK did not properly validate dimensions of glyph bitmap images read from font files. An attacker could specially craft a font file that could cause a denial of service (application crash). (CVE-2019-2987) It was discovered that a buffer overflow existed in the SunGraphics2D class in OpenJDK. An attacker could possibly use this to cause a denial of service (excessive memory consumption or application crash). (CVE-2019-2988) It was discovered that the Networking component in OpenJDK did not properly handle certain responses from HTTP proxies. An attacker controlling a malicious HTTP proxy could possibly use this to inject content into a proxied HTTP connection. (CVE-2019-2989) It was discovered that the font handling implementation in OpenJDK did not properly validate TrueType font files in some situations. An attacker could specially craft a font file that could cause a denial of service (excessive memory consumption). (CVE-2019-2992) It was discovered that the JavaDoc generator in OpenJDK did not properly filter out some HTML elements properly, includingdocumentation comments in Java source code. An attacker could possibly use this to craft a Cross-Site Scripting attack. (CVE-2019-2999) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 19.10: openjdk-11-jdk 11.0.5+10-0ubuntu1.1 openjdk-11-jre 11.0.5+10-0ubuntu1.1 openjdk-11-jre-headless 11.0.5+10-0ubuntu1.1 openjdk-11-jre-zero 11.0.5+10-0ubuntu1.1 Ubuntu 19.04: openjdk-11-jdk 11.0.5+10-0ubuntu1.1~19.04 openjdk-11-jre 11.0.5+10-0ubuntu1.1~19.04 openjdk-11-jre-headless 11.0.5+10-0ubuntu1.1~19.04 openjdk-11-jre-zero 11.0.5+10-0ubuntu1.1~19.04 Ubuntu 18.04 LTS: openjdk-11-jdk 11.0.5+10-0ubuntu1.1~18.04 openjdk-11-jre 11.0.5+10-0ubuntu1.1~18.04 openjdk-11-jre-headless 11.0.5+10-0ubuntu1.1~18.04 openjdk-11-jre-zero 11.0.5+10-0ubuntu1.1~18.04 Ubuntu 16.04 LTS: openjdk-8-jdk 8u232-b09-0ubuntu1~16.04.1 openjdk-8-jre 8u232-b09-0ubuntu1~16.04.1 openjdk-8-jre-headless 8u232-b09-0ubuntu1~16.04.1 openjdk-8-jre-jamvm 8u232-b09-0ubuntu1~16.04.1 openjdk-8-jre-zero 8u232-b09-0ubuntu1~16.04.1 This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart any Java applications or applets to make all the necessary changes. References: https://ubuntu.com/security/notices/USN-4223-1 CVE-2019-2894, CVE-2019-2945, CVE-2019-2949, CVE-2019-2962, CVE-2019-2964, CVE-2019-2973, CVE-2019-2975, CVE-2019-2977, CVE-2019-2978, CVE-2019-2981, CVE-2019-2983, CVE-2019-2987, CVE-2019-2988, CVE-2019-2989, CVE-2019-2992, CVE-2019-2999 Package Information: https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.5+10-0ubuntu1.1 https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.5+10-0ubuntu1.1~19.04 https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.5+10-0ubuntu1.1~18.04 https://launchpad.net/ubuntu/+source/openjdk-8/8u232-b09-0ubuntu1~16.04.1 . Multiple vulnerabilities addressed in OpenJDK for Ubuntu, including threats of denial of service and potential data leakage.. OpenJDK Security Update, Ubuntu OpenJDK Exploits, Java Security Advisory. . Severity: Critical. LinuxSecurity.com Team
Dec 17, 2019
•Critical
Ubuntu
89
security advisorymoderateFedoraFedora 24: Moderate Security Update for log4j Socket Issue
Security fix for CVE-2017-5645. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2017-2ccfbd650a 2017-05-04 13:28:25.130998 --------------------------------------------------------------------------------Name : log4j Product : Fedora 24 Version : 2.5 Release : 3.fc24 URL : https://logging.apache.org/log4j/2.x/ Summary : Java logging package Description : Log4j is a tool to help the programmer output log statements to a variety of output targets. --------------------------------------------------------------------------------Update Information: Security fix for CVE-2017-5645 --------------------------------------------------------------------------------References: [ 1 ] Bug #1443635 - CVE-2017-5645 log4j: Socket receiver deserialization vulnerability https://bugzilla.redhat.com/show_bug.cgi?id=1443635 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade log4j' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
May 04, 2017
•Important
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!