Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -7 articles for you...
98
security advisoryremote code executionaccess controlCritical Security Update for Red Hat Fuse 7.3.1 RHSA-2019:1545-01
A micro version update (from 7.3 to 7.3.1) is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat Fuse 7.3.1 security update Advisory ID: RHSA-2019:1545-01 Product: Red Hat JBoss Fuse Advisory URL: https://access.redhat.com/errata/RHSA-2019:1545 Issue date: 2019-06-18 CVE Names: CVE-2016-2510 CVE-2017-5645 CVE-2017-15691 CVE-2018-3258 CVE-2018-11798 ==================================================================== 1. Summary: A micro version update (from 7.3 to 7.3.1) is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: This release of Red Hat Fuse 7.3.1 serves as a replacement for Red Hat Fuse 7.3, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Security Fix(es): * bsh2: remote code execution via deserialization (CVE-2016-2510) * log4j: Socket receiver deserialization vulnerability (CVE-2017-5645) * uima: XML external entity expansion (XXE) can allow attackers to execute arbitrary code (CVE-2017-15691) * mysql-connector-java: Connector/J unspecified vulnerability (CPU October 2018) (CVE-2018-3258) * thrift: Improper Access Control grants access to files outside the webservers docroot path (CVE-2018-11798) For more details about the security issue(s),including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. Installation instructions are available from the Fuse 7.3.0 product documentation page: https://access.redhat.com/documentation/en-us/red_hat_fuse/7.3/ 4. Bugs fixed (https://bugzilla.redhat.com/): 1310647 - CVE-2016-2510 bsh2: remote code execution via deserialization 1443635 - CVE-2017-5645 log4j: Socket receiver deserialization vulnerability 1572463 - CVE-2017-15691 uima: XML external entity expansion (XXE) can allow attackers to execute arbitrary code 1640615 - CVE-2018-3258 mysql-connector-java: Connector/J unspecified vulnerability (CPU October 2018) 1667188 - CVE-2018-11798 thrift: Improper Access Control grants access to files outside the webservers docroot path 5. References: https://access.redhat.com/security/cve/CVE-2016-2510 https://access.redhat.com/security/cve/CVE-2017-5645 https://access.redhat.com/security/cve/CVE-2017-15691 https://access.redhat.com/security/cve/CVE-2018-3258 https://access.redhat.com/security/cve/CVE-2018-11798 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=jboss.fuse&version=7.3.1 https://access.redhat.com/documentation/en-us/red_hat_fuse/7.3 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2019 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBXQlBI9zjgjWX9erEAQh77w/+PsSuUAlieEwI9nv+bv7r8zfDnPx4c6yB EoLphmrN/thQ4cuBmPOjZjhoHuvxFNxPN8+n4s21qSJiPLDWdBZ37JPyukSQqKOo OvZwGOiSiQrvo0kWZIDwnSv6eqv5V2CfLW2BZpVYdpx/SN24LeKX9E9hDC4E/4+p oE3xc27npAkmkVwmLlESuQyPTzAMYL+gWgbxaz9U2YCyxqEPnqnfFqhGsa5SPJhf GfSVjCH6ck6RXf6rARZWJSCakP5NWK5zJ2DHYFEUyf1/hKrtvG5/8ndGF8CjuQ+I Tx1VzoEJXjM6FRihnoWZsE/e3jjNi6+32tqVrgAnWwdegozKvOU/MLBw8tTdul1g 6ivX51OrOdosa13gEpLWdk/yBlbeB0LKRiSnpy+ireTvd6cy657p+F6gXyS7qqA1 hlpNWqSp/iGY3wU5+z3XbGuY0eElkvYtj6itTxsBY7xW+s/GR10PkHQPvpSCHPv2 3uFWBu10QPdx6IF2CNHs1NAToQcgonIYmx5zcO8u06RJ7smvwZT2uVYEtWUqAn1X KqRjMLTXrp0uYPiBvZcAfZ+w3N4dhzUjN82aJGtU+Vz+hyP9vkQMGFNuMx5fANVL cUuFrK1uqLVNXjaLQe4YRknSDJpyWeAa4NvEDTKpPLTcLn0UhpiXo64N2g+A2RKb zlWsqxiu5w0=He6i -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Jun 18, 2019
•Important
Red Hat
89
security advisoryFedorasecurity fixFedora 25 log4j12 Security Fix: CVE-2017-5645 Socket Deserialization
Security fix for CVE-2017-5645. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2017-8348115acd 2017-06-12 13:03:55.241822 --------------------------------------------------------------------------------Name : log4j12 Product : Fedora 25 Version : 1.2.17 Release : 19.fc25 URL : https://logging.apache.org/log4j/1.x/ Summary : Java logging package Description : Log4j is a tool to help the programmer output log statements to a variety of output targets. --------------------------------------------------------------------------------Update Information: Security fix for CVE-2017-5645 --------------------------------------------------------------------------------References: [ 1 ] Bug #1443635 - CVE-2017-5645 log4j: Socket receiver deserialization vulnerability https://bugzilla.redhat.com/show_bug.cgi?id=1443635 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade log4j12' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Jun 12, 2017
•Critical
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!