Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 521
Alerts This Week
Warning Icon 1 521

Stay Secure with the Latest Linux Advisories

Opensuse Large Esm H800
openSUSE

openSUSE go1.25-openssl Important Security Issues 2026-3151-1

Calendar White Jul 21, 2026
Important
Opensuse Large Esm H900
openSUSE

openSUSE aws-nitro-enclaves-cli Important Issues Advisory 2026-3152-1

Calendar White Jul 21, 2026
Important
Opensuse Large Esm H900
openSUSE

openSUSE nghttp2 Moderate HTTP Request Smuggling Issue 2026-3153-1

Calendar White Jul 21, 2026
moderate
Opensuse Large Esm H800
openSUSE

openSUSE python-tornado6 Moderate Credential Leak Vulnerability 2026-3155-1

Calendar White Jul 21, 2026
moderate
Opensuse Large Esm H900
openSUSE

openSUSE Kernel Important Security Update Vulnerability Fix 2026-3156-1

Calendar White Jul 21, 2026
Important
Opensuse Large Esm H900
openSUSE

openSUSE php7 Moderate Buffer Vulnerability Resolution SUSE-SU-2026-3165-1

Calendar White Jul 21, 2026
moderate
Rockylinux Esm H800
Rocky

Rocky Linux httpd Important Denial of Service Fix RLSA-2026-42828

Calendar White Jul 21, 2026
Important
Ubuntu Large Esm H900
Ubuntu

Ubuntu Imagemagick Critical Denial of Service Vulnerabilities USN-8558-1

Calendar White Jul 21, 2026
Critical
Ubuntu Large Esm H900
Ubuntu

Ubuntu jbig2dec Important Denial of Service Vulnerabilities USN-8582-1

Calendar White Jul 21, 2026
Important
Filter%20icon Refine advisories
X Clear Filters
X Clear Filters
View More

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

More Polls

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":1,"type":"x","order":4,"pct":100,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Loading...

Explore Latest Linux Security advisories

We found -5 articles for you...
98
Ls Advisories Redhat Esm H240
Price Tag%201security advisoryupdatered hat

Red Hat: 2014:1166-01 Critical Update: jakarta-commons-httpclient SSL Fixes

Updated jakarta-commons-httpclient packages that fix one security issue are now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Important security [More...]. ==================================================================== Red Hat Security Advisory Synopsis: Important: jakarta-commons-httpclient security update Advisory ID: RHSA-2014:1166-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2014:1166.html Issue date: 2014-09-08 CVE Names: CVE-2014-3577 ==================================================================== 1. Summary: Updated jakarta-commons-httpclient packages that fix one security issue are now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 Red Hat Enterprise Linux Client (v. 7) - noarch Red Hat Enterprise Linux Client Optional (v. 7) - noarch Red Hat Enterprise Linux ComputeNode Optional (v. 7) - noarch Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server (v. 7) - noarch Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - noarch Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 Red Hat EnterpriseLinux Workstation (v. 7) - noarch Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - noarch 3. Description: Jakarta Commons HTTPClient implements the client side of HTTP standards. It was discovered that the HTTPClient incorrectly extracted host name from an X.509 certificate subject's Common Name (CN) field. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate. (CVE-2014-3577) For additional information on this flaw, refer to the Knowledgebase article in the References section. All jakarta-commons-httpclient users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1129074 - CVE-2014-3577 Apache HttpComponents client: SSL hostname verification bypass, incomplete CVE-2012-6153 fix 6. Package List: Red Hat Enterprise Linux Desktop (v. 5 client): Source: jakarta-commons-httpclient-3.0-7jpp.4.el5_10.src.rpm i386: jakarta-commons-httpclient-3.0-7jpp.4.el5_10.i386.rpm jakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10.i386.rpm x86_64: jakarta-commons-httpclient-3.0-7jpp.4.el5_10.x86_64.rpm jakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10.x86_64.rpm Red Hat Enterprise Linux Desktop Workstation (v. 5client): Source: jakarta-commons-httpclient-3.0-7jpp.4.el5_10.src.rpm i386: jakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10.i386.rpm jakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10.i386.rpm jakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10.i386.rpm jakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10.i386.rpm x86_64: jakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10.x86_64.rpm jakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10.x86_64.rpm jakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10.x86_64.rpm jakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10.x86_64.rpm Red Hat Enterprise Linux (v. 5server): Source: jakarta-commons-httpclient-3.0-7jpp.4.el5_10.src.rpm i386: jakarta-commons-httpclient-3.0-7jpp.4.el5_10.i386.rpm jakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10.i386.rpm jakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10.i386.rpm jakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10.i386.rpm jakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10.i386.rpm ia64: jakarta-commons-httpclient-3.0-7jpp.4.el5_10.ia64.rpm jakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10.ia64.rpm jakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10.ia64.rpm jakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10.ia64.rpm jakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10.ia64.rpm ppc: jakarta-commons-httpclient-3.0-7jpp.4.el5_10.ppc.rpm jakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10.ppc.rpm jakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10.ppc.rpm jakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10.ppc.rpm jakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10.ppc.rpm s390x: jakarta-commons-httpclient-3.0-7jpp.4.el5_10.s390x.rpm jakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10.s390x.rpm jakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10.s390x.rpm jakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10.s390x.rpm jakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10.s390x.rpm x86_64: jakarta-commons-httpclient-3.0-7jpp.4.el5_10.x86_64.rpm jakarta-commons-httpclient-debuginfo-3.0-7jpp.4.el5_10.x86_64.rpm jakarta-commons-httpclient-demo-3.0-7jpp.4.el5_10.x86_64.rpm jakarta-commons-httpclient-javadoc-3.0-7jpp.4.el5_10.x86_64.rpm jakarta-commons-httpclient-manual-3.0-7jpp.4.el5_10.x86_64.rpm Red Hat Enterprise Linux Desktop (v. 6): Source: jakarta-commons-httpclient-3.1-0.9.el6_5.src.rpm i386: jakarta-commons-httpclient-3.1-0.9.el6_5.i686.rpm jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5.i686.rpm x86_64: jakarta-commons-httpclient-3.1-0.9.el6_5.x86_64.rpm jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5.x86_64.rpm Red Hat Enterprise Linux Desktop Optional (v.6): Source: jakarta-commons-httpclient-3.1-0.9.el6_5.src.rpm i386: jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5.i686.rpm jakarta-commons-httpclient-demo-3.1-0.9.el6_5.i686.rpm jakarta-commons-httpclient-javadoc-3.1-0.9.el6_5.i686.rpm jakarta-commons-httpclient-manual-3.1-0.9.el6_5.i686.rpm x86_64: jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5.x86_64.rpm jakarta-commons-httpclient-demo-3.1-0.9.el6_5.x86_64.rpm jakarta-commons-httpclient-javadoc-3.1-0.9.el6_5.x86_64.rpm jakarta-commons-httpclient-manual-3.1-0.9.el6_5.x86_64.rpm Red Hat Enterprise Linux HPC Node (v. 6): Source: jakarta-commons-httpclient-3.1-0.9.el6_5.src.rpm x86_64: jakarta-commons-httpclient-3.1-0.9.el6_5.x86_64.rpm jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5.x86_64.rpm Red Hat Enterprise Linux HPC Node Optional (v. 6): Source: jakarta-commons-httpclient-3.1-0.9.el6_5.src.rpm x86_64: jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5.x86_64.rpm jakarta-commons-httpclient-demo-3.1-0.9.el6_5.x86_64.rpm jakarta-commons-httpclient-javadoc-3.1-0.9.el6_5.x86_64.rpm jakarta-commons-httpclient-manual-3.1-0.9.el6_5.x86_64.rpm Red Hat Enterprise Linux Server (v. 6): Source: jakarta-commons-httpclient-3.1-0.9.el6_5.src.rpm i386: jakarta-commons-httpclient-3.1-0.9.el6_5.i686.rpm jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5.i686.rpm ppc64: jakarta-commons-httpclient-3.1-0.9.el6_5.ppc64.rpm jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5.ppc64.rpm s390x: jakarta-commons-httpclient-3.1-0.9.el6_5.s390x.rpm jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5.s390x.rpm x86_64: jakarta-commons-httpclient-3.1-0.9.el6_5.x86_64.rpm jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5.x86_64.rpm Red Hat Enterprise Linux Server Optional (v.6): Source: jakarta-commons-httpclient-3.1-0.9.el6_5.src.rpm i386: jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5.i686.rpm jakarta-commons-httpclient-demo-3.1-0.9.el6_5.i686.rpm jakarta-commons-httpclient-javadoc-3.1-0.9.el6_5.i686.rpm jakarta-commons-httpclient-manual-3.1-0.9.el6_5.i686.rpm ppc64: jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5.ppc64.rpm jakarta-commons-httpclient-demo-3.1-0.9.el6_5.ppc64.rpm jakarta-commons-httpclient-javadoc-3.1-0.9.el6_5.ppc64.rpm jakarta-commons-httpclient-manual-3.1-0.9.el6_5.ppc64.rpm s390x: jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5.s390x.rpm jakarta-commons-httpclient-demo-3.1-0.9.el6_5.s390x.rpm jakarta-commons-httpclient-javadoc-3.1-0.9.el6_5.s390x.rpm jakarta-commons-httpclient-manual-3.1-0.9.el6_5.s390x.rpm x86_64: jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5.x86_64.rpm jakarta-commons-httpclient-demo-3.1-0.9.el6_5.x86_64.rpm jakarta-commons-httpclient-javadoc-3.1-0.9.el6_5.x86_64.rpm jakarta-commons-httpclient-manual-3.1-0.9.el6_5.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: jakarta-commons-httpclient-3.1-0.9.el6_5.src.rpm i386: jakarta-commons-httpclient-3.1-0.9.el6_5.i686.rpm jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5.i686.rpm x86_64: jakarta-commons-httpclient-3.1-0.9.el6_5.x86_64.rpm jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 6): Source: jakarta-commons-httpclient-3.1-0.9.el6_5.src.rpm i386: jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5.i686.rpm jakarta-commons-httpclient-demo-3.1-0.9.el6_5.i686.rpm jakarta-commons-httpclient-javadoc-3.1-0.9.el6_5.i686.rpm jakarta-commons-httpclient-manual-3.1-0.9.el6_5.i686.rpm x86_64: jakarta-commons-httpclient-debuginfo-3.1-0.9.el6_5.x86_64.rpm jakarta-commons-httpclient-demo-3.1-0.9.el6_5.x86_64.rpm jakarta-commons-httpclient-javadoc-3.1-0.9.el6_5.x86_64.rpm jakarta-commons-httpclient-manual-3.1-0.9.el6_5.x86_64.rpm Red Hat Enterprise Linux Client (v.7): Source: jakarta-commons-httpclient-3.1-16.el7_0.src.rpm noarch: jakarta-commons-httpclient-3.1-16.el7_0.noarch.rpm Red Hat Enterprise Linux Client Optional (v. 7): noarch: jakarta-commons-httpclient-demo-3.1-16.el7_0.noarch.rpm jakarta-commons-httpclient-javadoc-3.1-16.el7_0.noarch.rpm jakarta-commons-httpclient-manual-3.1-16.el7_0.noarch.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): Source: jakarta-commons-httpclient-3.1-16.el7_0.src.rpm noarch: jakarta-commons-httpclient-3.1-16.el7_0.noarch.rpm jakarta-commons-httpclient-demo-3.1-16.el7_0.noarch.rpm jakarta-commons-httpclient-javadoc-3.1-16.el7_0.noarch.rpm jakarta-commons-httpclient-manual-3.1-16.el7_0.noarch.rpm Red Hat Enterprise Linux Server (v. 7): Source: jakarta-commons-httpclient-3.1-16.el7_0.src.rpm noarch: jakarta-commons-httpclient-3.1-16.el7_0.noarch.rpm Red Hat Enterprise Linux Server Optional (v. 7): Source: jakarta-commons-httpclient-3.1-16.el7_0.src.rpm noarch: jakarta-commons-httpclient-3.1-16.el7_0.noarch.rpm jakarta-commons-httpclient-demo-3.1-16.el7_0.noarch.rpm jakarta-commons-httpclient-javadoc-3.1-16.el7_0.noarch.rpm jakarta-commons-httpclient-manual-3.1-16.el7_0.noarch.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: jakarta-commons-httpclient-3.1-16.el7_0.src.rpm noarch: jakarta-commons-httpclient-3.1-16.el7_0.noarch.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): noarch: jakarta-commons-httpclient-demo-3.1-16.el7_0.noarch.rpm jakarta-commons-httpclient-javadoc-3.1-16.el7_0.noarch.rpm jakarta-commons-httpclient-manual-3.1-16.el7_0.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key#package 7. References: https://access.redhat.com/security/cve/CVE-2014-3577 https://access.redhat.com/security/updates/classification#important https://access.redhat.com/solutions/1165533 8. Contact: The Red Hat security contact is . More contact details athttps://access.redhat.com/security/team/contact Copyright 2014 Red Hat, Inc. . Uncover the essential Jakarta Commons HttpClient security update notice pertinent to Red Hat Linux, outlining potential repercussions and remedial actions.. jakarta commons httpclient, red hat advisory, httpclient update, ssl server spoofing threat. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Sep 08, 2014 •Important Red Hat
87
Ls Advisories Debian Esm H240
Price Tag%201security advisorysecurity issuedebian

Debian: DSA-2738-1 Critical: Ruby1.9.1 Remote SSL Spoofing, DoS

Several vulnerabilities have been discovered in the interpreter for the Ruby language, which may lead to denial of service and other security problems. The Common Vulnerabilities and Exposures project identifies the following problems: . - ------------------------------------------------------------------------- Debian Security Advisory DSA-2738-1 This email address is being protected from spambots. You need JavaScript enabled to view it. http://www.debian.org/security/ Thijs Kinkhorst August 18, 2013 http://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : ruby1.9.1 Vulnerability : several Problem type : remote Debian-specific: no CVE ID : CVE-2013-1821 CVE-2013-4073 Debian Bug : 702525 714543 Several vulnerabilities have been discovered in the interpreter for the Ruby language, which may lead to denial of service and other security problems. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2013-1821 Ben Murphy discovered that unrestricted entity expansion in REXML can lead to a Denial of Service by consuming all host memory. CVE-2013-4073 William (B.J.) Snow Orvis discovered a vulnerability in the hostname checking in Ruby's SSL client that could allow man-in-the-middle attackers to spoof SSL servers via valid certificate issued by a trusted certification authority. For the oldstable distribution (squeeze), these problems have been fixed in version 1.9.2.0-2+deb6u1. For the stable distribution (wheezy), these problems have been fixed in version 1.9.3.194-8.1+deb7u1. For the unstable distribution (sid), these problems have been fixed in version 1.9.3.194-8.2. We recommend that you upgrade your ruby1.9.1 packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . The latestDebian security advisory DSA-2739-1 highlights several vulnerabilities in Python and advises users to perform necessary updates to enhance security.. Debian Security Advisory,Ruby Interpreter,Denial of Service,Security Problems. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Aug 18, 2013 •Critical Debian
Banner 1 1028x280 1708121660 1771599717
99
Ls Advisories Slackware Esm H240
Price Tag%201security advisorycriticalpatch

Slackware 14.0 Critical Advisory: Ruby SSL Spoofing Threat

New ruby packages are available for Slackware 13.1, 13.37, 14.0, and -current to fix a security issue. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] ruby (SSA:2013-178-01) New ruby packages are available for Slackware 13.1, 13.37, 14.0, and -current to fix a security issue. Here are the details from the Slackware 14.0 ChangeLog: +--------------------------+ patches/packages/ruby-1.9.3_p448-i486-1_slack14.0.txz: Upgraded. This update patches a vulnerability in Ruby's SSL client that could allow man-in-the-middle attackers to spoof SSL servers via a valid certificate issued by a trusted certification authority. For more information, see: https://www.ruby-lang.org/en/news/2013/06/27/hostname-check-bypassing-vulnerability-in-openssl-client-cve-2013-4073/ https://www.cve.org/CVERecord?id=CVE-2013-4073 (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ Thanks to the friendly folks at the OSU Open Source Lab (https://osuosl.org/) for donating FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://www.slackware.com/ for additional mirror sites near you. Updated package for Slackware 13.1: Updated package for Slackware x86_64 13.1: Updated package for Slackware 13.37: Updated package for Slackware x86_64 13.37: Updated package for Slackware 14.0: Updated package for Slackware x86_64 14.0: Updated package for Slackware -current: Updated package for Slackware x86_64 -current: MD5 signatures: +-------------+ Slackware 13.1 package: ed7eaa7fdb9ee08dd69e444a6c2c23d8 ruby-1.9.3_p448-i486-1_slack13.1.txz Slackware x86_64 13.1 package: 163e6c7d99abb43725d37c6ff16681ce ruby-1.9.3_p448-x86_64-1_slack13.1.txz Slackware 13.37 package: 3c23d63e4e8dcdd3465f63f38cb05663 ruby-1.9.3_p448-i486-1_slack13.37.txz Slackware x86_64 13.37 package: c7cb042a91dbe0882366b73bf2025ee0 ruby-1.9.3_p448-x86_64-1_slack13.37.txz Slackware 14.0package: dfb8718508b9dca9ce1b56c2fd90d3fd ruby-1.9.3_p448-i486-1_slack14.0.txz Slackware x86_64 14.0 package: 7ec70f13351a8ccd31f8d61169a453d1 ruby-1.9.3_p448-x86_64-1_slack14.0.txz Slackware -current package: 06a4826e83382f0c722855bea37f766a d/ruby-1.9.3_p448-i486-1.txz Slackware x86_64 -current package: 13fe939b565e81fe4a57ddbdf8217286 d/ruby-1.9.3_p448-x86_64-1.txz Installation instructions: +------------------------+ Upgrade the package as root: # upgradepkg ruby-1.9.3_p448-i486-1_slack14.0.txz +-----+ . Recent updates in Ruby libraries have been released for Slackware to tackle a significant vulnerability concerning SSL client capabilities.. Slackware Ruby Update, SSL Patch, Open Source Security Fix. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Jun 28, 2013 •Critical Slackware
91
Ls Advisories Gentoo Esm H240
Price Tag%201security advisorygentooman-in-the-middle

Gentoo: GLSA-201210-01 Addresses w3m SSL Spoofing Vulnerability

An error in the hostname matching of w3m might enable remote attackers to conduct man-in-the-middle attacks.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201210-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: w3m: SSL spoofing vulnerability Date: October 18, 2012 Bugs: #325431 ID: 201210-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= An error in the hostname matching of w3m might enable remote attackersto conduct man-in-the-middle attacks. Background ========= w3m is a text based WWW browser. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 www-client/w3m < 0.5.2-r4 > = 0.5.2-r4 Description ========== A SSL spoofing vulnerability has been discovered in w3m. Please review the CVE identifier referenced below for details. Impact ===== A remote attacker might employ a specially crafted certificate to conduct man-in-the-middle attacks on SSL connections made using w3m. Workaround ========= There is no known workaround at this time. Resolution ========= All w3m users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =www-client/w3m-0.5.2-r4" References ========= [ 1 ] CVE-2010-2074 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2074 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201210-01 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuringthe confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to This email address is being protected from spambots. You need JavaScript enabled to view it. or alternatively, you may file a bug at https://bugs.gentoo.org. License ====== Copyright 2012 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5/ . w3m security flaw could facilitate man-in-the-middle exploits. Update software to mitigate potential remote threats.. SSL Spoofing, w3m Attack, Gentoo Security Advisory. . LinuxSecurity.com Team

Calendar%202 Oct 18, 2012 Gentoo
Banner 1 1028x280 1708121660 1771599717
News Add Esm H240

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

More Polls

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":1,"type":"x","order":4,"pct":100,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200

Search Topics