Alerts This Week
Warning Icon 1 609
Alerts This Week
Warning Icon 1 609

Stay Secure with the Latest Linux Advisories

Filter Icon Refine advisories
X Clear Filters
X Clear Filters
View More

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

What got you started with Linux?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/150-what-got-you-started-with-linux?task=poll.vote&format=json
150
radio
0
[{"id":483,"title":"Self-taught through trial and error","votes":545,"type":"x","order":1,"pct":78.42,"resources":[]},{"id":484,"title":"Formal training or courses","votes":30,"type":"x","order":2,"pct":4.32,"resources":[]},{"id":485,"title":"A job that required it","votes":34,"type":"x","order":3,"pct":4.89,"resources":[]},{"id":486,"title":"Other","votes":86,"type":"x","order":4,"pct":12.37,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Loading...

Explore Latest Linux Security advisories

We found -5 articles for you...
219

Rocky Linux 8 RLSA-2022:267 Important: Polkit Security Update

Important: polkit security update. \{'type': 'Security', 'shortCode': 'RL', 'name': 'RLSA-2022:267', 'synopsis': 'Important: polkit security update', 'severity': 'Important', 'topic': 'An update for polkit is now available for Rocky Linux 8.\nRocky Linux Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.', 'description': 'The polkit packages provide a component for controlling system-wide privileges. This component provides a uniform and organized way for non-privileged processes to communicate with privileged ones.\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.', 'solution': None, 'affectedProducts': ['Rocky Linux 8'], 'fixes': ['2025869'], 'cves': ['Red Hat:::https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-4034.json:::CVE-2021-4034'], 'references': [], 'publishedAt': '2022-01-26T21:26:22.592494Z', 'rpms': ['polkit-0.115-13.el8_5.1.aarch64.rpm', 'polkit-0.115-13.el8_5.1.src.rpm', 'polkit-0.115-13.el8_5.1.x86_64.rpm', 'polkit-debuginfo-0.115-13.el8_5.1.aarch64.rpm', 'polkit-debuginfo-0.115-13.el8_5.1.i686.rpm', 'polkit-debuginfo-0.115-13.el8_5.1.x86_64.rpm', 'polkit-debugsource-0.115-13.el8_5.1.aarch64.rpm', 'polkit-debugsource-0.115-13.el8_5.1.i686.rpm', 'polkit-debugsource-0.115-13.el8_5.1.x86_64.rpm', 'polkit-devel-0.115-13.el8_5.1.aarch64.rpm', 'polkit-devel-0.115-13.el8_5.1.i686.rpm', 'polkit-devel-0.115-13.el8_5.1.x86_64.rpm', 'polkit-docs-0.115-13.el8_5.1.noarch.rpm', 'polkit-libs-0.115-13.el8_5.1.aarch64.rpm', 'polkit-libs-0.115-13.el8_5.1.i686.rpm', 'polkit-libs-0.115-13.el8_5.1.x86_64.rpm', 'polkit-libs-debuginfo-0.115-13.el8_5.1.aarch64.rpm', 'polkit-libs-debuginfo-0.115-13.el8_5.1.i686.rpm','polkit-libs-debuginfo-0.115-13.el8_5.1.x86_64.rpm']}\. CentOS Stream unveils a crucial patch for systemd, tackling operational vulnerabilities and introducing enhancements.. Rocky Linux, polkit, security update, privilege management, system permissions. . Severity: Important. LinuxSecurity.com Team

Calendar 2 Sep 02, 2022 Important Rocky Linux
98

Red Hat Enterprise 8.1: RHSA-2021-2236-01 Important Polkit Local Escalation

An update for polkit is now available for Red Hat Enterprise Linux 8.1 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: polkit security update Advisory ID: RHSA-2021:2236-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:2236 Issue date: 2021-06-03 CVE Names: CVE-2021-3560 ==================================================================== 1. Summary: An update for polkit is now available for Red Hat Enterprise Linux 8.1 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux BaseOS EUS (v. 8.1) - aarch64, noarch, ppc64le, s390x, x86_64 3. Description: The polkit packages provide a component for controlling system-wide privileges. This component provides a uniform and organized way for non-privileged processes to communicate with privileged ones. Security Fix(es): * polkit: local privilege escalation using polkit_system_bus_name_get_creds_sync() (CVE-2021-3560) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1961710 - CVE-2021-3560 polkit: local privilege escalation usingpolkit_system_bus_name_get_creds_sync() 6. Package List: Red Hat Enterprise Linux BaseOS EUS (v. 8.1): Source: polkit-0.115-9.el8_1.1.src.rpm aarch64: polkit-0.115-9.el8_1.1.aarch64.rpm polkit-debuginfo-0.115-9.el8_1.1.aarch64.rpm polkit-debugsource-0.115-9.el8_1.1.aarch64.rpm polkit-devel-0.115-9.el8_1.1.aarch64.rpm polkit-libs-0.115-9.el8_1.1.aarch64.rpm polkit-libs-debuginfo-0.115-9.el8_1.1.aarch64.rpm noarch: polkit-docs-0.115-9.el8_1.1.noarch.rpm ppc64le: polkit-0.115-9.el8_1.1.ppc64le.rpm polkit-debuginfo-0.115-9.el8_1.1.ppc64le.rpm polkit-debugsource-0.115-9.el8_1.1.ppc64le.rpm polkit-devel-0.115-9.el8_1.1.ppc64le.rpm polkit-libs-0.115-9.el8_1.1.ppc64le.rpm polkit-libs-debuginfo-0.115-9.el8_1.1.ppc64le.rpm s390x: polkit-0.115-9.el8_1.1.s390x.rpm polkit-debuginfo-0.115-9.el8_1.1.s390x.rpm polkit-debugsource-0.115-9.el8_1.1.s390x.rpm polkit-devel-0.115-9.el8_1.1.s390x.rpm polkit-libs-0.115-9.el8_1.1.s390x.rpm polkit-libs-debuginfo-0.115-9.el8_1.1.s390x.rpm x86_64: polkit-0.115-9.el8_1.1.x86_64.rpm polkit-debuginfo-0.115-9.el8_1.1.i686.rpm polkit-debuginfo-0.115-9.el8_1.1.x86_64.rpm polkit-debugsource-0.115-9.el8_1.1.i686.rpm polkit-debugsource-0.115-9.el8_1.1.x86_64.rpm polkit-devel-0.115-9.el8_1.1.i686.rpm polkit-devel-0.115-9.el8_1.1.x86_64.rpm polkit-libs-0.115-9.el8_1.1.i686.rpm polkit-libs-0.115-9.el8_1.1.x86_64.rpm polkit-libs-debuginfo-0.115-9.el8_1.1.i686.rpm polkit-libs-debuginfo-0.115-9.el8_1.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2021-3560 https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBYLiqEtzjgjWX9erEAQgpRw//aH+YvfC6BfsjJjIATE9H186vpmfz0sbt rqCjLnfM5kaFXPFMs0o9t4GA1tX8EH63DBN3DJLj1NMhC9mqaQR8g77mJPSmGtZd 6W/YyMjozQDQjI9a4pGqZ8uKHRe5Ul3Bz8vc0Tw4xKDcd3f+y7k4TY6GYiHPowTH gzZMw/HSRqal4mKiHis3JjqNBe/he5R9TYvOhyeLcBzf7jneNYVLPVIqe7gqc8CD d1sAdb3Gab7nil9q3n37pB72HTKRwefVXwpsfcZ0CjtLIT5WFAbtfq5hz8T9DEbI n1Wf613EnkOCasCVeBf81ZJPYlj3SDeqd/LhfoKQwZi/If8t3OurmiDEvjZ3xazi N4li+vI2fUkouYjG/byVLMBVGnkSm3+9AXIGy/7rcfTNpZUvXlDNycw+ldB7Jzsz gF9EFiQz3jOU2Qi/xOxvdnmOV9W2G3ozFmTNJXFEuZrwODrIxBnuziGNHqffk2un uubY+aJGBZ+0r7DoS542mEc2oWW899au9UtGB9Ds0nOaLRNwR+YJmJAQkwRiXEYp kzArNIPYMwisdeBTNj3ZuLzo3oMZ+CBsOjA2TSel5QoPwdOh+YH09W6TcNsmWApd XjFEYnhxSAonm6dw+Jkt+VRwjHRVIpQgU5xUqk2fk/sFS6/puJR5KxcGI29M6qm/ 7X6ulojVW68=0UrL -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. https://listman.redhat.com/mailman/listinfo/rhsa-announce . Ubuntu unveils a vital security patch for dbus to mitigate potential local privilege escalation vulnerabilities. Safeguard your system immediately.. polkit update, Red Hat Enterprise security, local attack risk. . Severity: Important. LinuxSecurity.com Team

Calendar 2 Jun 03, 2021 Important Red Hat
98

Red Hat Enterprise Linux 6 & 7: RHSA-2016-2872-01 Moderate Sudo Threat

An update for sudo is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: sudo security update Advisory ID: RHSA-2016:2872-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2016:2872.html Issue date: 2016-12-06 CVE Names: CVE-2016-7032 CVE-2016-7076 ==================================================================== 1. Summary: An update for sudo is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server (v. 7) - aarch64, ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - aarch64, ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation (v.7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 3. Description: The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root. Security Fix(es): * It was discovered that the sudo noexec restriction could have been bypassed if application run via sudo executed system(), popen(), or wordexp() C library functions with a user supplied argument. A local user permitted to run such application via sudo with noexec restriction could use these flaws to execute arbitrary commands with elevated privileges. (CVE-2016-7032, CVE-2016-7076) These issues were discovered by Florian Weimer (Red Hat). 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1372830 - CVE-2016-7032 sudo: noexec bypass via system() and popen() 1384982 - CVE-2016-7076 sudo: noexec bypass via wordexp() 6. Package List: Red Hat Enterprise Linux Desktop (v. 6): Source: sudo-1.8.6p3-25.el6_8.src.rpm i386: sudo-1.8.6p3-25.el6_8.i686.rpm sudo-debuginfo-1.8.6p3-25.el6_8.i686.rpm x86_64: sudo-1.8.6p3-25.el6_8.x86_64.rpm sudo-debuginfo-1.8.6p3-25.el6_8.x86_64.rpm Red Hat Enterprise Linux Desktop Optional (v. 6): i386: sudo-debuginfo-1.8.6p3-25.el6_8.i686.rpm sudo-devel-1.8.6p3-25.el6_8.i686.rpm x86_64: sudo-debuginfo-1.8.6p3-25.el6_8.i686.rpm sudo-debuginfo-1.8.6p3-25.el6_8.x86_64.rpm sudo-devel-1.8.6p3-25.el6_8.i686.rpm sudo-devel-1.8.6p3-25.el6_8.x86_64.rpm Red Hat Enterprise Linux HPC Node (v. 6): Source: sudo-1.8.6p3-25.el6_8.src.rpm x86_64: sudo-1.8.6p3-25.el6_8.x86_64.rpm sudo-debuginfo-1.8.6p3-25.el6_8.x86_64.rpm Red Hat Enterprise Linux HPC Node Optional (v.6): x86_64: sudo-debuginfo-1.8.6p3-25.el6_8.i686.rpm sudo-debuginfo-1.8.6p3-25.el6_8.x86_64.rpm sudo-devel-1.8.6p3-25.el6_8.i686.rpm sudo-devel-1.8.6p3-25.el6_8.x86_64.rpm Red Hat Enterprise Linux Server (v. 6): Source: sudo-1.8.6p3-25.el6_8.src.rpm i386: sudo-1.8.6p3-25.el6_8.i686.rpm sudo-debuginfo-1.8.6p3-25.el6_8.i686.rpm ppc64: sudo-1.8.6p3-25.el6_8.ppc64.rpm sudo-debuginfo-1.8.6p3-25.el6_8.ppc64.rpm s390x: sudo-1.8.6p3-25.el6_8.s390x.rpm sudo-debuginfo-1.8.6p3-25.el6_8.s390x.rpm x86_64: sudo-1.8.6p3-25.el6_8.x86_64.rpm sudo-debuginfo-1.8.6p3-25.el6_8.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 6): i386: sudo-debuginfo-1.8.6p3-25.el6_8.i686.rpm sudo-devel-1.8.6p3-25.el6_8.i686.rpm ppc64: sudo-debuginfo-1.8.6p3-25.el6_8.ppc.rpm sudo-debuginfo-1.8.6p3-25.el6_8.ppc64.rpm sudo-devel-1.8.6p3-25.el6_8.ppc.rpm sudo-devel-1.8.6p3-25.el6_8.ppc64.rpm s390x: sudo-debuginfo-1.8.6p3-25.el6_8.s390.rpm sudo-debuginfo-1.8.6p3-25.el6_8.s390x.rpm sudo-devel-1.8.6p3-25.el6_8.s390.rpm sudo-devel-1.8.6p3-25.el6_8.s390x.rpm x86_64: sudo-debuginfo-1.8.6p3-25.el6_8.i686.rpm sudo-debuginfo-1.8.6p3-25.el6_8.x86_64.rpm sudo-devel-1.8.6p3-25.el6_8.i686.rpm sudo-devel-1.8.6p3-25.el6_8.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: sudo-1.8.6p3-25.el6_8.src.rpm i386: sudo-1.8.6p3-25.el6_8.i686.rpm sudo-debuginfo-1.8.6p3-25.el6_8.i686.rpm x86_64: sudo-1.8.6p3-25.el6_8.x86_64.rpm sudo-debuginfo-1.8.6p3-25.el6_8.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 6): i386: sudo-debuginfo-1.8.6p3-25.el6_8.i686.rpm sudo-devel-1.8.6p3-25.el6_8.i686.rpm x86_64: sudo-debuginfo-1.8.6p3-25.el6_8.i686.rpm sudo-debuginfo-1.8.6p3-25.el6_8.x86_64.rpm sudo-devel-1.8.6p3-25.el6_8.i686.rpm sudo-devel-1.8.6p3-25.el6_8.x86_64.rpm Red Hat Enterprise Linux Client (v. 7): Source: sudo-1.8.6p7-21.el7_3.src.rpm x86_64: sudo-1.8.6p7-21.el7_3.x86_64.rpm sudo-debuginfo-1.8.6p7-21.el7_3.x86_64.rpm Red Hat Enterprise Linux Client Optional (v.7): x86_64: sudo-debuginfo-1.8.6p7-21.el7_3.i686.rpm sudo-debuginfo-1.8.6p7-21.el7_3.x86_64.rpm sudo-devel-1.8.6p7-21.el7_3.i686.rpm sudo-devel-1.8.6p7-21.el7_3.x86_64.rpm Red Hat Enterprise Linux ComputeNode (v. 7): Source: sudo-1.8.6p7-21.el7_3.src.rpm x86_64: sudo-1.8.6p7-21.el7_3.x86_64.rpm sudo-debuginfo-1.8.6p7-21.el7_3.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): x86_64: sudo-debuginfo-1.8.6p7-21.el7_3.i686.rpm sudo-debuginfo-1.8.6p7-21.el7_3.x86_64.rpm sudo-devel-1.8.6p7-21.el7_3.i686.rpm sudo-devel-1.8.6p7-21.el7_3.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: sudo-1.8.6p7-21.el7_3.src.rpm aarch64: sudo-1.8.6p7-21.el7_3.aarch64.rpm sudo-debuginfo-1.8.6p7-21.el7_3.aarch64.rpm ppc64: sudo-1.8.6p7-21.el7_3.ppc64.rpm sudo-debuginfo-1.8.6p7-21.el7_3.ppc64.rpm ppc64le: sudo-1.8.6p7-21.el7_3.ppc64le.rpm sudo-debuginfo-1.8.6p7-21.el7_3.ppc64le.rpm s390x: sudo-1.8.6p7-21.el7_3.s390x.rpm sudo-debuginfo-1.8.6p7-21.el7_3.s390x.rpm x86_64: sudo-1.8.6p7-21.el7_3.x86_64.rpm sudo-debuginfo-1.8.6p7-21.el7_3.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): aarch64: sudo-debuginfo-1.8.6p7-21.el7_3.aarch64.rpm sudo-devel-1.8.6p7-21.el7_3.aarch64.rpm ppc64: sudo-debuginfo-1.8.6p7-21.el7_3.ppc.rpm sudo-debuginfo-1.8.6p7-21.el7_3.ppc64.rpm sudo-devel-1.8.6p7-21.el7_3.ppc.rpm sudo-devel-1.8.6p7-21.el7_3.ppc64.rpm ppc64le: sudo-debuginfo-1.8.6p7-21.el7_3.ppc64le.rpm sudo-devel-1.8.6p7-21.el7_3.ppc64le.rpm s390x: sudo-debuginfo-1.8.6p7-21.el7_3.s390.rpm sudo-debuginfo-1.8.6p7-21.el7_3.s390x.rpm sudo-devel-1.8.6p7-21.el7_3.s390.rpm sudo-devel-1.8.6p7-21.el7_3.s390x.rpm x86_64: sudo-debuginfo-1.8.6p7-21.el7_3.i686.rpm sudo-debuginfo-1.8.6p7-21.el7_3.x86_64.rpm sudo-devel-1.8.6p7-21.el7_3.i686.rpm sudo-devel-1.8.6p7-21.el7_3.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: sudo-1.8.6p7-21.el7_3.src.rpm x86_64: sudo-1.8.6p7-21.el7_3.x86_64.rpm sudo-debuginfo-1.8.6p7-21.el7_3.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v.7): x86_64: sudo-debuginfo-1.8.6p7-21.el7_3.i686.rpm sudo-debuginfo-1.8.6p7-21.el7_3.x86_64.rpm sudo-devel-1.8.6p7-21.el7_3.i686.rpm sudo-devel-1.8.6p7-21.el7_3.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2016-7032 https://access.redhat.com/security/cve/CVE-2016-7076 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFYRqaEXlSAg2UNWIIRAim8AJ911lHOJS+wAeB6J6uUKy67M+1j7QCaA+Bl WHJJ934ZNL7OsDrkaY4y5QE=MFFg -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . Latest security patch for sudo in RHEL 6 and 7 targets noexec circumvention vulnerabilities. Ensure timely implementation of updates.. Red Hat Security Update, Sudo Noexec Bypass, RHEL Fixes. . LinuxSecurity.com Team

Calendar 2 Dec 06, 2016 Red Hat
98

Red Hat Enterprise: RHSA-2014:0266-01 Moderate: Sudo Security Update

An updated sudo package that fixes one security issue is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: sudo security update Advisory ID: RHSA-2014:0266-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2014:0266.html Issue date: 2014-03-10 CVE Names: CVE-2014-0106 ==================================================================== 1. Summary: An updated sudo package that fixes one security issue is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 3. Description: The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root. A flaw was found in the way sudo handled its blacklist of environment variables. When the "env_reset" option was disabled, a user permitted to run certain commands via sudo could use this flaw to run such a command with one of the blacklisted environment variables set, allowing them to run an arbitrary command with the target user's privileges. (CVE-2014-0106) Note: This issue does not affect the default configuration of the sudo package as shipped with Red Hat Enterprise Linux 5. Red Hat would like to thank Todd C. Miller for reporting this issue. Upstream acknowledges Sebastien Macke as the originalreporter. All sudo users are advised to upgrade to this updated package, which contains a backported patch to correct this issue. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1071780 - CVE-2014-0106 sudo: certain environment variables not sanitized when env_reset is disabled 6. Package List: Red Hat Enterprise Linux Desktop (v. 5 client): Source: i386: sudo-1.7.2p1-29.el5_10.i386.rpm sudo-debuginfo-1.7.2p1-29.el5_10.i386.rpm x86_64: sudo-1.7.2p1-29.el5_10.x86_64.rpm sudo-debuginfo-1.7.2p1-29.el5_10.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): Source: i386: sudo-1.7.2p1-29.el5_10.i386.rpm sudo-debuginfo-1.7.2p1-29.el5_10.i386.rpm ia64: sudo-1.7.2p1-29.el5_10.ia64.rpm sudo-debuginfo-1.7.2p1-29.el5_10.ia64.rpm ppc: sudo-1.7.2p1-29.el5_10.ppc.rpm sudo-debuginfo-1.7.2p1-29.el5_10.ppc.rpm s390x: sudo-1.7.2p1-29.el5_10.s390x.rpm sudo-debuginfo-1.7.2p1-29.el5_10.s390x.rpm x86_64: sudo-1.7.2p1-29.el5_10.x86_64.rpm sudo-debuginfo-1.7.2p1-29.el5_10.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key#package 7. References: https://access.redhat.com/security/cve/CVE-2014-0106 https://access.redhat.com/security/updates/classification#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFTHeIWXlSAg2UNWIIRAh4wAKCq6u7gbYVBwdmMueHCHYmKKRCTdACeNjJO kv5Vz+HXTexNMGs3Pr3fKpE=TJ6k -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . Recent update to sudoin Red Hat Enterprise addresses a security vulnerability classified as Moderate. All users are advised to upgrade.. Red Hat, sudo, security patch, enterprise linux. . LinuxSecurity.com Team

Calendar 2 Mar 10, 2014 Red Hat
News Add Esm H240

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

What got you started with Linux?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/150-what-got-you-started-with-linux?task=poll.vote&format=json
150
radio
0
[{"id":483,"title":"Self-taught through trial and error","votes":545,"type":"x","order":1,"pct":78.42,"resources":[]},{"id":484,"title":"Formal training or courses","votes":30,"type":"x","order":2,"pct":4.32,"resources":[]},{"id":485,"title":"A job that required it","votes":34,"type":"x","order":3,"pct":4.89,"resources":[]},{"id":486,"title":"Other","votes":86,"type":"x","order":4,"pct":12.37,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Your message here