Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -4 articles for you...
202
security advisorymoderatepatchopenSUSE Leap 15.1: 2020:0731-1 Moderate: libxslt Information Disclosure
An update that fixes three vulnerabilities is now available.. openSUSE Security Update: Security update for libxslt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2020:0731-1 Rating: moderate References: #1140095 #1140101 #1154609 Cross-References: CVE-2019-13117 CVE-2019-13118 CVE-2019-18197 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for libxslt fixes the following issues: Security issues fixed: - CVE-2019-13118: Fixed a read of uninitialized stack data (bsc#1140101). - CVE-2019-13117: Fixed a uninitialized read which allowed to discern whether a byte on the stack contains certain special characters (bsc#1140095). - CVE-2019-18197: Fixed a dangling pointer in xsltCopyText which may have led to information disclosure (bsc#1154609). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-731=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libxslt-debugsource-1.1.32-lp151.3.6.1 libxslt-devel-1.1.32-lp151.3.6.1 libxslt-tools-1.1.32-lp151.3.6.1 libxslt-tools-debuginfo-1.1.32-lp151.3.6.1 libxslt1-1.1.32-lp151.3.6.1 libxslt1-debuginfo-1.1.32-lp151.3.6.1 - openSUSE Leap 15.1 (x86_64): libxslt-devel-32bit-1.1.32-lp151.3.6.1 libxslt-python-1.1.32-lp151.3.6.1 libxslt-python-debuginfo-1.1.32-lp151.3.6.1 libxslt-python-debugsource-1.1.32-lp151.3.6.1 libxslt1-32bit-1.1.32-lp151.3.6.1 libxslt1-32bit-debuginfo-1.1.32-lp151.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-13117.html https://www.suse.com/security/cve/CVE-2019-13118.html https://www.suse.com/security/cve/CVE-2019-18197.html https://bugzilla.suse.com/1140095 https://bugzilla.suse.com/1140101 https://bugzilla.suse.com/1154609 -- . Patch addresses critical security flaws in libxslt for openSUSE. Apply fixes through standard security protocols to safeguard your system.. openSUSE Update, libxslt Security, Moderate Vulnerability, Patch Instructions. . LinuxSecurity.com Team
May 28, 2020
OpenSUSE
203
security advisorylibxsltuninitialized readMageia: 2019-0313 moderate: libxslt security update for stack exposure
Updated libxslt package fixes security vulnerabilities: * In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains . MGASA-2019-0313 - Updated libxslt packages fix security vulnerabilities Publication date: 02 Nov 2019 URL: https://advisories.mageia.org/MGASA-2019-0313.html Type: security Affected Mageia releases: 7 CVE: CVE-2019-13117, CVE-2019-13118, CVE-2019-18197 Updated libxslt package fixes security vulnerabilities: * In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character (CVE-2019-13117). * In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data (CVE-2019-13118). * In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed (CVE-2019-18197). References: - https://bugs.mageia.org/show_bug.cgi?id=25643 - https://ubuntu.com/security/notices/USN-4164-1 - https://www.cve.org/CVERecord?id=CVE-2019-13117 - https://www.cve.org/CVERecord?id=CVE-2019-13118 - https://www.cve.org/CVERecord?id=CVE-2019-18197 SRPMS: - 7/core/libxslt-1.1.33-2.1.mga7 . The latest libxslt update for Mageia resolves various security vulnerabilities, specifically targeting potential stack memory leakage concerns within the libxslt library.. libxslt update, security advisory, Mageia packages,stack memory. . LinuxSecurity.com Team
Nov 02, 2019
Mageia
89
security advisorybuffer overflowsoftware updateFedora 31: libxslt FEDORA-2019-fdf6ec39b4 critical: uninitialized read fix
Fixes for CVE-2019-13117, CVE-2019-13118. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2019-fdf6ec39b4 2019-10-29 01:27:04.178638 --------------------------------------------------------------------------------Name : libxslt Product : Fedora 31 Version : 1.1.33 Release : 4.fc31 URL : Summary : Library providing the Gnome XSLT engine Description : This C library allows to transform XML files into other XML files (or HTML, text, ...) using the standard XSLT stylesheet transformation mechanism. To use it you need to have a version of libxml2 > = 2.6.27 installed. The xsltproc command is a command line interface to the XSLT engine --------------------------------------------------------------------------------Update Information: Fixes for CVE-2019-13117, CVE-2019-13118 --------------------------------------------------------------------------------ChangeLog: * Fri Oct 11 2019 Jakub Jelen - 1.1.33-4 - Do not build python bindings even if the python is available - Fix CVE-2019-13117 (#1728547) - Fix CVE-2019-13118 (#1728542) * Tue Sep 10 2019 Richard W.M. Jones - 1.1.33-3 - Comment out Python bindings until upstream can convert them to Python 3. --------------------------------------------------------------------------------References: [ 1 ] Bug #1728546 - CVE-2019-13117 libxslt: an xsl number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers https://bugzilla.redhat.com/show_bug.cgi?id=1728546 [ 2 ] Bug #1728541 - CVE-2019-13118 libxslt: read of uninitialized stack data due to too narrow xsl:number instruction and an invalid character https://bugzilla.redhat.com/show_bug.cgi?id=1728541 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2019-fdf6ec39b4' at the command line. For moreinformation, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Oct 28, 2019
•Critical
Fedora
100
security advisorymoderatesoftware updateSUSE: 2019:1867-1 Moderate: Security Update for libxslt
An update that fixes two vulnerabilities is now available. . SUSE Security Update: Security update for libxslt ______________________________________________________________________________ Announcement ID: SUSE-SU-2019:1867-1 Rating: moderate References: #1140095 #1140101 Cross-References: CVE-2019-13117 CVE-2019-13118 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP4 SUSE Linux Enterprise Server 12-SP4 SUSE Linux Enterprise Desktop 12-SP4 SUSE CaaS Platform 3.0 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libxslt fixes the following issues: Security issues fixed: - CVE-2019-13118: Fixed a read of uninitialized stack data (bsc#1140101). - CVE-2019-13117: Fixed a uninitialized read which allowed to discern whether a byte on the stack contains certain special characters (bsc#1140095). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP4: zypper in -t patch SUSE-SLE-SDK-12-SP4-2019-1867=1 - SUSE Linux Enterprise Server 12-SP4: zypper in -t patch SUSE-SLE-SERVER-12-SP4-2019-1867=1 - SUSE Linux Enterprise Desktop 12-SP4: zypper in -t patch SUSE-SLE-DESKTOP-12-SP4-2019-1867=1 - SUSE CaaS Platform 3.0: To install this update, use the SUSE CaaS Platform Velum dashboard. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. Package List: - SUSE Linux Enterprise Software Development Kit 12-SP4 (aarch64 ppc64le s390x x86_64): libxslt-debugsource-1.1.28-17.6.1 libxslt-devel-1.1.28-17.6.1 - SUSE Linux Enterprise Server 12-SP4 (aarch64 ppc64le s390x x86_64): libxslt-debugsource-1.1.28-17.6.1 libxslt-tools-1.1.28-17.6.1 libxslt-tools-debuginfo-1.1.28-17.6.1 libxslt1-1.1.28-17.6.1 libxslt1-debuginfo-1.1.28-17.6.1 - SUSE Linux Enterprise Server 12-SP4 (s390x x86_64): libxslt1-32bit-1.1.28-17.6.1 libxslt1-debuginfo-32bit-1.1.28-17.6.1 - SUSE Linux Enterprise Desktop 12-SP4 (x86_64): libxslt-debugsource-1.1.28-17.6.1 libxslt-tools-1.1.28-17.6.1 libxslt-tools-debuginfo-1.1.28-17.6.1 libxslt1-1.1.28-17.6.1 libxslt1-32bit-1.1.28-17.6.1 libxslt1-debuginfo-1.1.28-17.6.1 libxslt1-debuginfo-32bit-1.1.28-17.6.1 - SUSE CaaS Platform 3.0 (x86_64): libxslt1-1.1.28-17.6.1 libxslt1-debuginfo-1.1.28-17.6.1 References: https://www.suse.com/security/cve/CVE-2019-13117.html https://www.suse.com/security/cve/CVE-2019-13118.html https://bugzilla.suse.com/1140095 https://bugzilla.suse.com/1140101 _______________________________________________ sle-security-updates mailing list
Jul 17, 2019
SuSE
99
security advisorycriticalslackwareSlackware 13.37: SSA:2011-210-01 Critical Libpng Uninitialized Read
New libpng packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, 12.1, 12.2, 13.0, 13.1, 13.37, and -current to fix security issues. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] libpng (SSA:2011-210-01) New libpng packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, 12.1, 12.2, 13.0, 13.1, 13.37, and -current to fix security issues. Here are the details from the Slackware 13.37 ChangeLog: +--------------------------+ patches/packages/libpng-1.4.8-i486-1_slack13.37.txz: Upgraded. Fixed uninitialized memory read in png_format_buffer() (Bug report by Frank Busse, related to CVE-2004-0421). For more information, see: https://www.cve.org/CVERecord?id=CVE-2011-0421 (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ Thanks to the friendly folks at the OSU Open Source Lab (https://osuosl.org/) for donating FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://www.slackware.com/ for additional mirror sites near you. Updated package for Slackware 8.1: Updated package for Slackware 9.0: Updated package for Slackware 9.1: Updated package for Slackware 10.0: Updated package for Slackware 10.1: Updated package for Slackware 10.2: Updated package for Slackware 11.0: Updated package for Slackware 12.0: Updated package for Slackware 12.1: Updated package for Slackware 12.2: Updated package for Slackware 13.0: Updated package for Slackware x86_64 13.0: Updated package for Slackware 13.1: Updated package for Slackware x86_64 13.1: Updated package for Slackware 13.37: Updated package for Slackware x86_64 13.37: Updated package for Slackware -current: Updated package for Slackware x86_64 -current: MD5 signatures: +-------------+ Slackware 8.1 package: ad0f8dc2b0b9269c342a0d61bd007c5e libpng-1.2.46-i386-1_slack8.1.tgz Slackware 9.0 package: 365bea389c02fdc3b920b36b1f5f5a4d libpng-1.2.46-i386-1_slack9.0.tgz Slackware 9.1 package: b96cf4fb882decd82bba233b615df3ba libpng-1.2.46-i486-1_slack9.1.tgz Slackware 10.0 package: 64b11f971f7379ed0af5dc766daf2dd4 libpng-1.2.46-i486-1_slack10.0.tgz Slackware 10.1 package: 13927173b5ecc4a33a0290363e4e53cd libpng-1.2.46-i486-1_slack10.1.tgz Slackware 10.2 package: b32cb1ee9694579a42e47128323b0412 libpng-1.2.46-i486-1_slack10.2.tgz Slackware 11.0 package: bc0efc812d8b1a52bb5c480a5b2f9200 libpng-1.2.46-i486-1_slack11.0.tgz Slackware 12.0 package: c4fb87f7ecf7aebcd380765d25d0f751 libpng-1.2.46-i486-1_slack12.0.tgz Slackware 12.1 package: 8f1d8ec6a325c95725b3740dbd41c311 libpng-1.2.46-i486-1_slack12.1.tgz Slackware 12.2 package: c846762291145276057dad5c58bb2f89 libpng-1.2.46-i486-1_slack12.2.tgz Slackware 13.0 package: e0bc86aa7eeed92f8f8734efa0b54483 libpng-1.2.46-i486-1_slack13.0.txz Slackware x86_64 13.0 package: 3d2a8eb7474420519c947f666635ece8 libpng-1.2.46-x86_64-1_slack13.0.txz Slackware 13.1 package: 406d411805cf2f99c567c97f53bce69b libpng-1.4.8-i486-1_slack13.1.txz Slackware x86_64 13.1 package: 972fb84c00c4a0d7ab9134f6e65c657f libpng-1.4.8-x86_64-1_slack13.1.txz Slackware 13.37 package: a323c2d1ff04054ec8423710200c7682 libpng-1.4.8-i486-1_slack13.37.txz Slackware x86_64 13.37 package: a56d0776e600625505cc12e6853c50cc libpng-1.4.8-x86_64-1_slack13.37.txz Slackware -current package: ebf0f61c96738b840afa104e6ed3a71f libpng-1.4.8-i486-1.txz Slackware x86_64 -current package: c3ea775b59fde83c9e65a1d9648945c9 libpng-1.4.8-x86_64-1.txz Installation instructions: +------------------------+ Upgrade the packages as root: # upgradepkg libpng-1.4.8-i486-1_slack13.37.txz +-----+ . Updated libpng distributions target security flaws impacting multiple Slackware iterations uniformly.. libpng packages, slackware security, package update. . Severity: Critical. LinuxSecurity.com Team
Jul 29, 2011
•Critical
Slackware
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!