Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -3 articles for you...
100
security advisorysecurity issueimportantSUSE: 2023:3024-1 Important Security Update for SUSE Registry Container
The container suse/registry was updated. The following patches have been included in this update:. SUSE Container Update Advisory: suse/registry ----------------------------------------------------------------- Container Advisory ID : SUSE-CU-2023:3024-1 Container Tags : suse/registry:2.8 , suse/registry:2.8-14.24 , suse/registry:latest Container Release : 14.24 Severity : important Type : security References : 1214052 CVE-2023-4039 ----------------------------------------------------------------- The container suse/registry was updated. The following patches have been included in this update: ----------------------------------------------------------------- Advisory ID: SUSE-SU-2023:3661-1 Released: Mon Sep 18 21:44:09 2023 Summary: Security update for gcc12 Type: security Severity: important References: 1214052,CVE-2023-4039 This update for gcc12 fixes the following issues: - CVE-2023-4039: Fixed incorrect stack protector for C99 VLAs on Aarch64 (bsc#1214052). The following package changes have been done: - libgcc_s1-12.3.0+git1204-150000.1.16.1 updated - libstdc++6-12.3.0+git1204-150000.1.16.1 updated - container:micro-image-15.5.0-11.4 updated . Red Hat's recent patch for redhat/registry fixes existing bugs and fortifies security in the container image.. SUSE Container Update, Security Advisory, Patches, Container Security, Update Guidance. . Severity: Important. LinuxSecurity.com Team
Sep 19, 2023
•Important
SuSE
98
security advisorysecurity issuered hatRed Hat: 2015:1242-01 Critical: Java Update Affects Multiple Platforms
Updated java-1.7.0-oracle packages that fix several security issues are now available for Oracle Java for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Critical security [More...]. ==================================================================== Red Hat Security Advisory Synopsis: Critical: java-1.7.0-oracle security update Advisory ID: RHSA-2015:1242-01 Product: Oracle Java for Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2015:1242.html Issue date: 2015-07-17 CVE Names: CVE-2015-2590 CVE-2015-2596 CVE-2015-2601 CVE-2015-2613 CVE-2015-2619 CVE-2015-2621 CVE-2015-2625 CVE-2015-2627 CVE-2015-2628 CVE-2015-2632 CVE-2015-2637 CVE-2015-2638 CVE-2015-2664 CVE-2015-2808 CVE-2015-4000 CVE-2015-4729 CVE-2015-4731 CVE-2015-4732 CVE-2015-4733 CVE-2015-4736 CVE-2015-4748 CVE-2015-4749 CVE-2015-4760 ==================================================================== 1. Summary: Updated java-1.7.0-oracle packages that fix several security issues are now available for Oracle Java for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Oracle Java for Red Hat Enterprise Linux Client (v. 7) - x86_64 Oracle Java for Red Hat Enterprise Linux Client 5 - i386, x86_64 Oracle Java for Red Hat Enterprise Linux Compute Node (v. 7) - x86_64 Oracle Java for Red Hat Enterprise Linux Desktop 5 - i386, x86_64 Oracle Java for Red Hat Enterprise Linux Desktop 6 - i386, x86_64 Oracle Java for Red Hat Enterprise Linux HPC Node 6 - i386, x86_64 Oracle Java for Red Hat EnterpriseLinux Server (v. 7) - x86_64 Oracle Java for Red Hat Enterprise Linux Server 6 - i386, x86_64 Oracle Java for Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Oracle Java for Red Hat Enterprise Linux Workstation 6 - i386, x86_64 3. Description: Oracle Java SE version 7 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. This update fixes several vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory page, listed in the References section. (CVE-2015-2590, CVE-2015-2596, CVE-2015-2601, CVE-2015-2613, CVE-2015-2619, CVE-2015-2621, CVE-2015-2625, CVE-2015-2627, CVE-2015-2628, CVE-2015-2632, CVE-2015-2637, CVE-2015-2638, CVE-2015-2664, CVE-2015-2808, CVE-2015-4000, CVE-2015-4729, CVE-2015-4731, CVE-2015-4732, CVE-2015-4733, CVE-2015-4736, CVE-2015-4748, CVE-2015-4749, CVE-2015-4760) Note: With this update, Oracle JDK now disables RC4 TLS/SSL cipher suites by default to address the CVE-2015-2808 issue. Refer to Red Hat Bugzilla bug 1207101, linked to in the References section, for additional details about this change. Note: This update forces the TLS/SSL client implementation in Oracle JDK to reject DH key sizes below 768 bits to address the CVE-2015-4000 issue. Refer to Red Hat Bugzilla bug 1223211, linked to in the References section, for additional details about this change. All users of java-1.7.0-oracle are advised to upgrade to these updated packages, which provide Oracle Java 7 Update 85 and resolve these issues. All running instances of Oracle Java must be restarted for the update to take effect. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1207101 - CVE-2015-2808 SSL/TLS: "Invariance Weakness"vulnerability in RC4 stream cipher 1223211 - CVE-2015-4000 LOGJAM: TLS connections which support export grade DHE key-exchange are vulnerable to MITM attacks 1241965 - CVE-2015-2625 OpenJDK: name for reverse DNS lookup used in certificate identity check (JSSE, 8067694) 1242019 - CVE-2015-2601 OpenJDK: non-constant time comparisons in crypto code (JCE, 8074865) 1242232 - CVE-2015-2628 OpenJDK: IIOPInputStream type confusion vulnerability (CORBA, 8076376) 1242234 - CVE-2015-4731 OpenJDK: improper permission checks in MBeanServerInvocationHandler (JMX, 8076397) 1242240 - CVE-2015-4732 OpenJDK: insufficient context checks during object deserialization (Libraries, 8076405) 1242275 - CVE-2015-4733 OpenJDK: RemoteObjectInvocationHandler allows calling finalize() (RMI, 8076409) 1242281 - CVE-2015-4748 OpenJDK: incorrect OCSP nextUpdate checking (Libraries, 8075374) 1242372 - CVE-2015-2621 OpenJDK: incorrect code permission checks in RMIConnectionImpl (JMX, 8075853) 1242379 - CVE-2015-4749 OpenJDK: DnsClient fails to release request information after error (JNDI, 8075378) 1242394 - CVE-2015-2632 ICU: integer overflow in LETableReference verifyLength() (OpenJDK 2D, 8077520) 1242447 - CVE-2015-4760 ICU: missing boundary checks in layout engine (OpenJDK 2D, 8071715) 1242456 - CVE-2015-2613 NSS / JCE: missing EC parameter validation in ECDH_Derive() (OpenJDK JCE, 8075833) 1243139 - CVE-2015-2590 OpenJDK: deserialization issue in ObjectInputStream.readSerialData() (Libraries, 8076401) 1243283 - CVE-2015-2638 Oracle JDK: unspecified vulnerability fixed in 6u101, 7u85 and 8u51 (2D) 1243284 - CVE-2015-4736 Oracle JDK: unspecified vulnerability fixed in 7u85 and 8u51 (Deployment) 1243286 - CVE-2015-2619 Oracle JDK: unspecified vulnerability fixed in 7u85 and 8u51 (2D) 1243287 - CVE-2015-2637 Oracle JDK: unspecified vulnerability fixed in 6u101, 7u85 and 8u51 (2D) 1243288 - CVE-2015-2596 Oracle JDK: unspecified vulnerability fixed in 7u85 (Hotspot) 1243290 - CVE-2015-4729 Oracle JDK: unspecified vulnerability fixed in 7u85 and8u51 (Deployment) 1243291 - CVE-2015-2627 Oracle JDK: unspecified vulnerability fixed in 6u101, 7u85 and 8u51 (Install) 1243300 - CVE-2015-2664 Oracle JDK: unspecified vulnerability fixed in 6u101, 7u85 and 8u51 (Deployment) 6. Package List: Oracle Java for Red Hat Enterprise Linux Client 5: i386: java-1.7.0-oracle-1.7.0.85-1jpp.1.el5_11.i586.rpm java-1.7.0-oracle-devel-1.7.0.85-1jpp.1.el5_11.i586.rpm java-1.7.0-oracle-javafx-1.7.0.85-1jpp.1.el5_11.i586.rpm java-1.7.0-oracle-jdbc-1.7.0.85-1jpp.1.el5_11.i586.rpm java-1.7.0-oracle-plugin-1.7.0.85-1jpp.1.el5_11.i586.rpm java-1.7.0-oracle-src-1.7.0.85-1jpp.1.el5_11.i586.rpm x86_64: java-1.7.0-oracle-1.7.0.85-1jpp.1.el5_11.x86_64.rpm java-1.7.0-oracle-devel-1.7.0.85-1jpp.1.el5_11.x86_64.rpm java-1.7.0-oracle-javafx-1.7.0.85-1jpp.1.el5_11.x86_64.rpm java-1.7.0-oracle-jdbc-1.7.0.85-1jpp.1.el5_11.x86_64.rpm java-1.7.0-oracle-plugin-1.7.0.85-1jpp.1.el5_11.x86_64.rpm java-1.7.0-oracle-src-1.7.0.85-1jpp.1.el5_11.x86_64.rpm Oracle Java for Red Hat Enterprise Linux Desktop 5: i386: java-1.7.0-oracle-1.7.0.85-1jpp.1.el5_11.i586.rpm java-1.7.0-oracle-devel-1.7.0.85-1jpp.1.el5_11.i586.rpm java-1.7.0-oracle-javafx-1.7.0.85-1jpp.1.el5_11.i586.rpm java-1.7.0-oracle-jdbc-1.7.0.85-1jpp.1.el5_11.i586.rpm java-1.7.0-oracle-plugin-1.7.0.85-1jpp.1.el5_11.i586.rpm java-1.7.0-oracle-src-1.7.0.85-1jpp.1.el5_11.i586.rpm x86_64: java-1.7.0-oracle-1.7.0.85-1jpp.1.el5_11.x86_64.rpm java-1.7.0-oracle-devel-1.7.0.85-1jpp.1.el5_11.x86_64.rpm java-1.7.0-oracle-javafx-1.7.0.85-1jpp.1.el5_11.x86_64.rpm java-1.7.0-oracle-jdbc-1.7.0.85-1jpp.1.el5_11.x86_64.rpm java-1.7.0-oracle-plugin-1.7.0.85-1jpp.1.el5_11.x86_64.rpm java-1.7.0-oracle-src-1.7.0.85-1jpp.1.el5_11.x86_64.rpm Oracle Java for Red Hat Enterprise Linux Desktop6: i386: java-1.7.0-oracle-1.7.0.85-1jpp.2.el6_6.i686.rpm java-1.7.0-oracle-devel-1.7.0.85-1jpp.2.el6_6.i686.rpm java-1.7.0-oracle-javafx-1.7.0.85-1jpp.2.el6_6.i686.rpm java-1.7.0-oracle-jdbc-1.7.0.85-1jpp.2.el6_6.i686.rpm java-1.7.0-oracle-plugin-1.7.0.85-1jpp.2.el6_6.i686.rpm java-1.7.0-oracle-src-1.7.0.85-1jpp.2.el6_6.i686.rpm x86_64: java-1.7.0-oracle-1.7.0.85-1jpp.2.el6_6.x86_64.rpm java-1.7.0-oracle-devel-1.7.0.85-1jpp.2.el6_6.x86_64.rpm java-1.7.0-oracle-javafx-1.7.0.85-1jpp.2.el6_6.x86_64.rpm java-1.7.0-oracle-jdbc-1.7.0.85-1jpp.2.el6_6.x86_64.rpm java-1.7.0-oracle-plugin-1.7.0.85-1jpp.2.el6_6.x86_64.rpm java-1.7.0-oracle-src-1.7.0.85-1jpp.2.el6_6.x86_64.rpm Oracle Java for Red Hat Enterprise Linux HPC Node 6: i386: java-1.7.0-oracle-1.7.0.85-1jpp.2.el6_6.i686.rpm java-1.7.0-oracle-devel-1.7.0.85-1jpp.2.el6_6.i686.rpm java-1.7.0-oracle-javafx-1.7.0.85-1jpp.2.el6_6.i686.rpm java-1.7.0-oracle-jdbc-1.7.0.85-1jpp.2.el6_6.i686.rpm java-1.7.0-oracle-plugin-1.7.0.85-1jpp.2.el6_6.i686.rpm java-1.7.0-oracle-src-1.7.0.85-1jpp.2.el6_6.i686.rpm x86_64: java-1.7.0-oracle-1.7.0.85-1jpp.2.el6_6.x86_64.rpm java-1.7.0-oracle-devel-1.7.0.85-1jpp.2.el6_6.x86_64.rpm java-1.7.0-oracle-javafx-1.7.0.85-1jpp.2.el6_6.x86_64.rpm java-1.7.0-oracle-jdbc-1.7.0.85-1jpp.2.el6_6.x86_64.rpm java-1.7.0-oracle-plugin-1.7.0.85-1jpp.2.el6_6.x86_64.rpm java-1.7.0-oracle-src-1.7.0.85-1jpp.2.el6_6.x86_64.rpm Oracle Java for Red Hat Enterprise Linux Server6: i386: java-1.7.0-oracle-1.7.0.85-1jpp.2.el6_6.i686.rpm java-1.7.0-oracle-devel-1.7.0.85-1jpp.2.el6_6.i686.rpm java-1.7.0-oracle-javafx-1.7.0.85-1jpp.2.el6_6.i686.rpm java-1.7.0-oracle-jdbc-1.7.0.85-1jpp.2.el6_6.i686.rpm java-1.7.0-oracle-plugin-1.7.0.85-1jpp.2.el6_6.i686.rpm java-1.7.0-oracle-src-1.7.0.85-1jpp.2.el6_6.i686.rpm x86_64: java-1.7.0-oracle-1.7.0.85-1jpp.2.el6_6.x86_64.rpm java-1.7.0-oracle-devel-1.7.0.85-1jpp.2.el6_6.x86_64.rpm java-1.7.0-oracle-javafx-1.7.0.85-1jpp.2.el6_6.x86_64.rpm java-1.7.0-oracle-jdbc-1.7.0.85-1jpp.2.el6_6.x86_64.rpm java-1.7.0-oracle-plugin-1.7.0.85-1jpp.2.el6_6.x86_64.rpm java-1.7.0-oracle-src-1.7.0.85-1jpp.2.el6_6.x86_64.rpm Oracle Java for Red Hat Enterprise Linux Workstation 6: i386: java-1.7.0-oracle-1.7.0.85-1jpp.2.el6_6.i686.rpm java-1.7.0-oracle-devel-1.7.0.85-1jpp.2.el6_6.i686.rpm java-1.7.0-oracle-javafx-1.7.0.85-1jpp.2.el6_6.i686.rpm java-1.7.0-oracle-jdbc-1.7.0.85-1jpp.2.el6_6.i686.rpm java-1.7.0-oracle-plugin-1.7.0.85-1jpp.2.el6_6.i686.rpm java-1.7.0-oracle-src-1.7.0.85-1jpp.2.el6_6.i686.rpm x86_64: java-1.7.0-oracle-1.7.0.85-1jpp.2.el6_6.x86_64.rpm java-1.7.0-oracle-devel-1.7.0.85-1jpp.2.el6_6.x86_64.rpm java-1.7.0-oracle-javafx-1.7.0.85-1jpp.2.el6_6.x86_64.rpm java-1.7.0-oracle-jdbc-1.7.0.85-1jpp.2.el6_6.x86_64.rpm java-1.7.0-oracle-plugin-1.7.0.85-1jpp.2.el6_6.x86_64.rpm java-1.7.0-oracle-src-1.7.0.85-1jpp.2.el6_6.x86_64.rpm Oracle Java for Red Hat Enterprise Linux Client (v. 7): x86_64: java-1.7.0-oracle-1.7.0.85-1jpp.2.el7_1.i686.rpm java-1.7.0-oracle-1.7.0.85-1jpp.2.el7_1.x86_64.rpm java-1.7.0-oracle-devel-1.7.0.85-1jpp.2.el7_1.i686.rpm java-1.7.0-oracle-devel-1.7.0.85-1jpp.2.el7_1.x86_64.rpm java-1.7.0-oracle-javafx-1.7.0.85-1jpp.2.el7_1.x86_64.rpm java-1.7.0-oracle-jdbc-1.7.0.85-1jpp.2.el7_1.x86_64.rpm java-1.7.0-oracle-plugin-1.7.0.85-1jpp.2.el7_1.x86_64.rpm java-1.7.0-oracle-src-1.7.0.85-1jpp.2.el7_1.x86_64.rpm Oracle Java for Red Hat Enterprise Linux Compute Node (v.7): x86_64: java-1.7.0-oracle-1.7.0.85-1jpp.2.el7_1.i686.rpm java-1.7.0-oracle-1.7.0.85-1jpp.2.el7_1.x86_64.rpm java-1.7.0-oracle-devel-1.7.0.85-1jpp.2.el7_1.i686.rpm java-1.7.0-oracle-devel-1.7.0.85-1jpp.2.el7_1.x86_64.rpm java-1.7.0-oracle-javafx-1.7.0.85-1jpp.2.el7_1.x86_64.rpm java-1.7.0-oracle-src-1.7.0.85-1jpp.2.el7_1.x86_64.rpm Oracle Java for Red Hat Enterprise Linux Server (v. 7): x86_64: java-1.7.0-oracle-1.7.0.85-1jpp.2.el7_1.i686.rpm java-1.7.0-oracle-1.7.0.85-1jpp.2.el7_1.x86_64.rpm java-1.7.0-oracle-devel-1.7.0.85-1jpp.2.el7_1.i686.rpm java-1.7.0-oracle-devel-1.7.0.85-1jpp.2.el7_1.x86_64.rpm java-1.7.0-oracle-javafx-1.7.0.85-1jpp.2.el7_1.x86_64.rpm java-1.7.0-oracle-jdbc-1.7.0.85-1jpp.2.el7_1.x86_64.rpm java-1.7.0-oracle-plugin-1.7.0.85-1jpp.2.el7_1.x86_64.rpm java-1.7.0-oracle-src-1.7.0.85-1jpp.2.el7_1.x86_64.rpm Oracle Java for Red Hat Enterprise Linux Workstation (v. 7): x86_64: java-1.7.0-oracle-1.7.0.85-1jpp.2.el7_1.i686.rpm java-1.7.0-oracle-1.7.0.85-1jpp.2.el7_1.x86_64.rpm java-1.7.0-oracle-devel-1.7.0.85-1jpp.2.el7_1.i686.rpm java-1.7.0-oracle-devel-1.7.0.85-1jpp.2.el7_1.x86_64.rpm java-1.7.0-oracle-javafx-1.7.0.85-1jpp.2.el7_1.x86_64.rpm java-1.7.0-oracle-jdbc-1.7.0.85-1jpp.2.el7_1.x86_64.rpm java-1.7.0-oracle-plugin-1.7.0.85-1jpp.2.el7_1.x86_64.rpm java-1.7.0-oracle-src-1.7.0.85-1jpp.2.el7_1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7.References: https://access.redhat.com/security/cve/CVE-2015-2590 https://access.redhat.com/security/cve/CVE-2015-2596 https://access.redhat.com/security/cve/CVE-2015-2601 https://access.redhat.com/security/cve/CVE-2015-2613 https://access.redhat.com/security/cve/CVE-2015-2619 https://access.redhat.com/security/cve/CVE-2015-2621 https://access.redhat.com/security/cve/CVE-2015-2625 https://access.redhat.com/security/cve/CVE-2015-2627 https://access.redhat.com/security/cve/CVE-2015-2628 https://access.redhat.com/security/cve/CVE-2015-2632 https://access.redhat.com/security/cve/CVE-2015-2637 https://access.redhat.com/security/cve/CVE-2015-2638 https://access.redhat.com/security/cve/CVE-2015-2664 https://access.redhat.com/security/cve/CVE-2015-2808 https://access.redhat.com/security/cve/CVE-2015-4000 https://access.redhat.com/security/cve/CVE-2015-4729 https://access.redhat.com/security/cve/CVE-2015-4731 https://access.redhat.com/security/cve/CVE-2015-4732 https://access.redhat.com/security/cve/CVE-2015-4733 https://access.redhat.com/security/cve/CVE-2015-4736 https://access.redhat.com/security/cve/CVE-2015-4748 https://access.redhat.com/security/cve/CVE-2015-4749 https://access.redhat.com/security/cve/CVE-2015-4760 https://access.redhat.com/security/updates/classification#critical https://www.oracle.com/security-alerts/cpujul2015.html https://bugzilla.redhat.com/show_bug.cgi?id=1207101#c11 https://bugzilla.redhat.com/show_bug.cgi?id=1223211#c33 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2015 Red Hat, Inc. . Important patch released for Red Hat's java-1.7.0-oracle. Urgent upgrade advised for systems at risk.. Java Security Update, Red Hat Advisory, Critical Java Fix, Oracle Java Update. . Severity: Critical. LinuxSecurity.com Team
Jul 17, 2015
•Critical
Red Hat
98
security advisorysecurity issuered hatRed Hat Enterprise Linux 5 RHSA-2014:1243-01 Low: Automake Security Issue
An updated automake package that fixes one security issue is now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Low: automake security update Advisory ID: RHSA-2014:1243-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2014:1243.html Issue date: 2014-09-16 CVE Names: CVE-2012-3386 ==================================================================== 1. Summary: An updated automake package that fixes one security issue is now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux (v. 5 server) - noarch Red Hat Enterprise Linux Desktop Workstation (v. 5 client) - noarch 3. Description: Automake is a tool for automatically generating Makefile.in files compliant with the GNU Coding Standards. It was found that the distcheck rule in Automake-generated Makefiles made a directory world-writable when preparing source archives. If a malicious, local user could access this directory, they could execute arbitrary code with the privileges of the user running "make distcheck". (CVE-2012-3386) Red Hat would like to thank Jim Meyering for reporting this issue. Upstream acknowledges Stefano Lattarini as the original reporter. All automake users are advised to upgrade to this updated package, which contains a backported patch to correct this issue. 4. Solution: Before applying this update, make sure all previously released errata relevant to your systemhave been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 838286 - CVE-2012-3386 automake: locally exploitable "make distcheck" bug 6. Package List: Red Hat Enterprise Linux Desktop Workstation (v. 5 client): Source: automake-1.9.6-3.el5.src.rpm noarch: automake-1.9.6-3.el5.noarch.rpm Red Hat Enterprise Linux (v. 5 server): Source: automake-1.9.6-3.el5.src.rpm noarch: automake-1.9.6-3.el5.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://access.redhat.com/security/cve/CVE-2012-3386 https://access.redhat.com/security/updates/classification/#low 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFUF9B3XlSAg2UNWIIRAj3NAJ9jflmwLlvZ89wpo2klBZCp22HHQwCgo+Tt xGuejoStlUib+9a2lkWIy28=/Gl6 -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list
Sep 16, 2014
•Low
Red Hat
98
security advisorydenial of servicemoderate impactRed Hat OpenShift: RHSA-2013-1136-01 Moderate: rubygem-passenger DoS
Updated rubygem-passenger packages that fix two security issues are now available for Red Hat OpenShift Enterprise 1.2.2. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: rubygem-passenger security update Advisory ID: RHSA-2013:1136-01 Product: Red Hat OpenShift Enterprise Advisory URL: https://access.redhat.com/errata/RHSA-2013:1136.html Issue date: 2013-08-05 CVE Names: CVE-2013-2119 CVE-2013-4136 ==================================================================== 1. Summary: Updated rubygem-passenger packages that fix two security issues are now available for Red Hat OpenShift Enterprise 1.2.2. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: RHOSE Infrastructure 2.1 - noarch, x86_64 RHOSE Node 1.2 - noarch, x86_64 3. Description: rubygem-passenger is a web server for Ruby, Python and Node.js applications. The rubygem-passenger gem created and re-used temporary directories and files in an insecure fashion. A local attacker could use these flaws to conduct a denial of service attack, take over the operation of the application or, potentially, execute arbitrary code with the privileges of the user running rubygem-passenger. (CVE-2013-2119, CVE-2013-4136) Note: By default, OpenShift Enterprise uses polyinstantiation (per user) for the /tmp/ directory, thereby minimizing the risk and impact of exploitation by local attackers of both CVE-2013-2119 and CVE-2013-4136. The CVE-2013-2119 issue was discovered by Michael Scherer ofthe Red Hat Regional IT team. The following packages are included with this update as dependencies of the updated Ruby 1.8 passenger packages: rubygem-spruz-0.2.5-4.el6op rubygem-file-tail-1.0.5-4.el6op Users of Red Hat OpenShift Enterprise 1.2.2 are advised to upgrade to these updated packages, which correct these issues. After installing the updated packages, manual action is required before the update takes effect. Refer to the Solution section for details. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258 Manual action is required for this update to take effect. In order for the updated passenger packages to be loaded by Ruby applications in the PaaS, the applications must be restarted with oo-admin-ctl-gears. One way to accomplish this is by running the following command, as a single line without the line break, on all OpenShift Nodes: for rubyapp in `ls -d /var/lib/openshift/*/ruby | cut -f5 -d/`; do oo-admin-ctl-gears restartgear $rubyapp; done If there are no Ruby applications on a Node it will simply fail with the message "No such file or directory". Another option is to run the following on all OpenShift Nodes; however, it will result in non-Ruby applications also being restarted: oo-admin-ctl-gears restartall (Note that without the manual action, if a user attempts to restart their Ruby application via the rhc command line, it will fail to start with a "Passenger could not be initialized..." error.) 5. Bugs fixed (http://bugzilla.redhat.com/): 892813 - CVE-2013-2119 rubygem-passenger: incorrect temporary file usage 985633 - CVE-2013-4136 rubygem-passenger: insecure temporary directory usage due to reuse of existing server instance directories 6. Package List: RHOSE Infrastructure2.1: Source: noarch: rubygem-file-tail-1.0.5-4.el6op.noarch.rpm rubygem-file-tail-doc-1.0.5-4.el6op.noarch.rpm rubygem-spruz-0.2.5-4.el6op.noarch.rpm rubygem-spruz-doc-0.2.5-4.el6op.noarch.rpm x86_64: mod_passenger-3.0.21-3.el6op.x86_64.rpm ruby193-mod_passenger-3.0.21-3.el6op.x86_64.rpm ruby193-rubygem-passenger-3.0.21-3.el6op.x86_64.rpm ruby193-rubygem-passenger-debuginfo-3.0.21-3.el6op.x86_64.rpm ruby193-rubygem-passenger-devel-3.0.21-3.el6op.x86_64.rpm ruby193-rubygem-passenger-doc-3.0.21-3.el6op.x86_64.rpm ruby193-rubygem-passenger-native-3.0.21-3.el6op.x86_64.rpm ruby193-rubygem-passenger-native-libs-3.0.21-3.el6op.x86_64.rpm rubygem-passenger-3.0.21-3.el6op.x86_64.rpm rubygem-passenger-debuginfo-3.0.21-3.el6op.x86_64.rpm rubygem-passenger-devel-3.0.21-3.el6op.x86_64.rpm rubygem-passenger-doc-3.0.21-3.el6op.x86_64.rpm rubygem-passenger-native-3.0.21-3.el6op.x86_64.rpm rubygem-passenger-native-libs-3.0.21-3.el6op.x86_64.rpm RHOSE Node 1.2: Source: noarch: rubygem-file-tail-1.0.5-4.el6op.noarch.rpm rubygem-file-tail-doc-1.0.5-4.el6op.noarch.rpm rubygem-spruz-0.2.5-4.el6op.noarch.rpm rubygem-spruz-doc-0.2.5-4.el6op.noarch.rpm x86_64: mod_passenger-3.0.21-3.el6op.x86_64.rpm ruby193-mod_passenger-3.0.21-3.el6op.x86_64.rpm ruby193-rubygem-passenger-3.0.21-3.el6op.x86_64.rpm ruby193-rubygem-passenger-debuginfo-3.0.21-3.el6op.x86_64.rpm ruby193-rubygem-passenger-devel-3.0.21-3.el6op.x86_64.rpm ruby193-rubygem-passenger-doc-3.0.21-3.el6op.x86_64.rpm ruby193-rubygem-passenger-native-3.0.21-3.el6op.x86_64.rpm ruby193-rubygem-passenger-native-libs-3.0.21-3.el6op.x86_64.rpm rubygem-passenger-3.0.21-3.el6op.x86_64.rpm rubygem-passenger-debuginfo-3.0.21-3.el6op.x86_64.rpm rubygem-passenger-devel-3.0.21-3.el6op.x86_64.rpm rubygem-passenger-doc-3.0.21-3.el6op.x86_64.rpm rubygem-passenger-native-3.0.21-3.el6op.x86_64.rpm rubygem-passenger-native-libs-3.0.21-3.el6op.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are availablefrom https://access.redhat.com/security/team/key#package 7. References: https://access.redhat.com/security/cve/CVE-2013-2119 https://access.redhat.com/security/cve/CVE-2013-4136 https://access.redhat.com/security/updates/classification#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2013 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFR/90sXlSAg2UNWIIRAmOiAJ4l/iy9fxxENCPbLWr57Vx4/Lkm0QCfe7Fd QYuctA45oRUzBa8NffuyR4k=odac -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list
Aug 05, 2013
Red Hat
87
security advisoryDebianremote attackDebian: DSA-1265-1 Security Vulnerabilities in Mozilla Software
Updated package.. - --------------------------------------------------------------------------Debian Security Advisory DSA 1265-1
Mar 10, 2007
•Critical
Debian
98
security advisoryRed Hatlow impactRed Hat Advisory: RHSA-2005:495-01 Low: Security Concern for rsh
Updated rsh packages that fix a theoretical security issue are now available. This update has been rated as having low security impact by the Red Hat Security Response Team. - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Low: rsh security update Advisory ID: RHSA-2005:495-01 Advisory URL: https://access.redhat.com/errata/RHSA-2005:495.html Issue date: 2005-06-13 Updated on: 2005-06-13 Product: Red Hat Enterprise Linux CVE Names: CAN-2004-0175 - ---------------------------------------------------------------------1. Summary: Updated rsh packages that fix a theoretical security issue are now available. This update has been rated as having low security impact by the Red Hat Security Response Team 2. Relevant releases/architectures: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64 Red Hat Linux Advanced Workstation 2.1 - ia64 Red Hat Enterprise Linux ES version 2.1 - i386 Red Hat Enterprise Linux WS version 2.1 - i386 3. Problem description: The rsh package contains a set of programs that allow users to run commands on remote machines, login to other machines, and copy files between machines, using the rsh, rlogin, and rcp commands. All three of these commands use rhosts-style authentication. The rcp protocol allows a server to instruct a client to write to arbitrary files outside of the current directory. This could potentially cause a security issue if a user uses rcp to copy files from a malicious server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0175 to this issue. All users of rsh should upgrade to these updated packages, which resolve these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh[filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via Red Hat Network. Many people find this an easier way to apply updates. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. If up2date fails to connect to Red Hat Network due to SSL Certificate Errors, you need to install a version of the up2date client with an updated certificate. The latest version of up2date is available from the Red Hat FTP site and may also be downloaded directly from the RHN website: https://access.redhat.com 5. Bug IDs fixed (http://bugzilla.redhat.com/): 158916 - CAN-2004-0175 malicious rsh server can cause rcp to write to arbitrary files 6. RPMs required: Red Hat Enterprise Linux AS (Advanced Server) version 2.1: SRPMS: 97e3fc12d40b985c90c1da4feb8d7e44 rsh-0.17-18.AS21.4.src.rpm i386: 53f2f58873f6b1448138b0051fc4d0c8 rsh-0.17-18.AS21.4.i386.rpm 7f1279fd4dd249e01309dc4d71506849 rsh-server-0.17-18.AS21.4.i386.rpm ia64: 39238168acaff66c7366db659f48809d rsh-0.17-18.AS21.4.ia64.rpm 87c3d4bb78f30940d49a289bb149647d rsh-server-0.17-18.AS21.4.ia64.rpm Red Hat Linux Advanced Workstation 2.1: SRPMS: 97e3fc12d40b985c90c1da4feb8d7e44 rsh-0.17-18.AS21.4.src.rpm ia64: 39238168acaff66c7366db659f48809d rsh-0.17-18.AS21.4.ia64.rpm 87c3d4bb78f30940d49a289bb149647d rsh-server-0.17-18.AS21.4.ia64.rpm Red Hat Enterprise Linux ES version 2.1: SRPMS: 97e3fc12d40b985c90c1da4feb8d7e44 rsh-0.17-18.AS21.4.src.rpm i386: 53f2f58873f6b1448138b0051fc4d0c8 rsh-0.17-18.AS21.4.i386.rpm 7f1279fd4dd249e01309dc4d71506849 rsh-server-0.17-18.AS21.4.i386.rpm Red Hat Enterprise Linux WS version 2.1: SRPMS: 97e3fc12d40b985c90c1da4feb8d7e44 rsh-0.17-18.AS21.4.src.rpm i386: 53f2f58873f6b1448138b0051fc4d0c8 rsh-0.17-18.AS21.4.i386.rpm 7f1279fd4dd249e01309dc4d71506849 rsh-server-0.17-18.AS21.4.i386.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key#package 7. References: https://www.cve.org/CVERecord?id=CAN-2004-0175 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2005 Red Hat, Inc. . Debian releases a patch notification for ssh toolkit enhancement, addressing a minor potential vulnerability with comprehensive instructions.. rsh Security Update, Red Hat Advisory, Remote Command Security. . Severity: Low. LinuxSecurity.com Team
Jun 13, 2005
•Low
Red Hat
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!