Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -7 articles for you...
202
security advisorymoderate severityopenSUSEopenSUSE Tumbleweed: 2025:14972-1 moderate: apache2 auth issue
An update that solves one vulnerability can now be installed.. # apache2-mod_auth_openidc-2.4.16.11-1.1 on GA media Announcement ID: openSUSE-SU-2025:14972-1 Rating: moderate Cross-References: * CVE-2025-31492 CVSS scores: * CVE-2025-31492 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2025-31492 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Affected Products: * openSUSE Tumbleweed An update that solves one vulnerability can now be installed. ## Description: These are all security issues fixed in the apache2-mod_auth_openidc-2.4.16.11-1.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * apache2-mod_auth_openidc 2.4.16.11-1.1 ## References: * https://www.suse.com/security/cve/CVE-2025-31492.html . Enhancement for apache2-mod_auth_openidc mitigates moderate security risks in openSUSE Tumbleweed, boosting overall protection.. openSUSE security update, apache2-mod_auth_openidc, moderate security flaws, linux security advisory, openSUSE update. . LinuxSecurity.com Team
Apr 09, 2025
OpenSUSE
100
security practicesminor issuesupdate reportSUSE 2010:008 Security Advisory Addresses Low Profile Vulnerabilities
To avoid flooding mailing lists with SUSE Security Announcements for minor To avoid flooding mailing lists with SUSE Security Announcements for minor issues, SUSE Security releases weekly summary reports for the low profile issues, SUSE Security releases weekly summary reports for the low profile vulnerability fixes. The SUSE Security Summary Reports do not list or download URLs like the SUSE Secu [More...]. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Summary Report Announcement ID: SUSE-SR:2010:008 Date: Wed, 07 Apr 2010 13:00:00 +0000 Cross-References: CVE-2008-5515, CVE-2009-2693, CVE-2009-2901 CVE-2009-2902, CVE-2009-3389, CVE-2009-3555 CVE-2010-0082, CVE-2010-0084, CVE-2010-0085 CVE-2010-0087, CVE-2010-0088, CVE-2010-0089 CVE-2010-0090, CVE-2010-0091, CVE-2010-0092 CVE-2010-0093, CVE-2010-0094, CVE-2010-0095 CVE-2010-0547, CVE-2010-0732, CVE-2010-0837 CVE-2010-0838, CVE-2010-0839, CVE-2010-0840 CVE-2010-0841, CVE-2010-0842, CVE-2010-0843 CVE-2010-0844, CVE-2010-0845, CVE-2010-0846 CVE-2010-0847, CVE-2010-0848, CVE-2010-0849 CVE-2010-0850, CVE-2010-0926 Content of this advisory: 1) Solved Security Vulnerabilities: - gnome-screensaver - tomcat5, tomcat6 - libtheora - java-1_6_0-sun - samba 2) Pending Vulnerabilities, Solutions, and Work-Arounds: none 3) Authenticity Verification and Additional Information ______________________________________________________________________________ 1)Solved Security Vulnerabilities To avoid flooding mailing lists with SUSE Security Announcements for minor issues, SUSE Security releases weekly summary reports for the low profile vulnerability fixes. The SUSE Security Summary Reports do not list or download URLs like the SUSE Security Announcements that are released for more severe vulnerabilities. Fixed packages for the following incidents are already available on our FTP server and via the YaST Online Update. - gnome-screensaver Pressing the "Return" key repeatedly caused an X error that terminated gnome-screensaver (CVE-2010-0732). Affected Products: SLE11, openSUSE 11.0, 11.1, 11.2 - tomcat5, tomcat6 tomcat was updated to fix several security issues: - CVE-2009-2693, CVE-2009-2902: Directory traversal vulnerability allowed remote attackers to create or overwrite arbitrary files/dirs with a specially crafted WAR file. - CVE-2009-2901: When autoDeploy is enabled the autodeployment process deployed appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests. - CVE-2008-5515: When using the RequestDispatcher method, it was possible for remote attackers to bypass intended access restrictions and conduct directory traversal attacks. Affected Products: SLES9, SLE10-SP2, SLE10-SP3, SLE11, openSUSE 11.0, 11.1, 11.2 - libtheora An integer overflow was fixed in libtheora. It could be exploited remotely to execute arbitrary code (CVE-2009-3389). Affected Products: SLE11, openSUSE 11.0, 11.1, 11.2 - java-1_6_0-sun Sun Java 6 Update 19 was released to fix a large number of security issues, including several buffer overflows. (CVE-2010-0082, CVE-2010-0084, CVE-2010-0085, CVE-2010-0087, CVE-2010-0088, CVE-2010-0089, CVE-2010-0090, CVE-2010-0091, CVE-2010-0092, CVE-2010-0093,CVE-2010-0094, CVE-2010-0095, CVE-2010-0837, CVE-2010-0838, CVE-2010-0839, CVE-2010-0840, CVE-2010-0841, CVE-2010-0842, CVE-2010-0843, CVE-2010-0844, CVE-2010-0845, CVE-2010-0846, CVE-2010-0847, CVE-2010-0848, CVE-2010-0849, CVE-2010-0850). This update also disables unsafe TLS renegotiations (CVE-2009-3555). Please refer to the following document for more information: https://www.oracle.com/java/technologies/ Affected Products: SLE11, openSUSE 11.0, 11.1, 11.2 - samba With enabled "wide links" samba follows symbolic links on the server side, therefore allowing clients to overwrite arbitrary files (CVE-2010-0926). This update changes the default setting to have "wide links" disabled by default. The new default only works if "wide links" is not set explicitly in smb.conf. Due to a race condition in mount.cifs a local attacker could corrupt /etc/mtab if mount.cifs is installed setuid root. mount.cifs is not setuid root by default and it's not recommended to change that (CVE-2010-0547). Affected Products: SLES9, SLE10-SP2, SLE10-SP3, SLE11, openSUSE 11.0, 11.1, 11.2 ______________________________________________________________________________ 2) Pending Vulnerabilities, Solutions, and Work-Arounds none ______________________________________________________________________________ 3) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify replacing with the name of the file containing the announcement. The output for a validsignature looks like: gpg: Signature made using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team " where is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and integrity of a package needs to be verified to ensure that it has not been tampered with. The internal RPM package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig to verify the signature of the package, replacing with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from
Apr 07, 2010
•Low
SuSE
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!