Explore top 10 tips to secure your open-source projects now. Read More
×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 33 articles for you...
89
security advisoryFedoraDoS attackFedora 40: UPDATE - phpMyAdmin 5.2.2 critical XSS and DoS issues
phpMyAdmin 5.2.2 is released Welcome to the release of phpMyAdmin version 5.2.2, the "I should have released this sooner" release. This is primarily a bugfix release but also contains a few security fixes as noted below. fix possible security issue in sql-parser which could cause long execution times. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-c17ef0f176 2025-01-31 03:22:59.299527+00:00 -------------------------------------------------------------------------------- Name : phpMyAdmin Product : Fedora 40 Version : 5.2.2 Release : 1.fc40 URL : https://www.phpmyadmin.net/ Summary : A web interface for MySQL and MariaDB Description : phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the Web. Currently it can create and drop databases, create/drop/alter tables, delete/edit/add fields, execute any SQL statement, manage keys on fields, manage privileges,export data into various formats and is available in 50 languages -------------------------------------------------------------------------------- Update Information: phpMyAdmin 5.2.2 is released Welcome to the release of phpMyAdmin version 5.2.2, the "I should have released this sooner" release. This is primarily a bugfix release but also contains a few security fixes as noted below. fix possible security issue in sql-parser which could cause long execution times that could create a DOS attack (thanks to Maximilian Krög) fix an XSS vulnerability in the check tables feature (PMASA-2025-1, thanks to bluebird) fix an XSS vulnerability in the Insert tab (PMASA-2025-2, thanks to frequent contributor Kamil Tekiela) fix possible security issue with library code slim/psr7 (CVE-2023-30536) fix possible security issue relating to iconv (CVE-2024-2961, PMASA-2025-3) fix a full path disclosure in the Monitoring tab issue #18268 Fix UI issue the theme manager is disabled issue Allow opening server breadcrumb links in new tab withCtrl/Meta key issue #19141 Add cookie prefix '-__Secure-' to cookies to help prevent cookie smuggling issue #18106 Fix renaming database with a view issue #18120 Fix bug with numerical tables during renaming database issue #16851 Fix ($cfg['Order']) default column order doesn't have have any effect since phpMyAdmin 4.2.0 issue #18258 Speed improvements when exporting a database issue #18769 Improved collations support for MariaDB 10.10 There are many, many more fixes that you can see in the ChangeLog file included with this release or online -------------------------------------------------------------------------------- ChangeLog: * Wed Jan 22 2025 Remi Collet - 5.2.2-1 - update to 5.2.2 (2025-01-21, security and bugfix release) -------------------------------------------------------------------------------- References: [ 1 ] Bug #2328680 - CVE-2023-44270 phpMyAdmin: Improper input validation in PostCSS [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2328680 [ 2 ] Bug #2331101 - CVE-2024-55565 phpMyAdmin: nanoid mishandles non-integer values [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2331101 [ 3 ] Bug #2334290 - CVE-2024-56522 phpMyAdmin: unserializeTCPDFtag uses != (aka loose comparison) and does not use a constant-time function to compare TCPDF tag hashes [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2334290 [ 4 ] Bug #2334295 - CVE-2024-56519 phpMyAdmin: setSVGStyles does not sanitize the SVG font-family attribute [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2334295 [ 5 ] Bug #2334299 - CVE-2024-56521 phpMyAdmin: CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set unsafely when libcurl is used [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2334299 [ 6 ] Bug #2334343 - CVE-2024-56527 phpMyAdmin: Error function lacks an htmlspecialchars call for the error message. [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2334343 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-c17ef0f176' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- . Fedora has rolled out security patches for phpMyAdmin version 5.2.2, tackling several vulnerabilities including cross-site scripting (XSS) and denial of service (DoS) concerns.. phpMyAdmin security update,Fedora advisory,phpMyAdmin 5.2.2,system security patches. . Severity: Critical. LinuxSecurity.com Team
Jan 31, 2025
•Critical
Fedora
91
security advisorydenial of servicegentooGentoo: GLSA-202408-13 Normal: Ethereum Protocol Vulnerability
A vulnerability has been discovered in Bitcoin, which can lead to a denial of service.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202408-12 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Bitcoin: Denial of Service Date: August 07, 2024 Bugs: #908084 ID: 202408-12 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== A vulnerability has been discovered in Bitcoin, which can lead to a denial of service. Background ========== Bitcoin Core consists of both "full-node" software for fully validating the blockchain as well as a bitcoin wallet. Affected packages ================= Package Vulnerable Unaffected ---------------- ------------ ------------ net-p2p/bitcoind < 25.0 > = 25.0 Description =========== Please review the CVE identifier referenced below for details. Impact ====== Bitcoin Core, when debug mode is not used, allows attackers to cause a denial of service (CPU consumption) because draining the inventory-to- send queue is inefficient, as exploited in the wild in May 2023. Workaround ========== There is no known workaround at this time. Resolution ========== All Bitcoin users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =net-p2p/bitcoind-25.0" References ========== [ 1 ] CVE-2023-33297 https://nvd.nist.gov/vuln/detail/CVE-2023-33297 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202408-12 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any securityconcerns should be addressed to
Aug 07, 2024
Gentoo
91
security advisoryGentoobuffer overflowGentoo: GLSA-202408-08 Normal: json-c Buffer Overflow Threat
A vulnerability has been discovered in json-c, which can lead to a stack buffer overflow.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202408-08 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: json-c: Buffer Overflow Date: August 07, 2024 Bugs: #918555 ID: 202408-08 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== A vulnerability has been discovered in json-c, which can lead to a stack buffer overflow. Background ========== json-c is a JSON implementation in C. Affected packages ================= Package Vulnerable Unaffected --------------- ------------ ------------ dev-libs/json-c < 0.16 > = 0.16 Description =========== Please review the CVE identifier referenced below for details. Impact ====== A stack-buffer-overflow exists in the auxiliary sample program json_parse which is located in the function parseit. Workaround ========== There is no known workaround at this time. Resolution ========== All json-c users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =dev-libs/json-c-0.16" References ========== [ 1 ] CVE-2021-32292 https://nvd.nist.gov/vuln/detail/CVE-2021-32292 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202408-08 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Aug 07, 2024
Gentoo
99
security advisorycriticalsoftware updateSlackware 15.0: 2022-336-01 Critical: Mozilla-Thunderbird Security Issue
New mozilla-thunderbird packages are available for Slackware 15.0 and -current to fix a security issue. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] mozilla-thunderbird (SSA:2022-336-01) New mozilla-thunderbird packages are available for Slackware 15.0 and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: +--------------------------+ patches/packages/mozilla-thunderbird-102.5.1-i686-1_slack15.0.txz: Upgraded. This release contains security fixes and improvements. For more information, see: https://www.thunderbird.net/en-US/thunderbird/102.5.1/releasenotes/ https://www.mozilla.org/en-US/security/advisories/mfsa2022-50/ https://www.cve.org/CVERecord?id=CVE-2022-45414 (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ Thanks to the friendly folks at the OSU Open Source Lab (https://osuosl.org/) for donating FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://www.slackware.com/ for additional mirror sites near you. Updated package for Slackware 15.0: Updated package for Slackware x86_64 15.0: Updated package for Slackware -current: Updated package for Slackware x86_64 -current: MD5 signatures: +-------------+ Slackware 15.0 package: 33cd568cf63a25b8416892234fbdea49 mozilla-thunderbird-102.5.1-i686-1_slack15.0.txz Slackware x86_64 15.0 package: 43621aac742ec9a0b1bff8edfaefbd9b mozilla-thunderbird-102.5.1-x86_64-1_slack15.0.txz Slackware -current package: f7372c2f75777def660e02d498e5b412 xap/mozilla-thunderbird-102.5.1-i686-1.txz Slackware x86_64 -current package: c9f585ae3cbf91086a22c250e48125c6 xap/mozilla-thunderbird-102.5.1-x86_64-1.txz Installation instructions: +------------------------+ Upgrade the package as root: # upgradepkg mozilla-thunderbird-102.5.1-i686-1_slack15.0.txz +-----+ . New LibreOffice updates released for Fedora 37, targeting a significant vulnerability. Upgrade stronglyrecommended.. Mozilla-Thunderbird Update, Slackware Security, Application Security Update. . Severity: Critical. LinuxSecurity.com Team
Dec 02, 2022
•Critical
Slackware
198
security advisorydenial of servicemedium severityArch Linux: 202106-51 Medium Risk: Tor Service Disruption Alert
The package tor before version 0.4.5.9-1 is vulnerable to denial of service. . Arch Linux Security Advisory ASA-202106-50 ========================================= Severity: Medium Date : 2021-06-22 CVE-ID : CVE-2021-34548 CVE-2021-34549 CVE-2021-34550 Package : tor Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2075 Summary ====== The package tor before version 0.4.5.9-1 is vulnerable to denial of service. Resolution ========= Upgrade to 0.4.5.9-1. # pacman -Syu "tor> =0.4.5.9-1" The problems have been fixed upstream in version 0.4.5.9. Workaround ========= None. Description ========== - CVE-2021-34548 (denial of service) A security issue has been found in Tor before version 0.4.5.9. Relays could spoof RELAY_END or RELAY_RESOLVED cell on half-closed streams because clients failed to validate which hop sent these cells. This would allow a relay on a circuit to end a stream that wasn't actually built with it. - CVE-2021-34549 (denial of service) A security issue has been found in Tor before version 0.4.5.9 that could be exploited for a hashtable-based CPU denial-of-service attack against relays. Previously a naive unkeyed hash function to look up circuits in a circuitmux object was used. An attacker could exploit this to construct circuits with chosen circuit IDs, to create collisions and make the hash table inefficient. Now a SipHash construction is used instead. - CVE-2021-34550 (denial of service) A security issue has been found in Tor before version 0.4.5.9. An out- of-bounds memory access in the v3 onion service descriptor parsing could be exploited by crafting an onion service descriptor that would crash any client that tried to visit it. Impact ===== A malicious relay could terminate client connections through crafted cells, leading to denial of service. A malicious client could cause denial of service on a relay through high resource usage using crafted circuit IDs. Lastly, clients could be crashed through crafted onion servicedescriptors. References ========= https://blog.torproject.org/new-stable-security-releases-03515-0449-0459-0465/ https://gitlab.torproject.org/tpo/core/tor/-/issues/40389 https://gitlab.torproject.org/tpo/core/tor/-/commit/adb248b6d6e0779719e6b873ee12a1e22fa390f4 https://gitlab.torproject.org/tpo/core/tor/-/issues/40391 https://gitlab.torproject.org/tpo/core/tor/-/commit/4c06c619faceb5d158a725d97fda45cadb2cf9c9 https://gitlab.torproject.org/tpo/core/tor/-/issues/40392 https://gitlab.torproject.org/tpo/core/tor/-/commit/f57b5c48e0aa01acd84a194fe4657a0d1cee04cf https://security.archlinux.org/CVE-2021-34548 https://security.archlinux.org/CVE-2021-34549 https://security.archlinux.org/CVE-2021-34550 . Arch Linux announcement regarding the denial of service issue in tor, including upgrade guidelines and associated CVE numbers. Discover further details here.. Arch Linux, tor security, denial of service, software update. . Severity: Medium. LinuxSecurity.com Team
Jun 24, 2021
•Medium
ArchLinux
198
security advisoryhigh severityremote code executionArch Linux ASA-202103-21 High: dotnet-sdk Remote Code Execution Advisory
The package dotnet-sdk before version 5.0.4.sdk104-1 is vulnerable to arbitrary code execution. . Arch Linux Security Advisory ASA-202103-21 ========================================= Severity: High Date : 2021-03-25 CVE-ID : CVE-2021-26701 Package : dotnet-sdk Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1698 Summary ====== The package dotnet-sdk before version 5.0.4.sdk104-1 is vulnerable to arbitrary code execution. Resolution ========= Upgrade to 5.0.4.sdk104-1. # pacman -Syu "dotnet-sdk> =5.0.4.sdk104-1" The problem has been fixed upstream in version 5.0.4.sdk104. Workaround ========= None. Description ========== A remote code execution vulnerability exists in .NET 5.0 before Runtime 5.0.4 and SDK 5.0.104 as well as .NET Core 3.1 before Runtime 3.1.13 and SDK 3.1.113 due to how text encoding is performed in the System.Text.Encodings.Web package, caused by a buffer overrun. Impact ===== An attacker can execute arbitrary code by abusing the text encoding. References ========= https://bugs.archlinux.org/task/69317 https://github.com/dotnet/announcements/issues/178 https://security.archlinux.org/CVE-2021-26701 . Arch Linux Security Notice regarding dotnet-sdk highlights a critical vulnerability that allows potential remote execution and provides guidance for necessary updates.. dotnet-sdk, Remote Code Execution, Arch Linux. . LinuxSecurity.com Team
Mar 26, 2021
ArchLinux
198
security advisorymedium severityremote threatArch Linux: ASA-202101-29 Medium: Lldpd Information Leak Threat
The package lldpd before version 1.0.8-1 is vulnerable to information disclosure. . Arch Linux Security Advisory ASA-202101-29 ========================================= Severity: Medium Date : 2021-01-20 CVE-ID : CVE-2020-27827 Package : lldpd Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-1451 Summary ====== The package lldpd before version 1.0.8-1 is vulnerable to information disclosure. Resolution ========= Upgrade to 1.0.8-1. # pacman -Syu "lldpd> =1.0.8-1" The problem has been fixed upstream in version 1.0.8. Workaround ========= None. Description ========== A security issue was found in lldpd before version 1.0.8. A packet that contains multiple instances of certain TLVs will cause lldpd to continually allocate memory and leak the old memory. As an example, multiple instances of system name TLV will cause old values to be dropped by the decoding routine. Impact ===== A remote attack can leak information through crafted packets. References ========= https://github.com/lldpd/lldpd/blob/master/NEWS https://github.com/lldpd/lldpd/commit/a8d3c90feca548fc0656d95b5d278713db86ff61 https://mail.openvswitch.org/pipermail/ovs-announce/2021-January/000269.html https://github.com/openvswitch/ovs/pull/337 https://github.com/openvswitch/ovs/commit/f915f32f5667e3b9d460055d8b47fa5d204ce83a https://security.archlinux.org/CVE-2020-27827 . Ubuntu Security Notice USN-2022-1234-1 addresses a low severity vulnerability in apache2 before version 2.4.51-0.. Arch Linux Advisory,Lldpd Security Issue,Information Disclosure Upgrade. . Severity: Medium. LinuxSecurity.com Team
Jan 28, 2021
•Medium
ArchLinux
91
security advisorysecurity issuegentooGentoo: GLSA-202012-10 Normal: WebkitGTK+ Code Execution Risk
Multiple vulnerabilities have been found in WebKitGTK+, the worst of which could result in the arbitrary execution of code.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202012-10 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: WebkitGTK+: Multiple vulnerabilities Date: December 23, 2020 Bugs: #755947 ID: 202012-10 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities have been found in WebKitGTK+, the worst of which could result in the arbitrary execution of code. Background ========= WebKitGTK+ is a full-featured port of the WebKit rendering engine, suitable for projects requiring any kind of web integration, from hybrid HTML/CSS applications to full-fledged web browsers. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-libs/webkit-gtk < 2.30.3 > = 2.30.3 Description ========== Multiple vulnerabilities have been discovered in WebKitGTK+. Please review the CVE identifiers referenced below for details. Impact ===== An attacker, by enticing a user to visit maliciously crafted web content, may be able to execute arbitrary code or cause memory corruption. Workaround ========= There is no known workaround at this time. Resolution ========= All WebkitGTK+ users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =net-libs/webkit-gtk-2.30.3" References ========= [ 1 ] CVE-2020-13543 https://nvd.nist.gov/vuln/detail/CVE-2020-13543 [ 2 ] CVE-2020-13584 https://nvd.nist.gov/vuln/detail/CVE-2020-13584 [ 3 ] CVE-2020-9948 https://nvd.nist.gov/vuln/detail/CVE-2020-9948 [ 4 ] CVE-2020-9951 https://nvd.nist.gov/vuln/detail/CVE-2020-9951 [ 5 ] CVE-2020-9952 https://nvd.nist.gov/vuln/detail/CVE-2020-9952 [ 6 ] CVE-2020-9983 https://nvd.nist.gov/vuln/detail/CVE-2020-9983 [ 7 ] WSA-2020-0008 https://webkitgtk.org/security/WSA-2020-0008.html [ 8 ] WSA-2020-0009 https://webkitgtk.org/security/WSA-2020-0009.html Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202012-10 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Dec 23, 2020
Gentoo
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!