Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 0 articles for you...
198
security advisorymedium severityremote attackArch Linux: 202110-4 Medium: Nodejs Url Request Injection Issue
The package nodejs before version 16.11.1-1 is vulnerable to url request injection. . Arch Linux Security Advisory ASA-202110-4 ======================================== Severity: Medium Date : 2021-10-21 CVE-ID : CVE-2021-22959 CVE-2021-22960 Package : nodejs Type : url request injection Remote : Yes Link : https://security.archlinux.org/AVG-2460 Summary ====== The package nodejs before version 16.11.1-1 is vulnerable to url request injection. Resolution ========= Upgrade to 16.11.1-1. # pacman -Syu "nodejs> =16.11.1-1" The problems have been fixed upstream in version 16.11.1. Workaround ========= None. Description ========== - CVE-2021-22959 (url request injection) A security issue has been found in Node.js before versions 16.11.1, 14.18.1 and 12.22.7. The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). - CVE-2021-22960 (url request injection) A security issue has been found in Node.js before versions 16.11.1, 14.18.1 and 12.22.7. The parser ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. Impact ===== A remote attacker could inject HTTP requests through crafted queries. References ========= https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/#http-request-smuggling-due-to-spaced-in-headers-medium-cve-2021-22959 https://hackerone.com/reports/1238099 https://hackerone.com/reports/1238709 https://github.com/nodejs/node/commit/af488f8dc82d69847992ea1cd2f53dc8082b3b91 https://github.com/nodejs/node/commit/8c254ca7e4693fb778d808fa835b095de6c9fdd4 https://github.com/nodejs/node/commit/21a2e554e3eaa325abbdb28f366928d0ccc0a0f0 https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/#http-request-smuggling-when-parsing-the-body-medium-cve-2021-22960 https://security.archlinux.org/CVE-2021-22959 https://security.archlinux.org/CVE-2021-22960 . Debian Security Notice DSN-202112-3 alerts usersto potential command execution vulnerabilities in python libraries. Take immediate precautions.. Arch Linux,nodejs,url injection,security advisory. . Severity: Medium. LinuxSecurity.com Team
Oct 21, 2021
•Medium
ArchLinux
198
security advisorymedium severityDoSArch Linux: 202106-42 Medium Severity: Go Package Issues
The package go before version 2:1.16.5-1 is vulnerable to multiple issues including insufficient validation, url request injection and denial of service. . Arch Linux Security Advisory ASA-202106-42 ========================================= Severity: Medium Date : 2021-06-15 CVE-ID : CVE-2021-33195 CVE-2021-33196 CVE-2021-33197 CVE-2021-33198 Package : go Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2006 Summary ====== The package go before version 2:1.16.5-1 is vulnerable to multiple issues including insufficient validation, url request injection and denial of service. Resolution ========= Upgrade to 2:1.16.5-1. # pacman -Syu "go> =2:1.16.5-1" The problems have been fixed upstream in version 1.16.5. Workaround ========= None. Description ========== - CVE-2021-33195 (insufficient validation) A security issue has been found in Go before version 1.16.5. The LookupCNAME, LookupSRV, LookupMX, LookupNS, and LookupAddr functions in net, and their respective methods on the Resolver type may return arbitrary values retrieved from DNS which do not follow the established RFC 1035 rules for domain names. If these names are used without further sanitization, for instance unsafely included in HTML, they may allow for injection of unexpected content. Note that LookupTXT may still return arbitrary values that could require sanitization before further use. - CVE-2021-33196 (denial of service) A security issue has been found in Go before version 1.16.5. Due to a pre-allocation optimization in zip.NewReader, a malformed archive which indicates it has a significant number of files can cause either a panic or memory exhaustion. - CVE-2021-33197 (url request injection) A security issue has been found in Go before version 1.16.5. ReverseProxy in net/http/httputil could be made to forward certain hop- by-hop headers, including Connection. In case the target of the ReverseProxy was itself a reverse proxy, this would let an attacker drop arbitrary headers, including those set bythe ReverseProxy.Director. - CVE-2021-33198 (denial of service) A security issue has been found in Go before version 1.16.5. The SetString and UnmarshalText methods of math/big.Rat may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents. Impact ===== An attacker could crash an application with crafted input, inject malicious and unexpected content or drop HTTP headers by posing as a reverse proxy. References ========= https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI/m/r_EP-NlKBgAJ https://github.com/golang/go/issues/46241 https://github.com/golang/go/commit/df6a737cc899507d3090e995abd1e1ed1a30cee3 https://github.com/golang/go/issues/46242 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33912 https://github.com/golang/go/commit/895fb1bb6fc0d3c01c5ef7c8cbaf033d1fff9ad7 https://github.com/golang/go/issues/46313 https://github.com/golang/go/commit/0410005dc458f23fb15f64354f9a24ca8f2fe044 https://github.com/golang/go/issues/45910 https://github.com/golang/go/commit/9210eaf7dc704612a6eda97c482012f779fd833b https://security.archlinux.org/CVE-2021-33195 https://security.archlinux.org/CVE-2021-33196 https://security.archlinux.org/CVE-2021-33197 https://security.archlinux.org/CVE-2021-33198 . Several vulnerabilities detected in Go library prior to release 2:1.16.5-1. Prompt update suggested to reduce potential threats.. Go Package Security, Arch Linux Advisory, Injection Issues, Security Flaws. . Severity: Medium. LinuxSecurity.com Team
Jun 18, 2021
•Medium
ArchLinux
198
security advisoryhigh severitycode executionArch Linux: 2021-03-27 High Severity: Python2 Code Issues and Fixes
The package python2 before version 2.7.18-3 is vulnerable to multiple issues including arbitrary code execution, url request injection and denial of service. . Arch Linux Security Advisory ASA-202103-27 ========================================= Severity: High Date : 2021-03-25 CVE-ID : CVE-2019-20907 CVE-2020-8492 CVE-2020-26116 CVE-2020-27619 CVE-2021-3177 CVE-2021-23336 Package : python2 Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1597 Summary ====== The package python2 before version 2.7.18-3 is vulnerable to multiple issues including arbitrary code execution, url request injection and denial of service. Resolution ========= Upgrade to 2.7.18-3. # pacman -Syu "python2> =2.7.18-3" The problems have been fixed upstream but no release is available yet. Workaround ========= None. Description ========== - CVE-2019-20907 (denial of service) In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. - CVE-2020-8492 (denial of service) Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking. - CVE-2020-26116 (url request injection) http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request. - CVE-2020-27619 (arbitrary code execution) In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP. - CVE-2021-3177 (arbitrary code execution) Python 3.x through 3.9.1 has a buffer overflow in PyCArg_reprin _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely. - CVE-2021-23336 (url request injection) The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter. The package python-django contains a copy of urllib.parse.parse_qsl() which was added to backport some security fixes. A further security fix has been issued in versions 3.1.7, 3.0.13 and 2.2.19 such that parse_qsl() no longer allows using ; as a query parameter separator by default. Impact ===== A remote attacker could execute code or crash the application through crafted files or HTTP requests. Furthermore, a remote attacker could inject arbitrary headers or poison web caches through craftedHTTP requests. References ========= https://bugs.archlinux.org/task/68063 https://bugs.python.org/issue39017 https://github.com/python/cpython/pull/21454 https://github.com/python/cpython/commit/5a8d121a1f3ef5ad7c105ee378cc79a3eac0c7d4 https://bugs.python.org/issue39503 https://github.com/python/cpython/pull/18284 https://github.com/python/cpython/commit/0b297d4ff1c0e4480ad33acae793fbaf4bf015b4 https://python-security.readthedocs.io/vuln/http-header-injection-method.html https://bugs.python.org/issue39603 https://github.com/python/cpython/pull/18485 https://github.com/python/cpython/commit/8ca8a2e8fb068863c1138f07e3098478ef8be12e https://python-security.readthedocs.io/vuln/cjk-codec-download-eval.html https://bugs.python.org/issue41944 https://github.com/python/cpython/pull/22575 https://github.com/python/cpython/commit/b664a1df4ee71d3760ab937653b10997081b1794 https://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_repr.html https://bugs.python.org/issue42938 https://github.com/python/cpython/pull/24239 https://github.com/python/cpython/commit/c347cbe694743cee120457aa6626712f7799a932 https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/ https://bugs.python.org/issue42967 https://github.com/python/cpython/pull/24297 https://github.com/python/cpython/commit/c9f07813ab8e664d8c34413c4fc2d4f86c061a92 https://www.djangoproject.com/weblog/2021/feb/19/security-releases/ https://github.com/django/django/commit/8f6d431b08cbb418d9144b976e7b972546607851 https://security.archlinux.org/CVE-2019-20907 https://security.archlinux.org/CVE-2020-8492 https://security.archlinux.org/CVE-2020-26116 https://security.archlinux.org/CVE-2020-27619 https://security.archlinux.org/CVE-2021-3177 https://security.archlinux.org/CVE-2021-23336 . A number of critical vulnerabilities identified in Arch Linux's python3 package necessitate immediate updates to address potential risks.. Arch Linux Python2 Security, Code Execution Risks, Update Recommendations for Python2. . LinuxSecurity.com Team
Mar 26, 2021
ArchLinux
89
security advisoryfedoraupdateFedora 32: FEDORA-2021-b5e897a2e5 Critical: Nagios URL Injection
Fix for CVE-2020-13977 BZ1849087 Require plugins needed for localhost monitoring (#1932297) Update to 4.4.6. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2021-b5e897a2e5 2021-03-07 13:52:38.179269 --------------------------------------------------------------------------------Name : nagios Product : Fedora 32 Version : 4.4.6 Release : 3.fc32 URL : https://www.nagios.org/projects/nagios-core/ Summary : Host/service/network monitoring program Description : Nagios is a program that will monitor hosts and services on your network. It has the ability to send email or page alerts when a problem arises and when a problem is resolved. Nagios is written in C and is designed to run under Linux (and some other *NIX variants) as a background process, intermittently running checks on various services that you specify. The actual service checks are performed by separate "plugin" programs which return the status of the checks to Nagios. The plugins are available at https://github.com/nagios-plugins/nagios-plugins This package provides the core program, web interface, and documentation files for Nagios. Development files are built as a separate package. --------------------------------------------------------------------------------Update Information: Fix for CVE-2020-13977 BZ1849087 Require plugins needed for localhost monitoring (#1932297) Update to 4.4.6 --------------------------------------------------------------------------------ChangeLog: * Sat Feb 27 2021 Guido Aulisi - 4.4.6-3 - Require plugins needed for localhost monitoring (#1932297) * Tue Feb 23 2021 Guido Aulisi - 4.4.6-2 - Fix systemd unit file permissions #1676334 * Sat Feb 20 2021 Guido Aulisi - 4.4.6-1 - Update to 4.4.6 - Fix for CVE-2020-13977 #BZ1849087 - Some spec cleanup --------------------------------------------------------------------------------References: [ 1 ] Bug #1829114 - nagios-4.4.6 isavailable https://bugzilla.redhat.com/show_bug.cgi?id=1829114 [ 2 ] Bug #1849087 - CVE-2020-13977 nagios: URL injection (post-authentication) vulnerability [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=1849087 [ 3 ] Bug #1932297 - Nagios server rpm missing some nagios-plugins-* dependency https://bugzilla.redhat.com/show_bug.cgi?id=1932297 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2021-b5e897a2e5' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Mar 07, 2021
•Critical
Fedora
198
security advisoryhigh severitycode executionArch Linux ASA-202101-16 High: Nodejs Code Execution And Injection Threats
The package nodejs before version 15.5.1-1 is vulnerable to multiple issues including arbitrary code execution and url request injection. . Arch Linux Security Advisory ASA-202101-16 ========================================= Severity: High Date : 2021-01-12 CVE-ID : CVE-2020-8265 CVE-2020-8287 Package : nodejs Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1400 Summary ====== The package nodejs before version 15.5.1-1 is vulnerable to multiple issues including arbitrary code execution and url request injection. Resolution ========= Upgrade to 15.5.1-1. # pacman -Syu "nodejs> =15.5.1-1" The problems have been fixed upstream in version 15.5.1. Workaround ========= None. Description ========== - CVE-2020-8265 (arbitrary code execution) The nodejs release lines 15.x, 14.x, 12.x and 10.x are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits. The issue is fixed in nodejs versions 15.5.1, 14.15.4, 12.20.1 and 10.23.1. - CVE-2020-8287 (url request injection) The nodejs release lines 15.x, 14.x, 12.x and 10.x allow two copies of a header field in an HTTP request. For example, two Transfer-Encoding header fields. In this case Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling. The issue is fixed in nodejs versions 15.5.1, 14.15.4, 12.20.1 and 10.23.1. Impact ===== A malicious user could achieve data exfiltration through HTTP headersor execute arbitrary code through poor APIusage. References ========= https://groups.google.com/g/nodejs-sec/c/kyzmwvQdUfs/m/7mjPCzY2BAAJ https://github.com/nodejs/node/commit/9834ef85a0a549a45a98f04dc51af1782a7126ee https://github.com/nodejs/node/commit/4f8772f9b731118628256189b73cd202149bbd97 https://github.com/nodejs/node/commit/5b00de7d67a1372aa342115ad28edd3f78268bb6 https://github.com/nodejs/node/commit/7f178663ebffc82c9f8a5a1b6bf2da0c263a30ed https://github.com/nodejs/node/commit/357e2857c8385c303782ced2ac8b568df06d4326 https://github.com/nodejs/node/commit/e0c9a2285cfe18642d15d5ed9b7122755c6e66e0 https://github.com/nodejs/node/commit/c5dbe831b714b3a98c59ba2406b791fb27016d79 https://github.com/nodejs/node/commit/641f786bb1a1f6eb1ff8750782ed939780f2b31a https://github.com/nodejs/node/commit/7ecac8143f0a91785ed0bd3b4d9aab5d98419b41 https://github.com/nodejs/node/commit/92d430917a63a567bb528100371263c46e50ee4a https://github.com/nodejs/node/commit/4a30ac8c755d0701e773831ce22153b66bb36305 https://github.com/nodejs/node/commit/420244e4d9ca6de2612e7f503f5c87e448fbc14b https://github.com/nodejs/node/commit/fc70ce08f5818a286fb5899a1bc3aff5965a745e https://github.com/nodejs/node/commit/aa6b97fb99d7528649fadb4c6a894e078fe4323c https://security.archlinux.org/CVE-2020-8265 https://security.archlinux.org/CVE-2020-8287 . Multiple vulnerabilities found in Node.js versions prior to 15.5.1-1 may lead to unauthorized code execution and header manipulation. An update is now available to fix these issues. Arch Linux,nodejs,code execution,injection threats,security update. . LinuxSecurity.com Team
Jan 15, 2021
ArchLinux
198
security advisoryhigh severitysoftware updateArch Linux: ASA-202101-13 High Severity: Nodejs-LTS-Dubnium Issues
The package nodejs-lts-dubnium before version 10.23.1-1 is vulnerable to multiple issues including arbitrary code execution and url request injection. . Arch Linux Security Advisory ASA-202101-13 ========================================= Severity: High Date : 2021-01-12 CVE-ID : CVE-2020-8265 CVE-2020-8287 Package : nodejs-lts-dubnium Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1403 Summary ====== The package nodejs-lts-dubnium before version 10.23.1-1 is vulnerable to multiple issues including arbitrary code execution and url request injection. Resolution ========= Upgrade to 10.23.1-1. # pacman -Syu "nodejs-lts-dubnium> =10.23.1-1" The problems have been fixed upstream in version 10.23.1. Workaround ========= None. Description ========== - CVE-2020-8265 (arbitrary code execution) The nodejs release lines 15.x, 14.x, 12.x and 10.x are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits. The issue is fixed in nodejs versions 15.5.1, 14.15.4, 12.20.1 and 10.23.1. - CVE-2020-8287 (url request injection) The nodejs release lines 15.x, 14.x, 12.x and 10.x allow two copies of a header field in an HTTP request. For example, two Transfer-Encoding header fields. In this case Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling. The issue is fixed in nodejs versions 15.5.1, 14.15.4, 12.20.1 and 10.23.1. Impact ===== A malicious user could achieve data exfiltration through HTTP headersor execute arbitrary code through poor APIusage. References ========= https://groups.google.com/g/nodejs-sec/c/kyzmwvQdUfs/m/7mjPCzY2BAAJ https://github.com/nodejs/node/commit/9834ef85a0a549a45a98f04dc51af1782a7126ee https://github.com/nodejs/node/commit/4f8772f9b731118628256189b73cd202149bbd97 https://github.com/nodejs/node/commit/5b00de7d67a1372aa342115ad28edd3f78268bb6 https://github.com/nodejs/node/commit/7f178663ebffc82c9f8a5a1b6bf2da0c263a30ed https://github.com/nodejs/node/commit/357e2857c8385c303782ced2ac8b568df06d4326 https://github.com/nodejs/node/commit/e0c9a2285cfe18642d15d5ed9b7122755c6e66e0 https://github.com/nodejs/node/commit/c5dbe831b714b3a98c59ba2406b791fb27016d79 https://github.com/nodejs/node/commit/641f786bb1a1f6eb1ff8750782ed939780f2b31a https://github.com/nodejs/node/commit/7ecac8143f0a91785ed0bd3b4d9aab5d98419b41 https://github.com/nodejs/node/commit/92d430917a63a567bb528100371263c46e50ee4a https://github.com/nodejs/node/commit/4a30ac8c755d0701e773831ce22153b66bb36305 https://github.com/nodejs/node/commit/420244e4d9ca6de2612e7f503f5c87e448fbc14b https://github.com/nodejs/node/commit/fc70ce08f5818a286fb5899a1bc3aff5965a745e https://github.com/nodejs/node/commit/aa6b97fb99d7528649fadb4c6a894e078fe4323c https://security.archlinux.org/CVE-2020-8265 https://security.archlinux.org/CVE-2020-8287 . Critical alert for Arch Linux users regarding nodejs-lts-dubnium security flaws. Ensure your systems are updated immediately for protection.. Nodejs Risks, Arch Linux Security, Code Execution Risk. . LinuxSecurity.com Team
Jan 15, 2021
ArchLinux
100
security advisorymoderateupdateSUSE: 2020:1339-1 Moderate: Python Security Issues Addressed
An update that fixes two vulnerabilities is now available. . SUSE Security Update: Security update for python ______________________________________________________________________________ Announcement ID: SUSE-SU-2020:1339-1 Rating: moderate References: #1155094 #1162825 Cross-References: CVE-2019-18348 CVE-2019-9674 Affected Products: SUSE Linux Enterprise Module for Python2 15-SP1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 SUSE Linux Enterprise Module for Desktop Applications 15-SP1 SUSE Linux Enterprise Module for Basesystem 15-SP1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for python fixes the following issues: Security issues fixed: - CVE-2019-18348: Fixed a CRLF injection via the host part of the url passed to urlopen(). Now an InvalidURL exception is raised (bsc#1155094). - CVE-2019-9674: Improved the documentation to reflect the dangers of zip-bombs (bsc#1162825). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Python2 15-SP1: zypper in -t patch SUSE-SLE-Module-Python2-15-SP1-2020-1339=1 - SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1: zypper in -t patch SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2020-1339=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP1: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP1-2020-1339=1 - SUSE Linux Enterprise Module for Basesystem 15-SP1: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP1-2020-1339=1 Package List: - SUSE Linux Enterprise Module for Python2 15-SP1(aarch64 ppc64le s390x x86_64): python-base-debuginfo-2.7.17-7.38.1 python-base-debugsource-2.7.17-7.38.1 python-curses-2.7.17-7.38.1 python-curses-debuginfo-2.7.17-7.38.1 python-debuginfo-2.7.17-7.38.1 python-debugsource-2.7.17-7.38.1 python-devel-2.7.17-7.38.1 python-gdbm-2.7.17-7.38.1 python-gdbm-debuginfo-2.7.17-7.38.1 python-xml-2.7.17-7.38.1 python-xml-debuginfo-2.7.17-7.38.1 - SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (aarch64 ppc64le s390x x86_64): python-debuginfo-2.7.17-7.38.1 python-debugsource-2.7.17-7.38.1 python-demo-2.7.17-7.38.1 python-idle-2.7.17-7.38.1 - SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (x86_64): libpython2_7-1_0-32bit-2.7.17-7.38.1 libpython2_7-1_0-32bit-debuginfo-2.7.17-7.38.1 python-32bit-2.7.17-7.38.1 python-32bit-debuginfo-2.7.17-7.38.1 python-base-32bit-2.7.17-7.38.1 python-base-32bit-debuginfo-2.7.17-7.38.1 python-base-debugsource-2.7.17-7.38.1 - SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (noarch): python-doc-2.7.17-7.38.1 python-doc-pdf-2.7.17-7.38.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP1 (aarch64 ppc64le s390x x86_64): python-debuginfo-2.7.17-7.38.1 python-debugsource-2.7.17-7.38.1 python-tk-2.7.17-7.38.1 python-tk-debuginfo-2.7.17-7.38.1 - SUSE Linux Enterprise Module for Basesystem 15-SP1 (aarch64 ppc64le s390x x86_64): libpython2_7-1_0-2.7.17-7.38.1 libpython2_7-1_0-debuginfo-2.7.17-7.38.1 python-2.7.17-7.38.1 python-base-2.7.17-7.38.1 python-base-debuginfo-2.7.17-7.38.1 python-base-debugsource-2.7.17-7.38.1 python-debuginfo-2.7.17-7.38.1 python-debugsource-2.7.17-7.38.1 References: https://www.suse.com/security/cve/CVE-2019-18348.html https://www.suse.com/security/cve/CVE-2019-9674.html https://bugzilla.suse.com/1155094 https://bugzilla.suse.com/1162825 _______________________________________________ sle-security-updates mailing list
May 19, 2020
SuSE
197
security advisorycriticalsoftware updateDebian 8: DLA-1550-1 Critical: Drupal7 Remote Code Execution Threat
It was discovered that there was a remote code execution and an external URL injection vulnerability in the Drupal content management framework. . Package : drupal7 Version : 7.32-1+deb8u13 Debian Bugs : #911336 #911337 It was discovered that there was a remote code execution and an external URL injection vulnerability in the Drupal content management framework. For more information, please see: For Debian 8 "Jessie", these issues have been fixed in drupal7 version 7.32-1+deb8u13. We recommend that you upgrade your drupal7 packages. Regards, - -- ,'`. : :' : Chris Lamb `. `'`
Oct 19, 2018
•Critical
Debian LTS
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!