Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -7 articles for you...
198
security advisoryhigh severitycode executionArch Linux 95.0.4638.69-1 High: Chromium Code Execution Risks
The package chromium before version 95.0.4638.69-1 is vulnerable to multiple issues including arbitrary code execution and insufficient validation. . Arch Linux Security Advisory ASA-202110-7 ======================================== Severity: High Date : 2021-10-29 CVE-ID : CVE-2021-37997 CVE-2021-37998 CVE-2021-37999 CVE-2021-38000 CVE-2021-38001 CVE-2021-38002 CVE-2021-38003 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2504 Summary ====== The package chromium before version 95.0.4638.69-1 is vulnerable to multiple issues including arbitrary code execution and insufficient validation. Resolution ========= Upgrade to 95.0.4638.69-1. # pacman -Syu "chromium> =95.0.4638.69-1" The problems have been fixed upstream in version 95.0.4638.69. Workaround ========= None. Description ========== - CVE-2021-37997 (arbitrary code execution) A use after free security issue has been found in the Sign-In component of the Chromium browser engine before version 95.0.4638.69. - CVE-2021-37998 (arbitrary code execution) A use after free security issue has been found in the Garbage Collection component of the Chromium browser engine before version 95.0.4638.69. - CVE-2021-37999 (insufficient validation) An insufficient data validation security issue has been found in the New Tab Page component of the Chromium browser engine before version 95.0.4638.69. - CVE-2021-38000 (insufficient validation) An insufficient validation of untrusted input security issue has been found in the Intents component of the Chromium browser engine before version 95.0.4638.69. Google is aware that an exploit for CVE-2021-38000 exists in the wild. - CVE-2021-38001 (arbitrary code execution) A type confusion security issue has been found in the V8 component of the Chromium browser engine before version 95.0.4638.69. - CVE-2021-38002 (arbitrary code execution) A use after free security issue has been found in the Web Transport component of the Chromium browser enginebefore version 95.0.4638.69. - CVE-2021-38003 (arbitrary code execution) An inappropriate implementation security issue has been found in the V8 component of the Chromium browser engine before version 95.0.4638.69. Google is aware that an exploit for CVE-2021-38003 exists in the wild. Impact ===== A remote attacker could execute arbitrary code through crafted web content. Google is aware that exploits for two of the security issues exist in the wild. References ========= https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_28.html https://security.archlinux.org/CVE-2021-37997 https://security.archlinux.org/CVE-2021-37998 https://security.archlinux.org/CVE-2021-37999 https://security.archlinux.org/CVE-2021-38000 https://security.archlinux.org/CVE-2021-38001 https://security.archlinux.org/CVE-2021-38002 https://security.archlinux.org/CVE-2021-38003 . Enhance the chromium package on Arch Linux to address critical vulnerabilities such as remote command execution risks.. Arch Linux Chromium Security, Remote Code Execution Issues, Security Patch. . LinuxSecurity.com Team
Nov 01, 2021
ArchLinux
198
security advisorydenial of servicemediumArch Linux: ASA-202107-16 Medium Severity: Multiple Issues in Php7
The package php7 before version 7.4.21-1 is vulnerable to multiple issues including denial of service and insufficient validation. . Arch Linux Security Advisory ASA-202107-16 ========================================= Severity: Medium Date : 2021-07-06 CVE-ID : CVE-2021-21704 CVE-2021-21705 Package : php7 Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2133 Summary ====== The package php7 before version 7.4.21-1 is vulnerable to multiple issues including denial of service and insufficient validation. Resolution ========= Upgrade to 7.4.21-1. # pacman -Syu "php7> =7.4.21-1" The problems have been fixed upstream in version 7.4.21. Workaround ========= None. Description ========== - CVE-2021-21704 (denial of service) Multiple bugs in the pdo_firebase module allow a malicious firebase server or man-in-the-middle attacker to crash PHP before versions 8.0.8 and 7.4.21. - CVE-2021-21705 (insufficient validation) A security issue was found in the php_url_parse_ex() function in PHP before versions 8.0.8 and 7.4.21, which leads to FILTER_VALIDATE_URL accepting URLs with invalid userinfo, a different issue from CVE-2020-7071. Impact ===== A remote user could bypass URL validation. Furthermore, a malicious firebase server or man-in-the-middle attacker could crash aPHP application. References ========= https://www.php.net/ChangeLog-8.php#8.0.8 https://www.php.net/ChangeLog-7.php#7.4.21 https://bugs.php.net/bug.php?id=76448 https://bugs.php.net/bug.php?id=76449 https://bugs.php.net/bug.php?id=76450 https://bugs.php.net/bug.php?id=76452 https://github.com/php/php-src/commit/1edd284cd56ce4c23f6fdf66050e4a722e6515c5 https://github.com/php/php-src/commit/8cb87aabba0b2e284428aabca13401d1ad54bc97 https://github.com/php/php-src/commit/921f320ec2baabd24e5ff182d9fb73092eb28676 https://github.com/php/php-src/commit/c8620a753114fac789016a4e6ae9c9b1210be10f https://github.com/php/php-src/commit/1d4c3114afe8f7dde51f917cd14dc4600a3a40f0 https://github.com/php/php-src/commit/922ea3419923c74471f01ff8c6ea30f0a07d8e19 https://github.com/php/php-src/commit/08fc2960bccd4f04031d10099c82cf8d76cfa501 https://github.com/php/php-src/commit/e92d5edeeeed809bc3a06b165e4f0a63bcabdb92 https://bugs.php.net/bug.php?id=81122 https://github.com/php/php-src/commit/5a1fe88ac120d71064bdd314dce1e49c86ff0585 https://github.com/php/php-src/commit/5cea97e083448aaa2352320612541c895178b3b5 https://security.archlinux.org/CVE-2021-21704 https://security.archlinux.org/CVE-2021-21705 . Several vulnerabilities detected in the php7 distribution on Arch Linux may result in service outages and inadequate validation concerns.. Arch Linux, php7, denial of service, security advisory, validation issues. . Severity: Medium. LinuxSecurity.com Team
Jul 09, 2021
•Medium
ArchLinux
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!