Explore top 10 tips to secure your open-source projects now. Read More
×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found -5 articles for you...
197
security advisoryDebianweb managementDebian 9: DLA-2889-1 Critical: Drupal 7 jQuery Security Fix
The Drupal project includes a very old version of jQuery. Security vulnerabilities leading to cross-site scripting attacks in different components of the jQuery UI libraries were found and fixed for Drupal version 7.86. . Package : drupal7 Version : 7.52-2+deb9u17 CVE ID : CVE-2021-41182 CVE-2021-41183 CVE-2016-7103 CVE-2010-5312 The Drupal project includes a very old version of jQuery. Security vulnerabilities leading to cross-site scripting attacks in different components of the jQuery UI libraries were found and fixed for Drupal version 7.86. The fixes for said vulnerabilities were backported to the version in Debian 9 Stretch (7.52). Drupal is a rich Web content management system; it was included in Debian until Stretch, but is not present in any newer releases. If you run a web server with Drupal7, we strongly recommend you to upgrade the drupal7 package. For the detailed security status of drupal7 please refer to its security tracker page at: Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Security advisory for Drupal 7.52 focuses on jQuery weakness mitigation to thwart cross-site scripting threats. Prompt upgrade advised.. Drupal Security Update, jQuery Patch, Debian LTS Advisory. . Severity: Critical. LinuxSecurity.com Team
Jan 19, 2022
•Critical
Debian LTS
89
security advisorysoftware updateFedoraFedora 21: phpMyAdmin Security Update for CVE-2015-7873 Critical Issue
phpMyAdmin 4.5.1.0 (2015-10-23) argument supplied for foreach() - array_key_exists() expects parameter 2 to be array - Notice Undefined index: drop_database - Server variable edition in ANSI_QUOTES sql_mode: losing current value - Propose table structure broken - phpMyAdmin suggests upgrading to newer version not usable on that system -. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2015-5c06260c4b 2015-11-10 19:03:39.458781 -------------------------------------------------------------------------------- Name : phpMyAdmin Product : Fedora 21 Version : 4.5.1 Release : 1.fc21 URL : https://www.phpmyadmin.net/ Summary : Handle the administration of MySQL over the World Wide Web Description : phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the World Wide Web. Most frequently used operations are supported by the user interface (managing databases, tables, fields, relations, indexes, users, permissions), while you still have the ability to directly execute any SQL statement. Features include an intuitive web interface, support for most MySQL features (browse and drop databases, tables, views, fields and indexes, create, copy, drop, rename and alter databases, tables, fields and indexes, maintenance server, databases and tables, with proposals on server configuration, execute, edit and bookmark any SQL-statement, even batch-queries, manage MySQL usersand privileges, manage stored procedures and triggers), import data from CSV and SQL, export data to various formats: CSV, SQL, XML, PDF, OpenDocument Text and Spreadsheet, Word, Excel, LATEX and others, administering multiple servers, creating PDF graphics of your database layout, creating complex queries using Query-by-example (QBE), searching globally in a database or a subset of it, transforming stored data into any format using a set of predefined functions, like displaying BLOB-data as image or download-link and muchmore... -------------------------------------------------------------------------------- Update Information: phpMyAdmin 4.5.1.0 (2015-10-23) =============================== - Invalid argument supplied for foreach() - array_key_exists() expects parameter 2 to be array - Notice Undefined index: drop_database - Server variable edition in ANSI_QUOTES sql_mode: losing current value - Propose table structure broken - phpMyAdmin suggests upgrading to newer version not usable on that system - 'PMA_Microhistory' is undefined - Incorrect definition for getTablesWhenOpen() - Error when creating new user on MariaDB 10.0.21 - Notice on htmlspecialchars() - Notice in Structure page of views - AUTO_INCREMENT always exported when IF NOT EXISTS is on - Some partitions are missing in copied table - Notice of undefined variable when performing SHOW CREATE - Error exporting sql query results with table alias - SQL editing window does not recognise 'OUTER' keyword in 'LEFT OUTER JOIN' - "NOT IN" clause not recognized (MySQL 5.6 and 5.7) - Yellow star does not change in database Structure after add/remove from favorites - Invalid SQL in table definition when exporting table - Foreign key to other database's tables fails - Bug while exporting results when a joined table field name is in SELECT query - Strange behavior on table rename - Rename table does not result in refresh in left panel - Missing arguments for PMA_Table::generateAlter() - Notices about undefined indexes on structure pages of information_schema tables - Change minimum PHP version for Composer - Import parser and backslash - "Visualize GIS data" seems to be broken - Confirm box on "Reset slave" option - Fix cookies clearing on version change - Cannot execute SQL with subquery - Incorrect syntax creating a user using mysql_native_password with MariaDB - Cannot use third party auth plugins -------------------------------------------------------------------------------- References: [ 1 ] Bug #1275108 - CVE-2015-7873 phpMyAdmin: Content spoofing on url.php(PMASA-2015-5) https://bugzilla.redhat.com/show_bug.cgi?id=1275108 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update phpMyAdmin' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Nov 10, 2015
•Critical
Fedora
98
security advisoryXSSbug fixRed Hat 5: RHSA-2012:0151-03 Moderate: Conga Update Fixing XSS Issues
Updated conga packages that fix multiple security issues, several bugs, and add one enhancement are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate [More...]. ==================================================================== Red Hat Security Advisory Synopsis: Moderate: conga security, bug fix, and enhancement update Advisory ID: RHSA-2012:0151-03 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2012:0151.html Issue date: 2012-02-21 CVE Names: CVE-2010-1104 CVE-2011-1948 ==================================================================== 1. Summary: Updated conga packages that fix multiple security issues, several bugs, and add one enhancement are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: RHEL Clustering (v. 5 server) - i386, ia64, ppc, x86_64 3. Description: The conga packages provide a web-based administration tool for remote cluster and storage management. Multiple cross-site scripting (XSS) flaws were found in luci, the conga web-based administration application. If a remote attacker could trick a user, who was logged into the luci interface, into visiting a specially-crafted URL, it would lead to arbitrary web script execution in the context of the user's luci session. (CVE-2010-1104, CVE-2011-1948) These updated conga packages include several bug fixes and an enhancement. Space precludes documenting all of these changes in this advisory. Usersare directed to the Red Hat Enterprise Linux 5.8 Technical Notes, linked to in the References, for information on the most significant of these changes. Users of conga areadvised to upgrade to these updated packages, which correct these issues and add this enhancement. After installing the updated packages, luci must be restarted ("service luci restart") for the update to take effect. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/kb/docs/DOC-11259 5. Bugs fixed (http://bugzilla.redhat.com/): 577019 - CVE-2010-1104 zope: XSS on error page 711494 - CVE-2011-1948 plone: A reflected cross site scripting vulnerability 723188 - Luci does not allow to modify __max_restarts and __restart_expire_time for independent subtrees, only for non-critical resources. 755935 - luci_admin man page is misleading 755941 - luci_admin restore is not consistent 6. Package List: RHEL Clustering (v. 5 server): Source: i386: conga-debuginfo-0.12.2-51.el5.i386.rpm luci-0.12.2-51.el5.i386.rpm ricci-0.12.2-51.el5.i386.rpm ia64: conga-debuginfo-0.12.2-51.el5.ia64.rpm luci-0.12.2-51.el5.ia64.rpm ricci-0.12.2-51.el5.ia64.rpm ppc: conga-debuginfo-0.12.2-51.el5.ppc.rpm luci-0.12.2-51.el5.ppc.rpm ricci-0.12.2-51.el5.ppc.rpm x86_64: conga-debuginfo-0.12.2-51.el5.x86_64.rpm luci-0.12.2-51.el5.x86_64.rpm ricci-0.12.2-51.el5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key#package 7. References: https://access.redhat.com/security/cve/CVE-2010-1104 https://access.redhat.com/security/cve/CVE-2011-1948 https://access.redhat.com/security/updates/classification#moderate https://access.redhat.com/search/ 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2012 Red Hat, Inc. . Delve into the Red Hat announcement highlighting essential updates for conga, which includesignificant security patches and crucial bug remediation.. Conga Update, Red Hat Security, Bug Fixes, Web Management. . LinuxSecurity.com Team
Feb 21, 2012
Red Hat
87
security advisorycriticalDebianDebian DSA 1371-1 Urgent: phpMyAdmin Flaw Leads to Remote DOS Vulnerability
Several remote vulnerabilities have been discovered in phpMyAdmin, a program to administrate MySQL over the web. The PMA_ArrayWalkRecursive function in libraries/common.lib.php does not limit recursion on arrays provided by users, which allows context-dependent attackers to cause a denial of service (web server crash) via an array with many dimensions. . - --------------------------------------------------------------------------Debian Security Advisory DSA 1370-2
Sep 10, 2007
•Critical
Debian
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!