Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Header injection via default_mimetype / default_charset mbstring may use pointer from some previous request Unexpected behavior with arrays and JIT Special character is breaking the path in xml function (CVE-2021-21707) XMLReader::getParserProperty may throw with a valid property . MGASA-2021-0519 - Updated php packages fix security vulnerability Publication date: 20 Nov 2021 URL: https://advisories.mageia.org/MGASA-2021-0519.html Type: security Affected Mageia releases: 8 CVE: CVE-2021-21707 Header injection via default_mimetype / default_charset mbstring may use pointer from some previous request Unexpected behavior with arrays and JIT Special character is breaking the path in xml function (CVE-2021-21707) XMLReader::getParserProperty may throw with a valid property References: - https://bugs.mageia.org/show_bug.cgi?id=29673 - https://www.php.net/ChangeLog-8.php#8.0.13 - https://www.cve.org/CVERecord?id=CVE-2021-21707 SRPMS: - 8/core/php-8.0.13-1.mga8 . Mageia 2021-0519 upgrades python components to resolve path traversal and buffer overflow vulnerabilities for improved protection.. Mageia Security Advisory, PHP Update, Header Injection, XML Issues, Moderate Severity. . LinuxSecurity.com Team
Upgrade to Ruby 2.7.3.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2021-0ea39d8eb3 2021-04-17 14:20:36.758927 --------------------------------------------------------------------------------Name : ruby Product : Fedora 32 Version : 2.7.3 Release : 136.fc32 URL : https://www.ruby-lang.org/ Summary : An interpreter of object-oriented scripting language Description : Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible. --------------------------------------------------------------------------------Update Information: Upgrade to Ruby 2.7.3. --------------------------------------------------------------------------------ChangeLog: * Wed Apr 7 2021 Pavel Valena - 2.7.3-136 - Upgrade to Ruby 2.7.3. --------------------------------------------------------------------------------References: [ 1 ] Bug #1947526 - CVE-2021-28965 ruby: XML round-trip vulnerability in REXML https://bugzilla.redhat.com/show_bug.cgi?id=1947526 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2021-0ea39d8eb3' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
An update for rh-maven35-jackson-databind is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: rh-maven35-jackson-databind security update Advisory ID: RHSA-2020:4312-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2020:4312 Issue date: 2020-10-22 CVE Names: CVE-2020-25649 ==================================================================== 1. Summary: An update for rh-maven35-jackson-databind is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) - noarch Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) - noarch Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch 3. Description: The jackson-databind package provides general data-binding functionality for Jackson, which works on top of Jackson core streaming API. Security Fix(es): * jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE) (CVE-2020-25649) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details onhow to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1887664 - CVE-2020-25649 jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE) 6. Package List: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7): Source: rh-maven35-jackson-databind-2.7.6-2.12.el7.src.rpm noarch: rh-maven35-jackson-databind-2.7.6-2.12.el7.noarch.rpm rh-maven35-jackson-databind-javadoc-2.7.6-2.12.el7.noarch.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7): Source: rh-maven35-jackson-databind-2.7.6-2.12.el7.src.rpm noarch: rh-maven35-jackson-databind-2.7.6-2.12.el7.noarch.rpm rh-maven35-jackson-databind-javadoc-2.7.6-2.12.el7.noarch.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6): Source: rh-maven35-jackson-databind-2.7.6-2.12.el7.src.rpm noarch: rh-maven35-jackson-databind-2.7.6-2.12.el7.noarch.rpm rh-maven35-jackson-databind-javadoc-2.7.6-2.12.el7.noarch.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7): Source: rh-maven35-jackson-databind-2.7.6-2.12.el7.src.rpm noarch: rh-maven35-jackson-databind-2.7.6-2.12.el7.noarch.rpm rh-maven35-jackson-databind-javadoc-2.7.6-2.12.el7.noarch.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7): Source: rh-maven35-jackson-databind-2.7.6-2.12.el7.src.rpm noarch: rh-maven35-jackson-databind-2.7.6-2.12.el7.noarch.rpm rh-maven35-jackson-databind-javadoc-2.7.6-2.12.el7.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2020-25649 https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details athttps://access.redhat.com/security/team/contact Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBX5G3l9zjgjWX9erEAQgNJw//V6i0MaE6kJf78AmcwlVreSW1RPxOKN/E x/K1urqgA74g4anadf8MRodiyk+JgL5Uujh1rGNFzMksL+U8F2XE3C5eZZu+L4lC wC+JVh1xKWRSmgVZab6GtQdUL7NvbBu4zl6lVqfdhgV7/24JJVfpvQ+s7X1m0yko vL83uZ5YVlvP7bdk4B+MF8CtyjmxOI3DhaJk0L88uTvNIVSSBCKLihQfmT5g7hB0 VnlYW1ThsnaGOvYSK1mhaWUQv3fw+xIIJ1e6xSlyVAANNI1cRuOS6502fzsn+s89 HOLUq47hPM+2YQBnj6nZi5KfaA7J+fDQfp0rsMrGzDI92nvG1FO+PhLHU/VdOESL Rwpy/dCG/Sx1499a0Tziwf1H5Dadfwpu2dIp7yNmPxHtPXUuwNJDoo9zWOggvZoR 97Syo6dfh2YxFsbshHEiFNH8siFNBsmU5dcDXD/asMNigoiIAW508ojfHhfr5yLc r42xHhBPmxnot65DNeQrwjUmibLCef3J3en0uV/OEyTgoaxlqt1Zf1uWUQ6aQxR/ Enklt1rKx8398R8UB61gRTYftaNX6md3zgWz844meG+cakEA1obWrO2Fau/67lNe NqGuFRDGGidSCL2v/WU/49AA7FReEm7wKuR/u0zbH50I4ihH7uR9DkrGvWD4soAe /o4+qVFSE74=ygzN -----END PGP SIGNATURE----- -- RHSA-announce mailing list
An update that fixes one vulnerability is now available. . SUSE Security Update: Security update for quartz ______________________________________________________________________________ Announcement ID: SUSE-SU-2020:0984-1 Rating: moderate References: #1143227 Cross-References: CVE-2019-13990 Affected Products: SUSE Linux Enterprise Module for SUSE Manager Server 4.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for quartz fixes the following issues: - CVE-2019-13990: Fixed XML External Entity attack in initDocumentParser (bsc#1143227). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for SUSE Manager Server 4.0: zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Server-4.0-2020-984=1 Package List: - SUSE Linux Enterprise Module for SUSE Manager Server 4.0 (noarch): quartz-2.3.0-4.3.1 References: https://www.suse.com/security/cve/CVE-2019-13990.html https://bugzilla.suse.com/1143227 _______________________________________________ sle-security-updates mailing list
An update for python-defusedxml and python-pysaml2 is now available for Red Hat OpenStack Platform 8.0 (Liberty). Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: python-defusedxml and python-pysaml2 security update Advisory ID: RHSA-2017:0936-01 Product: Red Hat Enterprise Linux OpenStack Platform Advisory URL: https://access.redhat.com/errata/RHSA-2017:0936 Issue date: 2017-04-12 CVE Names: CVE-2016-10149 ==================================================================== 1. Summary: An update for python-defusedxml and python-pysaml2 is now available for Red Hat OpenStack Platform 8.0 (Liberty). Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat OpenStack Platform 8.0 (Liberty) - noarch 3. Description: The defusedxml package contains several Python-only updates for security vulnerabilities in Python's XML libraries. Defusedxml functions and classes can be used instead of the originals to protect against entity-expansion and DTD-retrieval issues. PySAML2 is the python implementation of SAML Version 2, containing all the functionality for building a SAML2 service provider or an identity provider, to be used in a WSGI environment. Security Fix(es): * An XML entity expansion vulnerability was found in python-pysaml2. A remote attacker could send a crafted request which would cause denial of service through resource exhaustion. (CVE-2016-10149) 4. Solution: For details on how to apply this update, which includes thechanges described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1415710 - CVE-2016-10149 python-pysaml2: Entity expansion issue 6. Package List: Red Hat OpenStack Platform 8.0 (Liberty): Source: python-defusedxml-0.5.0-1.el7ost.src.rpm python-pysaml2-3.0.2-3.el7ost.src.rpm noarch: python-defusedxml-0.5.0-1.el7ost.noarch.rpm python-pysaml2-3.0.2-3.el7ost.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2016-10149 https://access.redhat.com/security/updates/classification#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2017 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFY7n+sXlSAg2UNWIIRAu4sAKC3MaFR/1NxH2kaxjSE5twde3xAxACgmXBk QfT2n6UvaBZ/EinRhfueD8E=A38l -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list
An update that solves two vulnerabilities and has one An update that solves two vulnerabilities and has one An update that solves two vulnerabilities and has one errata is now available. errata is now available.. SUSE Security Update: Security update for postgresql93 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:2414-1 Rating: important References: #973660 #993453 #993454 Cross-References: CVE-2016-5423 CVE-2016-5424 Affected Products: SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for postgresql93 to version 9.3.14 fixes the several issues. These security issues were fixed: - CVE-2016-5423: CASE/WHEN with inlining can cause untrusted pointer dereference (bsc#993454). - CVE-2016-5424: Fix client programs' handling of special characters in database and role names (bsc#993453). This non-security issue was fixed: - bsc#973660: Added "Requires: timezone" to Service Pack For additional non-security issues please refer to - https://www.postgresql.org/docs/9.3/release-9-3-14.html - https://www.postgresql.org/docs/9.3/release-9-3-13.html - https://www.postgresql.org/docs/9.3/release-9-3-12.html Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2016-1407=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2016-1407=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12 (noarch): postgresql93-docs-9.3.14-19.2 - SUSE LinuxEnterprise Server for SAP 12 (x86_64): postgresql93-9.3.14-19.2 postgresql93-contrib-9.3.14-19.2 postgresql93-contrib-debuginfo-9.3.14-19.2 postgresql93-debuginfo-9.3.14-19.2 postgresql93-debugsource-9.3.14-19.2 postgresql93-server-9.3.14-19.2 postgresql93-server-debuginfo-9.3.14-19.2 - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): postgresql93-9.3.14-19.2 postgresql93-contrib-9.3.14-19.2 postgresql93-contrib-debuginfo-9.3.14-19.2 postgresql93-debuginfo-9.3.14-19.2 postgresql93-debugsource-9.3.14-19.2 postgresql93-server-9.3.14-19.2 postgresql93-server-debuginfo-9.3.14-19.2 - SUSE Linux Enterprise Server 12-LTSS (noarch): postgresql93-docs-9.3.14-19.2 References: https://www.suse.com/security/cve/CVE-2016-5423.html https://www.suse.com/security/cve/CVE-2016-5424.html https://bugzilla.suse.com/973660 https://bugzilla.suse.com/993453 https://bugzilla.suse.com/993454 . SUSE Security Patch resolves critical vulnerabilities in postgresql94, particularly focusing on unvalidated pointers and the management of non-standard characters.. SUSE Security Update, postgresql security, character handling. . Severity: Important. LinuxSecurity.com Team
Two vulnerabilities were discovered in libspring-java, the Debian package for the Java Spring framework. CVE-2014-0054 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2890-1
Get the latest Linux and open source security news straight to your inbox.