Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -6 articles for you...
197
security advisorycriticaldebianDebian 8: DLA-1512-1 Critical: Open Redirect XSS in Sympa
An Open Redirect vulnerability has been discovered in sympa. The "referer" parameter of the wwsympa.fcgi login action can result in Open redirection and potential Cross Site Scripting via data URIs. . Package : sympa Version : 6.1.23~dfsg-2+deb8u3 CVE ID : CVE-2018-1000671 Debian Bug : 908165 An Open Redirect vulnerability has been discovered in sympa. The "referer" parameter of the wwsympa.fcgi login action can result in Open redirection and potential Cross Site Scripting via data URIs. This attack appear to be exploitable via Victim browser opening a crafted URL supplied by the attacker. For Debian 8 "Jessie", this problem has been fixed in version 6.1.23~dfsg-2+deb8u3. We recommend that you upgrade your sympa packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . A significant Open Redirect flaw in sympa could result in XSS attacks. Please update to version 6.1.23~dfsg-2+deb8u3 for resolution.. Open Redirect, XSS Exploit, Debian 8, Sympa Security, Security Update. . Severity: Critical. LinuxSecurity.com Team
Sep 21, 2018
•Critical
Debian LTS
91
security advisorysquirrelmailgentoo linuxGentoo: 202112-15 Critical: SquirrelMail XSS Vulnerability Alert
Squirrelmail fails to properly sanitize user input, which could lead to a compromise of webmail accounts.. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200406-08 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Squirrelmail: Another XSS vulnerability Date: June 15, 2004 Bugs: #52434 ID: 200406-08 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Squirrelmail fails to properly sanitize user input, which could lead to a compromise of webmail accounts. Background ========= SquirrelMail is a webmail package written in PHP. It supports IMAP and SMTP, and can optionally be installed with SQL support. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 mail-client/squirrelmail = 1.4.3 Description ========== A new cross-site scripting (XSS) vulnerability in Squirrelmail-1.4.3_rc1 has been discovered. In functions/mime.php Squirrelmail fails to properly sanitize user input. Impact ===== By enticing a user to read a specially crafted e-mail, an attacker can execute arbitrary scripts running in the context of the victim's browser. This could lead to a compromise of the user's webmail account, cookie theft, etc. Workaround ========= There is no known workaround at this time. Resolution ========= All SquirrelMail users should upgrade to the latest stable version: # emerge sync # emerge -pv "> =mail-client/squirrelmail-1.4.3" # emerge "> =mail-client/squirrelmail-1.4.3" References ========= [ 1 ]RS-Labs Advisory http://www.rs-labs.com/adv/RS-Labs-Advisory-2004-1.txt [ 2 ] CERT description of XSS https://www.sei.cmu.edu/library/2000-cert-advisories/ Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200406-08 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Jun 15, 2004
•Critical
Gentoo
100
security advisorymoderateSuSESuSE: 2002:036 Moderate: mod_php4 Remote Escalation And XSS Threat
Multiple vulnerabilities including improper behavior and XSS exploits have been fixed.. ______________________________________________________________________________ SuSE Security Announcement Package: mod_php4 Announcement-ID: SuSE-SA:2002:036 Date: Friday, Oct 4th 2002 10:30 MEST Affected products: 7.0, 7.1, 7.2, 7.3, 8.0 SuSE eMail Server 3.1 SuSE eMail Server III SuSE Linux Enterprise Server SuSE Linux Connectivity Server SuSE Linux Office Server Vulnerability Type: remote privilege escalation Severity (1-10): 5 SuSE default package: no Cross References: CAN-2002-0985 Content of this advisory: 1) security vulnerability resolved: - control char injection in mail() - handling 5th argument of mail() while in "safe mode" - CRLF injection 2) pending vulnerabilities, solutions, workarounds: - glibc - ghostview/kghostview - fetchmail - kdelibs - ethereal 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information PHP is a well known and widely used web programming language. If a PHP script runs in "safe mode" several restrictions are applied to it including limits on execution of external programs. An attacker can pass shell meta-characters or sendmail(8) command line options via the 5th argument (introduced in version 4.0.5) of the mail() function to execute shell commands or control the behavior of sendmail(8). The CRLF injection vulnerabilities in fopen(), file(), header(), ... allow an attacker to bypassACLs or trigger cross-side scripting. The mod_php4 package is not installed by default. A temporary fix is not known. Please note, that the following packages were rebuild too: - mod_php4-core - mod_php4-aolserver - mod_php4-devel - mod_php4-servlet - mod_php4-roxen Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. Our maintenance customers are being notified individually. The packages are being offered to install from the maintenance web. i386 Intel Platform: SuSE-8.0 00ce030f55f4d0af32528402a5cbe269 SuSE-8.0 3399c5b577464a282c85a6fcb56be915 source rpm: 730c4b802dd14b9f9fc0ce2bb83fdc4e SuSE-7.3 c82972d8b1933a388adb6669e625835f source rpm: 8a8bf1262e11f4adbfa973b1ba9c9b54 SuSE-7.2 b93a3680eef353f3e16de8f7dd13dfb8 source rpm: 3304dae258e667a56b6d095eb552016f SuSE-7.1 8a829c7fd56622b736a7f538e2d8cc3c source rpm: 23e6b8d1f2128dd4885f85d939646078 SuSE-7.0 99e3e87bf1f18a839f2b1a2f80c3f336 source rpm: 68013bd4050dff75267cdde07894e5d8 Sparc Platform: SuSE-7.3 397044fb23b60f444fcb6b76986027bf source rpm: 431de04e4b31cf939e0cb9a1881c9e72 SuSE-7.1 a6146130f0c20821696406e62ab22863 source rpm: e1019229ec79ea7175f188ecc348e2b6 AXP Alpha Platform: SuSE-7.1 8010e1ef878dd366bb3dcce07b5c8a99 source rpm: 7906462b3a64d505dc78e298512312de SuSE-7.0 55e770e7a01a680e3a776bb085d91254 source rpm: 0e6654da0c43f3170ddcf0b132ae9ac3 PPC Power PC Platform: SuSE-7.3 52421717b8fdd0c9ee4d96d3f0bb1e89 source rpm: df7274f651888c62ad3693d3672ccc00 SuSE-7.1 b43d618d2eba73477dd8f9e2d2215118 source rpm: f9457dc7736cdfecaa2e4a7a01c0c53f SuSE-7.0 56d6fb88d0032f5dcc12397f295e42b2 source rpm: b684c0aa03ec7ec9c8d75f5558bbea1e ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - glibc Client applications which use res_search/res_nsreach and/or res_query()/ res_nquery() of libresolv could trigger a DNS decoding error, a SEGV or leak information by reading beyond the end of a too small 'answer' buffer. The update packages are being built and tested. We will publish a security announcement as soon as they are ready. - ghostview/kghostview Bufferoverflows have recently been discovered in these packages. They allow attackers to execute arbitrary code with the privileges of the user viewing special crafted documents created by the attacker. New packgaes will soon be available on our ftp servers. - fetchmail Fetchmail contains remotely exploitable overflows in the mail header parsing functions. In depth discussion of these problems can be found at . New packages will soon be available on our ftp servers. - kdelibs KDE's SSL implementation fails to check the trust chain in SSL certificates. This bug allows faking valid SSL certificates. New KDE packages will be available soon to fix this and other bugs. - ethereal Several potential security issues have been discovered in ethereal 0.9.4. After this package is tested succesfuly it will be relased. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages areavailable on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key
Oct 07, 2002
SuSE
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!