Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 0 articles for you...
89
security advisorycritical issuefedoraFedora 40: 2024-2e908e829a Critical: Roundcubemail XSS Issues
Version 1.6.8 Managesieve: Protect special scripts in managesieve_kolab_master mode Fix newmail_notifier notification focus in Chrome (#9467) Fix fatal error when parsing some TNEF attachments (#9462) Fix double scrollbar when composing a mail with many plain text lines (#7760). -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2024-2e908e829a 2024-08-15 02:33:16.252055 -------------------------------------------------------------------------------- Name : roundcubemail Product : Fedora 40 Version : 1.6.8 Release : 1.fc40 URL : https://roundcube.net/ Summary : Round Cube Webmail is a browser-based multilingual IMAP client Description : RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in PHP and requires a database: MySQL, PostgreSQL and SQLite are known to work. The user interface is fully skinnable using XHTML and CSS 2. -------------------------------------------------------------------------------- Update Information: Version 1.6.8 Managesieve: Protect special scripts in managesieve_kolab_master mode Fix newmail_notifier notification focus in Chrome (#9467) Fix fatal error when parsing some TNEF attachments (#9462) Fix double scrollbar when composing a mail with many plain text lines (#7760) Fix decoding mail parts with multiple base64-encoded text blocks (#9290) Fix bug where some messages could get malformed in an import from a MBOX file (#9510) Fix invalid line break characters in multi-line text in Sieve scripts (#9543) Fix bug where "with attachment" filter could fail on some fts engines (#9514) Fix bug where an unhandled exception was caused by an invalid image attachment (#9475) Fix bug where a long subject title could not bedisplayed in some cases (#9416) Fix infinite loop when parsing malformed Sieve script (#9562) Fix bug where imap_conn_option's 'socket' was ignored (#9566) Fix XSS vulnerability in post-processing of sanitized HTML content CVE-2024-42009 Fix XSS vulnerability in serving of attachments other than HTML or SVG CVE-2024-42008 Fix information leak (access to remote content) via insufficient CSS filtering CVE-2024-42010 -------------------------------------------------------------------------------- ChangeLog: * Mon Aug 5 2024 Remi Collet - 1.6.8-1 - update to 1.6.8 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2303071 - CVE-2024-42008 roundcubemail: A Cross-Site Scripting vulnerability in rcmail_action_mail_get-> run() in Roundcube [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2303071 [ 2 ] Bug #2303076 - CVE-2024-42009 roundcubemail: A Cross-Site Scripting vulnerability in Roundcube [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2303076 [ 3 ] Bug #2303096 - CVE-2024-42010 roundcubemail: information leak due to insufficient CSS filtering [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2303096 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-2e908e829a' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Aug 15, 2024
•Critical
Fedora
100
security advisorysecurity updateimportantSUSE: 2024:0512-1 Important: Golang Alertmanager XSS Issue Fix
* bsc#1218838 * jsc#MSQA-719 * jsc#PED-7353 Cross-References: . # Security update for golang-github-prometheus-alertmanager Announcement ID: SUSE-SU-2024:0512-1 Rating: important References: * bsc#1218838 * jsc#MSQA-719 * jsc#PED-7353 Cross-References: * CVE-2023-40577 CVSS scores: * CVE-2023-40577 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2023-40577 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: * openSUSE Leap 15.3 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 * SUSE Linux Enterprise Desktop 15 SP1 * SUSE Linux Enterprise Desktop 15 SP2 * SUSE Linux Enterprise Desktop 15 SP3 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise High Performance Computing 15 * SUSE Linux Enterprise High Performance Computing 15 SP1 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP6 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP1 * SUSE Linux Enterprise Real Time 15 SP2 * SUSE Linux Enterprise Real Time 15 SP3 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 * SUSE Linux Enterprise Server 15 SP1 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE LinuxEnterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Manager Client Tools for SLE 15 * SUSE Manager Proxy 4.3 * SUSE Manager Proxy 4.3 Module 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Package Hub 15 15-SP5 An update that solves one vulnerability and contains two features can now be installed. ## Description: This update for golang-github-prometheus-alertmanager fixes the following issues: golang-github-prometheus-alertmanager was updated from version 0.23.0 to 0.26.0 (jsc#PED-7353): * Version 0.26.0: * Security fixes: * CVE-2023-40577: Fix stored XSS via the /api/v1/alerts endpoint in the Alertmanager UI (bsc#1218838) * Other changes and bugs fixed: * Configuration: Fix empty list of receivers and inhibit_rules would cause the alertmanager to crash * Templating: Fixed a race condition when using the title function. It is now race-safe * API: Fixed duplicate receiver names in the api/v2/receivers API endpoint * API: Attempting to delete a silence now returns the correct status code, 404 instead of 500 * Clustering: Fixes a panic when tls_client_config is empty * Webhook: url is now marked as a secret. It will no longer show up in the logs as clear-text * Metrics: New label reason for alertmanager_notifications_failed_total metric to indicate the type of error of the alert delivery * Clustering: New flag --cluster.label, to help to block any traffic that is not meant for the cluster * Integrations: Add Microsoft Teams as a supported integration * Version 0.25.0: * Fail configuration loading if api_key and api_key_file are defined at the same time * Fix the alertmanager_alerts metric to avoid counting resolved alerts as active. Also added a new alertmanager_marked_alerts metric that retain the old behavior * Trim contents of Slack API URLs when reading from files * amtool: Avoid panic when the label value matcher is empty * Fail configuration loading if api_url is empty for OpsGenie * Fix email template forresolved notifications * Add proxy_url support for OAuth2 in HTTP client configuration * Reload TLS certificate and key from disk when updated * Add Discord integration * Add Webex integration * Add min_version support to select the minimum TLS version in HTTP client configuration * Add max_version support to select the maximum TLS version in HTTP client configuration * Emit warning logs when truncating messages in notifications * Support HEAD method for the /-/healty and /-/ready endpoints * Add support for reading global and local SMTP passwords from files * UI: Add 'Link' button to alerts in list * UI: Allow to choose the first day of the week as Sunday or Monday * Version 0.24.0: * Fix HTTP client configuration for the SNS receiver * Fix unclosed file descriptor after reading the silences snapshot file * Fix field names for mute_time_intervals in JSON marshaling * Ensure that the root route doesn't have any matchers * Truncate the message's title to 1024 chars to avoid hitting Slack limits * Fix the default HTML email template (email.default.html) to match with the canonical source * Detect SNS FIFO topic based on the rendered value * Avoid deleting and recreating a silence when an update is possible * api/v2: Return 200 OK when deleting an expired silence * amtool: Fix the silence's end date when adding a silence. The end date is (start date + duration) while it used to be (current time + duration). The new behavior is consistent with the update operation * Add the /api/v2 prefix to all endpoints in the OpenAPI specification and generated client code * Add --cluster.tls-config experimental flag to secure cluster traffic via mutual TLS * Add Telegram integration ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Manager Proxy 4.3 Module 4.3 zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Proxy-4.3-2024-512=1 *openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-512=1 * SUSE Manager Client Tools for SLE 15 zypper in -t patch SUSE-SLE-Manager-Tools-15-2024-512=1 * SUSE Package Hub 15 15-SP5 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2024-512=1 ## Package List: * SUSE Manager Proxy 4.3 Module 4.3 (aarch64 ppc64le s390x x86_64) * golang-github-prometheus-alertmanager-0.26.0-150100.4.19.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * golang-github-prometheus-alertmanager-0.26.0-150100.4.19.1 * SUSE Manager Client Tools for SLE 15 (aarch64 ppc64le s390x x86_64) * golang-github-prometheus-alertmanager-0.26.0-150100.4.19.1 * SUSE Package Hub 15 15-SP5 (aarch64 ppc64le s390x x86_64) * golang-github-prometheus-alertmanager-0.26.0-150100.4.19.1 ## References: * https://www.suse.com/security/cve/CVE-2023-40577.html * https://bugzilla.suse.com/show_bug.cgi?id=1218838 * * . Essential SUSE enhancement for golang-github-prometheus-alertmanager tackling a significant XSS vulnerability through an updated version.. SUSE Update, Golang Security, Prometheus Alertmanager, XSS Fix. . Severity: Important. LinuxSecurity.com Team
Feb 15, 2024
•Important
SuSE
202
security advisoryimportant updateopenSUSEopenSUSE: 2023:3229-1 Important XSS Fix For Rubygem-Actionpack-5_1
This update for rubygem-actionpack-5_1 fixes the following issues: CVE-2023-28362: Fixed possible XSS via User Supplied Values to redirect_to (bsc#1213312).. # Security update for rubygem-actionpack-5_1 Announcement ID: SUSE-SU-2023:3229-1 Rating: important References: * #1213312 Cross-References: * CVE-2023-28362 CVSS scores: * CVE-2023-28362 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise High Availability Extension 15 SP1 * SUSE Linux Enterprise High Availability Extension 15 SP2 * SUSE Linux Enterprise High Availability Extension 15 SP3 * SUSE Linux Enterprise High Availability Extension 15 SP4 * SUSE Linux Enterprise High Availability Extension 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP1 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Server 15 SP1 * SUSE Linux Enterprise Server 15 SP1 Business Critical Linux 15-SP1 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP2 Business Critical Linux 15-SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 Business Critical Linux 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.0 * SUSE Manager Proxy 4.1 * SUSE Manager Proxy 4.2 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.0 * SUSE Manager Retail Branch Server 4.1 * SUSE Manager Retail BranchServer 4.2 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.0 * SUSE Manager Server 4.1 * SUSE Manager Server 4.2 * SUSE Manager Server 4.3 An update that solves one vulnerability can now be installed. ## Description: This update for rubygem-actionpack-5_1 fixes the following issues: * CVE-2023-28362: Fixed possible XSS via User Supplied Values to redirect_to (bsc#1213312). ## Patch Instructions: To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3229=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3229=1 * SUSE Linux Enterprise High Availability Extension 15 SP1 zypper in -t patch SUSE-SLE-Product-HA-15-SP1-2023-3229=1 * SUSE Linux Enterprise High Availability Extension 15 SP2 zypper in -t patch SUSE-SLE-Product-HA-15-SP2-2023-3229=1 * SUSE Linux Enterprise High Availability Extension 15 SP3 zypper in -t patch SUSE-SLE-Product-HA-15-SP3-2023-3229=1 * SUSE Linux Enterprise High Availability Extension 15 SP4 zypper in -t patch SUSE-SLE-Product-HA-15-SP4-2023-3229=1 * SUSE Linux Enterprise High Availability Extension 15 SP5 zypper in -t patch SUSE-SLE-Product-HA-15-SP5-2023-3229=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.18.1 * ruby2.5-rubygem-actionpack-doc-5_1-5.1.4-150000.3.18.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.18.1 * ruby2.5-rubygem-actionpack-doc-5_1-5.1.4-150000.3.18.1 * SUSE Linux Enterprise High Availability Extension 15 SP1 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.18.1 * SUSE Linux Enterprise High Availability Extension 15 SP2 (aarch64 ppc64le s390x x86_64) *ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.18.1 * SUSE Linux Enterprise High Availability Extension 15 SP3 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.18.1 * SUSE Linux Enterprise High Availability Extension 15 SP4 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.18.1 * SUSE Linux Enterprise High Availability Extension 15 SP5 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.18.1 ## References: * https://www.suse.com/security/cve/CVE-2023-28362.html * https://bugzilla.suse.com/show_bug.cgi?id=1213312 . Important patch for rubygem-actionpack-5_1 tackling XSS vulnerabilities. Ensure your security with timely updates from openSUSE.. rubygem-actionpack-5_1, openSUSE, important security update, XSS fix, CVE-2023-28362. . Severity: Important. LinuxSecurity.com Team
Aug 08, 2023
•Important
OpenSUSE
89
security advisorymoderatefedoraFedora 37: FEDORA-2023-e363201a4c Moderate: XSS Fix in Phoronix Test Suite
Security fix for CVE-2022-40704. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2023-e363201a4c 2023-01-12 01:50:48.921911 --------------------------------------------------------------------------------Name : phoronix-test-suite Product : Fedora 37 Version : 10.8.4 Release : 2.fc37 URL : http://phoronix-test-suite.com/ Summary : An Automated, Open-Source Testing Framework Description : The Phoronix Test Suite is the most comprehensive testing and benchmarking platform available for the Linux operating system. This software is designed to effectively carry out both qualitative and quantitative benchmarks in a clean, reproducible, and easy-to-use manner. The Phoronix Test Suite consists of a lightweight processing core (pts-core) with each benchmark consisting of an XML-based profile with related resource scripts. The process from the benchmark installation, to the actual benchmarking, to the parsing of important hardware and software components is heavily automated and completely repeatable, asking users only for confirmation of actions. --------------------------------------------------------------------------------Update Information: Security fix for CVE-2022-40704 --------------------------------------------------------------------------------ChangeLog: * Wed Jan 11 2023 Michel Alexandre Salim 10.8.4-2 - Backport fix for CVE-2022-40704 --------------------------------------------------------------------------------References: [ 1 ] Bug #2150776 - CVE-2022-40704 phoronix-test-suite: XSS in phoromatic_r_add_test_details.php https://bugzilla.redhat.com/show_bug.cgi?id=2150776 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-e363201a4c' at the command line. For more information, refer to the dnf documentation availableat https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Jan 12, 2023
Fedora
89
security advisorymoderatefedoraFedora 35: 2022-d7347d9432 Moderate: Roundcube XSS Security Fix
This is the second service release to update the new stable version 1.5. It provides a bunch of small fixes and improvements to the OAuth feature as well as a security fix to a recently reported XSS vulnerability. See the full changelog in the [release notes](https://github.com/roundcube/roundcubemail/releases/tag/1.5.2) on the. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-d7347d9432 2022-01-12 01:22:50.089534 --------------------------------------------------------------------------------Name : roundcubemail Product : Fedora 35 Version : 1.5.2 Release : 1.fc35 URL : https://roundcube.net/ Summary : Round Cube Webmail is a browser-based multilingual IMAP client Description : RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in PHP and requires a database: MySQL, PostgreSQL and SQLite are known to work. The user interface is fully skinnable using XHTML and CSS 2. --------------------------------------------------------------------------------Update Information: This is the second service release to update the new stable version 1.5. It provides a bunch of small fixes and improvements to the OAuth feature as well as a security fix to a recently reported XSS vulnerability. See the full changelog in the [release notes](https://github.com/roundcube/roundcubemail/releases/tag/1.5.2) on the Github download page. **Security fix** * Cross-site scripting (XSS) via HTML messages with malicious CSS content This release is considered stable and we recommend to update all productive installations of Roundcube with this version. --------------------------------------------------------------------------------ChangeLog: * Thu Dec 30 2021 RemiCollet - 1.5.2-1 - update to 1.5.2 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-d7347d9432' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Jan 11, 2022
•Important
Fedora
202
security advisorysecurity patchimportant updateopenSUSE 15 SP2: 2021:0942-1 Important xss Patch for RoundcubeMail
An update that fixes three vulnerabilities is now available. . openSUSE Security Update: Security update for roundcubemail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0942-1 Rating: important References: #1180399 #1187706 #1187707 Cross-References: CVE-2020-18670 CVE-2020-18671 CVE-2020-35730 CVSS scores: CVE-2020-18670 (NVD) : 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVE-2020-18671 (NVD) : 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVE-2020-35730 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for roundcubemail fixes the following issues: Upgrade to version 1.3.16 This is a security update to the LTS version 1.3. It fixes a recently reported stored cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content. References: - CVE-2020-18670: Cross Site Scripting (XSS) vulneraibility via database host and user in /installer/test.php (boo#1187707) - CVE-2020-18671: Cross Site Scripting (XSS) vulnerability via smtp config in /installer/test.php (boo#1187706) - CVE-2020-35730: cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content (boo#1180399) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-942=1 Package List: - openSUSE Backports SLE-15-SP2 (noarch): roundcubemail-1.3.16-bp152.4.6.1 References: https://www.suse.com/security/cve/CVE-2020-18670.html https://www.suse.com/security/cve/CVE-2020-18671.html https://www.suse.com/security/cve/CVE-2020-35730.html https://bugzilla.suse.com/1180399 https://bugzilla.suse.com/1187706 https://bugzilla.suse.com/1187707 . Critical openSUSE update for Roundcube Mail addresses significant concerns, such as XSS vulnerabilities along with necessary patches.. openSUSE Update, RoundcubeMail Security, XSS Exploit Fix, Important Security Patch. . Severity: Important. LinuxSecurity.com Team
Jun 30, 2021
•Important
OpenSUSE
89
security advisorymoderatefedoraFedora 33: FEDORA-2021-431b232659 Moderate: Moodle XSS Issue
Fixes for multiple CVEs. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2021-431b232659 2021-03-23 01:31:48.604577 --------------------------------------------------------------------------------Name : moodle Product : Fedora 33 Version : 3.9.5 Release : 1.fc33 URL : https://moodle.org/ Summary : A Course Management System Description : Moodle is a course management system (CMS) - a free, Open Source software package designed using sound pedagogical principles, to help educators create effective online learning communities. --------------------------------------------------------------------------------Update Information: Fixes for multiple CVEs --------------------------------------------------------------------------------ChangeLog: * Mon Mar 15 2021 Gwyn Ciesla - 3.9.5-1 - 3.9.5 --------------------------------------------------------------------------------References: [ 1 ] Bug #1939035 - CVE-2021-20279 moodle: Stored XSS via ID number user profile field [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1939035 [ 2 ] Bug #1939039 - CVE-2021-20280 moodle: Stored XSS and blind SSRF possible via feedback answer text [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1939039 [ 3 ] Bug #1939047 - CVE-2021-20281 moodle: User full name disclosure within online users block [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1939047 [ 4 ] Bug #1939049 - CVE-2021-20282 moodle: Bypass email verification secret when confirming account registration [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1939049 [ 5 ] Bug #1939053 - CVE-2021-20283 moodle: Fetching a user's enrolled courses via web services did not check profile access in each course [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1939053 --------------------------------------------------------------------------------This update can beinstalled with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2021-431b232659' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Mar 22, 2021
Fedora
202
security advisorymoderatesecurity updateopenSUSE Leap 15.2: Crucial XSS Security Fix for Django REST Framework
An update that fixes one vulnerability is now available. . openSUSE Security Update: Security update for python-djangorestframework ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0322-1 Rating: important References: #1177205 Cross-References: CVE-2020-25626 CVSS scores: CVE-2020-25626 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2020-25626 (SUSE): 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-djangorestframework fixes the following issues: Update to 3.11.2 * Security: Drop urlize_quoted_links template tag in favour of Django's built-in urlize. Removes a XSS vulnerability for some kinds of content in the browsable API. (boo#1177205, CVE-2020-25626) * update Django for APIs book to 3.0 edition * decode base64 credentials as utf8; adjust tests * Remove compat urls for Django < 2.0 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-322=1 Package List: - openSUSE Leap 15.2 (noarch): python3-djangorestframework-3.11.2-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-25626.html https://bugzilla.suse.com/1177205 . A significant openSUSE patch addresses a serious XSS vulnerability in python-djangorestframework. Discover further details.. openSUSE Update, Python Security Patch, Django REST Framework. . Severity: Important. LinuxSecurity.com Team
Feb 21, 2021
•Important
OpenSUSE
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!