Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 491
Alerts This Week
Warning Icon 1 491

Stay Secure with the Latest Linux Advisories

Opensuse Large Esm H800
openSUSE

openSUSE 2026-3139-1 sssd Important Privilege Escalation and Bypass

Calendar White Jul 21, 2026
Important
Opensuse Large Esm H900
openSUSE

openSUSE LibreOffice Important Security Issues and Updates 2026-3140-1

Calendar White Jul 21, 2026
Important
Ubuntu Large Esm H900
Ubuntu

Ubuntu 20.04 Linux Kernel Critical Privilege Escalation Issues USN-8576-1

Calendar White Jul 21, 2026
Critical
Ubuntu Large Esm H800
Ubuntu

Ubuntu 22.04 Linux Kernel Critical Issues Addressed USN-8575-1

Calendar White Jul 21, 2026
Important
Ubuntu Large Esm H900
Ubuntu

Ubuntu 24.04 LTS Linux-GCP FIPS Major Threat Update 2026-8574-1

Calendar White Jul 21, 2026
Critical
Rockylinux Esm H900
Rocky

Rocky Linux webkit2gtk3 Important Security Issues RLSA-2026-42088

Calendar White Jul 21, 2026
Important
Rockylinux Esm H800
Rocky

Rocky Linux glib2 Important Integer Underflow Threat RLSA-2026-42090

Calendar White Jul 21, 2026
Important
Debianlts Large Esm H900
Debian LTS

Debian LTS Samba Important Access Bypass Denial of Service DLA-4692-1

Calendar White Jul 21, 2026
Important
Mageia Large Esm H900
Mageia

Mageia 10 serd Important Security Bugfix Advisory 2026-0058

Calendar White Jul 20, 2026
Important
Filter%20icon Refine advisories
X Clear Filters
X Clear Filters
View More

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

More Polls

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":1,"type":"x","order":4,"pct":100,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Loading...

Explore Latest Linux Security advisories

We found 28 articles for you...
89
Ls Advisories Fedora Esm H240
Price Tag%201security advisoryfedorasoftware update

Fedora 38: FEDORA-2023-b2e5612471 Medium: Roundcubemail XSS Threat

**Release 1.6.3** - Fix bug where installto.sh/update.sh scripts were removing some essential options from the config file (#9051) - Update jQuery-UI to version 1.13.2 (#9041) - Fix regression that broke use_secure_urls feature (#9052) - Fix potential PHP fatal error when opening a message with message/rfc822 part (#8953) - Fix bug where a duplicate ` ` tag in HTML . -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2023-b2e5612471 2023-09-24 03:09:07.065625 -------------------------------------------------------------------------------- Name : roundcubemail Product : Fedora 38 Version : 1.6.3 Release : 1.fc38 URL : https://roundcube.net/ Summary : Round Cube Webmail is a browser-based multilingual IMAP client Description : RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in PHP and requires a database: MySQL, PostgreSQL and SQLite are known to work. The user interface is fully skinnable using XHTML and CSS 2. -------------------------------------------------------------------------------- Update Information: **Release 1.6.3** - Fix bug where installto.sh/update.sh scripts were removing some essential options from the config file (#9051) - Update jQuery-UI to version 1.13.2 (#9041) - Fix regression that broke use_secure_urls feature (#9052) - Fix potential PHP fatal error when opening a message with message/rfc822 part (#8953) - Fix bug where a duplicate ` ` tag in HTML email could cause some parts being cut off (#9029) - Fix bug where a list of folders could have been sorted incorrectly (#9057) - Fix regression where LDAP addressbook 'filter' option was ignored (#9061) - Fix wrong order of a multi- folder search result when sorting bysize (#9065) - Fix so install/update scripts do not require PEAR (#9037) - Fix regression where some mail parts could have been decoded incorrectly, or not at all (#9096) - Fix handling of an error case in Cyrus IMAP BINARY FETCH, fallback to non-binary FETCH (#9097) - Fix PHP8 deprecation warning in the reconnect plugin (#9083) - Fix "Show source" on mobile with x_frame_options = deny (#9084) - Fix various PHP warnings (#9098) - Fix deprecated use of ldap_connect() in password's ldap_simple driver (#9060) - Fix cross-site scripting (XSS) vulnerability in handling of linkrefs in plain text messages -------------------------------------------------------------------------------- ChangeLog: * Fri Sep 15 2023 Remi Collet - 1.6.3-1 - update to 1.6.3 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2239447 - roundcubemail: XSS vulnerability in handling of linkrefs in plain text messages https://bugzilla.redhat.com/show_bug.cgi?id=2239447 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-b2e5612471' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives:https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ Do not reply to spam, report it: . Explore the security update FEDORA-2023-b2e5612471 for roundcubemail version 1.6.3, which addresses various bug fixes and mitigates an XSS vulnerability.. Fedora Updates, Roundcube Webmail, Security Advisory, XSS Fixes, Software Update. . Severity: Medium. LinuxSecurity.com Team

Calendar%202 Sep 24, 2023 •Medium Fedora
197
Ls Advisories Deblts Esm H240
Price Tag%201security advisoryupdatedebian

Debian 10: DLA-3442-1 Moderate: Nbconvert XSS Risks Mitigated

Alvaro Muñoz from the GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert, a tool and library used to convert notebooks to various other formats via Jinja templates. . -------------------------------------------------------------------------Debian LTS Advisory DLA-3442-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/lts/security/ Guilhem Moulin June 03, 2023 https://wiki.debian.org/LTS -------------------------------------------------------------------------Package : nbconvert Version : 5.4-2+deb10u1 CVE ID : CVE-2021-32862 Alvaro Muñoz from the GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert, a tool and library used to convert notebooks to various other formats via Jinja templates. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to cross-site scripting (XSS) vulnerabilities if these HTML notebooks are served by a web server without tight Content-Security-Policy (e.g., nbviewer). * GHSL-2021-1013: XSS in notebook.metadata.language_info.pygments_lexer; * GHSL-2021-1014: XSS in notebook.metadata.title; * GHSL-2021-1015: XSS in notebook.metadata.widgets; * GHSL-2021-1016: XSS in notebook.cell.metadata.tags; * GHSL-2021-1017: XSS in output data text/html cells; * GHSL-2021-1018: XSS in output data image/svg+xml cells; * GHSL-2021-1019: XSS in notebook.cell.output.svg_filename; * GHSL-2021-1020: XSS in output data text/markdown cells; * GHSL-2021-1021: XSS in output data application/javascript cells; * GHSL-2021-1022: XSS in output.metadata.filenames image/png and image/jpeg; * GHSL-2021-1023: XSS in output data image/png and image/jpeg cells; * GHSL-2021-1024: XSS in output.metadata.width/height image/png and image/jpeg; * GHSL-2021-1025: XSS inoutput data application/vnd.jupyter.widget-state+ json cells; * GHSL-2021-1026: XSS in output data application/vnd.jupyter.widget-view+ json cells; * GHSL-2021-1027: XSS in raw cells; and * GHSL-2021-1028: XSS in markdown cells. Some of these vulnerabilities, namely GHSL-2021-1017, -1020, -1021, and -1028, are actually design decisions where text/html, text/markdown, application/JavaScript and markdown cells should allow for arbitrary JavaScript code execution. These vulnerabilities are therefore left open by default, but users can now opt-out and strip down all JavaScript elements via a new HTMLExporter option `sanitize_html`. For Debian 10 buster, this problem has been fixed in version 5.4-2+deb10u1. We recommend that you upgrade your nbconvert packages. For the detailed security status of nbconvert please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/nbconvert Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Enhance your nbconvert installations to counter XSS vulnerabilities as outlined in the Debian LTS security advisory DLA-3442-2.. nbconvert security, Debian LTS, XSS fix, software update. . LinuxSecurity.com Team

Calendar%202 Jun 03, 2023 Debian LTS
Banner 1 1028x280 1708121660 1771599717
89
Ls Advisories Fedora Esm H240
Price Tag%201security advisoryfedoraupdate notification

Fedora 38 Moderate: Rubygem-Redcarpet XSS Issue Advisory 2023-44daa9c1d4

A security flow was found on redcarpet that escaping html was not properly done even if requested on some cases which may cause XSS vulnerability. This issue is now assigned as CVE-2020-26298. This new rpm should fix this issue.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2023-44daa9c1d4 2023-05-09 01:57:45.056831 --------------------------------------------------------------------------------Name : rubygem-redcarpet Product : Fedora 38 Version : 3.3.2 Release : 26.fc38 URL : https://github.com/vmg/redcarpet Summary : A fast, safe and extensible Markdown to (X)HTML parser Description : A fast, safe and extensible Markdown to (X)HTML parser. --------------------------------------------------------------------------------Update Information: A security flow was found on redcarpet that escaping html was not properly done even if requested on some cases which may cause XSS vulnerability. This issue is now assigned as CVE-2020-26298. This new rpm should fix this issue. --------------------------------------------------------------------------------ChangeLog: * Sun Apr 30 2023 Mamoru TASAKA - 3.3.2-26 - Bacckport upstream patch for CVE-2020-26298 (bug 1915370) --------------------------------------------------------------------------------References: [ 1 ] Bug #1915371 - CVE-2020-26298 rubygem-redcarpet: does not escape HTML when processing quotes which could result in XSS vulnerability [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1915371 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-44daa9c1d4' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keysused by the Fedora Project can be found at --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ Do not reply to spam, report it: . Fedora 38 resolves an XSS vulnerability caused by inadequate HTML sanitization in rubygem-redcarpet through its most recent update.. Fedora Security Advisory,Rubygem Redcarpet,XSS Fix,Update Notification. . LinuxSecurity.com Team

Calendar%202 May 09, 2023 Fedora
197
Ls Advisories Deblts Esm H240
Price Tag%201security advisoryupdatedebian

Debian 10: DLA-3191-1 Moderate: Django Directory Traversal and XSS Issues

Multiple issues were discovered in Django, a Python-based web development framework: * CVE-2021-45452: Storage.save allowed directory traversal if . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3191-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/lts/security/ Chris Lamb November 17, 2022 https://wiki.debian.org/LTS - ------------------------------------------------------------------------- Package : python-django Version : 1:1.11.29-1+deb10u4 CVE IDs : CVE-2021-45452 CVE-2022-22818 CVE-2022-23833 Debian Bugs : 1003113 1004752 Multiple issues were discovered in Django, a Python-based web development framework: * CVE-2021-45452: Storage.save allowed directory traversal if crafted filenames were passed directlyto it. * CVE-2022-22818: The {% debug %} template tag did not properly encode the current context. This may lead to a cross-site scripting (XSS) vulnerability. * CVE-2022-23833: The HTTP MultiPartParser had a issue whereby certain inputs to multipart forms could result in an infinite loop when parsing uploaded files. For Debian 10 buster, these problems have been fixed in version 1:1.11.29-1+deb10u4. We recommend that you upgrade your python-django packages. For the detailed security status of python-django please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/python-django Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Important security patch for python-django resolves several vulnerabilities involving directory traversal and cross-site scripting threats.. python-django update,directory traversal,xss risks,security advisories,deb10. . LinuxSecurity.com Team

Calendar%202 Nov 17, 2022 Debian LTS
Banner 1 1028x280 1708121660 1771599717
98
Ls Advisories Redhat Esm H240
Price Tag%201security advisorymoderateupdate

Red Hat Enterprise Linux 8 RHSA-2022:7715-01 Moderate libxml2 XSS Attack

An update for libxml2 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: libxml2 security update Advisory ID: RHSA-2022:7715-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2022:7715 Issue date: 2022-11-08 CVE Names: CVE-2016-3709 ==================================================================== 1. Summary: An update for libxml2 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, ppc64le, s390x, x86_64 3. Description: The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): * libxml2: Incorrect server side include parsing can lead to XSS (CVE-2016-3709) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.7 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, referto: https://access.redhat.com/articles/11258 The desktop must be restarted (log out, then log back in) for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 2112766 - CVE-2016-3709 libxml2: Incorrect server side include parsing can lead to XSS 6. Package List: Red Hat Enterprise Linux AppStream (v. 8): aarch64: libxml2-debuginfo-2.9.7-15.el8.aarch64.rpm libxml2-debugsource-2.9.7-15.el8.aarch64.rpm libxml2-devel-2.9.7-15.el8.aarch64.rpm python3-libxml2-debuginfo-2.9.7-15.el8.aarch64.rpm ppc64le: libxml2-debuginfo-2.9.7-15.el8.ppc64le.rpm libxml2-debugsource-2.9.7-15.el8.ppc64le.rpm libxml2-devel-2.9.7-15.el8.ppc64le.rpm python3-libxml2-debuginfo-2.9.7-15.el8.ppc64le.rpm s390x: libxml2-debuginfo-2.9.7-15.el8.s390x.rpm libxml2-debugsource-2.9.7-15.el8.s390x.rpm libxml2-devel-2.9.7-15.el8.s390x.rpm python3-libxml2-debuginfo-2.9.7-15.el8.s390x.rpm x86_64: libxml2-debuginfo-2.9.7-15.el8.i686.rpm libxml2-debuginfo-2.9.7-15.el8.x86_64.rpm libxml2-debugsource-2.9.7-15.el8.i686.rpm libxml2-debugsource-2.9.7-15.el8.x86_64.rpm libxml2-devel-2.9.7-15.el8.i686.rpm libxml2-devel-2.9.7-15.el8.x86_64.rpm python3-libxml2-debuginfo-2.9.7-15.el8.i686.rpm python3-libxml2-debuginfo-2.9.7-15.el8.x86_64.rpm Red Hat Enterprise Linux BaseOS (v.8): Source: libxml2-2.9.7-15.el8.src.rpm aarch64: libxml2-2.9.7-15.el8.aarch64.rpm libxml2-debuginfo-2.9.7-15.el8.aarch64.rpm libxml2-debugsource-2.9.7-15.el8.aarch64.rpm python3-libxml2-2.9.7-15.el8.aarch64.rpm python3-libxml2-debuginfo-2.9.7-15.el8.aarch64.rpm ppc64le: libxml2-2.9.7-15.el8.ppc64le.rpm libxml2-debuginfo-2.9.7-15.el8.ppc64le.rpm libxml2-debugsource-2.9.7-15.el8.ppc64le.rpm python3-libxml2-2.9.7-15.el8.ppc64le.rpm python3-libxml2-debuginfo-2.9.7-15.el8.ppc64le.rpm s390x: libxml2-2.9.7-15.el8.s390x.rpm libxml2-debuginfo-2.9.7-15.el8.s390x.rpm libxml2-debugsource-2.9.7-15.el8.s390x.rpm python3-libxml2-2.9.7-15.el8.s390x.rpm python3-libxml2-debuginfo-2.9.7-15.el8.s390x.rpm x86_64: libxml2-2.9.7-15.el8.i686.rpm libxml2-2.9.7-15.el8.x86_64.rpm libxml2-debuginfo-2.9.7-15.el8.i686.rpm libxml2-debuginfo-2.9.7-15.el8.x86_64.rpm libxml2-debugsource-2.9.7-15.el8.i686.rpm libxml2-debugsource-2.9.7-15.el8.x86_64.rpm python3-libxml2-2.9.7-15.el8.x86_64.rpm python3-libxml2-debuginfo-2.9.7-15.el8.i686.rpm python3-libxml2-debuginfo-2.9.7-15.el8.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2016-3709 https://access.redhat.com/security/updates/classification#moderate https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/8.7_release_notes/index 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBY2pSQ9zjgjWX9erEAQhbwQ/+JK0xE6ih/uPs5BUSnCif7JSng2IiFEw5 ewphnnvqQnRVh4yL+mBgt0qFnTbCAtTUf3STpDaFVHzgV311amyKD+qgkCXT0JFN 3jn+mh0Nellrcm3CELmks8f6Dp1dOF6TAba0bMi06KqB5tbzz3HM7NGqcC3yz7NS 1HbM970Z35PeAeSUpjOXS76CcZ7a3f7zctCONyAbT6T5NMv7sT8k1Uz8EYG5XUKs z2NmpzzBmUk7qvwifgHHgr7myLPszKDtasR/7RTr46dIioEQOamLMFjfAgAO7Ie3 6fMIA/q1baZdDHE+JdNKvnKai6rl9vx9KiNa5kY3GfY8gCqRFE/fu0B0qm6Q7RlO 4jvp/LRYYzOgwYIYYjjEqgYpa0UAvQo/ccBitkDGxZ+kGUSg2s6IUKoKe6VBSJAe 3/ZCHzBBLxccX7O9HFyG4bqVqeoZH+DbqOjFbv4/7+s3D3Ck2OCUmk7rS7xHXcGv cfVAqG3XTbajruRKSEmWttp5+roGzd4s5TxoV0WW8od7DCD6dFRsfmVPM49HrxOH TJp/zvDD9+SV02/3mLnP44Ld0mZ9oZFL30K3jQ2MN/p040pW22y8lOQjZkaBDGme YWhHpWtTKIsxk3a8vOdX8yNn747i+quwi2W2uKW9dbf2Cm/XogihlwjPDitoTfKk 25H8Qs5+m+s=0Cbo -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . A new libxml2 update has been issued for Red Hat Enterprise Linux 8, enhancing defenses against XML parsing vulnerabilities and cross-site scripting (XSS) threats.. libxml2 security update, red hat enterprise linux, advisory details. . LinuxSecurity.com Team

Calendar%202 Nov 08, 2022 Red Hat
89
Ls Advisories Fedora Esm H240
Price Tag%201security advisoryfedorasoftware patch

Fedora 36: 2022-930b54aa84 Major Update: PlantUML XSS Security Fix

notes=Security fix for [CVE-2022-1231]. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-930b54aa84 2022-05-07 04:08:14.315686 --------------------------------------------------------------------------------Name : plantuml Product : Fedora 36 Version : 1.2022.4 Release : 1.fc36 URL : https://plantuml.com/ Summary : Program to generate UML diagram from a text description Description : PlantUML is a program allowing to draw UML diagrams, using a simple and human readable text description. It is extremely useful for code documenting, sketching project architecture during team conversations and so on. PlantUML supports the following diagram types - sequence diagram - use case diagram - class diagram - activity diagram - component diagram - state diagram --------------------------------------------------------------------------------Update Information: notes=Security fix for [CVE-2022-1231] --------------------------------------------------------------------------------ChangeLog: * Mon Apr 18 2022 Sandipan Roy - 1:1.2022.4-1 - Updated version to 1.2022.4 - Added fix for rhbz#2076162 - Added fix for rhbz#2076163 * Mon Mar 7 2022 Sandipan Roy - 1:1.2022.2-1 - Updated version to 1.2022.2 --------------------------------------------------------------------------------References: [ 1 ] Bug #2076163 - CVE-2022-1231 plantuml: Stored XSS in the context of the diagram embedder [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2076163 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-930b54aa84' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details onthe GPG keys used by the Fedora Project can be found at --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure . Fedora 36 has released an update for PlantUML to mitigate a critical stored XSS vulnerability. The security advisory encompasses specific details regarding the fix implemented.. PlantUML Update, Fedora Security, XSS Bug Fix, Software Security, Open Source Patch. . Severity: Important. LinuxSecurity.com Team

Calendar%202 May 07, 2022 •Important Fedora
Banner 1 1028x280 1708121660 1771599717
89
Ls Advisories Fedora Esm H240
Price Tag%201security advisoryfedorasoftware update

Fedora 36: FEDORA-2022-1f0643b63a Moderate: libkiwix XSS Issue

Updated to version 10.1.0 with XSS fix. Changelog: https://github.com/kiwix/libkiwix/releases/tag/10.1.0. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-1f0643b63a 2022-03-31 00:15:27.868097 --------------------------------------------------------------------------------Name : libkiwix Product : Fedora 36 Version : 10.1.0 Release : 1.fc36 URL : https://github.com/kiwix/libkiwix Summary : Common code base for all Kiwix ports Description : The Kiwix library provides the Kiwix software core. It contains the code shared by all Kiwix ports. --------------------------------------------------------------------------------Update Information: Updated to version 10.1.0 with XSS fix. Changelog: https://github.com/kiwix/libkiwix/releases/tag/10.1.0 --------------------------------------------------------------------------------ChangeLog: * Sat Mar 26 2022 Vitaly Zaitsev - 10.1.0-1 - Updated to version 10.1.0. --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-1f0643b63a' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives:https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure . The update for libkiwix to version 10.1.0 on Fedora addresses a critical XSS vulnerability. For further information, please refer to the changelog link provided.. libkiwix, Fedora 36, software fix, XSS issue. . LinuxSecurity.com Team

Calendar%202 Mar 30, 2022 Fedora
203
Ls Advisories Mageia Esm H240
Price Tag%201security advisorymoderatesecurity fix

Mageia: MGASA-2021-0260 moderate: python-bleach xss Issue

It was reported that python-bleach, a whitelist-based HTML-sanitizing library, is prone to a mutation XSS vulnerability in bleach.clean when "svg" or "math" are in the allowed tags, 'p' or "br" are in allowed tags, "style", "title", "noscript", "script", "textarea", "noframes", "iframe", or "xmp" are in allowed tags and 'strip_comments=False' is set (CVE-2021-23980). . MGASA-2021-0260 - Updated python-bleach packages fix a security vulnerability Publication date: 16 Jun 2021 URL: https://advisories.mageia.org/MGASA-2021-0260.html Type: security Affected Mageia releases: 7, 8 CVE: CVE-2021-23980 It was reported that python-bleach, a whitelist-based HTML-sanitizing library, is prone to a mutation XSS vulnerability in bleach.clean when "svg" or "math" are in the allowed tags, 'p' or "br" are in allowed tags, "style", "title", "noscript", "script", "textarea", "noframes", "iframe", or "xmp" are in allowed tags and 'strip_comments=False' is set (CVE-2021-23980). References: - https://bugs.mageia.org/show_bug.cgi?id=28986 - https://lists.debian.org/debian-security-announce/2021/msg00073.html - https://github.com/mozilla/bleach/security/advisories/GHSA-vv2x-vrpj-qqpq - - https://www.cve.org/CVERecord?id=CVE-2021-23980 SRPMS: - 7/core/python-bleach-3.1.4-1.1.mga7 - 8/core/python-bleach-3.3.0-1.mga8 . Recent patches to python-bleach tackle a critical XSS vulnerability impacting permitted tags; vital for safeguarding web applications on Mageia.. Python Bleach Update, HTML Sanitization, Mageia Security. . LinuxSecurity.com Team

Calendar%202 Jun 16, 2021 Mageia
Banner 1 1028x280 1708121660 1771599717
News Add Esm H240

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

More Polls

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":1,"type":"x","order":4,"pct":100,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200

Search Topics