Alerts This Week
Warning Icon 1 525
Alerts This Week
Warning Icon 1 525

Stay Secure with the Latest Linux Advisories

Filter Icon Refine advisories
X Clear Filters
X Clear Filters
View More

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

What got you started with Linux?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/150-what-got-you-started-with-linux?task=poll.vote&format=json
150
radio
0
[{"id":483,"title":"Self-taught through trial and error","votes":545,"type":"x","order":1,"pct":78.42,"resources":[]},{"id":484,"title":"Formal training or courses","votes":30,"type":"x","order":2,"pct":4.32,"resources":[]},{"id":485,"title":"A job that required it","votes":34,"type":"x","order":3,"pct":4.89,"resources":[]},{"id":486,"title":"Other","votes":86,"type":"x","order":4,"pct":12.37,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Loading...

Explore Latest Linux Security advisories

We found -4 articles for you...
199

CentOS 7 CESA-2022-5052 Critical: Xz Package Security Issue

Upstream details at : https://access.redhat.com/errata/RHSA-2022:5052. CentOS Errata and Security Advisory 2022:5052 Important Upstream details at : https://access.redhat.com/errata/RHSA-2022:5052 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: 775f41c9398da339ae50faf7692eb4b9de783c58e046c6c24f659c666b25eb48 xz-5.2.2-2.el7_9.x86_64.rpm aa0a9aa8e1958293d8bb429a513a459f4abafa838c9e217974640cfcd36c5e3a xz-compat-libs-5.2.2-2.el7_9.i686.rpm 2cb993f044a866a8d47b449c45f92f04540a139e5b827a0b845f6c9600d83af6 xz-compat-libs-5.2.2-2.el7_9.x86_64.rpm 4ddc7a2a317dc75228322785e2290c04acd3263ac771458097e5f402bb10508a xz-devel-5.2.2-2.el7_9.i686.rpm 8c62263350421e7c3081b4a531f8e15ef5bfb5e410a34687ca4a799ff23362ef xz-devel-5.2.2-2.el7_9.x86_64.rpm 86b3087af0b5a421efcfc192824973fcedcaee28a0e78bdb52d9101ffee96ebc xz-libs-5.2.2-2.el7_9.i686.rpm 4b698de5fd7e0a64306106f3018e9d00dedc1f7a46d354339f012c97d004bd0c xz-libs-5.2.2-2.el7_9.x86_64.rpm c16b5a1bf49c89cb3789f39c8dd6db6309830df4d3274cfa0ea3d38e38f0ebb8 xz-lzma-compat-5.2.2-2.el7_9.x86_64.rpm Source: 0d2e8869dac71d85de14a678e54c2a4bb4e7bd8a059b18d09523a2dabd81207f xz-5.2.2-2.el7_9.src.rpm -- Johnny Hughes CentOS Project { https://www.centos.org/ } irc: hughesjr, #This email address is being protected from spambots. You need JavaScript enabled to view it. Twitter: @JohnnyCentOS _______________________________________________ CentOS-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . For CentOS 7 users, essential patches for the xz utility are provided in advisory CESA-2022-5052, which includes comprehensive file specifics.. CentOS 7 Update, xz Package Fix, Security Advisory. . Severity: Critical. LinuxSecurity.com Team

Calendar 2 Aug 02, 2022 Critical CentOS
217

Oracle Linux 8 ELSA-2022-4991 Critical: Xz Arbitrary File Write Fix

The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network: . Oracle Linux Security Advisory ELSA-2022-4991 https://linux.oracle.com/errata/ELSA-2022-4991.html The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network: x86_64: xz-5.2.4-4.el8_6.x86_64.rpm xz-devel-5.2.4-4.el8_6.i686.rpm xz-devel-5.2.4-4.el8_6.x86_64.rpm xz-libs-5.2.4-4.el8_6.i686.rpm xz-libs-5.2.4-4.el8_6.x86_64.rpm xz-lzma-compat-5.2.4-4.el8_6.x86_64.rpm aarch64: xz-5.2.4-4.el8_6.aarch64.rpm xz-devel-5.2.4-4.el8_6.aarch64.rpm xz-libs-5.2.4-4.el8_6.aarch64.rpm xz-lzma-compat-5.2.4-4.el8_6.aarch64.rpm SRPMS: https://oss.oracle.com:443/ol8/SRPMS-updates/xz-5.2.4-4.el8_6.src.rpm Related CVEs: CVE-2022-1271 Description of changes: [5.2.4-4] - Fix arbitrary file write vulnerability Resolves: CVE-2022-1271 _______________________________________________ El-errata mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. https://oss.oracle.com/mailman/listinfo/el-errata . Red Hat Linux Security Advisory RHSA-2023-7743 updates gzip packages to resolve severe security vulnerabilities. Discover further details here.. Oracle Linux Security, ELSA-2022-4991, xz package update. . Severity: Critical. LinuxSecurity.com Team

Calendar 2 Jun 15, 2022 Critical Oracle
99

Slackware 15.0: 2022-104-03 Moderate: Xz File Overwrite Issue

New xz packages are available for Slackware 14.0, 14.1, 14.2, 15.0, and -current to fix a security issue. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] xz (SSA:2022-104-03) New xz packages are available for Slackware 14.0, 14.1, 14.2, 15.0, and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: +--------------------------+ patches/packages/xz-5.2.5-i586-4_slack15.0.txz: Rebuilt. This update fixes a security issue: xzgrep applied to a crafted file name with two or more newlines can no longer overwrite an arbitrary, attacker-selected file. For more information, see: https://www.cve.org/CVERecord?id=CVE-2022-1271 (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ Thanks to the friendly folks at the OSU Open Source Lab (https://osuosl.org/) for donating FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://www.slackware.com/ for additional mirror sites near you. Updated package for Slackware 14.0: Updated package for Slackware x86_64 14.0: Updated package for Slackware 14.1: Updated package for Slackware x86_64 14.1: Updated package for Slackware 14.2: Updated package for Slackware x86_64 14.2: Updated package for Slackware 15.0: ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/xz-5.2.5-i586-4_slack15.0.txz Updated package for Slackware x86_64 15.0: ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/xz-5.2.5-x86_64-4_slack15.0.txz Updated package for Slackware -current: Updated package for Slackware x86_64 -current: MD5 signatures: +-------------+ Slackware 14.0 package: 4835722bc7066487363c2b8dda562105 xz-5.2.5-i486-1_slack14.0.txz Slackware x86_64 14.0 package: 2ca6548bd35db4f5b5eaefe90c6070e2 xz-5.2.5-x86_64-1_slack14.0.txz Slackware 14.1 package: 35cd2b7b3f0bf24a81abd05a80e8c344 xz-5.2.5-i486-1_slack14.1.txz Slackware x86_64 14.1package: 06043e25eaa9f4f8d336afa0023ee232 xz-5.2.5-x86_64-1_slack14.1.txz Slackware 14.2 package: 044d7f03cf85a715d799e8958ddc68c3 xz-5.2.5-i586-1_slack14.2.txz Slackware x86_64 14.2 package: 4e7967ca1fe883c106def6f645b01277 xz-5.2.5-x86_64-1_slack14.2.txz Slackware 15.0 package: 958add191fc9193317814c57fe5e397f xz-5.2.5-i586-4_slack15.0.txz Slackware x86_64 15.0 package: af5cd05a54de11889a90f5309d65af7a xz-5.2.5-x86_64-4_slack15.0.txz Slackware -current package: a105af7063968ce0c4373359247b05a1 a/xz-5.2.5-i586-4.txz Slackware x86_64 -current package: 7b9a9cbec402562daf8411eecc886498 a/xz-5.2.5-x86_64-4.txz Installation instructions: +------------------------+ Upgrade the package as root: # upgradepkg xz-5.2.5-i586-4_slack15.0.txz +-----+ . Latest xz updates released for Slackware 14.x and -current to rectify a major vulnerability related to file processing.. xz Update, Slackware Security, Package Management, System Update. . Severity: Important. LinuxSecurity.com Team

Calendar 2 Apr 14, 2022 Important Slackware
198

Arch Linux: ASA-202204-8 High: xz Command Execution Issue

The package xz before version 5.2.5-3 is vulnerable to arbitrary command execution. . Arch Linux Security Advisory ASA-202204-8 ======================================== Severity: High Date : 2022-04-07 CVE-ID : CVE-2022-1271 Package : xz Type : arbitrary command execution Remote : No Link : https://security.archlinux.org/AVG-2665 Summary ====== The package xz before version 5.2.5-3 is vulnerable to arbitrary command execution. Resolution ========= Upgrade to 5.2.5-3. # pacman -Syu "xz> =5.2.5-3" The problem has been fixed upstream but no release is available yet. Workaround ========= None. Description ========== Malicious filenames with two or more newlines can make zgrep and xzgrep to write to arbitrary files or (with a GNU sed extension) lead to arbitrary code execution. The issue with the old code is that with multiple newlines, the N-command will read the second line of input, then the s-commands will be skipped because it's not the end of the file yet, then a new sed cycle starts and the pattern space is printed and emptied. So only the last line or two get escaped. Impact ===== An attacker is able to provide malicious filenames to write to arbitrary files or execute arbitrary commands on the affected host. References ========= https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=dc9740df61e575e8c3148b7bd3c147a81ea00c7c https://savannah.gnu.org/forum/forum.php?forum_id=10157 https://tukaani.org/xz/xzgrep-ZDI-CAN-16587.patch https://tukaani.org/xz/xzgrep-ZDI-CAN-16587.patch.sig https://security.archlinux.org/CVE-2022-1271 . The Ubuntu Security Notice USN-4456-1 addresses a critical vulnerability in the OpenSSL library versions preceding 1.1.1n.. Arch Linux, xz Command, Security Advisory, Command Execution, Package Security. . LinuxSecurity.com Team

Calendar 2 Apr 12, 2022 ArchLinux
100

SUSE: 2022:1160-1 Critical: xz File Path Security Vulnerability

An update that fixes one vulnerability is now available. . SUSE Security Update: Security update for xz ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1160-1 Rating: important References: #1198062 Cross-References: CVE-2022-1271 CVSS scores: CVE-2022-1271 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: HPE Helion Openstack 8 SUSE Linux Enterprise Server 12-SP2-BCL SUSE Linux Enterprise Server 12-SP3-BCL SUSE Linux Enterprise Server 12-SP3-LTSS SUSE Linux Enterprise Server 12-SP4-LTSS SUSE Linux Enterprise Server 12-SP5 SUSE Linux Enterprise Server for SAP 12-SP3 SUSE Linux Enterprise Server for SAP 12-SP4 SUSE Linux Enterprise Server for SAP Applications 12-SP5 SUSE Linux Enterprise Software Development Kit 12-SP5 SUSE OpenStack Cloud 8 SUSE OpenStack Cloud 9 SUSE OpenStack Cloud Crowbar 8 SUSE OpenStack Cloud Crowbar 9 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for xz fixes the following issues: - CVE-2022-1271: Fixed an incorrect escaping of malicious filenames (ZDI-CAN-16587). (bsc#1198062) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud Crowbar 9: zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-9-2022-1160=1 - SUSE OpenStack Cloud Crowbar 8: zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-8-2022-1160=1 - SUSE OpenStack Cloud 9: zypper in -t patch SUSE-OpenStack-Cloud-9-2022-1160=1 - SUSE OpenStack Cloud 8: zypper in -t patch SUSE-OpenStack-Cloud-8-2022-1160=1 - SUSE Linux Enterprise Software Development Kit 12-SP5: zypper in -t patch SUSE-SLE-SDK-12-SP5-2022-1160=1 - SUSE Linux Enterprise Server for SAP 12-SP4: zypper in -t patch SUSE-SLE-SAP-12-SP4-2022-1160=1 - SUSE Linux Enterprise Server for SAP 12-SP3: zypper in -t patch SUSE-SLE-SAP-12-SP3-2022-1160=1 - SUSE Linux Enterprise Server 12-SP5: zypper in -t patch SUSE-SLE-SERVER-12-SP5-2022-1160=1 - SUSE Linux Enterprise Server 12-SP4-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP4-LTSS-2022-1160=1 - SUSE Linux Enterprise Server 12-SP3-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2022-1160=1 - SUSE Linux Enterprise Server 12-SP3-BCL: zypper in -t patch SUSE-SLE-SERVER-12-SP3-BCL-2022-1160=1 - SUSE Linux Enterprise Server 12-SP2-BCL: zypper in -t patch SUSE-SLE-SERVER-12-SP2-BCL-2022-1160=1 - HPE Helion Openstack 8: zypper in -t patch HPE-Helion-OpenStack-8-2022-1160=1 Package List: - SUSE OpenStack Cloud Crowbar 9 (noarch): xz-lang-5.0.5-6.7.1 - SUSE OpenStack Cloud Crowbar 9 (x86_64): liblzma5-32bit-5.0.5-6.7.1 liblzma5-5.0.5-6.7.1 liblzma5-debuginfo-32bit-5.0.5-6.7.1 liblzma5-debuginfo-5.0.5-6.7.1 xz-5.0.5-6.7.1 xz-debuginfo-5.0.5-6.7.1 xz-debugsource-5.0.5-6.7.1 - SUSE OpenStack Cloud Crowbar 8 (noarch): xz-lang-5.0.5-6.7.1 - SUSE OpenStack Cloud Crowbar 8 (x86_64): liblzma5-32bit-5.0.5-6.7.1 liblzma5-5.0.5-6.7.1 liblzma5-debuginfo-32bit-5.0.5-6.7.1 liblzma5-debuginfo-5.0.5-6.7.1 xz-5.0.5-6.7.1 xz-debuginfo-5.0.5-6.7.1 xz-debugsource-5.0.5-6.7.1 - SUSE OpenStack Cloud 9 (x86_64): liblzma5-32bit-5.0.5-6.7.1 liblzma5-5.0.5-6.7.1 liblzma5-debuginfo-32bit-5.0.5-6.7.1 liblzma5-debuginfo-5.0.5-6.7.1 xz-5.0.5-6.7.1 xz-debuginfo-5.0.5-6.7.1 xz-debugsource-5.0.5-6.7.1 - SUSE OpenStack Cloud 9 (noarch): xz-lang-5.0.5-6.7.1 - SUSE OpenStack Cloud 8 (noarch): xz-lang-5.0.5-6.7.1 - SUSE OpenStack Cloud 8 (x86_64): liblzma5-32bit-5.0.5-6.7.1 liblzma5-5.0.5-6.7.1 liblzma5-debuginfo-32bit-5.0.5-6.7.1 liblzma5-debuginfo-5.0.5-6.7.1 xz-5.0.5-6.7.1 xz-debuginfo-5.0.5-6.7.1 xz-debugsource-5.0.5-6.7.1 - SUSE Linux Enterprise Software Development Kit 12-SP5 (aarch64 ppc64le s390x x86_64): xz-debuginfo-5.0.5-6.7.1 xz-debugsource-5.0.5-6.7.1 xz-devel-5.0.5-6.7.1 - SUSE Linux Enterprise Server for SAP 12-SP4 (ppc64le x86_64): liblzma5-5.0.5-6.7.1 liblzma5-debuginfo-5.0.5-6.7.1 xz-5.0.5-6.7.1 xz-debuginfo-5.0.5-6.7.1 xz-debugsource-5.0.5-6.7.1 - SUSE Linux Enterprise Server for SAP 12-SP4 (noarch): xz-lang-5.0.5-6.7.1 - SUSE Linux Enterprise Server for SAP 12-SP4 (x86_64): liblzma5-32bit-5.0.5-6.7.1 liblzma5-debuginfo-32bit-5.0.5-6.7.1 - SUSE Linux Enterprise Server for SAP 12-SP3 (ppc64le x86_64): liblzma5-5.0.5-6.7.1 liblzma5-debuginfo-5.0.5-6.7.1 xz-5.0.5-6.7.1 xz-debuginfo-5.0.5-6.7.1 xz-debugsource-5.0.5-6.7.1 - SUSE Linux Enterprise Server for SAP 12-SP3 (x86_64): liblzma5-32bit-5.0.5-6.7.1 liblzma5-debuginfo-32bit-5.0.5-6.7.1 - SUSE Linux Enterprise Server for SAP 12-SP3 (noarch): xz-lang-5.0.5-6.7.1 - SUSE Linux Enterprise Server 12-SP5 (aarch64 ppc64le s390x x86_64): liblzma5-5.0.5-6.7.1 liblzma5-debuginfo-5.0.5-6.7.1 xz-5.0.5-6.7.1 xz-debuginfo-5.0.5-6.7.1 xz-debugsource-5.0.5-6.7.1 - SUSE Linux Enterprise Server 12-SP5 (s390x x86_64): liblzma5-32bit-5.0.5-6.7.1 liblzma5-debuginfo-32bit-5.0.5-6.7.1 - SUSE Linux Enterprise Server 12-SP5 (noarch): xz-lang-5.0.5-6.7.1 - SUSE Linux Enterprise Server 12-SP4-LTSS (aarch64 ppc64le s390x x86_64): liblzma5-5.0.5-6.7.1 liblzma5-debuginfo-5.0.5-6.7.1 xz-5.0.5-6.7.1 xz-debuginfo-5.0.5-6.7.1 xz-debugsource-5.0.5-6.7.1 - SUSE Linux Enterprise Server 12-SP4-LTSS (s390x x86_64): liblzma5-32bit-5.0.5-6.7.1 liblzma5-debuginfo-32bit-5.0.5-6.7.1 - SUSE Linux Enterprise Server 12-SP4-LTSS (noarch): xz-lang-5.0.5-6.7.1 - SUSE Linux Enterprise Server 12-SP3-LTSS (aarch64 ppc64le s390x x86_64): liblzma5-5.0.5-6.7.1 liblzma5-debuginfo-5.0.5-6.7.1 xz-5.0.5-6.7.1 xz-debuginfo-5.0.5-6.7.1 xz-debugsource-5.0.5-6.7.1 - SUSE Linux Enterprise Server 12-SP3-LTSS (s390x x86_64): liblzma5-32bit-5.0.5-6.7.1 liblzma5-debuginfo-32bit-5.0.5-6.7.1 - SUSE Linux Enterprise Server 12-SP3-LTSS (noarch): xz-lang-5.0.5-6.7.1 - SUSE Linux Enterprise Server 12-SP3-BCL (noarch): xz-lang-5.0.5-6.7.1 - SUSE Linux Enterprise Server 12-SP3-BCL (x86_64): liblzma5-32bit-5.0.5-6.7.1 liblzma5-5.0.5-6.7.1 liblzma5-debuginfo-32bit-5.0.5-6.7.1 liblzma5-debuginfo-5.0.5-6.7.1 xz-5.0.5-6.7.1 xz-debuginfo-5.0.5-6.7.1 xz-debugsource-5.0.5-6.7.1 - SUSE Linux Enterprise Server 12-SP2-BCL (noarch): xz-lang-5.0.5-6.7.1 - SUSE Linux Enterprise Server 12-SP2-BCL (x86_64): liblzma5-32bit-5.0.5-6.7.1 liblzma5-5.0.5-6.7.1 liblzma5-debuginfo-32bit-5.0.5-6.7.1 liblzma5-debuginfo-5.0.5-6.7.1 xz-5.0.5-6.7.1 xz-debuginfo-5.0.5-6.7.1 xz-debugsource-5.0.5-6.7.1 - HPE Helion Openstack 8 (noarch): xz-lang-5.0.5-6.7.1 - HPE Helion Openstack 8 (x86_64): liblzma5-32bit-5.0.5-6.7.1 liblzma5-5.0.5-6.7.1 liblzma5-debuginfo-32bit-5.0.5-6.7.1 liblzma5-debuginfo-5.0.5-6.7.1 xz-5.0.5-6.7.1 xz-debuginfo-5.0.5-6.7.1 xz-debugsource-5.0.5-6.7.1 References: https://www.suse.com/security/cve/CVE-2022-1271.html https://bugzilla.suse.com/1198062 . Debian announces critical patch for tar resolvingarchive extraction vulnerability, enhancing protection across various platforms.. SUSE Security Update,xz Package,Important Fix,OpenStack Cloud,HPE Helion. . Severity: Important. LinuxSecurity.com Team

Calendar 2 Apr 12, 2022 Important SuSE
News Add Esm H240

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

What got you started with Linux?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/150-what-got-you-started-with-linux?task=poll.vote&format=json
150
radio
0
[{"id":483,"title":"Self-taught through trial and error","votes":545,"type":"x","order":1,"pct":78.42,"resources":[]},{"id":484,"title":"Formal training or courses","votes":30,"type":"x","order":2,"pct":4.32,"resources":[]},{"id":485,"title":"A job that required it","votes":34,"type":"x","order":3,"pct":4.89,"resources":[]},{"id":486,"title":"Other","votes":86,"type":"x","order":4,"pct":12.37,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Your message here