Thank you for reading the Linux Advisory Watch Security Newsletter. The purpose of this document is to provide our readers with a quick summary of each week's vendor security bulletins and pointers on methods to improve the security posture of your open source system. Vulnerabilities affect nearly every vendor virtually every week, so be sure to read through to find the updates your distributor have made available.
| |
Debian: DSA-4655-1: firefox-esr security update (Apr 8) |
| |
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code. For the oldstable distribution (stretch), these problems have been fixed
|
| |
Debian: DSA-4654-1: chromium security update (Apr 8) |
| |
Several vulnerabilities have been discovered in the chromium web browser. CVE-2020-6450
|
| |
Debian: DSA-4653-1: firefox-esr security update (Apr 4) |
| |
Two security issues have been found in the Mozilla Firefox web browser, which could result in the execution of arbitrary code. For the oldstable distribution (stretch), these problems have been fixed
|
| |
Debian: DSA-4652-1: gnutls28 security update (Apr 4) |
| |
A flaw was reported in the DTLS protocol implementation in GnuTLS, a library implementing the TLS and SSL protocols. The DTLS client would not contribute any randomness to the DTLS negotiation, breaking the security guarantees of the DTLS protocol.
|
| |
Debian: DSA-4650-1: qbittorrent security update (Apr 2) |
| |
Miguel Onoro reported that qbittorrent, a bittorrent client with a Qt5 GUI user interface, allows command injection via shell metacharacters in the torrent name parameter or current tracker parameter, which could result in remote command execution via a crafted name within an RSS feed
|
| |
Debian: DSA-4651-1: mediawiki security update (Apr 2) |
| |
It was discovered that some user-generated CSS selectors in MediaWiki, a website engine for collaborative work, were not escaped. The oldstable distribution (stretch) is not affected.
|
| |
Debian: DSA-4649-1: haproxy security update (Apr 2) |
| |
Felix Wilhelm of Google Project Zero discovered that HAProxy, a TCP/HTTP reverse proxy, did not properly handle HTTP/2 headers. This would allow an attacker to write arbitrary bytes around a certain location on the heap, resulting in denial-of-service or potential arbitrary code
|
|
|
| |
Fedora 31: nss FEDORA-2020-5967b8cd4e (Apr 9) |
| |
- New Firefox and NSS upstream update - More info at https://www.mozilla.org/en-US/firefox/75.0/releasenotes/
|
| |
Fedora 31: firefox FEDORA-2020-5967b8cd4e (Apr 9) |
| |
- New Firefox and NSS upstream update - More info at https://www.mozilla.org/en-US/firefox/75.0/releasenotes/
|
| |
Fedora 31: rubygem-puma FEDORA-2020-fd87f90634 (Apr 9) |
| |
Security fix for CVE-2020-5247, CVE-2020-5249
|
| |
Fedora 30: rubygem-puma FEDORA-2020-08092b4c97 (Apr 9) |
| |
Security fix for CVE-2020-5247, CVE-2020-5249
|
| |
Fedora 30: glibc FEDORA-2020-7f625c5ea8 (Apr 9) |
| |
This update incorporates fixes from the upstream glibc 2.29 stable release branch, including 3 fixes for medium severity security vulnerabilities. (CVE-2020-10029, CVE-2020-1752, CVE-2020-1751)
|
| |
Fedora 32: firefox FEDORA-2020-d3d6d60708 (Apr 9) |
| |
- New Firefox and NSS upstream update - More info at https://www.mozilla.org/en-US/firefox/75.0/releasenotes/
|
| |
Fedora 32: nss FEDORA-2020-d3d6d60708 (Apr 9) |
| |
- New Firefox and NSS upstream update - More info at https://www.mozilla.org/en-US/firefox/75.0/releasenotes/
|
| |
Fedora 32: haproxy FEDORA-2020-1f51251f01 (Apr 9) |
| |
Update to 2.1.4 (CVE-2010-11100, #1820200)
|
| |
Fedora 32: rubygem-puma FEDORA-2020-a3f26a9387 (Apr 9) |
| |
Security fix for CVE-2020-5247, CVE-2020-5249
|
| |
Fedora 32: php-symfony4 FEDORA-2020-fade6a8df7 (Apr 9) |
| |
**Version 4.4.7** (2020-03-30) * security #cve-2020-5255 [HttpFoundation] Do not set the default Content-Type based on the Accept header (yceruto) * security #cve-2020-5275 [Security] Fix access_control behavior with unanimous decision strategy (chalasr) * bug #36262 [DI] fix generating TypedReference from PriorityTaggedServiceTrait (nicolas-grekas) * bug #36252 [Security/Http]
|
| |
Fedora 31: kernel FEDORA-2020-666f3b1ac3 (Apr 6) |
| |
The 5.5.15 stable kernel update contains a number of important fixes across the tree.
|
| |
Fedora 31: kernel-tools FEDORA-2020-666f3b1ac3 (Apr 6) |
| |
The 5.5.15 stable kernel update contains a number of important fixes across the tree.
|
| |
Fedora 31: kernel-headers FEDORA-2020-666f3b1ac3 (Apr 6) |
| |
The 5.5.15 stable kernel update contains a number of important fixes across the tree.
|
| |
Fedora 32: chromium FEDORA-2020-3f09e75bf3 (Apr 5) |
| |
Update to 80.0.3987.162. Fixes the following CVEs: * CVE-2020-6450 * CVE-2020-6451 * CVE-2020-6452
|
| |
Fedora 32: xmlrpc FEDORA-2020-1d0635bd71 (Apr 5) |
| |
Update to latest release of PyDev and fix dependency errors
|
| |
Fedora 32: eclipse-pydev FEDORA-2020-1d0635bd71 (Apr 5) |
| |
Update to latest release of PyDev and fix dependency errors
|
| |
Fedora 32: swt-chart FEDORA-2020-1d0635bd71 (Apr 5) |
| |
Update to latest release of PyDev and fix dependency errors
|
| |
Fedora 31: firefox FEDORA-2020-8a36678d16 (Apr 4) |
| |
- New upstream version (74.0.1), fixed 0day vulnerability
|
| |
Fedora 31: glibc FEDORA-2020-244efc27af (Apr 4) |
| |
This update incorporates fixes from the upstream glibc 2.30 stable release branch, including 3 fixes for medium severity security vulnerabilities. (CVE-2020-10029, CVE-2020-1752, CVE-2020-1751)
|
| |
Fedora 32: firefox FEDORA-2020-92539cf29b (Apr 4) |
| |
- New upstream version (74.0.1), fixed 0day vulnerability
|
| |
Fedora 32: kernel FEDORA-2020-4ef0bcc89c (Apr 4) |
| |
Update to v5.6.2
|
| |
Fedora 30: telnet FEDORA-2020-6b07ff2526 (Apr 4) |
| |
Security fix for CVE-2020-10188
|
| |
Fedora 31: telnet FEDORA-2020-e7b942a47a (Apr 3) |
| |
Security fix for CVE-2020-10188
|
| |
Fedora 31: cyrus-sasl FEDORA-2020-bf829f9a84 (Apr 3) |
| |
Security fix for CVE 2019 19906
|
| |
Fedora 32: mediawiki FEDORA-2020-4426cc4c6f (Apr 3) |
| |
https://lists.wikimedia.org/hyperkitty/list/This email address is being protected from spambots. You need JavaScript enabled to view it./message/FHLX7QG75B5XNOAJZVGMPZTB3FJJPJLS/
|
| |
Fedora 31: squid FEDORA-2020-790296a8f4 (Apr 3) |
| |
- update to 4.10 - Resolves: #1798535 - CVE-2019-12528 squid: Information Disclosure issue in FTP Gateway - Resolves: #1798554 - CVE-2020-8450 squid: Buffer overflow in a Squid acting as reverse-proxy - Resolves: #1798541 - CVE-2020-8449 squid: Improper input validation issues. in HTTP Request processing
|
| |
Fedora 30: squid FEDORA-2020-ab8e7463ab (Apr 3) |
| |
- update to 4.10 - Resolves: #1798535 - CVE-2019-12528 squid: Information Disclosure issue in FTP Gateway - Resolves: #1798554 - CVE-2020-8450 squid: Buffer overflow in a Squid acting as reverse-proxy - Resolves: #1798541 - CVE-2020-8449 squid: Improper input validation issues. in HTTP Request processing
|
| |
Fedora 31: tomcat FEDORA-2020-04ac174fa9 (Apr 2) |
| |
This update includes a rebase from 9.0.30 up to 9.0.31 which resolves one CVE along with various other bugs/features: * rhbz#1806805 CVE-2020-1938 tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability * rhbz#1801729 tomcat-9.0.31 is available **WARNING** - This update does *not* enforce the change in defaults for the AJP Connector like the upstream fix does. This is
|
| |
Fedora 30: tomcat FEDORA-2020-c870aa8378 (Apr 2) |
| |
This update includes a rebase from 9.0.30 up to 9.0.31 which resolves one CVE along with various other bugs/features: * rhbz#1806805 CVE-2020-1938 tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability * rhbz#1801729 tomcat-9.0.31 is available **WARNING** - This update does *not* enforce the change in defaults for the AJP Connector like the upstream fix does. This is
|
|
|
| |
Gentoo: GLSA-202004-07: Mozilla Firefox: Multiple vulnerabilities (Apr 4) |
| |
Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code.
|
| |
Gentoo: GLSA-202004-06: GnuTLS: DTLS protocol regression (Apr 2) |
| |
A regression in GnuTLS breaks the security guarantees of the DTLS protocol.
|
|
|
| |
RedHat: RHSA-2020-1420:01 Important: firefox security update (Apr 9) |
| |
An update for firefox is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
|
| |
RedHat: RHSA-2020-1406:01 Important: firefox security update (Apr 8) |
| |
An update for firefox is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
|
| |
RedHat: RHSA-2020-1280:01 Moderate: OpenShift Container Platform 4.2.z (Apr 8) |
| |
An update for openshift-enterprise-ansible-operator-container is now available for Red Hat OpenShift Container Platform 4.2. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
|
| |
RedHat: RHSA-2020-1404:01 Important: firefox security update (Apr 8) |
| |
An update for firefox is now available for Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
|
| |
RedHat: RHSA-2020-1403:01 Important: qemu-kvm security and bug fix update (Apr 8) |
| |
An update for qemu-kvm is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
|
| |
RedHat: RHSA-2020-1277:01 Moderate: OpenShift Container Platform 4.3.10 (Apr 8) |
| |
An update for openshift-enterprise-hyperkube-container is now available for Red Hat OpenShift Container Platform 4.3. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
|
| |
RedHat: RHSA-2020-1287:01 Critical: OpenShift Container Platform 3.11 (Apr 7) |
| |
Red Hat OpenShift Container Platform release 3.11.200 is now available with updates to packages and images that fix several bugs. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score,
|
| |
RedHat: RHSA-2020-1358:01 Important: virt:rhel security and bug fix update (Apr 7) |
| |
An update for the virt:rhel and virt-devel:rhel modules is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
|
| |
RedHat: RHSA-2020-1360:01 Important: container-tools:1.0 security update (Apr 7) |
| |
An update for the container-tools:1.0 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
|
| |
RedHat: RHSA-2020-1276:01 Moderate: OpenShift Container Platform 4.3.10 (Apr 7) |
| |
An update for openshift is now available for Red Hat OpenShift Container Platform 4.3. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
|
| |
RedHat: RHSA-2020-1372:01 Moderate: kernel security and bug fix update (Apr 7) |
| |
An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from
|
| |
RedHat: RHSA-2020-1349:01 Important: krb5-appl security update (Apr 7) |
| |
An update for krb5-appl is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
|
| |
RedHat: RHSA-2020-1379:01 Important: container-tools:rhel8 security and bug (Apr 7) |
| |
An update for the container-tools:rhel8 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
|
| |
RedHat: RHSA-2020-1352:01 Important: qemu-kvm-ma security update (Apr 7) |
| |
An update for qemu-kvm-ma is now available for Red Hat Enterprise Linux 7.7 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
|
| |
RedHat: RHSA-2020-1350:01 Important: chromium-browser security update (Apr 7) |
| |
An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
|
| |
RedHat: RHSA-2020-1378:01 Moderate: kernel-rt security and bug fix update (Apr 7) |
| |
An update for kernel-rt is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from
|
| |
RedHat: RHSA-2020-1351:01 Important: qemu-kvm security update (Apr 7) |
| |
An update for qemu-kvm is now available for Red Hat Enterprise Linux 7.7 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
|
| |
RedHat: RHSA-2020-1345:01 Important: nss-softokn security update (Apr 7) |
| |
An update for nss-softokn is now available for Red Hat Enterprise Linux 7.4 Advanced Update Support, Red Hat Enterprise Linux 7.4 Telco Extended Update Support, and Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions.
|
| |
RedHat: RHSA-2020-1346:01 Moderate: python security update (Apr 7) |
| |
An update for python is now available for Red Hat Enterprise Linux 7.4 Advanced Update Support, Red Hat Enterprise Linux 7.4 Telco Extended Update Support, and Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions.
|
| |
RedHat: RHSA-2020-1347:01 Important: kernel security and bug fix update (Apr 7) |
| |
An update for kernel is now available for Red Hat Enterprise Linux 7.4 Advanced Update Support, Red Hat Enterprise Linux 7.4 Telco Extended Update Support, and Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions.
|
| |
RedHat: RHSA-2020-1353:01 Important: kernel-rt security and bug fix update (Apr 7) |
| |
An update for kernel-rt is now available for Red Hat Enterprise MRG 2. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
|
| |
RedHat: RHSA-2020-1338:01 Critical: firefox security update (Apr 7) |
| |
An update for firefox is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from
|
| |
RedHat: RHSA-2020-1339:01 Critical: firefox security update (Apr 7) |
| |
An update for firefox is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from
|
| |
RedHat: RHSA-2020-1341:01 Critical: firefox security update (Apr 7) |
| |
An update for firefox is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from
|
| |
RedHat: RHSA-2020-1344:01 Important: virt:rhel security update (Apr 7) |
| |
An update for the virt:rhel and virt-devel:rhel modules is now available for Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
|
| |
RedHat: RHSA-2020-1343:01 Important: nodejs:10 security update (Apr 7) |
| |
An update for the nodejs:10 module is now available for Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
|
| |
RedHat: RHSA-2020-1342:01 Important: telnet security update (Apr 7) |
| |
An update for telnet is now available for Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
|
| |
RedHat: RHSA-2020-1340:01 Critical: firefox security update (Apr 7) |
| |
An update for firefox is now available for Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
|
| |
RedHat: RHSA-2020-1337:01 Moderate: Red Hat JBoss Core Services Apache HTTP (Apr 6) |
| |
Updated packages that provide Red Hat JBoss Core Services Pack Apache Server 2.4.37 and fix several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact
|
| |
RedHat: RHSA-2020-1336:01 Moderate: Red Hat JBoss Core Services Apache HTTP (Apr 6) |
| |
Red Hat JBoss Core Services Pack Apache Server 2.4.37 Service Pack 2 zip release for RHEL 6, RHEL 7 and Microsoft Windows is available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
|
| |
RedHat: RHSA-2020-1333:01 Important: ksh security update (Apr 6) |
| |
An update for ksh is now available for Red Hat Enterprise Linux 7.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
|
| |
RedHat: RHSA-2020-1331:01 Important: ipmitool security update (Apr 6) |
| |
An update for ipmitool is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
|
| |
RedHat: RHSA-2020-1332:01 Important: ksh security update (Apr 6) |
| |
An update for ksh is now available for Red Hat Enterprise Linux 7.5 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
|
| |
RedHat: RHSA-2020-1334:01 Important: telnet security update (Apr 6) |
| |
An update for telnet is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
|
| |
RedHat: RHSA-2020-1335:01 Important: telnet security update (Apr 6) |
| |
An update for telnet is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
|
| |
RedHat: RHSA-2020-1326:01 Moderate: openstack-manila security update (Apr 6) |
| |
An update for openstack-manila is now available for Red Hat OpenStack Platform 15 (Stein). Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
|
| |
RedHat: RHSA-2020-1325:01 Moderate: python-XStatic-jQuery security update (Apr 6) |
| |
An update for python-XStatic-jQuery is now available for Red Hat OpenStack Platform 15 (Stein). Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
|
| |
RedHat: RHSA-2020-1324:01 Moderate: python-django security update (Apr 6) |
| |
An update for python-django is now available for Red Hat OpenStack Platform 15 (Stein). Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
|
| |
RedHat: RHSA-2020-1318:01 Important: telnet security update (Apr 6) |
| |
An update for telnet is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
|
| |
RedHat: RHSA-2020-1317:01 Important: nodejs:10 security update (Apr 6) |
| |
An update for the nodejs:10 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
|
| |
RedHat: RHSA-2020-1308:01 Low: Red Hat Virtualization Engine security, (Apr 2) |
| |
An update is now available for Red Hat Virtualization Engine 4.3. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from
|
| |
RedHat: RHSA-2020-1288:01 Critical: haproxy security update (Apr 2) |
| |
An update for haproxy is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from
|
| |
RedHat: RHSA-2020-1290:01 Critical: rh-haproxy18-haproxy security update (Apr 2) |
| |
An update for rh-haproxy18-haproxy is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
|
| |
RedHat: RHSA-2020-1289:01 Critical: haproxy security update (Apr 2) |
| |
An update for haproxy is now available for Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
|
| |
RedHat: RHSA-2020-1300:01 Important: qemu-kvm-rhev security update (Apr 2) |
| |
An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform 10.0 (Newton). Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
|
| |
RedHat: RHSA-2020-1296:01 Important: qemu-kvm-rhev security update (Apr 2) |
| |
An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform 13.0 (Queens). Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
|
| |
RedHat: RHSA-2020-1293:01 Important: nodejs:12 security update (Apr 2) |
| |
An update for the nodejs:12 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
|
| |
RedHat: RHSA-2020-1292:01 Important: qemu-kvm-rhev security update (Apr 2) |
| |
An update for qemu-kvm-rhev is now available for Red Hat Virtualization for Red Hat Virtualization Host 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
|
|
|
| |
Slackware: 2020-098-01: mozilla-firefox Security Update (Apr 7) |
| |
New mozilla-firefox packages are available for Slackware 14.2 and -current to fix security issues.
|
| |
Slackware: 2020-094-01: mozilla-firefox Security Update (Apr 3) |
| |
New mozilla-firefox packages are available for Slackware 14.2 and -current to fix security issues.
|
|
|
| |
SUSE: 2020:0978-1 important: MozillaFirefox (Apr 9) |
| |
An update that fixes 5 vulnerabilities is now available.
|
| |
SUSE: 2020:14339-1 important: MozillaFirefox (Apr 9) |
| |
An update that fixes 5 vulnerabilities is now available.
|
| |
SUSE: 2020:0970-1 djvulibre (Apr 9) |
| |
An update that fixes one vulnerability is now available.
|
| |
SUSE: 2020:0971-1 important: MozillaFirefox (Apr 9) |
| |
An update that fixes 5 vulnerabilities is now available.
|
| |
SUSE: 2020:0967-1 moderate: libssh (Apr 9) |
| |
An update that fixes one vulnerability is now available.
|
| |
SUSE: 2020:0969-1 moderate: permissions (Apr 9) |
| |
An update that contains security fixes can now be installed.
|
| |
SUSE: 2020:0968-1 moderate: libssh (Apr 9) |
| |
An update that fixes one vulnerability is now available.
|
| |
SUSE: 2020:0962-1 important: ceph (Apr 8) |
| |
An update that fixes one vulnerability is now available.
|
| |
SUSE: 2020:0959-1 important: python-PyYAML (Apr 8) |
| |
An update that fixes one vulnerability is now available.
|
| |
SUSE: 2020:0957-1 moderate: mgetty (Apr 8) |
| |
An update that solves one vulnerability and has one errata is now available.
|
| |
SUSE: 2020:0955-1 moderate: vino (Apr 8) |
| |
An update that fixes one vulnerability is now available.
|
| |
SUSE: 2020:0954-1 moderate: rubygem-actionview-4_2 (Apr 8) |
| |
An update that fixes one vulnerability is now available.
|
| |
SUSE: 2020:0948-1 moderate: gmp, gnutls, libnettle (Apr 8) |
| |
An update that solves one vulnerability and has three fixes is now available.
|
| |
SUSE: 2020:0944-1 moderate: runc (Apr 7) |
| |
An update that solves one vulnerability and has one errata is now available.
|
| |
SUSE: 2020:14337-1 important: MozillaFirefox (Apr 7) |
| |
An update that fixes two vulnerabilities is now available.
|
| |
SUSE: 2020:0940-1 important: the Linux Kernel (Live Patch 16 for SLE 15) (Apr 7) |
| |
An update that fixes two vulnerabilities is now available.
|
| |
SUSE: 2020:0930-1 important: ceph (Apr 6) |
| |
An update that fixes two vulnerabilities is now available.
|
| |
SUSE: 2020:0929-1 important: MozillaFirefox (Apr 6) |
| |
An update that fixes two vulnerabilities is now available.
|
| |
SUSE: 2020:0928-1 important: MozillaFirefox (Apr 6) |
| |
An update that fixes two vulnerabilities is now available.
|
| |
SUSE: 2020:0921-1 moderate: exiv2 (Apr 3) |
| |
An update that fixes 11 vulnerabilities is now available.
|
| |
SUSE: 2020:0920-1 moderate: libxslt (Apr 3) |
| |
An update that fixes one vulnerability is now available.
|
| |
SUSE: 2020:0918-1 moderate: bluez (Apr 3) |
| |
An update that fixes one vulnerability is now available.
|
| |
SUSE: 2020:0911-1 moderate: libpng12 (Apr 3) |
| |
An update that fixes one vulnerability is now available.
|
| |
SUSE: 2020:0868-1 important: the Linux Kernel (Live Patch 37 for SLE 12 SP1) (Apr 3) |
| |
An update that fixes two vulnerabilities is now available.
|
| |
SUSE: 2020:0891-1 important: the Linux Kernel (Live Patch 3 for SLE 12 SP5) (Apr 3) |
| |
An update that fixes one vulnerability is now available.
|
| |
SUSE: 2020:0860-1 moderate: exiv2 (Apr 3) |
| |
An update that fixes 6 vulnerabilities is now available.
|
| |
SUSE: 2020:0856-1 moderate: SUSE Manager Server 3.2 (Apr 2) |
| |
An update that solves two vulnerabilities and has 15 fixes is now available.
|
| |
SUSE: 2020:0852-1 important: haproxy (Apr 2) |
| |
An update that fixes one vulnerability is now available.
|
| |
SUSE: 2020:0853-1 moderate: mgetty (Apr 2) |
| |
An update that fixes one vulnerability is now available.
|
| |
SUSE: 2020:0854-1 moderate: python3 (Apr 2) |
| |
An update that solves three vulnerabilities and has two fixes is now available.
|
| |
SUSE: 2020:0851-1 important: haproxy (Apr 2) |
| |
An update that fixes one vulnerability is now available.
|
|
|
| |
Ubuntu 4327-1: libssh vulnerability (Apr 9) |
| |
libssh could be made to crash if it received specially crafted network traffic.
|
| |
Ubuntu 4326-1: libiberty vulnerabilities (Apr 8) |
| |
Several security issues were fixed in libiberty.
|
| |
Ubuntu 4325-1: Linux kernel vulnerabilities (Apr 7) |
| |
Several security issues were fixed in the Linux kernel.
|
| |
Ubuntu 4324-1: Linux kernel vulnerabilities (Apr 7) |
| |
Several security issues were fixed in the Linux kernel.
|
| |
Ubuntu 4323-1: Firefox vulnerabilities (Apr 7) |
| |
Firefox could be made to crash or run programs as your login if it opened a malicious website.
|
| |
Ubuntu 4322-1: GnuTLS vulnerability (Apr 7) |
| |
GnuTLS could expose sensitive information over the network.
|
| |
Ubuntu 4321-1: HAProxy vulnerability (Apr 7) |
| |
HAProxy could be made to execute arbitrary code if it received a specially crafted HTTP/2 request.
|
| |
Ubuntu 4320-1: Linux kernel vulnerability (Apr 6) |
| |
The system could be made to crash or expose sensitive information.
|
| |
Ubuntu 4319-1: Linux kernel vulnerabilities (Apr 6) |
| |
Several security issues were fixed in the Linux kernel.
|
| |
Ubuntu 4318-1: Linux kernel vulnerabilities (Apr 6) |
| |
Several security issues were fixed in the Linux kernel.
|
| |
Ubuntu 4317-1: Firefox vulnerabilities (Apr 4) |
| |
Firefox could be made to crash or run programs as your login if it opened a malicious website.
|
| |
Ubuntu 4316-2: GD Graphics Library vulnerabilities (Apr 2) |
| |
Several security issues were fixed in GD Graphics Library.
|
| |
Ubuntu 4316-1: GD Graphics Library vulnerabilities (Apr 2) |
| |
Several security issues were fixed in GD Graphics Library.
|
| |
Ubuntu 4315-1: Apport vulnerabilities (Apr 2) |
| |
Several security issues were fixed in Apport.
|
|
|
| |
Debian LTS: DLA-2171-1: ceph security update (Apr 9) |
| |
It was discovered that there was a header-splitting vulnerability in ceph, a distributed storage and file system. For Debian 8 "Jessie", this issue has been fixed in ceph version
|
| |
Debian LTS: DLA-2169-1: libmtp security update (Apr 5) |
| |
libmtp is a library for communicating with MTP aware devices. The Media Transfer Protocol (commonly referred to as MTP) is a devised set of custom extensions to support the transfer of music files on USB digital audio players
|
| |
Debian LTS: DLA-2168-1: libplist security update (Apr 2) |
| |
libplist is a library for reading and writing the Apple binary and XML property lists format. It's part of the libimobiledevice stack, providing access to iDevices (iPod, iPhone, iPad ...).
|
|
|
| |
ArchLinux: 202004-11: libssh: denial of service (Apr 10) |
| |
The package libssh before version 0.9.4-1 is vulnerable to denial of service.
|
| |
ArchLinux: 202004-10: wireshark-cli: arbitrary code execution (Apr 10) |
| |
The package wireshark-cli before version 3.2.3-1 is vulnerable to arbitrary code execution.
|
| |
ArchLinux: 202004-9: chromium: multiple issues (Apr 10) |
| |
The package chromium before version 81.0.4044.92-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure, access restriction bypass and insufficient validation.
|
| |
ArchLinux: 202004-8: firefox: multiple issues (Apr 10) |
| |
The package firefox before version 75.0-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure and access restriction bypass.
|
| |
ArchLinux: 202004-7: haproxy: arbitrary code execution (Apr 10) |
| |
The package haproxy before version 2.1.4-1 is vulnerable to arbitrary code execution.
|
| |
ArchLinux: 202004-6: firefox: arbitrary code execution (Apr 7) |
| |
The package firefox before version 74.0.1-1 is vulnerable to arbitrary code execution.
|
|
|
| |
CentOS: CESA-2020-1339: Critical CentOS 6 firefox (Apr 8) |
| |
Upstream details at : https://access.redhat.com/errata/RHSA-2020:1339
|
| |
CentOS: CESA-2020-1335: Important CentOS 6 telnet (Apr 8) |
| |
Upstream details at : https://access.redhat.com/errata/RHSA-2020:1335
|
| |
CentOS: CESA-2020-1331: Important CentOS 6 ipmitool (Apr 8) |
| |
Upstream details at : https://access.redhat.com/errata/RHSA-2020:1331
|
| |
CentOS: CESA-2020-1349: Important CentOS 6 krb5-appl (Apr 8) |
| |
Upstream details at : https://access.redhat.com/errata/RHSA-2020:1349
|
|
|
| |
SciLinux: SLSA-2020-1403-1 Important: qemu-kvm on SL6.x i386/x86_64 (Apr 8) |
| |
QEMU: Slirp: potential OOB access due to unsafe snprintf() usages Bug Fix(es): * QEMU: Slirp: disable emulation of tcp programs like ftp IRC etc. [rhel-6] SL6 x86_64 qemu-guest-agent-0.12.1.2-2.506.el6_10.7.x86_64.rpm qemu-img-0.12.1.2-2.506.el6_10.7.x86_64.rpm qemu-kvm-0.12.1.2-2.506.el6_10.7.x86_64.rpm qemu-kvm-debuginfo-0.12.1.2-2.506.el6_10.7.x86_64.rpm qemu-kvm-to [More...]
|
| |
SciLinux: SLSA-2020-1349-1 Important: krb5-appl on SL6.x i386/x86_64 (Apr 7) |
| |
telnet-server: no bounds checks in nextitem() function allows to remotely execute arbitrary code (CVE-2020-10188) SL6 x86_64 krb5-appl-clients-1.0.1-10.el6_10.x86_64.rpm krb5-appl-debuginfo-1.0.1-10.el6_10.x86_64.rpm krb5-appl-servers-1.0.1-10.el6_10.x86_64.rpm i386 krb5-appl-clients-1.0.1-10.el6_10.i686.rpm krb5-appl-debuginfo-1.0.1-10.el6_10.i686.rpm krb5-appl-se [More...]
|
| |
SciLinux: SLSA-2020-1339-1 Critical: firefox on SL6.x i386/x86_64 (Apr 7) |
| |
Mozilla: Use-after-free while running the nsDocShell destructor (CVE-2020-6819) * Mozilla: Use-after-free when handling a ReadableStream (CVE-2020-6820) SL6 x86_64 firefox-68.6.1-1.el6_10.x86_64.rpm firefox-debuginfo-68.6.1-1.el6_10.x86_64.rpm firefox-68.6.1-1.el6_10.i686.rpm firefox-debuginfo-68.6.1-1.el6_10.i686.rpm i386 firefox-68.6.1-1.el6_10.i686.rpm firefox- [More...]
|
| |
SciLinux: SLSA-2020-1331-1 Important: ipmitool on SL6.x i386/x86_64 (Apr 6) |
| |
ipmitool: Buffer overflow in read_fru_area_section function in lib/ipmi_fru.c (CVE-2020-5208) SL6 x86_64 ipmitool-1.8.15-3.el6_10.x86_64.rpm ipmitool-debuginfo-1.8.15-3.el6_10.x86_64.rpm i386 ipmitool-1.8.15-3.el6_10.i686.rpm ipmitool-debuginfo-1.8.15-3.el6_10.i686.rpm - Scientific Linux Development Team
|
| |
SciLinux: SLSA-2020-1335-1 Important: telnet on SL6.x i386/x86_64 (Apr 6) |
| |
telnet-server: no bounds checks in nextitem() function allows to remotely execute arbitrary code (CVE-2020-10188) SL6 x86_64 telnet-0.17-49.el6_10.x86_64.rpm telnet-debuginfo-0.17-49.el6_10.x86_64.rpm telnet-server-0.17-49.el6_10.x86_64.rpm i386 telnet-0.17-49.el6_10.i686.rpm telnet-debuginfo-0.17-49.el6_10.i686.rpm telnet-server-0.17-49.el6_10.i686.rpm - Scientif [More...]
|
|
|
| |
openSUSE: 2020:0494-1: important: ceph (Apr 10) |
| |
An update that fixes two vulnerabilities is now available.
|
| |
openSUSE: 2020:0493-1: important: MozillaFirefox (Apr 10) |
| |
An update that fixes 5 vulnerabilities is now available.
|
| |
openSUSE: 2020:0490-1: moderate: gnuhealth (Apr 9) |
| |
An update that contains security fixes can now be installed.
|
| |
openSUSE: 2020:0491-1: moderate: exim (Apr 9) |
| |
An update that solves one vulnerability and has one errata is now available.
|
| |
openSUSE: 2020:0482-1: moderate: exiv2 (Apr 8) |
| |
An update that fixes 11 vulnerabilities is now available.
|
| |
openSUSE: 2020:0479-1: moderate: bluez (Apr 8) |
| |
An update that fixes one vulnerability is now available.
|
| |
openSUSE: 2020:0468-1: important: qemu (Apr 7) |
| |
An update that solves 6 vulnerabilities and has two fixes is now available.
|
| |
openSUSE: 2020:0467-1: important: glibc (Apr 6) |
| |
An update that fixes one vulnerability is now available.
|
| |
openSUSE: 2020:0461-1: critical: MozillaFirefox (Apr 6) |
| |
An update that fixes two vulnerabilities is now available.
|
| |
openSUSE: 2020:0459-1: important: icu (Apr 5) |
| |
An update that fixes one vulnerability is now available.
|
| |
openSUSE: 2020:0446-1: important: spamassassin (Apr 4) |
| |
An update that solves three vulnerabilities and has one errata is now available.
|
| |
openSUSE: 2020:0444-1: important: haproxy (Apr 4) |
| |
An update that fixes one vulnerability is now available.
|
|
|
| |
Mageia 2020-0163: firefox security update (Apr 8) |
| |
Updated firefox packages fix security vulnerabilities: When reading from areas partially or fully outside the source resource with WebGL's copyTexSubImage method, the specification requires the returned values be zero. Previously, this memory was uninitialized,
|
| |
Mageia 2020-0162: kernel security update (Apr 5) |
| |
This update is based on upstream 5.5.15 and fixes some security related issues related to use after free and null pointer dereferences and also some other bugfixes. Other fixes in this update:
|
| |
Mageia 2020-0161: firefox security update (Apr 5) |
| |
Updated firefox packages fix security vulnerabilities: Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free (CVE-2020-6819).
|
| |
Mageia 2020-0160: python-nltk security update (Apr 5) |
| |
Updated python-ntlk package fixes security vulnerability: A vulnerability was found in NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ in an NLTK package (ZIP archive) that is mishandled during extraction
|
| |
Mageia 2020-0159: librsvg security update (Apr 5) |
| |
The updated packages fix a security vulnerability: In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The attacker constructs pattern elements so that the number
|
| |
Mageia 2020-0158: kernel-linus security update (Apr 3) |
| |
This update is based on upstream 5.5.15 and fixes atleast the following security vulnerabilities: In the Linux kernel 5.4.0-rc2, there is a use-after-free (read) in the __blk_add_trace function in kernel/trace/blktrace.c (which is used to
|
| |
Mageia 2020-0157: dcraw security update (Apr 3) |
| |
The updated packages fix security vulnerabilities: There is a floating point exception in the kodak_radc_load_raw function in dcraw_common.cpp in LibRaw 0.18.2. It will lead to a remote denial of service attack. (CVE-2017-13735)
|
| |
Mageia 2020-0156: kernel security update (Apr 2) |
| |
This update is based on upstream 5.5.14 and fixes atleast the following security vulnerabilities: In the Linux kernel 5.3.10, there is a use-after-free (read) in the perf_trace_lock_acquire function (related to include/trace/events/lock.h)
|
| |
Mageia 2020-0155: python-yaml security update (Apr 2) |
| |
Updated python-yaml packages fix security vulnerability: A vulnerability was discovered in the PyYAML library, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader.
|
| |
Mageia 2020-0154: varnish security update (Apr 2) |
| |
Updated varnish packages fix security vulnerability: An assert can be triggered in Varnish Cache when using Varnish with a TLS termination proxy, and the proxy and Varnish use the PROXY version 2. The assert will cause Varnish to restart, and the cache will be empty after the
|
| |
Mageia 2020-0153: weechat security update (Apr 2) |
| |
Updated weechat packages fix security vulnerabilities: An issue was discovered in WeeChat before 2.7.1 (0.4.0 to 2.7 are affected). A malformed message 352 (who) can cause a NULL pointer dereference in the callback function, resulting in a crash
|
| |
Mageia 2020-0152: bluez security update (Apr 2) |
| |
The updated packages fix security vulnerabilities: A bug in Bluez may allow for the Bluetooth Discoverable state being set to on when no Bluetooth agent is registered with the system. This situation could lead to the unauthorized pairing of certain Bluetooth
|
