Thank you for reading the Linux Advisory Watch Security Newsletter. The purpose of this document is to provide our readers with a quick summary of each week's vendor security bulletins and pointers on methods to improve the security posture of your open source system. Vulnerabilities affect nearly every vendor virtually every week, so be sure to read through to find the updates your distributor have made available.

LinuxSecurity.com Feature Extras:

Linux: An OS Capable of Effectively Meeting the US Governments Security Needs Heading into 2020 - As Open Source has become increasingly mainstream and widely accepted for its numerous benefits, the use of Linux as a flexible, transparent and highly secure operating system has also increasingly become a prominent choice among corporations, educational institutions and government sectors alike. With national security concerns at an all time high heading into 2020, it appears that the implementation of Linux could effectively meet the United States governments critical security needs for application development and installations.

Linux Kernel Security in a Nutshell: How to Secure Your Linux System - The Linux kernel is the core component of the Linux operating system, maintaining complete control over everything in the system. It is the interface between applications and data processing at the hardware level, connecting the system hardware to the application software. The kernel manages input/output requests from software, memory, processes, peripherals and security, among other hefty responsibilities. Needless to say, the Linux kernel is pretty important.

  Debian: DSA-4591-1: cyrus-sasl2 security update (Dec 20)
 

Stephan Zeisberg reported an out-of-bounds write vulnerability in the _sasl_add_string() function in cyrus-sasl2, a library implementing the Simple Authentication and Security Layer. A remote attacker can take advantage of this issue to cause denial-of-service conditions for
  Debian: DSA-4590-1: cyrus-imapd security update (Dec 19)
 

It was discovered that the lmtpd component of the Cyrus IMAP server created mailboxes with administrator privileges if the "fileinto" was used, bypassing ACL checks.
  Fedora 31: cacti-spine FEDORA-2019-362f0e9710 (Dec 20)
 

- Update to 1.2.8 Release notes:

  Fedora 31: cacti FEDORA-2019-362f0e9710 (Dec 20)
 

- Update to 1.2.8 Release notes:

  Fedora 30: cacti-spine FEDORA-2019-6bf27b45b3 (Dec 19)
 

- Update to 1.2.8 Release notes:

  Fedora 30: cacti FEDORA-2019-6bf27b45b3 (Dec 19)
 

- Update to 1.2.8 Release notes:

  Fedora 30: fribidi FEDORA-2019-533a72fec5 (Dec 19)
 

Security fix for CVE-2019-18397
  RedHat: RHSA-2019-4361:01 Important: fribidi security update (Dec 23)
 

An update for fribidi is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
  RedHat: RHSA-2019-4360:01 Important: libyang security update (Dec 22)
 

An update for libyang is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
  RedHat: RHSA-2019-4344:01 Important: qemu-kvm-rhev security update (Dec 20)
 

An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform 10.0 (Newton). Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
  RedHat: RHSA-2019-4237:01 Moderate: OpenShift Container Platform 4.1.28 (Dec 19)
 

An update for the openshift-enterprise-builder container is now available for Red Hat OpenShift Container Platform 4.1. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
  RedHat: RHSA-2019-4358:01 Important: openstack-keystone security update (Dec 19)
 

An update for openstack-keystone is now available for Red Hat OpenStack Platform 15 (Stein). Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
  RedHat: RHSA-2019-4356:01 Important: git security update (Dec 19)
 

An update for git is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
  RedHat: RHSA-2019-4357:01 Moderate: Red Hat Ceph Storage security update (Dec 19)
 

An update is now available for Red Hat Ceph Storage 3.3 that runs on Ubuntu 16.04. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
  RedHat: RHSA-2019-4353:01 Moderate: Red Hat Ceph Storage security, bug fix, (Dec 19)
 

An update is now available for Red Hat Ceph Storage 3.3 that runs on Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
  RedHat: RHSA-2019-4326:01 Important: fribidi security update (Dec 19)
 

An update for fribidi is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
  RedHat: RHSA-2019-4341:01 Moderate: Red Hat Quay v3.2.0 security and bug (Dec 19)
 

An update is now available for Red Hat Quay 3. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from
  RedHat: RHSA-2019-4352:01 Important: Red Hat JBoss Fuse/A-MQ 6.3 R14 (Dec 19)
 

An update is now available for Red Hat JBoss Fuse 6.3 and Red Hat JBoss A-MQ 6.3. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
  Slackware: 2019-354-02: tigervnc Security Update (Dec 20)
 

New tigervnc packages are available for Slackware 14.2 and -current to fix security issues.
  Slackware: 2019-354-01: openssl Security Update (Dec 20)
 

New openssl packages are available for Slackware 14.2 and -current to fix a security issue.
  Slackware: 2019-353-01: wavpack Security Update (Dec 19)
 

New wavpack packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues.
  SUSE: 2019:3385-1 important: slurm (Dec 23)
 

An update that solves one vulnerability and has three fixes is now available.
  SUSE: 2019:3386-1 moderate: shibboleth-sp (Dec 23)
 

An update that fixes one vulnerability is now available.
  SUSE: 2019:3379-1 important: the Linux Kernel (Dec 21)
 

An update that solves 26 vulnerabilities and has 14 fixes is now available.
  SUSE: 2019:14260-1 important: MozillaFirefox, mozilla-nspr, mozilla-nss (Dec 20)
 

An update that fixes 8 vulnerabilities is now available.
  SUSE: 2019:3369-1 moderate: mariadb (Dec 20)
 

An update that fixes 7 vulnerabilities is now available.
  SUSE: 2019:3371-1 important: the Linux Kernel (Dec 20)
 

An update that solves 24 vulnerabilities and has 58 fixes is now available.
  SUSE: 2019:3371-1 important: the Linux Kernel (Dec 20)
 

An update that solves 24 vulnerabilities and has 58 fixes is now available.
  SUSE: 2019:3370-1 moderate: mariadb-100 (Dec 20)
 

An update that fixes one vulnerability is now available.
  SUSE: 2019:3349-1 moderate: trousers (Dec 19)
 

An update that fixes one vulnerability is now available.
  SUSE: 2019:3347-1 important: MozillaFirefox (Dec 19)
 

An update that fixes 8 vulnerabilities is now available.
  SUSE: 2019:3348-1 moderate: spectre-meltdown-checker (Dec 19)
 

An update that fixes two vulnerabilities is now available.
  SUSE: 2019:3340-1 moderate: spectre-meltdown-checker (Dec 19)
 

An update that fixes two vulnerabilities is now available.
  SUSE: 2019:3341-1 moderate: zziplib (Dec 19)
 

An update that solves two vulnerabilities and has one errata is now available.
  Debian LTS: DLA-2046-1: opensc security update (Dec 25)
 

An issue was discovered in libopensc/card-setcos.c in OpenSC, which has an incorrect read operation during parsing of a SETCOS file attribute.
  Debian LTS: DLA-2047-1: cups security update (Dec 22)
 

An issue has been found in cups, the Common UNIX Printing System(tm). An incorrect bounds check could lead to a possible out-of-bounds read and
  Debian LTS: DLA-2038-2: x2goclient regression update (Dec 22)
 

A change introduced in libssh 0.6.3-4+deb8u4 (which got released as DLA 2038-1) has broken x2goclient's way of scp'ing session setup files from client to server, resulting in an error message shown in a GUI error dialog box during session startup (and session resuming).
  Debian LTS: DLA-2045-1: tightvnc security update (Dec 21)
 

Several vulnerabilities have recently been discovered in TightVNC 1.x, an X11 based VNC server/viewer application for Windows and Unix.
  Debian LTS: DLA-2044-1: cyrus-sasl2 security update (Dec 20)
 

There has been an out-of-bounds write in Cyrus SASL leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash was ultimately caused by an off-by-one error
  Debian LTS: DLA-2043-2: gdk-pixbuf regression update (Dec 20)
 

While preparing a fix for CVE-2017-6314 an unknown symbol g_uint_checked_mul() was introduced.
  Debian LTS: DLA-2043-1: gdk-pixbuf security update (Dec 19)
 

Several issues in gdk-pixbuf, a library to handle pixbuf, have been found. CVE-2016-6352 fix for denial of service (out-of-bounds write and crash) via
  CentOS: CESA-2019-4107: Critical CentOS 7 firefox (Dec 24)
 

Upstream details at : https://access.redhat.com/errata/RHSA-2019:4107
  CentOS: CESA-2019-4148: Important CentOS 7 thunderbird (Dec 24)
 

Upstream details at : https://access.redhat.com/errata/RHSA-2019:4148
  CentOS: CESA-2019-4240: Critical CentOS 7 openslp (Dec 24)
 

Upstream details at : https://access.redhat.com/errata/RHSA-2019:4240
  CentOS: CESA-2019-4326: Important CentOS 7 fribidi (Dec 24)
 

Upstream details at : https://access.redhat.com/errata/RHSA-2019:4326
  CentOS: CESA-2019-4190: Important CentOS 7 nss (Dec 24)
 

Upstream details at : https://access.redhat.com/errata/RHSA-2019:4190
  CentOS: CESA-2019-4190: Important CentOS 7 nss-softokn (Dec 24)
 

Upstream details at : https://access.redhat.com/errata/RHSA-2019:4190
  CentOS: CESA-2019-4190: Important CentOS 7 nss-util (Dec 24)
 

Upstream details at : https://access.redhat.com/errata/RHSA-2019:4190
  CentOS: CESA-2019-4256: Important CentOS 6 kernel (Dec 24)
 

Upstream details at : https://access.redhat.com/errata/RHSA-2019:4256
  CentOS: CESA-2019-4254: Moderate CentOS 6 freetype (Dec 24)
 

Upstream details at : https://access.redhat.com/errata/RHSA-2019:4254
  CentOS: CESA-2019-4205: Important CentOS 6 thunderbird (Dec 24)
 

Upstream details at : https://access.redhat.com/errata/RHSA-2019:4205
  SciLinux: SLSA-2019-4326-1 Important: fribidi on SL7.x x86_64 (Dec 19)
 

fribidi: buffer overflow in fribidi_get_par_embedding_levels_ex() in lib /fribidi-bidi.c leading to denial of service and possible code execution (CVE-2019-18397) SL7 x86_64 fribidi-debuginfo-1.0.2-1.el7_7.1.i686.rpm fribidi-debuginfo-1.0.2-1.el7_7.1.x86_64.rpm fribidi-1.0.2-1.el7_7.1.i686.rpm fribidi-1.0.2-1.el7_7.1.x86_64.rpm fribidi-devel-1.0.2-1.el7_7.1.i686.rpm [More...]
  openSUSE: 2019:2700-1: important: samba (Dec 22)
 

An update that fixes two vulnerabilities is now available.
  openSUSE: 2019:2698-1: moderate: mariadb (Dec 22)
 

An update that fixes 7 vulnerabilities is now available.
  Mageia 2019-0414: kernel security update (Dec 25)
 

This update is based on upstream 5.4.6 and fixes various potential security issues related to buffer overflows, double frees, NUll pointer dereferences, improper / missing input validations and so on. It also adds other bugfixes all over the kernel.
  Mageia 2019-0412: php security update (Dec 25)
 

Updated php packages fix security vulnerabilities: DirectoryIterator class silently truncates after a null byte (CVE-2019-11045).
  Mageia 2019-0411: 389-ds-base security update (Dec 25)
 

he updated packages fix security vulnerabilities and a packaging problem: An out-of-bounds memory read flaw was found in the way 389-ds-base handled certain LDAP search filters, affecting all versions including 1.4.x. A remote, unauthenticated attacker could potentially use this flaw to make
  Mageia 2019-0410: apache-mod_auth_openidc security update (Dec 25)
 

The updated package fixes a security vulnerability: A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019-3877 in mod_auth_mellon. (CVE-2019-14857)
  Mageia 2019-0409: libofx security update (Dec 25)
 

Updated libofx packages fix security vulnerability: There is a NULL pointer dereference in the function OFXApplication::startElement in the file lib/ofx_sgml.cpp, as demonstrated by ofxdump (CVE-2019-9656).
  Mageia 2019-0408: ruby security update (Dec 25)
 

Updated ruby packages fix security vulnerabilities: It was discovered that Ruby incorrectly handled certain files. An attacker could possibly use this issue to pass path matching what can lead to an unauthorized access (CVE-2019-15845).
  Mageia 2019-0407: apache security update (Dec 25)
 

The updated packages fix security vulnerabilities: Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they
  Mageia 2019-0406: spamassassin security update (Dec 24)
 

The updated packages fix security vulnerabilities: In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA
  Mageia 2019-0405: ghostpcl security update (Dec 24)
 

This updates ghostpcl from 9.05 (which dates from 2012 February 8) to be at the same version as ghostscript, ie. 9.27 with fixes for known CVEs as like the ones fixed in MGASA-2017-0355, MGASA-2017-0430, MGASA-2018-0142, MGASA-2018-0219, MGASA-2018-0378, MGASA-2018-0408, MGASA-2018-0466, MGASA-2019-0056, MGASA-2019-0130, MGASA-2019-0188, MGASA-2019-0236,
  Mageia 2019-0404: libmirage security update (Dec 24)
 

Updated libmirage packages fix security vulnerabilities: The CSO filter in libMirage in CDemu did not validate the part size, triggering a heap-based buffer overflow that could lead to root access by a local user (CVE-2019-15540).
  Mageia 2019-0403: htmldoc security update (Dec 19)
 

Updated htmldoc packages fix security vulnerability: In HTMLDOC, there was a one-byte underflow in htmldoc/ps-pdf.cxx caused by a floating point math difference between GCC and Clang (CVE-2019-19630).
  Mageia 2019-0402: libssh security update (Dec 19)
 

Updated libssh packages fix security vulnerability: In an environment where a user is only allowed to copy files and not to execute applications, it would be possible to pass a location which contains commands to be executed in addition (CVE-2019-14889).
  Mageia 2019-0401: freerdp security update (Dec 19)
 

Updated freerdp packages fix security vulnerabilities: Multiple memory leaks in libfreerdp/codec/region.c (CVE-2019-17177). Memory leak in HuffmanTree_makeFromFrequencies (CVE-2019-17178).
  Mageia 2019-0400: rsyslog security update (Dec 19)
 

Updated rsyslog packages fix security vulnerabilities: Heap overflow in the parser for AIX log messages (CVE-2019-17041). Heap overflow in the parser for Cisco log messages (CVE-2019-17042).
  Mageia 2019-0399: apache-commons-beanutils security update (Dec 19)
 

Updated apache-commons-beanutils packages fix security vulnerability: In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We,
  Mageia 2019-0398: fence-agents security update (Dec 19)
 

pdated fence-agents package fixes security vulnerability: Denial of service via guest VM comments (CVE-2019-10153). References:
  Mageia 2019-0397: samba security update (Dec 19)
 

Updated samba packages fix security vulnerabilities: Malicious servers can cause Samba client code to return filenames containing path separators to calling code (CVE-2019-10218).
  Mageia 2019-0396: flightcrew security update (Dec 19)
 

The updated packages fix security vulnerabilities: An issue was discovered in FlightCrew v0.9.2 and earlier. A NULL pointer dereference occurs in GetRelativePathToNcx() or GetRelativePathsToXhtmlDocuments() when a NULL pointer is passed to
  Mageia 2019-0395: sssd security update (Dec 19)
 

The updated packages fix a security vulnerability: A flaw was found in sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to a too strict permission settings on the server side, SSSD will allow all authenticated users to login
  Mageia 2019-0394: pacemaker security update (Dec 19)
 

The updated packages fix security vulnerabilities: A use-after-free flaw was found in pacemaker up to and including version 2.0.1 which could result in certain sensitive information to be leaked via the system logs. (CVE-2019-3885)