Kernel developers reported more security issues were discovered this week, including a remotely exploitable vulnerabilty that could result in a DoS attack, the deployment of ransomware or other malware on your system, and exposure of sensitive info.

Our own Dave Wreski also evaluated Vali Cyber's ZeroLock, the latest ransomware protection developed specifically for Linux servers, and how it can be used to keep your critical systems and sensitive data protected from the dramatic increase in attacks against Linux we've seen over the last year.

Remember that last week distros released updates for OpenSSL to fix a high-severity vulnerability that could allow an attacker to read and disclose private memory contents or decrypt application data. Has your distro released updates yet? Learn if you are a risk, and how to protect yourself now!

Continue reading to learn about other significant issues fixed this week, and how to secure your systems against them.

Yours in Open Source,

Brittany Signature 150 Esm W150

Linux Kernel

The Discovery 

Several security issues were discovered in the Linux kernel, including a remotely exploitable problem with the netfilter IRC protocol tracking implementation in the Kernel that resulted in incorrect handling of certain message payloads in some situations (CVE-2022-2663). 

LinuxKernel Esm W206

The Impact

These flaws could result in denial of service (DoS) attacks, the execution of arbitrary code, the deployment of ransomware or other malware on target systems, the exposure of sensitive information, or bypass of firewall filtering.

The Fix

A security update for the kernel that fixes these vulnerabilities has been released. We recommend that you update now to prevent potential downtime and attacks leading to compromise, and protect the confidentiality of your sensitive information.

Your Related Advisories:

[distro_list_1]

X.Org

The Discovery 

A high-severity use-after-free vulnerability that can be exploited to read and write into freed memory was found in the X.Org X11 X server (CVE-2023-0494). 

Xorg Esm W251

The Impact

This issue, which has a high confidentiality, integrity and availability impact, could result in privilege escalation attacks, potentially leading to the deletion or theft of data, unauthorized access to system files, disruption of operations, and the creation of backdoors for future attacks.

The Fix

An important update is available for X.Org that mitigates this flaw. We urge you to update immediately to protect the security, integrity, and availability of your systems and the confidentiality of your data. 

Your Related Advisories:

[distro_list_2]

Opera

The Discovery 

Four high-severity use after free and type confusion vulnerabilities have been discovered in the Opera web browser (CVE-2023-0471, CVE-2023-0472, CVE-2023-0473 and CVE-2023-0474).

Opera Esm W152

The Impact

These issues could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page, or enable an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a Chrome web app.

The Fix

An important update is available for Opera that fixes these flaws. We recommend that you update as soon as possible to prevent exploits leading to compromise.

Your Related Advisories:

[distro_list_3]