LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Advisory Watch: November 21st, 2014
Linux Security Week: November 17th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
Linux Advisory Watch: March 21st, 2014 Print E-mail
User Rating:      How can I rate this item?
Source: LinuxSecurity Contributors - Posted by Benjamin D. Thomas   
Linux Advisory Watch Thank you for reading the Linux Advisory Watch Security Newsletter. The purpose of this document is to provide our readers with a quick summary of each week's vendor security bulletins and pointers on methods to improve the security posture of your open source system. Vulnerabilities affect nearly every vendor virtually every week, so be sure to read through to find the updates your distributor have made available.

LinuxSecurity.com Feature Extras:

Peter Smith Releases Linux Network Security Online - Thanks so much to Peter Smith for announcing on linuxsecurity.com the release of his Linux Network Security book available free online. "In 2005 I wrote a book on Linux security. 8 years later and the publisher has gone out of business. Now that I'm free from restrictions on reproducing material from the book, I have decided to make the entire book available online."

Securing a Linux Web Server - With the significant prevalence of Linux web servers globally, security is often touted as a strength of the platform for such a purpose. However, a Linux based web server is only as secure as its configuration and very often many are quite vulnerable to compromise. While specific configurations vary wildly due to environments or specific use, there are various general steps that can be taken to insure basic security considerations are in place.


  Debian: 2882-1: extplorer: Summary (Mar 20)
 

Security Report Summary

  Debian: 2859-2: pidgin: Summary (Mar 19)
 

Security Report Summary

  Debian: 2881-1: iceweasel: Summary (Mar 19)
 

Security Report Summary

  Debian: 2880-1: python2.7: Summary (Mar 17)
 

Security Report Summary

  Debian: 2879-1: libssh: Summary (Mar 13)
 

Security Report Summary

  Debian: 2878-1: virtualbox: Summary (Mar 13)
 

Security Report Summary

  Debian: 2877-1: lighttpd: Summary (Mar 13)
 

Security Report Summary


  Gentoo: 201403-05 GNU Emacs: Multiple vulnerabilities (Mar 20)
 

Two vulnerabilities have been found in GNU Emacs, possibly leading to user-assisted execution of arbitrary code.

  Gentoo: 201403-04 QtCore: Denial of Service (Mar 13)
 

A vulnerability in QXmlSimpleReader class can be used to cause a Denial of Service condition.

  Gentoo: 201403-03 file: Denial of Service (Mar 13)
 

A vulnerability in file could result in Denial of Service.


  Mandriva: 2014:066: nss (Mar 20)
 

A vulnerability has been found and corrected in mozilla NSS: In a wildcard certificate, the wildcard character should not be embedded within the U-label of an internationalized domain name. See the last bullet point in RFC 6125, Section 7.2 (CVE-2014-1492). [More...]

  Mandriva: 2014:065: apache (Mar 20)
 

Multiple vulnerabilities has been found and corrected in apache (ASF HTTPD): XML parsing code in mod_dav incorrectly calculates the end of the string when removing leading spaces and places a NUL character outside [More...]

  Mandriva: 2014:064: udisks (Mar 17)
 

Updated udisks packages fixes security vulnerability: A flaw was found in the way udisks and udisks2 handled long path names. A malicious, local user could use this flaw to create a specially-crafted directory structure that could lead to arbitrary [More...]

  Mandriva: 2014:063: x2goserver (Mar 17)
 

Updated x2goserver package fixes security vulnerability: A vulnerability in x2goserver before 4.0.0.2 in the setgid wrapper x2gosqlitewrapper.c, which does not hardcode an internal path to x2gosqlitewrapper.pl, allowing a remote attacker to change that [More...]

  Mandriva: 2014:062: webmin (Mar 17)
 

Multiple vulnerabilities was discovered and corrected in webmin: Multiple XSS, CSRF, and arbitrary code execution vulnerabilities that impact Webmin versions prior to 1.620 (CVE-2012-2981, CVE-2012-2982, CVE-2012-2983, CVE-2012-4893, SA51201). [More...]

  Mandriva: 2014:061: oath-toolkit (Mar 14)
 

Updated oath-toolkit packages fix security vulnerability: It was found that comments (lines starting with a hash) in /etc/users.oath could prevent one-time-passwords (OTP) from being invalidated, leaving the OTP vulnerable to replay attacks [More...]

  Mandriva: 2014:060: imapsync (Mar 14)
 

Updated imapsync package fixes security vulnerabilities: Imapsync, by default, runs a release check when executed, which causes imapsync to connect to http://imapsync.lamiral.info and send information about the version of imapsync, the operating system and [More...]

  Mandriva: 2014:059: php (Mar 14)
 

Multiple vulnerabilities has been discovered and corrected in php: Fixed bug #66731 (file: infinite recursion (CVE-2014-1943)). Fixed bug #66820 (out-of-bounds memory access in fileinfo [More...]

  Mandriva: 2014:058: freeradius (Mar 13)
 

Updated freeradius package fixes security vulnerability: SSHA processing in freeradius before 2.2.3 runs into a stack-based buffer overflow in the freeradius rlm_pap module if the password source uses an unusually long hashed password (CVE-2014-2015). [More...]

  Mandriva: 2014:057: mediawiki (Mar 13)
 

Updated mediawiki packages fix multiple vulnerabilities: MediaWiki user Michael M reported that the fix for CVE-2013-4568 allowed insertion of escaped CSS values which could pass the CSS validation checks, resulting in XSS (CVE-2013-6451). [More...]

  Mandriva: 2014:056: apache-commons-fileupload (Mar 13)
 

Updated apache-commons-fileupload packages fix security vulnerability: It was discovered that the Apache Commons FileUpload package for Java could enter an infinite loop while processing a multipart request with a crafted Content-Type, resulting in a denial-of-service condition [More...]

  Mandriva: 2014:055: owncloud (Mar 13)
 

Updated owncloud packages fix security vulnerabilities and bugs: Owncloud versions 5.0.15 and 6.0.2 fix several unspecified security vulnerabilities, as well as many other bugs. [More...]

  Mandriva: 2014:054: otrs (Mar 13)
 

Updated otrs package fixes security vulnerability: An attacker could send a specially prepared HTML email to OTRS. If he can then trick an agent into following a special link to display this email, JavaScript code would be executed (CVE-2014-1695). [More...]

  Mandriva: 2014:053: libssh (Mar 13)
 

Updated libssh package fixes security vulnerability: When using libssh before 0.6.3, a libssh-based server, when accepting a new connection, forks and the child process handles the request. The RAND_bytes() function of openssl doesn't reset its state after the [More...]

  Mandriva: 2014:052: net-snmp (Mar 13)
 

Updated net-snmp packages fix two vulnerabilities: Remotely exploitable denial of service vulnerability in Net-SNMP, in the Linux implementation of the ICMP-MIB, making the SNMP agent vulnerable if it is making use of the ICMP-MIB table objects [More...]

  Mandriva: 2014:051: file (Mar 13)
 

Updated file package fixes security vulnerability: It was discovered that file before 5.17 contains a flaw in the handling of indirect magic rules in the libmagic library, which leads to an infinite recursion when trying to determine the file type of certain [More...]


  Red Hat: 2014:0311-01: php: Critical Advisory (Mar 18)
 

Updated php packages that fix two security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having Critical [More...]

  Red Hat: 2014:0312-01: php: Critical Advisory (Mar 18)
 

Updated php packages that fix one security issue are now available for Red Hat Enterprise Linux 5.3 and 5.6 Long Life, and Red Hat Enterprise Linux 5.9 Extended Update Support. [More...]

  Red Hat: 2014:0306-01: ruby193-rubygem-actionpack: Moderate Advisory (Mar 17)
 

Updated ruby193-rubygem-actionpack packages that fix two security issues are now available for Red Hat Software Collections 1. The Red Hat Security Response Team has rated this update as having Moderate [More...]

  Red Hat: 2014:0305-01: samba: Moderate Advisory (Mar 17)
 

Updated samba packages that fix three security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having Moderate [More...]

  Red Hat: 2014:0304-01: mutt: Important Advisory (Mar 17)
 

An updated mutt package that fixes one security issue is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having [More...]

  Red Hat: 2014:0292-01: 389-ds-base: Important Advisory (Mar 13)
 

Updated 389-ds-base packages that fix one security issue are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having [More...]

  Red Hat: 2014:0293-01: udisks: Important Advisory (Mar 13)
 

Updated udisks packages that fix one security issue are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having [More...]


  Slackware: 2014-074-01: php: Security Update (Mar 16)
 

New php packages are available for Slackware 14.0, 14.1, and -current to fix a security issue. [More Info...]

  Slackware: 2014-072-01: samba: Security Update (Mar 14)
 

New samba packages are available for Slackware 14.0, 14.1, and -current to fix security issues. [More Info...]

  Slackware: 2014-071-01: mutt: Security Update (Mar 13)
 

New mutt packages are available for Slackware 13.37, 14.0, 14.1, and -current to fix a security issue. [More Info...]


  Ubuntu: 2150-1: Firefox vulnerabilities (Mar 18)
 

Firefox could be made to crash or run programs as your login if itopened a malicious website.

  Ubuntu: 2148-1: FreeType vulnerabilities (Mar 17)
 

FreeType could be made to crash or run programs as your login if it openeda specially crafted font file.

  Ubuntu: 2149-2: GTK+ update (Mar 17)
 

This update provides a compatibility fix for GTK+.

  Ubuntu: 2149-1: librsvg vulnerability (Mar 17)
 

Librsvg could be made to expose sensitive information.

  Ubuntu: 2147-1: Mutt vulnerability (Mar 13)
 

The mutt mail client could be made to crash or run programs as yourlogin if it opened a specially crafted email.

  Ubuntu: 2146-1: Sudo vulnerabilities (Mar 13)
 

Several security issues were fixed in Sudo.

Only registered users can write comments.
Please login or register.

Powered by AkoComment!

 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
Google Releases Open Source Tool for Testing Web App Security Scanners
Most Targeted Attacks Exploit Privileged Accounts
NotCompable sets new standards for mobile botnet sophistication
Hands on with Caine Linux: Pentesting and UEFI compatible
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.