Find the information you need for your favorite open source distribution .
Ronald Volgers discovered that FUSE did not correctly check mountlocations. A local attacker, with access to use FUSE, could unmountarbitrary locations, leading to a denial of service.
Ronald Volgers discovered that the mount.cifs utility, when installed as a setuid program, suffered from a race condition when verifying user permissions. A local attacker could trick samba into mounting over arbitrary locations, leading to a root privilege escalation. [More...]
It was discovered that lintian did not correctly validate certainfilenames when processing input. If a user or an automated systemwere tricked into running lintian on a specially crafted set of files,a remote attacker could execute arbitrary code with user privileges. [More...]
USN-803-1 fixed a vulnerability in Dhcp. Due to an error, the patch tofix the vulnerability was not properly applied on Ubuntu 8.10 and higher.Even with the patch improperly applied, the default compiler optionsreduced the vulnerability to a denial of service. Additionally, in Ubuntu9.04 and higher, users were also protected by the AppArmor dhclient3 [More...]
USN-890-1 fixed vulnerabilities in Expat. This update provides the corresponding updates for PyXML.
USN-890-1 fixed vulnerabilities in Expat. This update provides the corresponding updates for the PyExpat module in Python 2.4.
USN-890-1 fixed vulnerabilities in Expat. This update provides the corresponding updates for the PyExpat module in Python 2.5.
Jukka Taimisto, Tero Rontti and Rauli Kaksonen discovered that Expat didnot properly process malformed XML. If a user or application linked againstExpat were tricked into opening a crafted XML file, an attacker could causea denial of service via application crash. (CVE-2009-2625, CVE-2009-3720) [More...]
It was discovered that Bind would incorrectly cache bogus NXDOMAIN responses. When DNSSEC validation is in use, a remote attacker could exploit this to cause a denial of service, and possibly poison DNS caches. (CVE-2010-0097) [More...]
It was discovered that gzip incorrectly handled certain malformed compressed files. If a user or automated system were tricked into opening a specially crafted gzip file, an attacker could cause gzip to crash or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-2624) [More...]
Tim Starling discovered that LibThai did not correctly handle long strings. A remote attacker could use specially-formed strings to execute arbitrary code with the user's privileges.
It was discovered that Pidgin did not properly handle certain topic messages in the IRC protocol handler. If a user were tricked into connecting to a malicious IRC server, an attacker could cause Pidgin to crash, leading to a denial of service. This issue only affected Ubuntu 8.04 LTS, Ubuntu 8.10 and Ubuntu 9.04. (CVE-2009-2703) [More...]
Tim Starling discovered that LibThai did not correctly handle long strings. A remote attacker could use specially-formed strings to execute arbitrary code with the user's privileges.
It was discovered that the Transmission web interface was vulnerable tocross-site request forgery (CSRF) attacks. If a user were tricked intoopening a specially crafted web page in a browser while Transmission wasrunning, an attacker could trigger commands in Transmission. This issueaffected Ubuntu 9.04. (CVE-2009-1757) [More...]
It was discovered that OpenSSL did not correctly free unused memory incertain situations. A remote attacker could trigger this flaw in servicesthat used SSL, causing the service to use all available system memory,leading to a denial of service. [More...]
Maksymilian Arciemowicz discovered that PHP did not properly handle the ini_restore function. An attacker could exploit this issue to obtain random memory contents or to cause the PHP server to crash, resulting in a denial of service. (CVE-2009-2626) [More...]
It was discovered that NetworkManager did not ensure that the Certification Authority (CA) certificate file remained present when using WPA Enterprise or 802.1x networks. A remote attacker could use this flaw to spoof the identity of a wireless network and view sensitive information. (CVE-2009-4144) [More...]
It was discovered that Kerberos did not correctly handle invalid AESblocks. An unauthenticated remote attacker could send specially craftedtraffic that would crash the KDC service, leading to a denial of service,or possibly execute arbitrary code with root privileges. [More...]
USN-874-1 fixed vulnerabilities in Firefox and Xulrunner. The upstreamchanges introduced a regression when using NTLM authentication. This updatefixes the problem and added additional stability fixes. [More...]
USN-873-1 fixed vulnerabilities in Firefox and Xulrunner. The upstreamchanges introduced a regression when using NTLM authentication. This updatefixes the problem and added additional stability fixes. [More...]
Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.
Cloud Security Cryptography Desktop Security Firewall Government Hacks/Cracks IoT Security Network Security Organizations/Events Privacy Security Projects Security Trends Security Vulnerabilities Server Security Vendors/Products
Debian Debian LTS Fedora Gentoo Mageia Oracle openSUSE RockyLinux Slackware SuSE Ubuntu
Harden My Filesystem Learn Tips and Tricks Secure My E-mail Secure My Firewall Secure My Network Secure My Webserver Strengthen My Privacy
Best Secure Linux Distros for Enhanced Privacy & Security The Truth About Linux Malware & How to Protect Your System Is Linux A More Secure Option Than Windows For Businesses? How Secure Is Linux? Top Tips for Securing Your Linux System
Advertise Contribute Your Article Legal Notice RSS Feeds Contact Us Terms of Service Privacy Policy
Linux Security - Your source for Top Linux News, Advisories, HowTo's and Feature Release.
