Language Selection

English French German Italian Portuguese Spanish

LinuxSecurity.com Advisories

Syndicate content
The central voice for Linux and Open Source security news.
Updated: 3 hours 46 min ago

Fedora 26: openvas-scanner Security Update

Sunday 16th of July 2017 04:34:00 PM
LinuxSecurity.com: Update to openvas-9

Fedora 26: openvas-libraries Security Update

Sunday 16th of July 2017 04:33:00 PM
LinuxSecurity.com: Update to openvas-9

Fedora 26: openvas-cli Security Update

Sunday 16th of July 2017 04:33:00 PM
LinuxSecurity.com: Update to openvas-9

Fedora 26: openvas-gsa Security Update

Sunday 16th of July 2017 04:33:00 PM
LinuxSecurity.com: Update to openvas-9

Debian: DSA-3912-1: heimdal security update

Sunday 16th of July 2017 09:13:00 AM
LinuxSecurity.com: Jeffrey Altman, Viktor Dukhovni, and Nicolas Williams reported that Heimdal, an implementation of Kerberos 5 that aims to be compatible with MIT Kerberos, trusts metadata taken from the unauthenticated plaintext (Ticket), rather than the authenticated and encrypted KDC response. A

Fedora 25: evince Security Update

Saturday 15th of July 2017 04:10:00 PM
LinuxSecurity.com: - CVE-2017-1000083: Evince command injection vulnerability in CBT handler (#1468488)

Fedora 25: httpd Security Update

Saturday 15th of July 2017 04:10:00 PM
LinuxSecurity.com: File /etc/sysconfig/httpd is ghosted now ---- Version update ---- Security fix for CVE-2017-3167 CVE-2017-3169 CVE-2017-7659 CVE-2017-7668 CVE-2017-7679

Fedora 25: qt5-qtwebengine Security Update

Saturday 15th of July 2017 04:09:00 PM
LinuxSecurity.com: This update updates QtWebEngine to the 5.9.1 release, a security and bugfix release from the 5.9 branch. QtWebEngine 5.9.1 is part of the Qt 5.9.1 release, but only the QtWebEngine component is included in this update. The update fixes the following security issues in QtWebEngine 5.9.0: CVE-2017-5070, CVE-2017-5071, CVE-2017-5075, CVE-2017-5076, CVE-2017-5077, CVE-2017-5078,

Fedora 24: GraphicsMagick Security Update

Saturday 15th of July 2017 03:00:00 PM
LinuxSecurity.com: New stable upstream release, primarily includes security fixes for CVE-2017-10794, CVE-2017-10799, CVE-2017-10800 See also http://www.graphicsmagick.org/NEWS.html#july-4-2017

openSUSE: 2017:1885-1: important: xorg-x11-server

Saturday 15th of July 2017 09:18:00 AM
LinuxSecurity.com: An update that fixes two vulnerabilities is now available. An update that fixes two vulnerabilities is now available. An update that fixes two vulnerabilities is now available.

Slackware: 2017-195-02: samba Security Update

Friday 14th of July 2017 10:06:00 PM
LinuxSecurity.com: New samba packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue.

Slackware: 2017-195-01: mariadb Security Update

Friday 14th of July 2017 10:06:00 PM
LinuxSecurity.com: New mariadb packages are available for Slackware 14.1, 14.2, and -current to fix security issues.

openSUSE: 2017:1882-1: important: Recommended ncurses

Friday 14th of July 2017 06:26:00 PM
LinuxSecurity.com: An update that solves two vulnerabilities and has one An update that solves two vulnerabilities and has one An update that solves two vulnerabilities and has one errata is now available. errata is now available.

openSUSE: 2017:1872-1: important: qemu

Friday 14th of July 2017 06:19:00 PM
LinuxSecurity.com: An update that solves 23 vulnerabilities and has four fixes An update that solves 23 vulnerabilities and has four fixes An update that solves 23 vulnerabilities and has four fixes is now available. is now available.

Ubuntu 3353-2: Samba vulnerability

Friday 14th of July 2017 04:30:00 PM
LinuxSecurity.com: Samba could allow unintended access to network services.

Ubuntu 3353-1: Heimdal vulnerability

Friday 14th of July 2017 04:09:00 PM
LinuxSecurity.com: Heimdal could allow unintended access to network services.

Debian: DSA-3910-1: knot security update

Friday 14th of July 2017 03:44:00 PM
LinuxSecurity.com: Clément Berthaux from Synaktiv discovered a signature forgery vulnerability in knot, an authoritative-only DNS server. This vulnerability allows an attacker to bypass TSIG authentication by sending crafted DNS packets to a server.

Debian: DSA-3911-1: evince security update

Friday 14th of July 2017 03:35:00 PM
LinuxSecurity.com: Felix Wilhelm discovered that the Evince document viewer made insecure use of tar when opening tar comic book archives (CBT). Opening a malicious CBT archive could result in the execution of arbitrary code. This update disables the CBT format entirely

SuSE: 2017:1865-1: important: cryptctl

Friday 14th of July 2017 03:20:00 PM
LinuxSecurity.com: An update that fixes one vulnerability is now available. An update that fixes one vulnerability is now available. An update that fixes one vulnerability is now available.

Fedora 25: sqlite Security Update

Friday 14th of July 2017 02:38:00 PM
LinuxSecurity.com: Security fix for CVE-2017-10989: Heap-buffer overflow in the getNodeSize function

More in Tux Machines

Ryzen Compiler Performance: Clang 4/5 vs. GCC 6/7/8 Benchmarks

A few days back I posted some fresh AMD Ryzen compiler benchmarks of LLVM Clang now that it has its new Znver1 scheduler model, which helps out the performance of Ryzen on Linux with some of the generated binaries tested. But it was found still that Haswell-tuned binaries are sometimes still faster on Ryzen than the Zen "znver1" tuning itself. For continuing our fresh compiler benchmarks from AMD's new Ryzen platform, here are the latest GCC numbers. Read more

More Security Leftovers

  • Fingerprint-based detection of DNS hijacks using RIPE Atlas [Warning for PDF]

    DNS hijacking is a real thing happening on the Internet
    ○ We found several RIPE Atlas probes with hijacked DNS resolver
    ○ Some countries have >25% chances of DNS being hijacked

  • How the Swedish administration leaked EU’s secure STESTA intranet to Russia, then tried glossing over it

    The Swedish administration is leaking its secret intranet and databases to Russia, via its Transport Agency, via the IBM cloud, via IBM's subcontractor NCR (formerly AT&T) in Serbia, which is a close Russian military ally. Giving staff in Serbia administrative access to these networks practically guarantees that Russia also has access to the network. The European Union's secure STESTA network is also connected to the leaked intranet. But this is not about geopolitics and who’s allied with whom, but about how an administration tries to quiet down and gloss over an apocalyptically stupid and monstrously damaging data leak.

  • Outsourcing Nightmare

    We had two reports of an ongoing situation in Sweden where confidential information held by the government has been compromised

  • Status update from the Reproducible Builds project
    Since then, we have made considerable progress which has been reported during DebConf 15 and 16 talks as well as other conferences around the world. However, for the sake of information preservation and clear communication we felt the need to write a newer report here.

KDE: KDE Slimbook, Akademy, and GSoC

  • Yesterday I picked up my new KDE Slimbook from the Slimbook.es stand at Akademy.
    First thing I did, of course, was boot it with my FreeBSD 11.0 SD card, to see if it works with my favorite operating system (with Plasma 5 desktop, of course). Nope: 11.0 hangs after finding acpi_ec0, so I will write about that later this week. Second thing I did was boot KDE Neon (pre-installed) on it, to see how it works out-of-the-box. I collected a bunch of tiny-little-irritations, papercuts if you will, from the basic installation — which have disappeared after an update and reboot.
  • Akademy 2017 -- Day 1
    During the first day at the Akademy, everything went according to plan and nearly everything was on time. Kudos to the organisers. The weather was balmy at the beginning of the day and, although Aleix Pol said it was not hotter than a hot day in Barcelona, many of the Scandinavian and Scottish attendees were visibly wilting under the sun. Fortunately for them, the venue is equipped with air-conditioning. Little known fact about Almería: it is situated in the biggest desert in Europe, the Desert of Tabernas. A better known fact is that that same desert has been used as a location for many spaghetti westerns, including the seminal Sergio Leone movies "For A Fistful of Dollars" and "The Good, the Bad and the Ugly". What is more interesting for some KDE members is that Tabernas has also been used in the filming of at least one Doctor Who episode ("A Town Called Mercy"). Unsurprisingly, the whovians amongst us quickly got busy and organised a trip to the place of the shoot for later in the week.
  • Akademy-es 2017 Fue Muy Bien
    On the 20th and 21st of July, KDE España held, with the invaluable help of UNIA, HackLab Almería and the University of Almería, and with the sponsorship of Opentia, its 12th annual gathering: Akademy-es 2017. As it always happens when Akademy takes place in Spain, Akademy-es 2017 became a prelude of the international event and many well-known KDE developers attended. Throughout two days, talks were offered covering many different topics, including Plasma, programming (C++, Qt, mobile), exciting projects like Kirigami, proposals for the future such as KDE on automobile, encouragement to use KDE software and contribute to KDE, and information about KDE España.
  • GSoC’17-Week #5
    In Krita, we cannot delete the bundle created just like that. The Bundles created are saved as the KisResource in a QList. We have to remove it from that list, then obviously, we have to remove it from the list widget where this bundle is shown. Then we have to BlackList the file. Then from there, we can remove the blacklisted bundles as we empty a recycle bin ;).

Today in Techrights