Debian

Rsync vulnerabilities allow remote code execution on servers, patch quickly!

January 15, 2025

Six vulnerabilities have been fixed in the newest versions of Rsync (v3.4.0), two of which could be exploited by a malicious client to achieve arbitrary code execution on a …

XZ Utils backdoor update: Which Linux distros are affected and what can you do?

March 31, 2024

UPDATE: April 9, 09:23 AM ET A new story has been published: XZ Utils backdoor: Detection tools, scripts, rules The news that XZ Utils, a compression utility present in most …

Beware! Backdoor found in XZ utilities used by many Linux distros (CVE-2024-3094)

March 29, 2024

UPDATE: April 9, 09:23 AM ET Two stories have been published since this initial release: Which Linux distros are affected and what can you do? XZ Utils backdoor: Detection …

Curl project squashes high-severity bug in omnipresent libcurl library (CVE-2023-38545)

October 11, 2023

Curl v8.4.0 is out, and fixes – among other things – a high-severity SOCKS5 heap buffer overflow vulnerability (CVE-2023-38545). Appropriate patches for some older …

GNOME users at risk of RCE attack (CVE-2023-43641)

October 10, 2023

If you’re running GNOME on you Linux system(s), you are probably open to remote code execution attacks via a booby-trapped file, thanks to a memory corruption …

“Looney Tunables” bug allows root access on Linux distros (CVE-2023-4911)

October 5, 2023

A vulnerability (CVE-2023-4911) in the GNU C Library (aka “glibc”) can be exploited by attackers to gain root privileges on many popular Linux distributions, …

Google “confirms” that exploited Chrome zero-day is actually in libwebp (CVE-2023-5129)

September 27, 2023

UPDATE (September 28, 2023, 03:15 a.m. ET): The CVE-2023-5129 ID has been either rejected or withdrawn by the CVE Numbering Authority (Google), since it’s a duplicate of …

Downfall attacks can gather passwords, encryption keys from Intel processors

August 9, 2023

A variety of Intel Core processors and the devices using them are vulnerable to “Downfall”, a new class of attacks made possible by CVE-2022-40982, which enables …

Nimbuspwn bugs allow attackers to gain root privileges on some Linux machines (CVE-2022-29799, CVE-2022-29800)

April 27, 2022

Microsoft has unearthed two security vulnerabilities (CVE-2022-29799, CVE-2022-29800) in the networkd-dispatcher daemon that may be exploited by attackers to gain root on many …

Easily exploitable Linux bug gives root access to attackers (CVE-2022-0847)

March 8, 2022

An easily exploitable vulnerability (CVE-2022-0847) in the Linux kernel can be used by local unprivileged users to gain root privileges on vulnerable systems by taking …

PolKit vulnerability can give attackers root on many Linux distros (CVE-2021-4034)

January 26, 2022

A memory corruption vulnerability (CVE-2021-4034) in PolKit, a component used in major Linux distributions and some Unix-like operating systems, can be easily exploited by …

Researchers flag 7-years-old privilege escalation flaw in Linux kernel (CVE-2021-33909)

July 20, 2021

A vulnerability (CVE-2021-33909) in the Linux kernel’s filesystem layer that may allow local, unprivileged attackers to gain root privileges on a vulnerable host has been …