Book Mark

Ike.ninja

Linux Fun
  • Home
  • How to
  • Reference Links
  • Categories
    • Releases
    • Plesk
    • Community
    • CMS
    • security
    • MYSQL
    • cPanel
  • Tools
    • IP Checker
    • Byte Converter
RSS

Security Advisory 2013-08-21

Aug22
by Ike on August 22, 2013 at 1:48 pm
Posted In: Community, cPanel, Hosting, News, security

SUMMARY

The PHP development team has announced the immediate availability of PHP 5.5.2. This release contains approximately 20 bug fixes, including a security issue in the OpenSSL module (CVE-2013-4248) and a session fixation problem (CVE-2011-4718). All users of PHP are encouraged to upgrade to this release. cPanel has released EasyApache 3.22.6 with PHP 5.5.2 to address this issue.

AFFECTED VERSIONS

All versions of PHP5 before 5.5.2

SECURITY RATING

The National Vulnerability Database (NIST) has given the following severity ratings of these CVEs:

CVE-2011-4718 – MEDIUM
CVE-2013-4248 – MEDIUM

PHP 5.5.2

CVE-2011-4718: A session fixation vulnerability in the Sessions subsystem in PHP, before 5.5.2, allows remote attackers to hijack web sessions by specifying a session ID.

CVE-2013-4248: The openssl_x509_parse function in openssl.c in the OpenSSL module in PHP before 5.4.18 and 5.5.x (before 5.5.2) does not properly handle a null character in a domain name in the Subject Alternative Name field of an X.509 certificate. This allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificated issued by a legitimate Certification Authority. This issue is related to CVE-2009-2408.

SOLUTION

cPanel, Inc. has released EasyApache 3.22.6 with an updated version of PHP5.5 to correct these issues. Unless EasyApache updates are disabled on your system, the latest version of EasyApache will be used whenever EasyApache is run.

REFERENCES

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4248
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4718
http://www.php.net/ChangeLog-5.php#5.5.2

For the PGP signed message, please go here.

└ Tags: cPanel, CVE, news, PHP, security
 Comment 

Parallels Plesk Panel 11.5.30 MU#13

Aug22
by Ike on August 22, 2013 at 9:45 am
Posted In: Plesk, Releases
The following features have been improved:
 
[*] DNS zones restoration process was improved. (140967)
[*] (Windows only) MailEnable was upgraded to version 7.50. (141274)
[*] (Windows only) Panel is shipped with Tomcat 7.0.42 and Java Runtime libraries 7 update 25. (141273)

The following issues have been fixed:

[-] (Linux only) Customers could receive the “Mail Not Delivered” messages even if their email was delivered successfully. (119925)
[-] (Linux only) The virus definitions of Parallels Premium Antivirus by Dr. Web were not updated if the default trial license key was used. (139833)
[-] (Linux only) After Panel was upgraded from version 11.0, PHP scripts could no longer be processed by nginx if SELinux was turned on. The following error was recorded in /var/log/php-fpm/error.log: “php-fpm.sock failed (13: Permission denied)”. (140941) [-] (Linux only) In some cases, Panel did not validate DNS record conflicts if CNAME records were manually modified. The DNS server failed to start. (141147)
[-] (Linux only) The RoundCube webmail was not working due to various errors (PHP errors, memory exhaustion, and so on) if certain classes or functions such as ini_get were disabled in the server-wide php.ini file. (141201)
[-] (Linux only) After upgrading Plesk from version 9.5, customers could no longer back up domains that had subdomains. The following error occurred: “Cannot savedir: Permission denied”. (141214)
[-] (Linux only) The subscription command-line utility could not change the PHP handler for websites. (141238)
[-] (Linux only) Subscriptions could not be synchronized with a service plan if the plan was created using command-line utilities and access to shell was not allowed or was set to chroot. (141254)
[-] (Linux only) The allow and deny access directives of Apache .htaccess worked incorrectly if a reverse proxy in nginx was enabled. (141265)
[-] (Linux only) If Panel was installed without updates, and updates were installed afterwards, email messages could not be sent. The following error occurred: “Warning: the Postfix sendmail command must be installed without set-uid root file permissions”. (141283)
[-] (Linux only) Administrators were unable to turn off the nginx reverse proxy. The following error occurred: “Service /etc/init.d/nginx failed to stop”. (141297)
[-] (Linux only) Customers could not disable DomainKeys email signing on domains after it had been enabled. (141316)
[-] The help page of the dns command-line utility was not localized. (141368)
[-] The help page of the server_dns command-line utility contained errors. (141374)
[-] Backing up to external FTP repositories did not work properly. (141100 and 141338)
[-] Updating of reseller service plans via API-RPC could result in the following error: “PHP Fatal error: Call to undefined method”. (141439)
[-] After upgrading from Plesk 9 it was impossible to remove email accounts with mail forwarding. The following error occurred: “PHP Fatal error: Call to undefined method”. (141453)
[-] Customers could use webmail on their domains even if the domains were suspended. (84187)
[-] (Linux only) Qmail did not accept email messages sent to mailing lists on domain aliases. The following error occurred: “550 sorry, no mailbox here by that name. (#5.7.17)”. (107619)
[-] (Linux only) Panel failed to migrate the Mailman data and settings if the default locale of the source server was German. (133147)
[-] Panel failed to migrate mail relay settings from Plesk 9.x with the error “Unable to set relaying type”. (140277)
[-] (Linux only) Panel failed to migrate databases that use latin-1 character set. In the migrated databases, non-ASCII characters were replaced with question marks. (141027)
[-] Panel did not pass database user passwords to event handlers. (141261)
[-] (Linux only) When administrators executed the statistics utility for a single domain, Panel removed FTP log records for other domains. (141378)
[-] Email notifications about resource overuse that were sent on behalf of the administrator contained wrong sender email addresses. (141380)
[-] Administrators had to complete the post-install configuration of Panel before they could use the server_dns command-line utility. (141502)
[-] Security improvements. (141537)
[-] (Linux only) Kaspersky Antivirus could not be switched on via the API-RPC. (141491)
[-] (Linux only) Message submission did not work after installing updates on Panel 11.5.30. (141740)
[-] (Windows only) Domains could not be migrated from Plesk 9 if mail accounts on source servers had a password containing a quotation mark (“) (141054)
[-] (Windows only) AWStats statistics processed log files very slowly because of excessive DNS lookups. (137500)
[-] (Windows only) IP addresses that were no longer used could not be removed from the server IP pool. The following error occurred: “The IP address x.x.x.x is already used for hosting”. (141139)
[-] (Windows only) Panel did not include some DNS records from the server-wide DNS template into DNS zones of newly created domains. (132577)
[-] (Windows only) Users were unable to log in to Control Panel from Customer & Business Manager by clicking Business Operations > Subscriptions > <subscription name> > Log In. They encountered the following error: “Internal error: SQLSTATE[42S22]: Column not found: 1054 Unknown column ‘externalId’ in ‘where clause’.” (141454)
[-] (Windows only) Users were unable to import database backups through phpMyAdmin. (141524)

└ Tags: command, DNS, Linux, Parallels Plesk Panel
 Comment 

Ubuntu: 1932-1: Linux kernel vulnerabilities

Aug22
by Ike on August 22, 2013 at 12:06 am
Posted In: Other

(Aug 20) Several security issues were fixed in the kernel.

└ Tags: Linux
 Comment 

Ubuntu: 1936-1: Linux kernel (Raring HWE) vulnerabilities

Aug22
by Ike on August 22, 2013 at 12:06 am
Posted In: Other

(Aug 20) Several security issues were fixed in the kernel.

└ Tags: Linux
 Comment 

Red Hat: 2013:1166-01: kernel: Important Advisory

Aug21
by Ike on August 21, 2013 at 11:37 pm
Posted In: Other

(Aug 20) Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having [More…]

└ Tags: Important Advisory, Red Hat, security, update
 Comment 
  • Page 2,599 of 2,972
  • « First
  • «
  • 2,597
  • 2,598
  • 2,599
  • 2,600
  • 2,601
  • »
  • Last »

What’s New?

  • Debian: Important DoS Vulnerabilities in FFmpeg DSA-6080-1 Advisory
  • Ubuntu 20.04 LTS: USN-7922-1 Linux Kernel Important Security Issues
  • Ubuntu 24.04 LTS: Kernel Important Security Fixes USN-7921-1 CVE-2025-39946
  • Debian: firefox-esr Critical Privilege Escalation DSA-6078-1 CVE-2025-14321
  • 2026 Global Partner Program Announcement
  • Fedora 43: python3-docs Update 2025-e235793f10 – Maintenance Release
  • Fedora 43: python3.14 Critical Update Addresses Quadratic Complexity Bug
  • Debian: WordPress Important XSS and Info Disclosure DSA-6075-1
  • Ubuntu 22.04 LTS: fontTools Important Path Traversal Risk CVE-2025-66034
  • Debian: webkit2gtk Critical Info Exfiltration DSA-6074-1 CVE-2025-13947
  • Ubuntu 25.10: Radare2 Critical Memory Leak Security Advisory USN-7915-1
  • Fedora 41 ABRT Critical Command Injection Vulnerability Fix CVE-2025-12744
  • Fedora 42: mingw-libpng Important Heap Buffer Overflow Vuln 2025-9d0f04f316
  • Ubuntu: WebKitGTK High Remote Code Execution Threat USN-7914-1
  • Debian Trixie: FFmpeg Critical Denial of Service and Code Exec DSA-6073-1
  • Fedora 42: tinygltf Update 2.9.7 Advisory FEDORA-2025-ac8ed4a110
  • Fedora 43: webkitgtk Critical Update for CVE-2025-13947, 43458, 66287
  • Fedora 43: TinyGLTF 2.9.7 Security Advisory FEDORA-2025-47bff6f74d
  • Fedora 42: abrt Critical Command Injection Vulnerability CVE-2025-12744
  • Fedora 42: Chromium High CVE-2025-13630, 13631, 13632 Advisory
  • Fedora 42: cef High Type Confusion Vuln CVE-2025-13223,13224 Advisory
  • Fedora 43: chromium High CVE-2025-13630 Type Confusion and more
  • Fedora 43: abrt Critical Command Injection Fix CVE-2025-12744
  • Ubuntu 22.04: Linux Kernel Azure Important Security Flaws USN-7910-2
  • Ubuntu 22.04: Important Linux Kernel Updates Addressing Security Flaws

Search

Translator

Tags

Business and industry code Community cPanel CVE Debian Debian Linux Distribution - Security Advisories Development Events Fedora Fedora Linux Distribution - Security Advisories General Hosting Important Advisory Linux Moderate Advisory Month in WordPress news Parallels Plesk Parallels Plesk Panel Performance PHP Plesk news and announcements Plesk Panel Podcast ProdDevSec Product and technology Products Project Release News Red Hat Red Hat Linux Distribution - Security Advisories Releases security Security Centre sensitive site Ubuntu Ubuntu Linux Distribution - Security Advisories update updates Various vulnerability Web Server Survey Wordpress wp-briefing

Posts

Helpful Links

  • Liquidweb.com
  • MYSQL Dev Documentation
  • Plugins
  • Source forge SED command
  • Themes
  • WordPress Documentation
  • You Tube
December 2025
M T W T F S S
« Nov    
1234567
891011121314
15161718192021
22232425262728
293031  
  • Google
  • Yahoo
  • Liquid Web
  • Storm
  • YouTube

©1999-2025 Ike.ninja | Powered by WordPress with Easel | Subscribe: RSS | Back to Top ↑

50 queries. 8.5 mb Memory usage. 0.266 seconds.