Mandriva Linux Security Advisory : automake (MDVSA-2013:031)

A vulnerability has been discovered and corrected in automake : A race condition in automake lib/am/distdir.am could allow a local attacker to run arbitrary code with the privileges of the user running make distcheck CVE-2012-3386. The updated packages have been patched to correct this issue. NOT...

Mandriva Linux Security Advisory : bip (MDVSA-2013:063)

Updated bip package fixes security vulnerability : Buffer overflow in Bip 0.8.8 and earlier might allow remote authenticated users to execute arbitrary code via vectors involving a series of TCP connections that triggers use of many open file descriptors CVE-2012-0806. %NASLMINLEVEL 70300 C Tenab...

Mandriva Linux Security Advisory : rpmdevtools (MDVSA-2013:123)

Updated rpmdevtools package fixes security vulnerability : A TOCTOU race condition was found in the way 'annotate-output' used to execute a program annotating the output linewise with time and stream tool of rpmdevtools before 8.3 performed management of its temporary files used for standard outp...

Mandriva Linux Security Advisory : icclib (MDVSA-2013:089)

A security issue was identified and fixed in icclib : An integer overflow flaw, leading to a heap-based buffer overflow, was found in Ghostscript's International Color Consortium Format library icclib. An attacker could create a specially crafted PostScript or PDF file with embedded images that...

Mandriva Linux Security Advisory : argyllcms (MDVSA-2013:090)

A security issue was identified and fixed in argyllcms : An integer overflow flaw, leading to a heap-based buffer overflow, was found in Ghostscript's International Color Consortium Format library icclib. An attacker could create a specially crafted PostScript or PDF file with embedded images tha...

Mandriva Linux Security Advisory : apache-mod_security (MDVSA-2013:029)

A vulnerability has been discovered and corrected in apache-modsecurity : ModSecurity = 2.6.8 is vulnerable to multipart/invalid part ruleset bypass, this was fixed in 2.7.0 released on2012-10-16 CVE-2012-4528. The updated packages have been patched to correct this issue. NOTE: This advisory was...

Mandriva Linux Security Advisory : openconnect (MDVSA-2013:108)

Updated openconnect packages fix security vulnerability : A stack-based buffer overflow flaw was found in the way OpenConnect, a client for Cisco's AnyConnect VPN, performed processing of certain host names, paths, or cookie lists, received from the VPN gateway. A remote VPN gateway could provide...

Mandriva Linux Security Advisory : squashfs-tools (MDVSA-2013:128)

Updated squashfs-tools packages fix security vulnerabilities : remote arbitrary code execution via crafted list file CVE-2012-4024. integer overflow in queueinit may lead to arbitrary code execution CVE-2012-4025. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and packa...

Mandriva Linux Security Advisory : xinetd (MDVSA-2013:057)

A security issue was identified and fixed in xinetd : builtins.c in Xinetd before 2.3.15 does not check the service type when the tcpmux-server service is enabled, which exposes all enabled services and allows remote attackers to bypass intended access restrictions via a request to tcpmux port 1...

Mandriva Linux Security Advisory : jakarta-poi (MDVSA-2013:094)

Updated jakarta-poi packages fix security vulnerability : It was discovered that Apache POI, a Java implementation of the Microsoft Office file formats, would allocate arbitrary amounts of memory when processing crafted documents. This could impact the stability of the Java virtual machine...

Mandriva Linux Security Advisory : vte (MDVSA-2013:135)

Updated vte packages fix security vulnerability : A denial of service flaw was found in the way VTE, a terminal emulator widget, processed certain escape sequences with large repeat counts. A remote attacker could provide a specially crafted file, which once opened in a terminal using the VTE...

Mandriva Linux Security Advisory : ruby (MDVSA-2013:124)

Updated ruby packages fix security vulnerabilities : Shugo Maedo and Vit Ondruch discovered that Ruby incorrectly allowed untainted strings to be modified in protective safe levels. An attacker could use this flaw to bypass intended access restrictions CVE-2012-4466, CVE-2012-4481. It was...

Mandriva Linux Security Advisory : libotr (MDVSA-2013:097)

A vulnerability was found and corrected in libotr : Just Ferguson discovered that libotr, an off-the-record OTR messaging library, can be forced to perform zero-length allocations for heap buffers that are used in base64 decoding routines. An attacker can exploit this flaw by sending crafted...

Mandriva Linux Security Advisory : python-pycrypto (MDVSA-2013:120)

Updated python-pycrypto package fixes security vulnerability : PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it easier for attackers to conduct brute-force attacks to...

Mandriva Linux Security Advisory : socat (MDVSA-2013:127)

Updated socat package fixes security vulnerability : Heap-based buffer overflow in the xioscanreadline function in xio-readline.c in socat 1.4.0.0 through 1.7.2.0 and 2.0.0-b1 through 2.0.0-b4 allows local users to execute arbitrary code via the READLINE address CVE-2012-0219. %NASLMINLEVEL 70300...

Mandriva Linux Security Advisory : cronie (MDVSA-2013:033)

Updated cronie package fixes the following issue : It was reported that cronie 1.4.8 would leak certain file descriptors. On systems where /etc/crontab is not world-readable this could be an information disclosure concern CVE-2012-6097. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Mandriva Linux Security Advisory : python-feedparser (MDVSA-2013:118)

Updated python-feedparser package fixes security vulnerability : Universal Feed Parser aka feedparser or python-feedparser before 5.1.2 allows remote attackers to cause a denial of service memory consumption via a crafted XML ENTITY declaration in a non-ASCII encoded document CVE-2012-2921...

Mandriva Linux Security Advisory : python (MDVSA-2013:117)

Updated python packages fix security vulnerabilities : A race condition was found in the way the Python distutils module set file permissions during the creation of the .pypirc file. If a local user had access to the home directory of another user who is running distutils, they could use this fla...

USN-1805-1: Linux kernel vulnerabilities

Mathias Krause discovered an information leak in the Linux kernel's getsockname implementation for Logical Link Layer llc sockets. A local user could exploit this flaw to examine some of the kernel's stack memory. CVE-2012-6542 Mathias Krause discovered information leaks in the Linux kernel's...

Fedora Update for krb5 FEDORA-2013-5286

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scripttagname:"affected", value:"krb...