Mandrake Linux Security Advisory : apache (MDKSA-2007:127)

The recallheaders function in modmemcache in Apache 2.2.4 does not properly copy all levels of header data, which can cause Apache to return HTTP headers containing previously-used data, which could be used to obtain potentially sensitive information by unauthorized users. Updated packages have...

Mandrake Linux Security Advisory : kernel (MDKSA-2007:232)

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel : The minix filesystem code allows local users to cause a denial of service hang via a malformed minix file stream CVE-2006-6058. An integer underflow in the Linux kernel prior to 2.6.23 allows remote attackers to cause a...

Mandrake Linux Security Advisory : kernel (MDKSA-2007:226)

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel : The tcpsacktagwritequeue function in the Linux kernel 2.6.21 through 2.6.23.7 allows remote attackers to cause a denial of service via crafted ACK responses that trigger a NULL pointer dereference CVE-2007-5501. To updat...

Mandrake Linux Security Advisory : mozilla-firefox (MDKSA-2007:202)

A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox program, version 2.0.0.8. This update provides the latest Firefox to correct these issues. As well, it provides Firefox 2.0.0.8 for older products. %NASLMINLEVEL 70300 C Tenable Network Security,...

Mandrake Linux Security Advisory : qt4 (MDKSA-2007:075-1)

Andreas Nolden discover a bug in qt4, where the UTF8 decoder does not reject overlong sequences, which can cause '/../' injection or in the case of konqueror a '' tag injection. Updated packages have been patched to address this issue. Update : Packages for Mandriva Linux 2007.1 are now available...

Mandrake Linux Security Advisory : poppler (MDKSA-2007:227)

Alin Rad Pop found several flaws in how PDF files are handled in poppler. An attacker could create a malicious PDF file that would cause poppler to crash or potentially execute arbitrary code when opened. The updated packages have been patched to correct this issue. %NASLMINLEVEL 70300 C Tenable...

Mandrake Linux Security Advisory : tomcat5 (MDKSA-2007:241)

A number of vulnerabilities were found in Tomcat : A directory traversal vulnerability, when using certain proxy modules, allows a remote attacker to read arbitrary files via a .. dot dot sequence with various slash, backslash, or url-encoded backslash characters CVE-2007-0450; affects Mandriva...

Mandrake Linux Security Advisory : qt3 (MDKSA-2007:074)

Andreas Nolden discover a bug in qt3, where the UTF8 decoder does not reject overlong sequences, which can cause '/../' injection or in the case of konqueror a '' tag injection. Updated packages have been patched to address this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Mandrake Linux Security Advisory : php (MDKSA-2007:090)

A heap-based buffer overflow vulnerability was found in PHP's gd extension. A script that could be forced to process WBMP images from an untrusted source could result in arbitrary code execution CVE-2007-1001. A DoS flaw was found in how PHP processed a deeply nested array. A remote attacker coul...

Mandrake Linux Security Advisory : pcre (MDKSA-2007:211)

Multiple vulnerabilities were discovered by Tavis Ormandy and Will Drewry in the way that pcre handled certain malformed regular expressions. If an application linked against pcre, such as Konqueror, parses a malicious regular expression, it could lead to the execution of arbitrary code as the us...

Mandrake Linux Security Advisory : mozilla-firefox (MDKSA-2007:126-1)

A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox program, version 2.0.0.4. This update provides the latest Firefox to correct these issues. Update : The l10n language packages have now been updated and are available. %NASLMINLEVEL 70300 C Tenab...

MDKA-2007:042 : desktop-common-data

The default directories were not created with the correct translated name for Chinese locales. As well, an error message was displayed on the terminal when calling the www-browser script. Both issues have been fixed with this updated package. %NASLMINLEVEL 999999 @DEPRECATED@ This script has been...

MDKA-2007:075 : openal

The openal devel package used invalid requirements in its pkgconfig file, making some basic pkgconfig commands fail such as pkg-config --exists openal. This update package fixes the issue. %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a...

Mandrake Linux Security Advisory : mozilla-thunderbird (MDKSA-2007:131)

A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Thunderbird program, version 2.0.0.4. This update provides the latest Thunderbird to correct these issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

Mandrake Linux Security Advisory : bind (MDKSA-2007:100)

A vulnerability in ISC BIND 9.4.0, when recursion is enabled, could allow a remote attacker to cause a denial of service daemon exit via a certain sequence of queries. BIND 9.4.1, which corrects this issue, is provided with this update. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Mandrake Linux Security Advisory : ghostscript (MDKSA-2007:208)

A function in the JasPer JPEG-2000 library before 1.900 could allow a remote user-assisted attack to cause a crash and possibly corrupt the heap via malformed image files. Newer versions of ghostscript contain an embedded copy of libjasper and as such is vulnerable to this issue. Updated packages...

MDKA-2007:136 : ez-ipupdate

A 64-bit type error in ez-ipupdate would cause it to creash on x8664 systems. This update corrects the problem. %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a security fix. Disabled on 2012/09/06. C Tenable Network Security, Inc. This...

MDKA-2007:057 : xinitrc

The xdm scripts from the xinitrc package were not calling the sessreg utility, which is responsible for recording user logins on wtmp, correctly. This would prevent logins being registered when in graphical mode. This update corrects the problem. %NASLMINLEVEL 999999 @DEPRECATED@ This script has...

MDKA-2007:063 : mdkonline

The Mdkonline applet, mdkapplet, wrongly logged passwords for authenticated media via syslog. This update fixes the issue. %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a security fix. Disabled on 2012/09/06. C Tenable Network Security,...

MDKA-2007:094 : nfs-utils

The nfs-utils package had some issues with it's provided initscripts including: a lack of dependency on portmap made the various services start in an arbitary order prior to portmap starting, and parallel execution of rpcidmapd and rpcgss led to a launch failure due to a sunrpc module loading...