Mandriva Linux Security Advisory : grub2 (MDVSA-2015:163)

Updated grub2 package fixes security vulnerability : An integer overflow in liblzo before 2.07 allows attackers to cause a denial of service or possibly code execution in applications using performing LZO decompression on a compressed payload from the attacker CVE-2014-4607. The grub2 package is...

Mandriva Linux Security Advisory : cups (MDVSA-2015:108)

Updated cups packages fix security vulnerabilities : Cross-site scripting XSS vulnerability in scheduler/client.c in Common Unix Printing System CUPS before 1.7.2 allows remote attackers to inject arbitrary web script or HTML via the URL path, related to the ispathabsolute function CVE-2014-2856...

Mandriva Linux Security Advisory : bash (MDVSA-2015:164)

Updated bash packages fix security vulnerability : A flaw was found in the way Bash evaluated certain specially crafted environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Certain services and applications allow remote...

Mandriva Linux Security Advisory : rsyslog (MDVSA-2015:130)

Updated rsyslog packages fix security vulnerability : Rainer Gerhards, the rsyslog project leader, reported a vulnerability in Rsyslog. As a consequence of this vulnerability an attacker can send malformed messages to a server, if this one accepts data from untrusted sources, and trigger a denial...

Mandriva Linux Security Advisory : jbigkit (MDVSA-2015:101)

Updated jbigkit packages fix security vulnerability : Florian Weimer found a stack-based buffer overflow flaw in the libjbig library part of jbigkit. A specially crafted image file read by libjbig could be used to cause a program linked to libjbig to crash or, potentially, to execute arbitrary co...

Mandriva Linux Security Advisory : libvirt (MDVSA-2015:070)

Updated libvirt packages fixes security vulnerabilities : The qemuDomainMigratePerform and qemuDomainMigrateFinish2 functions in qemu/qemudriver.c in libvirt do not unlock the domain when an ACL check fails, which allow local users to cause a denial of service via unspecified vectors CVE-2014-813...

Mandriva Linux Security Advisory : libarchive (MDVSA-2015:157)

Updated libarchive packages fix security vulnerability : Alexander Cherepanov discovered that bsdcpio, an implementation of the cpio program part of the libarchive project, is susceptible to a directory traversal vulnerability via absolute paths CVE-2015-2304. %NASLMINLEVEL 70300 C Tenable Networ...

Mandriva Linux Security Advisory : python-numpy (MDVSA-2015:077)

Updated python-numpy packages fix security vulnerabilities : f2py insecurely used a temporary file. A local attacker could use this flaw to perform a symbolic link attack to modify an arbitrary file accessible to the user running f2py CVE-2014-1858, CVE-2014-1859. %NASLMINLEVEL 70300 C Tenable...

Mandriva Linux Security Advisory : readline (MDVSA-2015:132)

Updated readline packages fix security vulnerability : Steve Kemp discovered the rltropen function in readline insecurely handled a temporary file. This could allow a local attacker to perform symbolic link attacks CVE-2014-2524. Also, upstream patches have been added to fix an infinite loop in v...

Mandriva Linux Security Advisory : libksba (MDVSA-2015:151)

Updated libksba packages fix security vulnerability : By using special crafted S/MIME messages or ECC based OpenPGP data, it is possible to create a buffer overflow, which could lead to a denial of service CVE-2014-9087. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text an...

Mandriva Linux Security Advisory : lua (MDVSA-2015:144)

Updated lua and lua5.1 packages fix security vulnerability : A heap-based overflow vulnerability was found in the way Lua handles varargs functions with many fixed parameters called with few arguments, leading to application crashes or, potentially, arbitrary code execution CVE-2014-5461...

Mandriva Linux Security Advisory : cifs-utils (MDVSA-2015:114)

Updated cifs-utils packages fix security vulnerability : Sebastian Krahmer discovered a stack-based buffer overflow flaw in cifscreds.c CVE-2014-2830. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandriva Linux...

Mandriva Linux Security Advisory : lcms2 (MDVSA-2015:107)

Updated lcms2 packages fix security vulnerability : Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect availability via unknown vectors related to 2D CVE-2014-0459. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descripti...

Mandriva Linux Security Advisory : cpio (MDVSA-2015:066)

Updated cpio package fixes security vulnerability : In GNU Cpio 2.11, the --no-absolute-filenames option limits extracting contents of an archive to be strictly inside a current directory. However, it can be bypassed with symlinks. While extracting an archive, it will extract symlinks and then...

Mandriva Linux Security Advisory : php (MDVSA-2015:080)

Multiple vulnerabilities has been discovered and corrected in php : It was discovered that the file utility contains a flaw in the handling of indirect magic rules in the libmagic library, which leads to an infinite recursion when trying to determine the file type of certain files CVE-2014-1943. ...

Mandriva Linux Security Advisory : libvncserver (MDVSA-2015:146)

Updated libvncserver packages fix security vulnerabilities : An integer overflow in liblzo before 2.07 allows attackers to cause a denial of service or possibly code execution in applications using performing LZO decompression on a compressed payload from the attacker CVE-2014-4607. The...

Mandriva Linux Security Advisory : dovecot (MDVSA-2015:113)

Updated dovecot packages fix security vulnerability. Dovecot before 2.2.13 is vulnerable to a DoS attack against imap/pop3-login processes. If SSL/TLS handshake was started but wasn't finished, the login process attempted to eventually forcibly disconnect the client, but failed to do it correctly...

Mandriva Linux Security Advisory : egroupware (MDVSA-2015:087)

Updated egroupware packages fix security vulnerabilities : eGroupware prior to 1.8.006.20140217 is vulnerable to remote file deletion and possible remote code execution due to user input being passed to PHP's unserialize method CVE-2014-2027. eGroupWare before 1.8.007 allows logged in users with...

Mandriva Linux Security Advisory : samba (MDVSA-2015:081)

Updated samba packages fix security vulnerabilities : An uninitialized pointer use flaw was found in the Samba daemon smbd. A malicious Samba client could send specially crafted netlogon packets that, when processed by smbd, could potentially lead to arbitrary code execution with the privileges o...

Mandriva Linux Security Advisory : libgd (MDVSA-2015:153)

Updated libgd packages fix security vulnerabilities : The gdImageCreateFromXpm function in gdxpm.c in the gd image library allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a crafted color table in an XPM file CVE-2014-2497. A buffer read...