[ MDVSA-2015:022 ] wireshark

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:022 http://www.mandriva.com/en/support/security/ Package : wireshark Date : January 12, 2015 Affected: Business Server 1.0 Problem Description: Updated wireshark packages fix security vulnerabilities: The DE...

[ MDVSA-2015:005 ] subversion

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:005 http://www.mandriva.com/en/support/security/ Package : subversion Date : January 5, 2015 Affected: Business Server 1.0 Problem Description: Updated subversion packages fix security vulnerabilities: A NUL...

[ MDVSA-2015:009 ] krb5

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:009 http://www.mandriva.com/en/support/security/ Package : krb5 Date : January 8, 2015 Affected: Business Server 1.0 Problem Description: Updated krb5 packages fix security vulnerability: In MIT krb5, when...

[ MDVSA-2015:017 ] libevent

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:017 http://www.mandriva.com/en/support/security/ Package : libevent Date : January 8, 2015 Affected: Business Server 1.0 Problem Description: Updated libevent packages fix security vulnerability: Andrew...

Mandriva Linux Security Advisory : wireshark (MDVSA-2015:022)

Updated wireshark packages fix security vulnerabilities : The DEC DNA Routing Protocol dissector could crash CVE-2015-0562. The SMTP dissector could crash CVE-2015-0563. Wireshark could crash while decypting TLS/SSL sessions CVE-2015-0564. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Mandriva Linux Security Advisory : libssh (MDVSA-2015:020)

Updated libssh packages fix security vulnerability : Double free vulnerability in the sshpacketkexinit function in kex.c in libssh 0.5.x and 0.6.x before 0.6.4 allows remote attackers to cause a denial of service via a crafted kexinit packet CVE-2014-8132. %NASLMINLEVEL 70300 C Tenable Network...

Mandriva Linux Security Advisory : openssl (MDVSA-2015:019)

Multiple vulnerabilities has been discovered and corrected in openssl : A carefully crafted DTLS message can cause a segmentation fault in OpenSSL due to a NULL pointer dereference. This could lead to a Denial Of Service attack CVE-2014-3571. A memory leak can occur in the dtls1bufferrecord...

Mandriva Linux Security Advisory : znc (MDVSA-2015:013)

Updated znc packages fix security vulnerabilities : Multiple vulnerabilities were reported in ZNC version 1.0 which can be exploited by malicious authenticated users to cause a denial of service. These flaws are due to errors when handling the editnetwork, editchan, addchan, and delchan page...

Mandriva Linux Security Advisory : krb5 (MDVSA-2015:009)

Updated krb5 packages fix security vulnerability : In MIT krb5, when kadmind is configured to use LDAP for the KDC database, an authenticated remote attacker can cause a NULL dereference by attempting to use a named ticket policy object as a password policy for a principal. The attacker needs to ...

Mandriva Linux Security Advisory : unrtf (MDVSA-2015:007)

Updated unrtf package fixes security vulnerabilities : Michal Zalewski reported an out-of-bounds memory access vulnerability in unrtf. Processing a malformed RTF file could lead to a segfault while accessing a pointer that may be under the attacker's control. This would lead to a denial of servic...

Mandriva Linux Security Advisory : libevent (MDVSA-2015:017-1)

Updated libevent packages fix security vulnerability : Andrew Bartlett of Catalyst reported a defect affecting certain applications using the Libevent evbuffer API. This defect leaves applications which pass insanely large inputs to evbuffers open to a possible heap overflow or infinite loop. In...

Mandriva Linux Security Advisory : jasper (MDVSA-2015:012)

Updated jasper packages fix security vulnerabilities : A double free flaw was found in the way JasPer parsed ICC color profiles in JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code CVE-2014-8137. A heap-based buff...

Mandriva Linux Security Advisory : sox (MDVSA-2015:015)

Updated sox packages fix security vulnerability : The sox command line tool is affected by two heap-based buffer overflows, respectively located in functions startread and AdpcmReadBlock. A specially crafted wav file can be used to trigger the vulnerabilities CVE-2014-8145. %NASLMINLEVEL 70300 C...

Mandriva Linux Security Advisory : mediawiki (MDVSA-2015:006)

Updated mediawiki packages fix security vulnerabilities : In MediaWiki before 1.23.8, thumb.php outputs wikitext message as raw HTML, which could lead to cross-site scripting. Permission to edit MediaWiki namespace is required to exploit this. In MediaWiki before 1.23.8, a malicious site can bypa...

Mandriva Linux Security Advisory : libjpeg (MDVSA-2015:014)

Updated libjpeg packages fix security vulnerability : Passing a specially crafted jpeg file to libjpeg-turbo could lead to stack smashing CVE-2014-9092. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandriva Linux...

Mandriva Linux Security Advisory : nail (MDVSA-2015:011)

Updated nail package fixes security vulnerabilities : A flaw was found in the way mailx handled the parsing of email addresses. A syntactically valid email address could allow a local attacker to cause mailx to execute arbitrary shell commands through shell meta-characters and the direct command...

Mandriva Linux Security Advisory : pwgen (MDVSA-2015:008)

Updated pwgen package fixes security vulnerabilities : Pwgen was found to generate weak non-tty passwords by default, which could be brute-forced with a commendable success rate, which could raise security concerns CVE-2013-4440. Pwgen was found to silently falling back to use standard pseudo...

Mandriva Linux Security Advisory : unzip (MDVSA-2015:016)

Updated unzip package fix security vulnerabilities : The unzip command line tool is affected by heap-based buffer overflows within the CRC32 verification CVE-2014-8139, the testcompreb CVE-2014-8140 and the getZip64Data CVE-2014-8141 functions. The input errors may result in in arbitrary code...

Mandriva Linux Security Advisory : file (MDVSA-2015:010)

Updated file packages fix security vulnerabilities : Thomas Jarosch of Intra2net AG reported that using the file command on a specially crafted ELF binary could lead to a denial of service due to uncontrolled resource consumption CVE-2014-8116. Thomas Jarosch of Intra2net AG reported that using t...

Mandriva Linux Security Advisory : asterisk (MDVSA-2015:018)

Updated asterisk packages fix security vulnerability : Double free vulnerability in the WebSocket Server reshttpwebsocket module in Asterisk Open Source 11.x before 11.14.2 allows remote attackers to cause a denial of service crash by sending a zero length frame after a non-zero length frame...