MDVA-2009:239 : imagemagick

The package was accidently linked against the wrong libjasper version. This update addresses that problem. %NASLMINLEVEL 70300 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a security fix. Disabled on 2012/09/06. C Tenable Network Security, Inc. This script...

Mandriva Linux Security Advisory : netpbm (MDVSA-2009:317)

Multiple security vulnerabilities has been identified and fixed in netpbm : Multiple integer overflows in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via a crafted image file, related to integer multiplication for memory allocation CVE-2008-3520. Buffer overfl...

Mandriva Linux Security Advisory : samba (MDVSA-2009:320)

Multiple vulnerabilities has been found and corrected in samba : The aclgroupoverride function in smbd/posixacls.c in smbd in Samba 3.0.x before 3.0.35, 3.1.x and 3.2.x before 3.2.13, and 3.3.x before 3.3.6, when dos filemode is enabled, allows remote attackers to modify access control lists for...

Mandriva Linux Security Advisory : expat (MDVSA-2009:316-3)

A vulnerability has been found and corrected in expat : The big2toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service application crash via an XML document with malformed UTF-8 sequences...

Mandriva Linux Security Advisory : libtiff (MDVSA-2009:169-1)

Multiple vulnerabilities has been found and corrected in libtiff : Buffer underflow in the LZWDecodeCompat function in libtiff 3.8.2 allows context-dependent attackers to cause a denial of service crash via a crafted TIFF image, a different vulnerability than CVE-2008-2327 CVE-2009-2285. Fix...

Mandriva Linux Security Advisory : ntp (MDVSA-2009:309)

Multiple vulnerabilities has been found and corrected in ntp : Requesting peer information from a malicious remote time server may lead to an unexpected application termination or arbitrary code execution CVE-2009-0159. A buffer overflow flaw was discovered in the ntpd daemon's NTPv4 authenticati...

Mandriva Linux Security Advisory : wireshark (MDVSA-2009:292-1)

"Vulnerabilities have been discovered and corrected in wireshark, affecting DCERPC/NT dissector, which allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a file that records a malformed packet trace CVE-2009-3550 %NASLMINLEVEL 70300 C Tenable...

Mandriva Linux Security Advisory : openssl (MDVSA-2009:310)

Multiple security vulnerabilities has been identified and fixed in OpenSSL : The dtls1bufferrecord function in ssl/d1pkt.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allows remote attackers to cause a denial of service memory consumption via a large series of future epoch DTLS records that are...

MDVA-2009:235 : freeradius

The cron files included in freeradius-web package were syntactically invalid, by lacking mention of the user expected to run the task. %NASLMINLEVEL 70300 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a security fix. Disabled on 2012/09/06. C Tenable Networ...

[ MDVSA-2009:306 ] dovecot

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2009:306 http://www.mandriva.com/security/ Package : dovecot Date : November 29, 2009 Affected: 2010.0 Problem Description: A vulnerability was discovered and corrected in dovecot: Dovecot 1.2.x before 1.2.8 sets...

Mandriva Linux Security Advisory : libtool (MDVSA-2009:307-1)

A vulnerability was discovered and corrected in libtool : All versions of libtool prior to 2.2.6b suffers from a local privilege escalation vulnerability that could be exploited under certain conditions to load arbitrary code CVE-2009-3736. This advisory fixes this issue. Additionally, all...

MDVA-2009:226 : apache

This is a minor bugfix release for apache modssl: The openssl and makedev packages is needed at install time from cdrom medias in %post for the apache-modssl sub package in order to be able to generate the dummy ssl certificate fixes 55951 The packages provided with this update addresses this...

Mandriva Linux Security Advisory : php (MDVSA-2009:304)

Some vulnerabilities were discovered and corrected in php : PHP 5.2.11, and 5.3.x before 5.3.1, does not restrict the number of temporary files created when handling a multipart/form-data POST request, which allows remote attackers to cause a denial of service resource exhaustion, and makes it...

MDVA-2009:219 : libxcb

Due to a packaging problem, the development version of the libxcb package on 64 bit systems could lead to file conflicts during the installation because it was not providing the libxcb-devel package. This update fixes this issue. %NASLMINLEVEL 70300 @DEPRECATED@ This script has been deprecated as...

MDVA-2009:220 : libxt

Due to a packaging problem, the development version of the libxt package on 64 bit systems could lead to file conflicts during the installation because it was not providing the libxt6-devel package. This update fixes this issue. %NASLMINLEVEL 70300 @DEPRECATED@ This script has been deprecated as...

[ MDVSA-2009:302 ] php

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2009:302 http://www.mandriva.com/security/ Package : php Date : November 21, 2009 Affected: 2010.0 Problem Description: Some vulnerabilities were discovered and corrected in php-5.3.1: - Added maxfileuploads INI...

Mandriva Linux Security Advisory : xine-lib (MDVSA-2009:299)

Vulnerabilities have been discovered and corrected in xine-lib : - Integer overflow in the qterror parsetrakatom function in demuxers/demuxqt.c in xine-lib 1.1.16.2 and earlier allows remote attackers to execute arbitrary code via a Quicktime movie file with a large count value in an STTS atom,...

Mandriva Linux Security Advisory : apache-conf (MDVSA-2009:300-2)

A vulnerability was discovered and corrected in apache-conf : The Apache HTTP Server enables the HTTP TRACE method per default which allows remote attackers to conduct cross-site scripting XSS attacks via unspecified web client software CVE-2009-2823. This update provides a solution to this...

Mandriva Linux Security Advisory : ffmpeg (MDVSA-2009:297-1)

Vulnerabilities have been discovered and corrected in ffmpeg : - The ffmpeg lavf demuxer allows user-assisted attackers to cause a denial of service application crash via a crafted GIF file CVE-2008-3230 - FFmpeg 0.4.9, as used by MPlayer, allows context-dependent attackers to cause a denial of...

MDVA-2009:199 : squid

This is a bugfix and maintenance release for squid that upgrades squid to 3.0.STABLE20 and fixes some bugs: An outstanding issue with code 304 and code 200 replies being mixed up has now been resolved. This means requests which need to refresh cache objects will not cause temporary client softwar...