Mandriva Linux Security Advisory : wget (MDVSA-2009:206-1)

A vulnerability has been found and corrected in wget : GNU Wget before 1.12 does not properly handle a '' NUL character in a domain name in the Common Name field of an X.509 certificate, which allows man-in-the-middle remote attackers to spoof arbitrary SSL servers via a crafted certificate issue...

MDVA-2009:151 : samba

This is the last upstream maintenance release of the Samba 3.2 series. Major enhancements in 3.2.14 include: o Fix SAMR access checks e.g. bugs 6089 and 6112. o Fix 'force user' bug 6291. o Improve Win7 support bug 6099. o Fix posix ACLs when setting an ACL without explicit ACE for the owner bug...

Mandriva Linux Security Advisory : memcached (MDVSA-2009:202)

A vulnerability has been found and corrected in memcached : Multiple integer overflows in memcached 1.1.12 and 1.2.2 allow remote attackers to execute arbitrary code via vectors involving length attributes that trigger heap-based buffer overflows CVE-2009-2415. This update provides a solution to...

Mandriva Linux Security Advisory : curl (MDVSA-2009:203-1)

A vulnerability has been found and corrected in curl : lib/ssluse.c in cURL and libcurl 7.4 through 7.19.5, when OpenSSL is used, does not properly handle a '' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spo...

[ MDVSA-2009:203 ] curl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2009:203 http://www.mandriva.com/security/ Package : curl Date : August 15, 2009 Affected: 2008.1, 2009.0, Corporate 3.0, Corporate 4.0, Enterprise Server 5.0, Multi Network Firewall 2.0 Problem Description: A...

Mandriva Linux Security Advisory : libxml (MDVSA-2009:200-1)

Multiple vulnerabilities has been found and corrected in libxml : Stack consumption vulnerability in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allows context-dependent attackers to cause a denial of service application crash via a large depth of element declarations i...

Mandriva Linux Security Advisory : fetchmail (MDVSA-2009:201-1)

A vulnerability has been found and corrected in fetchmail : socket.c in fetchmail before 6.3.11 does not properly handle a '' NUL character in a domain name in the subject's Common Name CN and subjectAlternativeName fields of an X.509 certificate, which allows man-in-the-middle attackers to spoof...

MDVA-2009:144 : libv4l

This update addresses the issue of urpmi preventing installation of both i586/x8664 versions of libv4l wrappers Mandriva bug 45316. Updated packages are provided to fix this issue. %NASLMINLEVEL 70300 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a security...

[ MDVSA-2009:161-1 ] squid

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2009:161-1 http://www.mandriva.com/security/ Package : squid Date : August 8, 2009 Affected: 2008.1, 2009.0, 2009.1, Enterprise Server 5.0 Problem Description: Multiple vulnerabilities has been found and correcte...

Mandriva Linux Security Advisory : nss (MDVSA-2009:197-3)

Security issues in nss prior to 3.12.3 could lead to a man-in-the-middle attack via a spoofed X.509 certificate CVE-2009-2408 and md2 algorithm flaws CVE-2009-2409, and also cause a denial-of-service and possible code execution via a long domain name in X.509 certificate CVE-2009-2404. This updat...

Mandriva Linux Security Advisory : firefox (MDVSA-2009:198)

Security issues were identified and fixed in firefox 3.0.x : Security researcher Juan Pablo Lopez Yacubian reported that an attacker could call window.open on an invalid URL which looks similar to a legitimate URL and then use document.write to place content within the new document, appearing to...

Mandriva Linux Security Advisory : apr (MDVSA-2009:195)

A vulnerability has been identified and corrected in apr and apr-util : Multiple integer overflows in the Apache Portable Runtime APR library and the Apache Portable Utility library aka APR-util 0.9.x and 1.3.x allow remote attackers to cause a denial of service application crash or possibly...

Mandriva Linux Security Advisory : ruby (MDVSA-2009:193)

ext/openssl/osslocsp.c in Ruby 1.8 and 1.9 does not properly check the return value from the OCSPbasicverify function, which might allow remote attackers to successfully present an invalid X.509 certificate, possibly involving a revoked certificate. This update corrects the problem, including for...

Mandriva Linux Security Advisory : wireshark (MDVSA-2009:194)

Vulnerabilities have been discovered in wireshark package, which could lead to application crash via radius, infiniband and afs dissectors CVE-2009-2560, CVE-2009-2562, CVE-2009-2563. This update provides a fix for those vulnerabilities. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Mandriva Linux Security Advisory : apache-mod_auth_mysql (MDVSA-2009:189-1)

A vulnerability has been found and corrected in modauthmysql : SQL injection vulnerability in modauthmysql.c in the mod-auth-mysql aka libapache2-mod-auth-mysql module for the Apache HTTP Server 2.x allows remote attackers to execute arbitrary SQL commands via multibyte character encodings for...

Mandriva Linux Security Advisory : bind (MDVSA-2009:181)

A vulnerability has been found and corrected in ISC BIND : The dnsdbfindrdataset function in db.c in named in ISC BIND 9.4 before 9.4.3-P3, 9.5 before 9.5.1-P3, and 9.6 before 9.6.1-P1, when configured as a master server, allows remote attackers to cause a denial of service assertion failure and...

Mandriva Linux Security Advisory : initscripts (MDVSA-2009:170)

Mandriva Security team has identified and fixed a vulnerability in initscripts which could lead to partial wireless password disclosure for WPA/WPA2 passwords of certain length which contained spaces. This update fixes the vulnerability. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Mandriva Linux Security Advisory : squid (MDVSA-2009:161-1)

Multiple vulnerabilities has been found and corrected in squid : Due to incorrect buffer limits and related bound checks Squid is vulnerable to a denial of service attack when processing specially crafted requests or responses CVE-2009-2621. Due to incorrect data validation Squid is vulnerable to...

Mandriva Linux Security Advisory : ruby (MDVSA-2009:160)

The BigDecimal library in Ruby 1.8.6 before p369 and 1.8.7 before p173 allows context-dependent attackers to cause a denial of service application crash via a string argument that represents a large number, as demonstrated by an attempted conversion to the Float data type. This update corrects th...

Mandriva Linux Security Advisory : pango (MDVSA-2009:158-3)

Integer overflow in the pangoglyphstringsetsize function in pango/glyphstring.c in Pango before 1.24 allows context-dependent attackers to cause a denial of service application crash or possibly execute arbitrary code via a long glyph string that triggers a heap-based buffer overflow. This update...