MDVA-2009:001 : dos2unix

The dos2unix command removes the last line of a file if no newline characters follow. This package fixes the issue. %NASLMINLEVEL 70300 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a security fix. Disabled on 2012/09/06. C Tenable Network Security, Inc. Th...

MDVA-2008:091-1 : gnome-applets

The clock applet in GNOME could crash when using some specific locations or when using updated timezone data. The Recent Documents menu was not always able to start the right application for a specific document. Update: The previous gnome-applets package on x8664 was improperly built and included...

MDVA-2008:170 : alsa-plugins

The version of alsa-plugins provided with Mandriva Linux 2009.0 fails when trying to record sound via alsa using pulseaudio. This updated package contains an upstream patch to fix this bug. %NASLMINLEVEL 70300 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a...

MDVA-2008:055 : xkeyboard-config

Mandriva Linux 2008.1 introduced an improved Finnish default keyboard layout called Kotoistus. This layout adds altgr-space as a key combination for non-breaking space. However, that key combination can be easily hit accidentally when a normal space was intended instead, especially after typing t...

Mandriva Linux Security Advisory : nasm (MDVSA-2008:120)

An off-by-one error was found in nasm 2.02 that allowed context-dependent attackers to cause a denial of service crash or possibly execute arbitrary code via a crafted file that triggers a stack-based buffer overflow CVE-2008-2719. The updated packages have been patched to prevent this issue...

Mandriva Linux Security Advisory : libxslt (MDVSA-2008:160)

Chris Evans of the Google Security Team found a vulnerability in the RC4 processing code in libxslt that did not properly handle corrupted key information. A remote attacker able to make an application linked against libxslt process malicious XML input could cause the application to crash or...

Mandriva Linux Security Advisory : cairo (MDVSA-2008:019)

Peter Valchev discovered that Cairo did not correctly decode PNG image data. By tricking a user or automated system into processing a specially crafted PNG with Cairo, a remote attacker could execute arbitrary code with the privileges of the user opening the file. The updated packages have been...

Mandriva Linux Security Advisory : clamav (MDVSA-2008:166)

An incomplete fix for CVE-2008-2713 resulted in remote attackers being able to cause a denial of service via a malformed Petite file that triggered an out-of-bounds memory access CVE-2008-3215. This issue is corrected with the 0.93.3 release which is being provided. %NASLMINLEVEL 70300 C Tenable...

Mandriva Linux Security Advisory : boost (MDVSA-2008:032)

Tavis Ormandy and Will Drewry found that the bost library did not properly perform input validation on regular expressions. An attacker could exploit this by sening a specially crafted regular expression to an application linked against boost and cause a denial of service via an application crash...

Mandriva Linux Security Advisory : poppler (MDVSA-2009:068-1)

A crafted PDF file that triggers a parsing error allows remote attackers to cause definal of service. This bug is consequence of a wrong processing on FormWidgetChoice::loadDefaults method CVE-2009-0755. A crafted PDF file that triggers a parsing error allows remote attackers to cause definal of...

Mandriva Linux Security Advisory : ruby (MDVSA-2008:029)

Ruby network libraries Net::HTTP, Net::IMAP, Net::FTPTLS, Net::Telnet, Net::POP3, and Net::SMTP, up to Ruby version 1.8.6 are affected by a possible man-in-the-middle attack, when using SSL, due to a missing check of the CN common name attribute in SSL certificates against the server's hostname...

Mandriva Linux Security Advisory : madwifi-source (MDVSA-2008:007)

MadWifi prior to 0.9.3.3 allowed remote attackers to cause a denial of service panic via a beacon frame with a large length value in the extended supported rates xrates element, which would trigger an assertion error. Updated packages have been updated to 0.9.3.3 to correct this issue...

Mandriva Linux Security Advisory : freetype2 (MDVSA-2008:121)

Multiple vulnerabilities were discovered in FreeType's Printer Font Binary PFB font-file format parser. If a user were to load a carefully crafted font file with a program linked against FreeType, it could cause the application to crash or potentially execute arbitrary code CVE-2008-1806,...

Mandriva Linux Security Advisory : pam (MDVSA-2009:077)

A security vulnerability has been identified and fixed in pam : Integer signedness error in the pamStrTok function in libpam/pammisc.c in Linux-PAM aka pam 1.0.3 and earlier, when a configuration file contains non-ASCII usernames, might allow remote attackers to cause a denial of service, and mig...

Mandriva Linux Security Advisory : libcdaudio (MDVSA-2008:233-1)

A heap overflow was found in the CDDB retrieval code of libcdaudio, which could result in the execution of arbitrary code CVE-2008-5030. In addition, the fixes for CVE-2005-0706 were not applied to newer libcdaudio packages as shipped with Mandriva Linux, so the patch to fix that issue has been...

Mandriva Linux Security Advisory : gstreamer0.10-plugins-good (MDVSA-2009:035)

Security vulnerabilities have been discovered and corrected in gstreamer0.10-plugins-good, might allow remote attackers to execute arbitrary code via a malformed QuickTime media file CVE-2009-0386, CVE-2009-0387, CVE-2009-0397. The updated packages have been patched to prevent this. %NASLMINLEVEL...

Mandriva Linux Security Advisory : gd (MDVSA-2008:038)

Buffer overflow in the LWZReadByte function in gdgifin.c in GD prior to 2.0.34 allows remote attackers to have an unknown impact via a GIF file with inputcodesize greater than MAXLWZBITS, which triggers an overflow when initializing the table array. This was originally fixed in PHP's embedded GD...

Mandriva Linux Security Advisory : nfs-utils (MDVSA-2009:060)

A security vulnerability has been identified and fixed in nfs-utils, which caused TCP Wrappers to ignore netgroups and allows remote attackers to bypass intended access restrictions CVE-2008-4552. The updated packages have been patched to prevent this. %NASLMINLEVEL 70300 C Tenable Network...

Mandriva Linux Security Advisory : php (MDVSA-2009:021)

A buffer overflow in the imageloadfont function in PHP allowed context-dependent attackers to cause a denial of service crash and potentially execute arbitrary code via a crafted font file CVE-2008-3658. A buffer overflow in the memnstr function allowed context-dependent attackers to cause a deni...

Mandriva Linux Security Advisory : kernel (MDVSA-2008:234)

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel : Buffer overflow in the hfsplusfindcat function in fs/hfsplus/catalog.c in the Linux kernel before 2.6.28-rc1 allows attackers to cause a denial of service memory corruption or system crash via an hfsplus filesystem image...