Mandriva Linux Security Advisory : libsoup (MDVSA-2009:081)

An integer overflow in libsoup Base64 encoding and decoding functions enables attackers either to cause denial of service and to execute arbitrary code CVE-2009-0585. This update provides the fix for that security issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text an...

Mandriva Linux Security Advisory : mozilla-thunderbird (MDVSA-2009:083)

A number of security vulnerabilities have been discovered in previous versions, and corrected in the latest Mozilla Thunderbird program, version 2.0.0.21 CVE-2009-0040, CVE-2009-0776, CVE-2009-0771, CVE-2009-0772, CVE-2009-0773, CVE-2009-0774, CVE-2009-0352, CVE-2009-0353. This update provides th...

Mandriva Linux Security Advisory : speex (MDVSA-2008:094)

A vulnerability in the Speex library was found where it did not properly validate input values read from the Speex files headers. An attacker could create a malicious Speex file that would crash an application or potentially allow the execution of arbitrary code with the privileges of the...

Mandriva Linux Security Advisory : curl (MDVSA-2009:069)

A security vulnerability has been identified and fixed in curl, which could allow remote HTTP servers to 1 trigger arbitrary requests to intranet servers, 2 read or overwrite arbitrary files via a redirect to a file: URL, or 3 execute arbitrary commands via a redirect to an scp: URL CVE-2009-0037...

Mandriva Linux Security Advisory : wireshark (MDVSA-2008:152)

A number of vulnerabilities were discovered in Wireshark that could cause it to crash while processing malicious packets CVE-2008-3137, CVE-2008-3138, CVE-2008-3139, CVE-2008-3140, CVE-2008-3141, CVE-2008-3145. This update provides Wireshark 1.0.2, which is not vulnerable to these issues...

Mandriva Linux Security Advisory : krb5 (MDVSA-2009:082)

The spnegogssacceptseccontext function in lib/gssapi/spnego/spnegomech.c in MIT Kerberos 5 aka krb5 1.6.3, when SPNEGO is used, allows remote attackers to cause a denial of service NULL pointer dereference and application crash via invalid ContextFlags data in the reqFlags field in a negTokenInit...

Mandriva Linux Security Advisory : gstreamer-plugins-good (MDVSA-2008:092)

A vulnerability in the Speex library was found where it did not properly validate input values read from the Speex files headers. An attacker could create a malicious Speex file that would crash an application or potentially allow the execution of arbitrary code with the privileges of the...

Mandriva Linux Security Advisory : clamav (MDVSA-2008:166)

An incomplete fix for CVE-2008-2713 resulted in remote attackers being able to cause a denial of service via a malformed Petite file that triggered an out-of-bounds memory access CVE-2008-3215. This issue is corrected with the 0.93.3 release which is being provided. %NASLMINLEVEL 70300 C Tenable...

Mandriva Linux Security Advisory : lynx (MDVSA-2008:218)

A vulnerability was found in the Lynxcgi: URI handler that could allow an attacker to create a web page redirecting to a malicious URL that would execute arbitrary code as the user running Lynx, if they were using the non-default Advanced user mode CVE-2008-4690. This update corrects these issues...

Mandriva Linux Security Advisory : openoffice.org (MDVSA-2008:137)

Integer overflow in the rtlallocateMemory function in sal/rtl/source/allocglobal.c in OpenOffice.org OOo 2.0 through 2.4 allows remote attackers to execute arbitrary code via a crafted file that triggers a heap-based buffer overflow. CVE-2008-2152 Also, according to bug 38874 decimal numbers on...

Mandriva Linux Security Advisory : libpng (MDVSA-2008:156)

Tavis Ormandy of the Google Security Team discovered a flaw in how libpng handles zero-length unknown chunks in PNG files, which could lead to memory corruption in applications that make use of certain functions CVE-2008-1382. The updated packages have been patched to correct this issue...

Mandriva Linux Security Advisory : pidgin (MDVSA-2008:143)

An integer overflow flaw was found in Pidgin's MSN protocol handler that could allow for the execution of arbitrary code if a user received a malicious MSN message CVE-2008-2927. In addition, this update provides the ability to use ICQ networks again on Mandriva Linux 2008.0, as in MDVA-2008:103...

Mandriva Linux Security Advisory : gd (MDVSA-2008:038)

Buffer overflow in the LWZReadByte function in gdgifin.c in GD prior to 2.0.34 allows remote attackers to have an unknown impact via a GIF file with inputcodesize greater than MAXLWZBITS, which triggers an overflow when initializing the table array. This was originally fixed in PHP's embedded GD...

MDVA-2008:159 : curl

An idiosyncratic feature of the Turkish language is that the letter 'i' in Turkish is not the lower-case version of the letter 'I'. This issue breaks standard POSIX string case comparison on strings containing the character 'i'. This issue affected the curl package shipped with Mandriva Linux 200...

MDVA-2008:168 : sound-scripts

The sound initialization scripts provided with Mandriva Linux 2009 activate the Analog Loopback channel when it is present. This channel is present on most audio chipsets supported by the snd-hda-intel driver, which are commonly used on recent systems. When active, this channel plays back the sou...

MDVA-2008:001 : urpmi

urpmi --auto-update was strangely broken in some uncertain cases see bug 36134. urpmi --limit-rate had a regression introduced in version 4.9.12. The updated package fixes these issues. %NASLMINLEVEL 70300 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a...

MDVA-2008:151 : timezone

Updated timezone packages are being provided for older Mandriva Linux systems that do not contain new Daylight Savings Time information and Time Zone information for some locations. These updated packages contain the new information. %NASLMINLEVEL 70300 @DEPRECATED@ This script has been deprecate...

MDVA-2009:001-1 : dos2unix

The dos2unix command removes the last line of a file if no newline characters follow. This package fixes the issue. Update: This update now provides corrected packages for Mandriva Linux 2008.x and Corporate Server 4.0. %NASLMINLEVEL 70300 @DEPRECATED@ This script has been deprecated as the...

MDVA-2008:018 : mysql

Updated MySQL packages are being made available that fix a number of upstream bugs, as well as some minor packaging bugs. %NASLMINLEVEL 70300 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a security fix. Disabled on 2012/09/06. C Tenable Network Security,...

MDVA-2008:029 : evolution

A bug in Evolution was preventing the adding of remote calendars, which caused the application to crash. This update provides Evolution 2.12.3 which fixes this bug and other crash bugs, as well as including translation updates. %NASLMINLEVEL 70300 @DEPRECATED@ This script has been deprecated as t...