Mandriva Linux Security Advisory : ipsec-tools (MDVSA-2008:181)

Two denial of service vulnerabilities were discovered in the ipsec-tools racoon daemon, which could allow a remote attacker to cause it to consume all available memory CVE-2008-3651, CVE-2008-3652. The updated packages have been patched to prevent these issues. %NASLMINLEVEL 70300 C Tenable Netwo...

Mandriva Linux Security Advisory : ed (MDVSA-2008:200)

A heap-based buffer overflow was found in GNU ed that allowed context-dependent or user-assisted attackers to execute arbitrary code via a long filename CVE-2008-3916. This update provides GNU ed 1.0, which is not vulnerable to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Mandriva Linux Security Advisory : pcre (MDVSA-2008:147)

Tavis Ormandy of the Google Security Team discovered a heap-based buffer overflow when compiling certain regular expression patterns. This could be used by a malicious attacker by sending a specially crafted regular expression to an application using the PCRE library, resulting in the possible...

Mandriva Linux Security Advisory : gnumeric (MDVSA-2008:056)

A vulnerability was found in the excelreadHLINK function in the Microsoft Excel plugin in Gnumeric prior to version 1.8.1 that would allow for the execution of arbitrary code via a crafted XLS file containing XLS HLINK opcodes. The updated packages have been patched to correct this issues...

Mandriva Linux Security Advisory : firefox (MDVSA-2009:075)

Security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox 3.x, version 3.0.7 CVE-2009-0040, CVE-2009-0771, CVE-2009-0772, CVE-2009-0773, CVE-2009-0774, CVE-2009-0775, CVE-2009-0776, CVE-2009-0777. This update provides the latest Mozilla Firefox 3.x to correct these...

Mandriva Linux Security Advisory : libneon0.27 (MDVSA-2009:074)

A security vulnerability has been identified and fixed in neon : neon 0.28.0 through 0.28.2 allows remote servers to cause a denial of service NULL pointer dereference and crash via vectors related to Digest authentication and Digest domain parameter support CVE-2008-3746. The updated packages ha...

Mandriva Linux Security Advisory : unzip (MDVSA-2008:068)

Tavis Ormandy of Google Security discovered an invalid pointer flaw in unzip that could lead to the execution of arbitrary code with the privileges of the user running unzip. The updated packages have been patched to correct this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Mandriva Linux Security Advisory : rxvt (MDVSA-2008:161)

A vulnerability in rxvt allowed it to open a terminal on :0 if the environment variable was not set, which could be used by a local user to hijack X11 connections CVE-2008-1142. The updated packages have been patched to correct this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Mandriva Linux Security Advisory : wireshark (MDVSA-2008:215)

A number of vulnerabilities were discovered in Wireshark that could cause it to crash or abort while processing malicious packets CVE-2008-4680, CVE-2008-4681, CVE-2008-4682, CVE-2008-4683, CVE-2008-4684, CVE-2008-4685. This update provides Wireshark 1.0.4, which is not vulnerable to these issues...

Mandriva Linux Security Advisory : nss_ldap (MDVSA-2008:049)

A race condition in nssldap, when used in applications that use pthread and fork after a call to nssldap, does not properly handle the LDAP connection, which might cause nssldap to return the wrong user data to the wrong process, giving one user access to data belonging to another user, in some...

Mandriva Linux Security Advisory : krb5 (MDVSA-2008:070)

A memory management flaw was found in the GSSAPI library used by Kerberos that could result in an attempt to free already freed memory, possibly leading to a crash or allowing the execution of arbitrary code CVE-2007-5971. A flaw was discovered in how the Kerberos krb5kdc handled Kerberos v4...

Mandriva Linux Security Advisory : kernel (MDVSA-2008:104)

A race condition in the directory notification subsystem dnotify in Linux kernel 2.6.x before 2.6.24.6, and 2.6.25 before 2.6.25.1, allows local users to cause a denial of service OOPS and possibly gain privileges via unspecified vectors. CVE-2008-1375 The Linux kernel before 2.6.25.2 does not...

Mandriva Linux Security Advisory : evolution (MDVSA-2008:111)

Alan Rad Pop of Secunia Research discovered the following two vulnerabilities in Evolution : Evolution did not properly validate timezone data when processing iCalendar attachments. If a user disabled the Itip Formatter plugin and viewed a crafted iCalendar attachment, an attacker could cause a...

Mandriva Linux Security Advisory : libxml2 (MDVSA-2008:180-1)

Andreas Solberg found a denial of service flaw in how libxml2 processed certain content. If an application linked against libxml2 processed such malformed XML content, it could cause the application to stop responding CVE-2008-3281. Update : The original fix used to correct this issue caused some...

Mandriva Linux Security Advisory : mozilla-thunderbird (MDVSA-2008:062)

A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Thunderbird program, version 2.0.0.12. This update provides the latest Thunderbird to correct these issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

Mandriva Linux Security Advisory : cups (MDVSA-2008:036)

Wei Wang found that the SNMP discovery backend in CUPS did not correctly calculate the length of strings. If a user could be tricked into scanning for printers, a remote attacker could send a specially crafted packet and possibly execute arbitrary code CVE-2007-5849. As well, the fix for...

Mandriva Linux Security Advisory : openssl (MDVSA-2009:087)

A security vulnerability has been identified and fixed in OpenSSL, which could crash applications using OpenSSL library when parsing malformed certificates CVE-2009-0590. The updated packages have been patched to prevent this. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Mandriva Linux Security Advisory : mplayer (MDVSA-2008:045)

Heap-based buffer overflow in the rmffdumpcont function in input/libreal/rmff.c in xine-lib 1.1.9 and earlier allows remote attackers to execute arbitrary code via the SDP Abstract attribute, related to the rmffdumpheader function and related to disregarding the max field. Although originally a...

Mandriva Linux Security Advisory : rsync (MDVSA-2008:011)

rsync before 3.0.0pre6, when running a writable rsync daemon that is not using chroot, allows remote attackers to access restricted files via unknown vectors that cause rsync to create a symlink that points outside of the module's hierarchy. CVE-2007-6199 Unspecified vulnerability in rsync before...

Mandriva Linux Security Advisory : postgresql (MDVSA-2009:079)

PostgreSQL before 8.3.7, 8.2.13, 8.1.17, 8.0.21, and 7.4.25 allows remote authenticated users to cause a denial of service stack consumption and crash by triggering a failure in the conversion of a localized error message to a client-specified encoding, as demonstrated using mismatched encoding...