Mandriva Linux Security Advisory : ffmpeg (MDVSA-2008:157)

A vulnerability was found in how ffmpeg handled STR file demuxing. If a user were tricked into processing a malicious STR file, a remote attacker could execute arbitrary code with user privileges via applications linked against ffmpeg CVE-2008-3162. The updated packages have been patched to corre...

Mandriva Linux Security Advisory : wireshark (MDVSA-2008:057)

A few vulnerabilities were found in Wireshark, that could cause it to crash or consume excessive memory under certain conditions. This update rovides Wireshark 0.99.8 which is not vulnerable to the issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package check...

Mandriva Linux Security Advisory : tk (MDVSA-2008:041)

The ReadImage function in Tk did not check codeSize read from GIF images prior to initializing the append array, which could lead to a buffer overflow with unknown impact. The updated packages have been patched to correct this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Mandriva Linux Security Advisory : vim (MDVSA-2009:047-1)

Python has a variable called sys.path that contains all paths where Python loads modules by using import scripting procedure. A wrong handling of that variable enables local attackers to execute arbitrary code via Python scripting in the current Vim working directory CVE-2009-0316. This update...

Mandriva Linux Security Advisory : gcc (MDVSA-2008:066)

Jurgen Weigert found a directory traversal vulnerability in fastjar versions prior to 0.93. This vulnerability allows user-assisted attackers to overwrite arbitrary files via a .jar file containing filename with ../ sequences. The updated packages have been patched to correct this issue...

Mandriva Linux Security Advisory : vinagre (MDVSA-2008:240)

Alfredo Ortega found a flaw in how Vinagre uses format strings. A remote attacker could exploit this vulnerability if they were able to trick a user into connecting to a malicious VNC server, or opening a specially crafted URI with Vinagre. With older versions of Vinagre, it was possible to execu...

Mandriva Linux Security Advisory : sudo (MDVSA-2009:033)

A vulnerability has been identified in sudo which allowed - depending on the sudoers rules - a sudo-user to execute arbitrary shell commands as root CVE-2009-0034. The updated packages have been patched to prevent this. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Mandriva Linux Security Advisory : clamav (MDVSA-2008:003)

An integer overflow vulnerability was reported by iDefense with clamav when parsing Portable Executable PE files packed in he MEW format. This could be exploited to cause a heap-based buffer overflow CVE-2007-6335. Toeroek Edwin reported an off-by-one error when decompressing MS-ZIP compressed CA...

Mandriva Linux Security Advisory : libtiff (MDVSA-2008:184)

Drew Yao of the Apple Product Security Team reported multiple uses of uninitialized values in libtiff's LZW compression algorithm decoder. An attacker could create a carefully crafted LZW-encoded TIFF file that would cause an application linked to libtiff to crash or potentially execute arbitrary...

Mandriva Linux Security Advisory : firefox (MDVSA-2009:084)

Security vulnerabilities have been discovered in previous versions, and corrected in the latest Mozilla Firefox 3.x, version 3.0.8 CVE-2009-1044, CVE-2009-1169. This update provides the latest Mozilla Firefox 3.x to correct these issues. Additionally, some packages requiring it have also been...

Mandriva Linux Security Advisory : python (MDVSA-2008:163)

Multiple integer overflows in the imageop module in Python prior to 2.5.3 allowed context-dependent attackers to cause a denial of service crash or possibly execute arbitrary code via crafted images that trigger heap-based buffer overflows CVE-2008-1679. This was due to an incomplete fix for...

Mandriva Linux Security Advisory : pidgin (MDVSA-2009:025)

The NSS plugin in libpurple in Pidgin 2.4.1 does not verify SSL certificates, which makes it easier for remote attackers to trick a user into accepting an invalid server certificate for a spoofed service. CVE-2008-3532 Pidgin 2.4.1 allows remote attackers to cause a denial of service crash via a...

Mandriva Linux Security Advisory : openoffice.org (MDVSA-2009:070)

senddoc uses temporary files /tmp/log.obr.4043 in a insecure way which enables local attackers to overwrite arbitrary files by using a symlink attack CVE-2008-4937. This update provides fix for that vulnerability. Update : Further this update is a rebuild against lastest xulrunner 1.9.0.6...

Mandriva Linux Security Advisory : squid (MDVSA-2009:034)

Due to an internal error Squid is vulnerable to a denial of service attack when processing specially crafted requests. This problem allows any client to perform a denial of service attack on the Squid service CVE-2009-0478. The updated packages have been patched to adress this. %NASLMINLEVEL 7030...

Mandriva Linux Security Advisory : krb5 (MDVSA-2008:070)

A memory management flaw was found in the GSSAPI library used by Kerberos that could result in an attempt to free already freed memory, possibly leading to a crash or allowing the execution of arbitrary code CVE-2007-5971. A flaw was discovered in how the Kerberos krb5kdc handled Kerberos v4...

Mandriva Linux Security Advisory : mpg123 (MDVSA-2009:093-1)

A vulnerability has been found and corrected in mpg123 : Integer signedness error in the storeid3text function in the ID3v2 code in mpg123 before 1.7.2 allows remote attackers to cause a denial of service out-of-bounds memory access and possibly execute arbitrary code via an ID3 tag with a negati...

Mandriva Linux Security Advisory : wireshark (MDVSA-2008:215)

A number of vulnerabilities were discovered in Wireshark that could cause it to crash or abort while processing malicious packets CVE-2008-4680, CVE-2008-4681, CVE-2008-4682, CVE-2008-4683, CVE-2008-4684, CVE-2008-4685. This update provides Wireshark 1.0.4, which is not vulnerable to these issues...

Mandriva Linux Security Advisory : postfix (MDVSA-2008:171)

Sebastian Krahmer of the SUSE Security Team discovered a flaw in the way Postfix dereferenced symbolic links. If a local user had write access to a mail spool directory without a root mailbox file, it could be possible for them to append arbitrary data to files that root had write permissions to...

Mandriva Linux Security Advisory : clamav (MDVSA-2008:189-1)

Multiple vulnerabilities were discovered in ClamAV and corrected with the 0.94 release, including : A vulnerability in ClamAV's chm-parser allowed remote attackers to cause a denial of service application crash via a malformed CHM file CVE-2008-1389. A vulnerability in libclamav would allow...

Mandriva Linux Security Advisory : pulseaudio (MDVSA-2008:065)

Luigi Auriemma found a few programming errors in Pulseaudio, that can be used to crash the Pulseaudio daemon, by authenticated and unauthenticated users. The updated packages fix these issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...