Mandriva Linux Security Advisory : clamav (MDVSA-2008:189-1)

Multiple vulnerabilities were discovered in ClamAV and corrected with the 0.94 release, including : A vulnerability in ClamAV's chm-parser allowed remote attackers to cause a denial of service application crash via a malformed CHM file CVE-2008-1389. A vulnerability in libclamav would allow...

Mandriva Linux Security Advisory : libtiff (MDVSA-2008:184)

Drew Yao of the Apple Product Security Team reported multiple uses of uninitialized values in libtiff's LZW compression algorithm decoder. An attacker could create a carefully crafted LZW-encoded TIFF file that would cause an application linked to libtiff to crash or potentially execute arbitrary...

Mandriva Linux Security Advisory : libsamplerate (MDVSA-2008:238)

A buffer overflow was found by Russell O'Conner in the libsamplerate library versions prior to 0.1.4 that could possibly lead to the execution of arbitrary code via a specially crafted audio file CVE-2008-5008. The updated packages have been patched to prevent this issue. %NASLMINLEVEL 70300 C...

Mandriva Linux Security Advisory : gnutls (MDVSA-2008:106)

Flaws discovered in versions prior to 2.2.4 stable and 2.3.10 development of GnuTLS allow an attacker to cause denial of service application crash, and maybe so far undetermined execute arbitrary code. The updated packages have been patched to fix these flaws. Note that any applications using thi...

Mandriva Linux Security Advisory : poppler (MDVSA-2008:146)

A memory management issue was found in libpoppler by Felipe Andres Manzano that could allow for the execution of arbitrary code with the privileges of the user running a poppler-based application, if they opened a specially crafted PDF file CVE-2008-2950. The updated packages have been patched to...

Mandriva Linux Security Advisory : libxfont (MDVSA-2008:024)

A heap-based buffer overflow flaw was found in how the X.org server handled malformed font files that could allow a malicious local user to potentially execute arbitrary code with the privileges of the X.org server CVE-2008-0006. The updated packages have been patched to correct this issue...

Mandriva Linux Security Advisory : vorbis-tools (MDVSA-2008:093)

A vulnerability in the Speex library was found where it did not properly validate input values read from the Speex files headers. An attacker could create a malicious Speex file that would crash an application or potentially allow the execution of arbitrary code with the privileges of the...

Mandriva Linux Security Advisory : squid (MDVSA-2008:134)

An incorrect fix for CVE-2007-6239 resulted in Squid not performing proper bounds checking when processing cache update replies. Because of this, a remote authenticated user might have been able to trigger an assertion error and cause a denial of service CVE-2008-1612. The updated packages have...

Mandriva Linux Security Advisory : hplip (MDVSA-2008:169)

Marc Schoenefeld of the Red Hat Security Response Team discovered a vulnerability in the hplip alert-mailing functionality that could allow a local attacker to elevate their privileges by using specially crafted packets to trigger alert mails that are sent by the root account CVE-2008-2940. Anoth...

Mandriva Linux Security Advisory : clamav (MDVSA-2008:229)

An off-by-one error was found in ClamAV versions prior to 0.94.1 that could allow remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted VBA project file CVE-2008-5050. Other bugs have also been corrected in 0.94.1 which is being provided with this update...

Mandriva Linux Security Advisory : perl-Tk (MDVSA-2008:077)

A vulnerability in perl-Tk was found where specially crafted GIF images could crash perl-Tk an identical issue to that found in php-gd, gd, and SDLimage. The updated packages have been patched to correct this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Mandriva Linux Security Advisory : libexif (MDVSA-2008:005)

An infinite recursion flaw was found in the way that libexif parses Exif image tags. A carefully crafted Exif image file opened by an application linked against libexif could cause the application to crash CVE-2007-6351. An integer overflow flaw was also found in how libexif parses Exif image tag...

Mandriva Linux Security Advisory : perl-MDK-Common (MDVSA-2009:072)

Some vulnerabilities were discovered and corrected in perl-MDK-Common : The functions used to write strings into shell like configuration files by Mandriva tools were not taking care of some special characters. This could lead to some bugs like wireless keys containing certain characters not...

Mandriva Linux Security Advisory : libid3tag (MDVSA-2008:103)

field.c in the libid3tag 0.15.0b library allows context-dependent attackers to cause a denial of service CPU and memory consumption via an ID3FIELDTYPESTRINGLIST field that ends in '', which triggers an infinite loop. The updated packages have been patched to correct this. %NASLMINLEVEL 70300 C...

Mandriva Linux Security Advisory : bzip2 (MDVSA-2008:075)

Bzip2 versions before 1.0.5 are vulnerable to a denial of service attack via malicious compressed data. The updated packages have been patched to prevent the issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

Mandriva Linux Security Advisory : php (MDVSA-2008:127)

A number of vulnerabilities have been found and corrected in PHP : The htmlentities and htmlspecialchars functions in PHP prior to 5.2.5 accepted partial multibyte sequences, which has unknown impact and attack vectors CVE-2007-5898. The outputaddrewritevar function in PHP prior to 5.2.5 rewrites...

Mandriva Linux Security Advisory : postfix (MDVSA-2008:190)

A vulnerability in Postfix 2.4 and later was discovered, when running on Linux kernel 2.6, where a local user could cause a denial of service due to Postfix leaking the epoll file descriptor when executing non-Postfix commands CVE-2008-3889. The updated packages have been patched to correct this...

Mandriva Linux Security Advisory : tcl (MDVSA-2008:059)

A flaw in the Tcl regular expression handling engine was originally discovered by Will Drewry in the PostgreSQL database server's Tcl regular expression engine. This flaw can result in an infinite loop when processing certain regular expressions. The updated packages have been patched to correct...

Mandriva Linux Security Advisory : mozilla-firefox (MDVSA-2008:244)

Security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox 2.x, version 2.0.0.19 CVE-2008-5500, CVE-2008-5503, CVE-2008-5504, CVE-2008-5506, CVE-2008-5507, CVE-2008-5508, CVE-2008-5510, CVE-2008-5511, CVE-2008-5512, CVE-2008-5513. This update provides the latest...

Mandriva Linux Security Advisory : net-snmp (MDVSA-2008:118)

A vulnerability was found in how Net-SNMP checked an SNMPv3 packet's Keyed-Hash Message Authentication Code HMAC. An attacker could exploit this flaw to spoof an authenticated SNMPv3 packet CVE-2008-0960. A buffer overflow was found in the perl bindings for Net-SNMP that could be exploited if an...