Mandriva Linux Security Advisory : mozilla-firefox (MDVSA-2008:148)

Security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox program, version 2.0.0.16 CVE-2008-2785, CVE-2008-2933. This update provides the latest Firefox to correct these issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Mandriva Linux Security Advisory : kernel (MDVSA-2008:104)

A race condition in the directory notification subsystem dnotify in Linux kernel 2.6.x before 2.6.24.6, and 2.6.25 before 2.6.25.1, allows local users to cause a denial of service OOPS and possibly gain privileges via unspecified vectors. CVE-2008-1375 The Linux kernel before 2.6.25.2 does not...

Mandriva Linux Security Advisory : wireshark (MDVSA-2008:199)

A number of vulnerabilities were discovered in Wireshark that could cause it to crash while processing malicious packets CVE-2008-3146, CVE-2008-3932, CVE-2008-3933, CVE-2008-3934. This update provides Wireshark 1.0.3, which is not vulnerable to these issues. %NASLMINLEVEL 70300 C Tenable Network...

Mandriva Linux Security Advisory : libpng (MDVSA-2008:156)

Tavis Ormandy of the Google Security Team discovered a flaw in how libpng handles zero-length unknown chunks in PNG files, which could lead to memory corruption in applications that make use of certain functions CVE-2008-1382. The updated packages have been patched to correct this issue...

Mandriva Linux Security Advisory : apache (MDVSA-2008:016)

A number of vulnerabilities were found and fixed in the Apache 2.2.x packages : A flaw found in the modimagemap module could lead to a cross-site scripting attack on sites where modimagemap was enabled and an imagemap file was publically available CVE-2007-5000. A flaw found in the modstatus modu...

Mandriva Linux Security Advisory : wordnet (MDVSA-2008:182-1)

Rob Holland found several programming errors in WordNet which could lead to the execution or arbitrary code when used with untrusted input CVE-2008-2149, CVE-2008-3908. Update : The previous patch had a typo that caused incorrect behaviour in WordNet. This update uses an update patch that correct...

Mandriva Linux Security Advisory : cups (MDVSA-2008:036)

Wei Wang found that the SNMP discovery backend in CUPS did not correctly calculate the length of strings. If a user could be tricked into scanning for printers, a remote attacker could send a specially crafted packet and possibly execute arbitrary code CVE-2007-5849. As well, the fix for...

Mandriva Linux Security Advisory : net-snmp (MDVSA-2009:056)

A vulnerability has been identified and corrected in net-snmp : The netsnmpudpfmtaddr function snmplib/snmpUDPDomain.c in net-snmp 5.0.9 through 5.4.2, when using TCP wrappers for client authorization, does not properly parse hosts.allow rules, which allows remote attackers to bypass intended...

Mandriva Linux Security Advisory : evolution (MDVSA-2008:111)

Alan Rad Pop of Secunia Research discovered the following two vulnerabilities in Evolution : Evolution did not properly validate timezone data when processing iCalendar attachments. If a user disabled the Itip Formatter plugin and viewed a crafted iCalendar attachment, an attacker could cause a...

Mandriva Linux Security Advisory : xterm (MDVSA-2009:005)

A vulnerability has been discovered in xterm, which can be exploited by malicious people to compromise a user's system. The vulnerability is caused due to xterm not properly processing the DECRQSS Device Control Request Status String escape sequence. This can be exploited to inject and execute...

Mandriva Linux Security Advisory : libxml2 (MDVSA-2008:010)

A denial of service flaw was discovered by the Google Security Team in the way libxml2 processes malformed XML content. This flaw could cause the application to stop responding. The updated packages have been patched to correct this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Mandriva Linux Security Advisory : cups (MDVSA-2009:027)

A vulnerability has been discovered in CUPS shipped with Mandriva Linux which allows local users to overwrite arbitrary files via a symlink attack on the /tmp/pdf.log temporary file CVE-2009-0032. The updated packages have been patched to prevent this. %NASLMINLEVEL 70300 C Tenable Network...

Mandriva Linux Security Advisory : ghostscript (MDVSA-2008:055)

Chris Evans found a buffer overflow condition in Ghostscript, which can lead to arbitrary code execution as the user running any application using it to process a maliciously crafted Postscript file. The updated packages have been patched to prevent this issue. %NASLMINLEVEL 70300 C Tenable Netwo...

Mandriva Linux Security Advisory : mod_perl (MDVSA-2009:091-1)

A vulnerability has been found and corrected in modperl v1.x and v2.x : Cross-site scripting XSS vulnerability in Status.pm in Apache::Status and Apache2::Status in modperl1 and modperl2 for the Apache HTTP Server, when /perl-status is accessible, allows remote attackers to inject arbitrary web...

Mandriva Linux Security Advisory : krb5 (MDVSA-2008:069)

Multiple memory management flaws were found in the GSSAPI library used by Kerberos that could result in the use of already freed memory or an attempt to free already freed memory, possibly leading to a crash or allowing the execution of arbitrary code CVE-2007-5901, CVE-2007-5971. A flaw was...

Mandriva Linux Security Advisory : cups (MDVSA-2008:170)

Thomas Pollet discovered an integer overflow vulnerability in the PNG image handling filter in CUPS. This could allow a malicious user to execute arbitrary code with the privileges of the user running CUPS, or cause a denial of service by sending a specially crafted PNG image to the print server...

Mandriva Linux Security Advisory : pam_mount (MDVSA-2009:004)

passwdehd script in pammount would allow local users to overwrite arbitrary files via a symlink attack on a temporary file. The updated packages have been patched to prevent this. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Mandriva Linux Security Advisory : emacs (MDVSA-2008:153)

A vulnerability in emacs was found where an attacker could provide a group of files containing local variable definitions and arbitrary Lisp code to be executed when one of the provided files is opened by emacs CVE-2008-2142. The updated packages have been patched to correct this issue...

Mandriva Linux Security Advisory : firefox (MDVSA-2009:075)

Security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox 3.x, version 3.0.7 CVE-2009-0040, CVE-2009-0771, CVE-2009-0772, CVE-2009-0773, CVE-2009-0774, CVE-2009-0775, CVE-2009-0776, CVE-2009-0777. This update provides the latest Mozilla Firefox 3.x to correct these...

Mandriva Linux Security Advisory : libneon0.27 (MDVSA-2009:074)

A security vulnerability has been identified and fixed in neon : neon 0.28.0 through 0.28.2 allows remote servers to cause a denial of service NULL pointer dereference and crash via vectors related to Digest authentication and Digest domain parameter support CVE-2008-3746. The updated packages ha...