Mandriva Linux Security Advisory : libxfont (MDVSA-2008:024)

A heap-based buffer overflow flaw was found in how the X.org server handled malformed font files that could allow a malicious local user to potentially execute arbitrary code with the privileges of the X.org server CVE-2008-0006. The updated packages have been patched to correct this issue...

Mandriva Linux Security Advisory : silc-toolkit (MDVSA-2008:158)

A vulnerability was found in the SILC toolkit before version 1.1.5 that allowed a remote attacker to cause a denial of service crash, or possibly execute arbitrary code via long input data CVE-2008-1227. A vulnerability was found in the SILC toolkit before version 1.1.7 that allowed a remote...

Mandriva Linux Security Advisory : poppler (MDVSA-2008:146)

A memory management issue was found in libpoppler by Felipe Andres Manzano that could allow for the execution of arbitrary code with the privileges of the user running a poppler-based application, if they opened a specially crafted PDF file CVE-2008-2950. The updated packages have been patched to...

Mandriva Linux Security Advisory : perl-Tk (MDVSA-2008:077)

A vulnerability in perl-Tk was found where specially crafted GIF images could crash perl-Tk an identical issue to that found in php-gd, gd, and SDLimage. The updated packages have been patched to correct this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Mandriva Linux Security Advisory : clamav (MDVSA-2008:003)

An integer overflow vulnerability was reported by iDefense with clamav when parsing Portable Executable PE files packed in he MEW format. This could be exploited to cause a heap-based buffer overflow CVE-2007-6335. Toeroek Edwin reported an off-by-one error when decompressing MS-ZIP compressed CA...

Mandriva Linux Security Advisory : libtiff (MDVSA-2008:184)

Drew Yao of the Apple Product Security Team reported multiple uses of uninitialized values in libtiff's LZW compression algorithm decoder. An attacker could create a carefully crafted LZW-encoded TIFF file that would cause an application linked to libtiff to crash or potentially execute arbitrary...

Mandriva Linux Security Advisory : firefox (MDVSA-2009:084)

Security vulnerabilities have been discovered in previous versions, and corrected in the latest Mozilla Firefox 3.x, version 3.0.8 CVE-2009-1044, CVE-2009-1169. This update provides the latest Mozilla Firefox 3.x to correct these issues. Additionally, some packages requiring it have also been...

Mandriva Linux Security Advisory : opensc (MDVSA-2008:183)

Chaskiel M Grundman found that OpenSC would initialize smart cards with the Siemens CardOS M4 card operating system without proper access rights. This allowed everyone to change the card's PIN without first having the PIN or PUK, or the superuser's PIN or PUK CVE-2008-2235. Please note that this...

Mandriva Linux Security Advisory : php (MDVSA-2008:126)

A number of vulnerabilities have been found and corrected in PHP : PHP 5.2.1 would allow context-dependent attackers to read portions of heap memory by executing certain scripts with a serialized data input string beginning with 'S:', which did not properly track the number of input bytes being...

Mandriva Linux Security Advisory : clamav (MDVSA-2008:229)

An off-by-one error was found in ClamAV versions prior to 0.94.1 that could allow remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted VBA project file CVE-2008-5050. Other bugs have also been corrected in 0.94.1 which is being provided with this update...

Mandriva Linux Security Advisory : postfix (MDVSA-2008:171)

Sebastian Krahmer of the SUSE Security Team discovered a flaw in the way Postfix dereferenced symbolic links. If a local user had write access to a mail spool directory without a root mailbox file, it could be possible for them to append arbitrary data to files that root had write permissions to...

Mandriva Linux Security Advisory : squid (MDVSA-2009:034)

Due to an internal error Squid is vulnerable to a denial of service attack when processing specially crafted requests. This problem allows any client to perform a denial of service attack on the Squid service CVE-2009-0478. The updated packages have been patched to adress this. %NASLMINLEVEL 7030...

Mandriva Linux Security Advisory : clamav (MDVSA-2008:189-1)

Multiple vulnerabilities were discovered in ClamAV and corrected with the 0.94 release, including : A vulnerability in ClamAV's chm-parser allowed remote attackers to cause a denial of service application crash via a malformed CHM file CVE-2008-1389. A vulnerability in libclamav would allow...

Mandriva Linux Security Advisory : hplip (MDVSA-2008:169)

Marc Schoenefeld of the Red Hat Security Response Team discovered a vulnerability in the hplip alert-mailing functionality that could allow a local attacker to elevate their privileges by using specially crafted packets to trigger alert mails that are sent by the root account CVE-2008-2940. Anoth...

Mandriva Linux Security Advisory : mysql (MDVSA-2009:094)

Multiple vulnerabilities has been found and corrected in mysql : MySQL 5.0 before 5.0.66, 5.1 before 5.1.26, and 6.0 before 6.0.6 does not properly handle a b'' b single-quote single-quote token, aka an empty bit-string literal, which allows remote attackers to cause a denial of service daemon...

Mandriva Linux Security Advisory : python-pycrypto (MDVSA-2009:050-1)

A vulnerability have been discovered and corrected in PyCrypto ARC2 module 2.0.1, which allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large ARC2 key length CVE-2009-0544. The updated packages have been patched to prevent this. Update : The previous...

Mandriva Linux Security Advisory : mozilla-firefox (MDVSA-2008:136)

Security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox program, version 2.0.0.15 CVE-2008-2798, CVE-2008-2799, CVE-2008-2800, CVE-2008-2801, CVE-2008-2802, CVE-2008-2803, CVE-2008-2805, CVE-2008-2807, CVE-2008-2808, CVE-2008-2809, CVE-2008-2811. This update...

Mandriva Linux Security Advisory : openssh (MDVSA-2008:098)

A vulnerability in OpenSSH 4.4 through 4.8 allowed local attackers to bypass intended security restrictions enabling them to execute commands other than those specified by the ForceCommand directive, provided they are able to modify to /.ssh/rc CVE-2008-1657. The updated packages have been patche...

Mandriva Linux Security Advisory : libsamplerate (MDVSA-2008:238)

A buffer overflow was found by Russell O'Conner in the libsamplerate library versions prior to 0.1.4 that could possibly lead to the execution of arbitrary code via a specially crafted audio file CVE-2008-5008. The updated packages have been patched to prevent this issue. %NASLMINLEVEL 70300 C...

Mandriva Linux Security Advisory : libid3tag (MDVSA-2008:103)

field.c in the libid3tag 0.15.0b library allows context-dependent attackers to cause a denial of service CPU and memory consumption via an ID3FIELDTYPESTRINGLIST field that ends in '', which triggers an infinite loop. The updated packages have been patched to correct this. %NASLMINLEVEL 70300 C...