Mandriva Linux Security Advisory : weechat (MDVSA-2013:136)

Updated weechat packages fix security vulnerability : A buffer overflow is causing a crash or freeze of WeeChat 0.36 to 0.39 when decoding IRC colors in strings. The packages have been patched to fix this problem CVE-2012-5854. Untrusted command for function hookprocess in WeeChat before 0.3.9.2...

Mandriva Linux Security Advisory : dhcp (MDVSA-2013:059)

A security issue was identified and fixed in ISC DHCP : libdns in ISC DHCP 4.2.x before 4.2.5-P1 allows remote name servers to cause a denial of service memory consumption via vectors involving a regular expression, as demonstrated by a memory-exhaustion attack against a machine running a dhcpd...

Mandriva Linux Security Advisory : gimp (MDVSA-2013:082)

Updated gimp packages fix security vulnerabilities : An integer overflow flaw, leading to a heap-based buffer overflow, was found in the GIMP's GIF image format plug-in. An attacker could create a specially crafted GIF image file that, when opened, could cause the GIF plug-in to crash or,...

Mandriva Linux Security Advisory : libgssglue (MDVSA-2013:043)

This update fixes insecure getenv usage in libgssglue, which could be used under some circumstances by local attackers do gain root privileges CVE-2011-2709. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandriva...

Mandriva Linux Security Advisory : dnsmasq (MDVSA-2013:072)

Updated dnsmasq packages fix security vulnerabilities : When dnsmasq before 2.63 is used in conjunctions with certain configurations of libvirtd, network packets from prohibited networks e.g. packets that should not be passed in may be sent to the dnsmasq application and processed. This can resul...

Mandriva Linux Security Advisory : freeradius (MDVSA-2013:038)

Updated freeradius packages fixes security vulnerabilities : It was found that the unix module ignored the password expiration setting in /etc/shadow. If FreeRADIUS was configured to use this module for user authentication, this flaw could allow users with an expired password to successfully...

Mandriva Linux Security Advisory : snack (MDVSA-2013:126)

Updated snack packages fix security vulnerability : Two vulnerabilities have been discovered in Snack Sound Toolkit, which are caused due to missing boundary checks in the GetWavHeader function generic/jkSoundFile.c when parsing either format sub-chunks or unknown sub-chunks. This can be exploite...

Mandriva Linux Security Advisory : openjpeg (MDVSA-2013:110)

Updated openjpeg packages fix security vulnerability : An out-of heap-based buffer bounds read and write flaw, leading to invalid free, was found in the way a tile coder / decoder TCD implementation of OpenJPEG, an open source JPEG 2000 codec written in C language, performed releasing of previous...

Mandriva Linux Security Advisory : bogofilter (MDVSA-2013:064)

Updated bogofilter package fixes security vulnerability : In bogofilter before 1.2.3, bogofilter's/bogolexer's base64 could overwrite heap memory in the character set conversion in certain pathological cases of invalid base64 code that decodes to incomplete multibyte characters CVE-2012-5468...

Mandriva Linux Security Advisory : clamav (MDVSA-2013:027-1)

ClamAV 0.97.7 addresses several reported potential security bugs. Thanks to Felix Groebert, Mateusz Jurczyk and Gynvael Coldwind of the Google Security Team for finding and reporting these issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Mandriva Linux Security Advisory : libxslt (MDVSA-2013:141)

Updated libxslt packages fix security vulnerability : Nicholas Gregoire discovered that libxslt incorrectly handled certain empty values. If a user or automated system were tricked into processing a specially crafted XSLT document, a remote attacker could cause libxslt to crash, causing a denial ...

Mandriva Linux Security Advisory : dbus (MDVSA-2013:070)

Updated dbus packages fix security vulnerability : It was discovered that the D-Bus library honored environment settings even when running with elevated privileges. A local attacker could possibly use this flaw to escalate their privileges, by setting specific environment variables before running...

Mandriva Linux Security Advisory : awstats (MDVSA-2013:061)

Multiple XXS vulnerabilities was found and corrected in awstats CVE-2012-4547. The updated packages have been patched to correct this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandriva Linux Security...

Mandriva Linux Security Advisory : fail2ban (MDVSA-2013:078)

Updated fail2ban package fixes security vulnerability : fail2ban before 0.8.8 didn't escape the content of \ if used in custom action files, which could cause issues on the system running fail2ban as it scans log files, depending on what content is matched, since that content could contain...

Mandriva Linux Security Advisory : arpwatch (MDVSA-2013:030)

A vulnerability has been discovered and corrected in arpwatch : arpwatch 2.1a15, as used by Red Hat, Debian, Fedora, and possibly others, does not properly drop supplementary groups, which might allow attackers to gain root privileges by leveraging other vulnerabilities in the daemon CVE-2012-265...

Mandriva Linux Security Advisory : squid (MDVSA-2013:129)

Updated squid packages fix security vulnerability : Due to missing input validation, the Squid cachemgr.cgi tool in Squid before 3.1.22 and 3.2.4 is vulnerable to a denial of service attack when processing specially crafted requests CVE-2012-5643. It was discovered that the patch for CVE-2012-564...

Mandriva Linux Security Advisory : dokuwiki (MDVSA-2013:073)

Updated dokuwiki package fixes security vulnerabilities : DokuWiki 2009-12-25c allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by lib/tpl/index.php and certain other files...

Mandriva Linux Security Advisory : net-snmp (MDVSA-2013:049)

A vulnerability has been discovered and corrected in net-snmp : An array index error, leading to out-of heap-based buffer read flaw was found in the way net-snmp agent performed entries lookup in the extension table. When certain MIB subtree was handled by the extend directive, a remote attacker...

Mandriva Linux Security Advisory : emacs (MDVSA-2013:076)

Updated emacs packages fix security vulnerabilities : Untrusted search path vulnerability in EDE in CEDET before 1.0.1, as used in GNU Emacs before 23.4 and other products, allows local users to gain privileges via a crafted Lisp expression in a Project.ede file in the directory, or a parent...

Mandriva Linux Security Advisory : cups-pk-helper (MDVSA-2013:069)

Updated cups-pk-helper package fixes security vulnerability : cups-pk-helper, a PolicyKit helper to configure CUPS with fine-grained privileges, wraps CUPS function calls in an insecure way. This could lead to uploading sensitive data to a CUPS resource, or overwriting specific files with the...