Mandriva Linux Security Advisory : php-ZendFramework (MDVSA-2013:115)

Updated php-ZendFramework packages fix security vulnerabilities : ZendDom, ZendFeed, ZendSoap, and ZendXmlRpc in Zend Framework before 1.11.13 and 1.12.0 are vulnerable to XML Entity Expansion XEE vectors, leading to Denial of Service vectors. XEE attacks occur when the XML DOCTYPE declaration...

Mandriva Linux Security Advisory : net-snmp (MDVSA-2013:049)

A vulnerability has been discovered and corrected in net-snmp : An array index error, leading to out-of heap-based buffer read flaw was found in the way net-snmp agent performed entries lookup in the extension table. When certain MIB subtree was handled by the extend directive, a remote attacker...

Mandriva Linux Security Advisory : ncpfs (MDVSA-2013:048)

Multiple vulnerabilities has been discovered and corrected in ncpfs : ncpfs 2.2.6 and earlier attempts to use 1 ncpmount to append to the /etc/mtab file and 2 ncpumount to append to the /etc/mtab.tmp file without first checking whether resource limits would interfere, which allows local users to...

Mandriva Linux Security Advisory : open-iscsi (MDVSA-2013:109)

Updated open-iscsi package fixes security vulnerability : Colin Watson discovered that iscsidiscovery in Open-iSCSI did not safely create temporary files. A local attacker could exploit this to overwrite arbitrary files with root privileges CVE-2009-1297. %NASLMINLEVEL 70300 C Tenable Network...

Mandriva Linux Security Advisory : ircd-hybrid (MDVSA-2013:093)

Updated ircd-hybrid packages fix security vulnerability : Bob Nomnomnom reported a Denial of Service vulnerability in IRCD-Hybrid, an Internet Relay Chat server. A remote attacker may use an error in the masks validation and crash the server CVE-2013-0238. Please note that due to the previously...

Mandriva Linux Security Advisory : freetype2 (MDVSA-2013:039)

Updated freetype2 packages fixes security vulnerabilities : A NULL pointer de-reference flaw was found in the way Freetype font rendering engine handled Glyph bitmap distribution format BDF fonts. A remote attacker could provide a specially crafted BDF font file, which once processed in an...

Mandriva Linux Security Advisory : gnutls (MDVSA-2013:040)

Nadhem Alfardan and Kenny Paterson devised an attack that recovers some bits of the plaintext of a GnuTLS session that utilizes that CBC ciphersuites, by using timing information CVE-2013-1619. The gnutls package has been updated to latest 3.0.28 version to fix above problem. %NASLMINLEVEL 70300 ...

Mandriva Linux Security Advisory : snack (MDVSA-2013:126)

Updated snack packages fix security vulnerability : Two vulnerabilities have been discovered in Snack Sound Toolkit, which are caused due to missing boundary checks in the GetWavHeader function generic/jkSoundFile.c when parsing either format sub-chunks or unknown sub-chunks. This can be exploite...

Mandriva Linux Security Advisory : squid (MDVSA-2013:129)

Updated squid packages fix security vulnerability : Due to missing input validation, the Squid cachemgr.cgi tool in Squid before 3.1.22 and 3.2.4 is vulnerable to a denial of service attack when processing specially crafted requests CVE-2012-5643. It was discovered that the patch for CVE-2012-564...

Mandriva Linux Security Advisory : socat (MDVSA-2013:127)

Updated socat package fixes security vulnerability : Heap-based buffer overflow in the xioscanreadline function in xio-readline.c in socat 1.4.0.0 through 1.7.2.0 and 2.0.0-b1 through 2.0.0-b4 allows local users to execute arbitrary code via the READLINE address CVE-2012-0219. %NASLMINLEVEL 70300...

Mandriva Linux Security Advisory : mosh (MDVSA-2013:104)

Updated mosh package fixes security vulnerability : Mosh versions 1.2 and earlier allow an application to cause the mosh-server to consume large amounts of CPU time with a short ANSI escape sequence. In addition, a malicious mosh-server can cause the mosh-client to consume large amounts of CPU ti...

Mandriva Linux Security Advisory : nss-pam-ldapd (MDVSA-2013:106)

Updated nss-pam-ldapd packages fixes the following security vulnerability : Garth Mollett discovered that a file descriptor overflow issue in the use of FDSET in nss-pam-ldapd can lead to a stack-based buffer overflow. An attacker could, under some circumstances, use this flaw to cause a process...

Mandriva Linux Security Advisory : sudo (MDVSA-2013:054)

Multiple vulnerabilities has been found and corrected in sudo : A flaw exists in the IP network matching code in sudo versions 1.6.9p3 through 1.8.4p4 that may result in the local host being matched even though it is not actually part of the network described by the IP address and associated...

Mandriva Linux Security Advisory : bash (MDVSA-2013:032)

A vulnerability was found and corrected in bash : A stack-based buffer overflow flaw was found in the way bash, the GNU Bourne Again shell, expanded certain /dev/fd file names when checking file names 'test' command and evaluating /dev/fd file names in conditinal command expressions. A remote...

Mandriva Linux Security Advisory : html2ps (MDVSA-2013:041)

A vulnerability has been found and corrected in html2ps : Directory traversal vulnerability in html2ps before 1.0b7 allows remote attackers to read arbitrary files via directory traversal sequences in SSI directives CVE-2009-5067. The updated packages have been upgraded to the 1.0b7 version which...

Mandriva Linux Security Advisory : perl (MDVSA-2013:113)

Updated perl packages fix security vulnerability : It was discovered that Perl's 'x' string repeat operator is vulnerable to a heap-based buffer overflow. An attacker could use this to execute arbitrary code CVE-2012-5195. The compile function in Maketext.pm in the Locale::Maketext implementation...

Mandriva Linux Security Advisory : openslp (MDVSA-2013:111)

Updated openslp packages fix security vulnerability : The extension parser in slpv2message.c in OpenSLP 1.2.1 allows remote attackers to cause a denial of service infinite loop via a packet with a next extension offset that references this extension or a previous extension CVE-2010-3609...

Mandriva Linux Security Advisory : emacs (MDVSA-2013:076)

Updated emacs packages fix security vulnerabilities : Untrusted search path vulnerability in EDE in CEDET before 1.0.1, as used in GNU Emacs before 23.4 and other products, allows local users to gain privileges via a crafted Lisp expression in a Project.ede file in the directory, or a parent...

Mandriva Linux Security Advisory : vte (MDVSA-2013:135)

Updated vte packages fix security vulnerability : A denial of service flaw was found in the way VTE, a terminal emulator widget, processed certain escape sequences with large repeat counts. A remote attacker could provide a specially crafted file, which once opened in a terminal using the VTE...

Mandriva Linux Security Advisory : python-pycrypto (MDVSA-2013:120)

Updated python-pycrypto package fixes security vulnerability : PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it easier for attackers to conduct brute-force attacks to...