Mandriva Linux Security Advisory : gcc (MDVSA-2015:170)

Updated gcc packages fix the following security issue : Multiple integer overflow issues were found in libgfortran, the run-time support library for the Fortran compiler. These could possibly be used to crash a Fortran application or cause it to execute arbitrary code CVE-2014-5044. They also fix...

Mandriva Linux Security Advisory : squid (MDVSA-2015:103)

Updated squid packages fix security vulnerabilities : Due to incorrect state management, Squid before 3.3.12 is vulnerable to a denial of service attack when processing certain HTTPS requests if the SSL-Bump feature is enabled CVE-2014-0128. Matthew Daley discovered that Squid 3 did not properly...

Mandriva Linux Security Advisory : python3 (MDVSA-2015:076)

Updated python3 packages fix security vulnerabilities : ZipExtFile.read goes into 100% CPU infinite loop on maliciously binary edited zips CVE-2013-7338. A vulnerability was reported in Python's socket module, due to a boundary error within the sockrecvfrominto function, which could be exploited ...

Mandriva Linux Security Advisory : libjpeg (MDVSA-2015:152)

Updated libjpeg packages fix security vulnerability : Passing a specially crafted jpeg file to libjpeg-turbo could lead to stack smashing CVE-2014-9092. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandriva Linux...

Mandriva Linux Security Advisory : openldap (MDVSA-2015:074)

A vulnerability has been discovered and corrected in openldap : The derefparseCtrl function in servers/slapd/overlays/deref.c in OpenLDAP 2.4.13 through 2.4.40 allows remote attackers to cause a denial of service NULL pointer dereference and crash via an empty attribute list in a deref control in...

Mandriva Linux Security Advisory : cpio (MDVSA-2015:065)

Updated cpio package fixes security vulnerabilities : Heap-based buffer overflow in the processcopyin function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive CVE-2014-9112. Additionally, a NULL pointer dereference in the copyinlink...

Mandriva Linux Security Advisory : jython (MDVSA-2015:158)

Updated jython packages fix security vulnerability : There are serveral problems with the way Jython creates class cache files, potentially leading to arbitrary code execution or information disclosure CVE-2013-2027. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Mandriva Linux Security Advisory : patch (MDVSA-2015:138)

Updated patch package fixes security vulnerabilities : It was reported that a crafted diff file can make patch eat memory and later segfault CVE-2014-9637. It was reported that the versions of the patch utility that support Git-style patches are vulnerable to a directory traversal flaw. This coul...

Mandriva Linux Security Advisory : libpng (MDVSA-2015:090)

Updated libpng package fixes security vulnerabilities : The pngpushreadchunk function in pngpread.c in the progressive decoder in libpng 1.6.x through 1.6.9 allows remote attackers to cause a denial of service infinite loop and CPU consumption via an IDAT chunk with a length of zero CVE-2014-0333...

Mandriva Linux Security Advisory : ipython (MDVSA-2015:160)

Updated ipython package fixes security vulnerability : In IPython before 1.2, the origin of websocket requests was not verified within the IPython notebook server. If an attacker has knowledge of an IPython kernel id they can run arbitrary code on a user's machine when the client visits a crafted...

Mandriva Linux Security Advisory : libksba (MDVSA-2015:151)

Updated libksba packages fix security vulnerability : By using special crafted S/MIME messages or ECC based OpenPGP data, it is possible to create a buffer overflow, which could lead to a denial of service CVE-2014-9087. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text an...

Mandriva Linux Security Advisory : python-numpy (MDVSA-2015:077)

Updated python-numpy packages fix security vulnerabilities : f2py insecurely used a temporary file. A local attacker could use this flaw to perform a symbolic link attack to modify an arbitrary file accessible to the user running f2py CVE-2014-1858, CVE-2014-1859. %NASLMINLEVEL 70300 C Tenable...

Mandriva Linux Security Advisory : libxfont (MDVSA-2015:145-1)

Updated libxfont packages fix security vulnerabilities : Ilja van Sprundel discovered that libXfont incorrectly handled font metadata file parsing. A local attacker could use this issue to cause libXfont to crash, or possibly execute arbitrary code in order to gain privileges CVE-2014-0209. Ilja...

Mandriva Linux Security Advisory : cpio (MDVSA-2015:066)

Updated cpio package fixes security vulnerability : In GNU Cpio 2.11, the --no-absolute-filenames option limits extracting contents of an archive to be strictly inside a current directory. However, it can be bypassed with symlinks. While extracting an archive, it will extract symlinks and then...

Mandriva Linux Security Advisory : libarchive (MDVSA-2015:157)

Updated libarchive packages fix security vulnerability : Alexander Cherepanov discovered that bsdcpio, an implementation of the cpio program part of the libarchive project, is susceptible to a directory traversal vulnerability via absolute paths CVE-2015-2304. %NASLMINLEVEL 70300 C Tenable Networ...

Mandriva Linux Security Advisory : util-linux (MDVSA-2015:122)

Updated util-linux packages fix security vulnerability : Sebastian Krahmer reported a command injection flaw in blkid. This could possibly result in command execution with root privileges CVE-2014-9114. The util-linux package has been updated to version 2.24.2 and patched to fix this issue and...

Mandriva Linux Security Advisory : ntp (MDVSA-2015:140)

Updated ntp packages fix security vulnerabilities : If no authentication key is defined in the ntp.conf file, a cryptographically-weak default key is generated CVE-2014-9293. ntp-keygen before 4.2.7p230 uses a non-cryptographic random number generator with a weak seed to generate symmetric keys...

Mandriva Linux Security Advisory : egroupware (MDVSA-2015:087)

Updated egroupware packages fix security vulnerabilities : eGroupware prior to 1.8.006.20140217 is vulnerable to remote file deletion and possible remote code execution due to user input being passed to PHP's unserialize method CVE-2014-2027. eGroupWare before 1.8.007 allows logged in users with...

Mandriva Linux Security Advisory : liblzo (MDVSA-2015:150)

Updated liblzo packages fix security vulnerability : An integer overflow in liblzo before 2.07 allows attackers to cause a denial of service or possibly code execution in applications performing LZO decompression on a compressed payload from the attacker CVE-2014-4607. %NASLMINLEVEL 70300 C Tenab...

Mandriva Linux Security Advisory : stunnel (MDVSA-2015:096)

Updated stunnel package fixes security vulnerability : A flaw was found in the way stunnel, a socket wrapper which can provide SSL support to ordinary applications, performed reinitialization of PRNG after fork. When accepting a new connection, the server forks and the child process handles the...