Mandrake Linux Security Advisory : gpm (MDKSA-2000:025)

Many security flaws existed in the gpm package, which is used to control the mouse in a terminal outside of X Windows. As well, a denial of service attack via /dev/gpmctl is possible. All security issues with the gpm package have been addressed with this update. %NASLMINLEVEL 70300 C Tenable...

Mandrake Linux Security Advisory : glibc (MDKSA-2001:012)

The LDPRELOAD variable in the GNU C Library is honoured normally even for SUID/SGID applications but removed afterwards from the environment if it does not contain '/' characters. There is a special check which only preloads found libraries if they have the SUID bit set. However, if a library has...

Mandrake Linux Security Advisory : eperl (MDKSA-2001:027)

Several potential buffer overflows in the ePerl package have been found by Fumitoshi Ukai and Denis Barbier. When eperl is installed setuid root, it can switch to the UID/GID of the script's owner. Although Linux-Mandrake does not ship the program setuid root, this is a useful feature which some...

Mandrake Linux Security Advisory : hylafax (MDKSA-2001:041)

A problem exists with the HylaFAX program, hfaxd. When hfaxd tries to change it's queue directory and fails, it prints an error message via syslog by directly passing user-supplied data as the format string. If hfaxd is installed setuid root, this behaviour can be exploited to gain root access...

Mandrake Linux Security Advisory : cups (MDKSA-2005:041)

Previous updates to correct integer overflow issues affecting xpdf overlooked certain conditions when built for a 64 bit platform. formerly CVE-2004-0888. This also affects applications like cups, that use embedded versions of xpdf. The updated packages are patched to deal with these issues...

Mandrake Linux Security Advisory : lpr (MDKSA-2003:059)

A buffer overflow was discovered in the lpr printer spooling system that can be exploited by a local user to gain root privileges. This can be done even if the printer is configured properly. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plug...

Mandrake Linux Security Advisory : gpm (MDKSA-2000:002)

A security bug was found in gpm-root; the bug can be exploited to provide local users with root access. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandrake Linux Security Advisory MDKSA-2000:002. The text itself ...

Mandrake Linux Security Advisory : emacs (MDKSA-2000:088)

A vulnerability exists in Emacs 20.6 and prior that allows any user on a multiuser system to eavesdrop on, or forge responses to, an Emacs client. The vulnerability stems from Emacs' failure to properly set permissions for slave PTY devices. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Th...

Mandrake Linux Security Advisory : vixie-cron (MDKSA-2001:022)

A buffer overflow exists in the 'crontab' command if it was called by a user with a username longer than 20 characters. If the system administrator has created usernames of that length, it would be possible for those users to gain elevated privileges. %NASLMINLEVEL 70300 C Tenable Network Securit...

Mandrake Linux Security Advisory : vim (MDKSA-2001:035)

Users could embed malicious VIM control codes into a file, and as soon as any user opened that file in vim-enhanced or vim-X11 with the status line option enabled in .vimrc, the commands would be executed as that user. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Mandrake Linux Security Advisory : apcupsd (MDKSA-2000:077)

A problem exists with the apcupsd daemon. During startup, apcupsd creates a PID file in /var/run with the ID of the daemon process. This file is used by the shutdown script to kill the daemon process. The /var/run/apcupsd.pid file is created with mode 666 permissions, meaning it is world-writeabl...

Mandrake Linux Security Advisory : bind (MDKSA-2001:017)

Four problems exists in all versions of ISC BIND 4.9.x prior to 4.9.8 and 8.2.x prior to 8.2.3 9.x is not affected. Version 8.2.x contains a buffer overflow in transaction signature TSIG handling code that can be exploited by an attacker to gain unauthorized privileged access to the system,...

Mandrake Linux Security Advisory : wu-ftpd (MDKSA-2001:001-2)

WireX discovered a temporary file creation bug in the 2.6.1 release of wu-ftpd. The problem exists in the privatepw helper program. As well, Linux-Mandrake 7.2 users must update to this package as it fixes security problems as discussed in the prior advisory, MDKSA-2000:014, which had not been...

Mandrake Linux Security Advisory : lpr (MDKSA-2000:054)

There is a format string bug in lpr with its calls to the syslog facility. There are no known exploits at ths time, but it may be possible for a user to gain local root access. This new lpr fixes this problem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Mandrake Linux Security Advisory : shadow-utils (MDKSA-2001:007)

WireX discovered a potential temporary file race condition in the useradd program contained in the shadow-utils package. The useradd program creates it's temporary files in the protected directory /etc/default, but if this directory is changed to world-writable, a problem could occur. This update...

Mandrake Linux Security Advisory : sudo (MDKSA-2001:024-1)

A buffer overflow exists in the sudo program which could be used by an attacker to obtain higher privileges. sudo is a program used to delegate superuser privileges to ordinary users and only for specific commands. Update : The sudo package for 7.1 used the system-auth facility of newer pam...

Mandrake Linux Security Advisory : koffice (MDKSA-2005:056)

Previous updates to correct integer overflow issues affecting xpdf overlooked certain conditions when built for a 64 bit platform. formerly CVE-2004-0888. This also affects applications like koffice, that use embedded versions of xpdf. The updated packages are patched to deal with these issues...

Mandriva Update for webmin MDVSA-2011:109 (webmin)

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Mandriva Security Advisory MDVSA-2009:282-1 (cups)

The remote host is missing an update to cups announced via advisory MDVSA-2009:282-1. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...

Mandriva Security Advisory MDVSA-2009:212-1 (python)

The remote host is missing an update to python announced via advisory MDVSA-2009:212-1. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...