Mandrake Linux Security Advisory : mplayer (MDKSA-2007:055)

The DMOVideoDecoderOpen function in loader/dmo/DMOVideoDecoder.c in MPlayer 1.0rc1 and earlier does not set the biSize before use in a memcpy, which allows user-assisted remote attackers to cause a buffer overflow and possibly execute arbitrary code. Updated packages have been patched to address...

Mandrake Linux Security Advisory : xine-lib (MDKSA-2007:057)

The DMOVideoDecoderOpen function in dmo/DMOVideoDecoder.c in xine-lib does not set the biSize before use in a memcpy, which allows user-assisted remote attackers to cause a buffer overflow and possibly execute arbitrary code. Updated packages have been patched to address this issue. %NASLMINLEVEL...

Mandrake Linux Security Advisory : gnupg (MDKSA-2007:059)

GnuPG prior to 1.4.7 and GPGME prior to 1.1.4, when run from the command line, did not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components. This could allow a remote attacker to forge the contents of an email message without detection. GnuPG 1.4.7 is bei...

Mandrake Linux Security Advisory : mozilla-thunderbird (MDKSA-2007:052)

A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Thunderbird program, version 1.5.0.10. This update provides the latest Thunderbird to correct these issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

Mandrake Linux Security Advisory : util-linux (MDKSA-2007:053)

Umount allows local users to trigger a NULL dereference and application crash by invoking the program with a pathname for a USB pen drive that was mounted and then physically removed, which might allow the users to obtain sensitive information, including core file contents. Updated packages have...

MDKA-2007:017 : tcpdump

tcpdump would segfault on certain packets when reading back a captured tcpdump file. This update corrects that problem. %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a security fix. Disabled on 2012/09/06. C Tenable Network Security, In...

Mandrake Linux Security Advisory : mozilla-firefox (MDKSA-2007:050-1)

A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox program, version 1.5.0.10. This update provides the latest Firefox to correct these issues. Update : A regression was found in the latest Firefox packages provided where changes to library paths...

Mandrake Linux Security Advisory : spamassassin (MDKSA-2007:049)

A bug in the way that SpamAssassin processes HTML emails containing URIs was discovered in versions 3.1.x. A carefully crafted mail message could make SpamAssassin consume significant amounts of CPU resources that could delay or prevent the delivery of mail if a number of these messages were sent...

Mandrake Linux Security Advisory : php (MDKSA-2007:048)

A number of vulnerabilities were discovered in PHP language. Many buffer overflow flaws were discovered in the PHP session extension, the strreplace function, and the imapmailcompose function. An attacker able to use a PHP application using any of these functions could trigger these flaws and...

Mandrake Linux Security Advisory : kernel (MDKSA-2007:047)

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel : A double free vulnerability in the squashfs module could allow a local user to cause a Denial of Service by mounting a crafted squashfs filesystem CVE-2006-5701. The zlibinflate function allows local users to cause a cra...

Mandrake Linux Security Advisory : ekiga (MDKSA-2007:044)

A format string flaw was discovered in how ekiga processes certain messages, which could permit a remote attacker that can connect to ekiga to potentially execute arbitrary code with the privileges of the user running ekiga. Updated package have been patched to correct this issue. %NASLMINLEVEL...

Mandrake Linux Security Advisory : gnucash (MDKSA-2007:046)

Gnucash 2.0.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on the 1 gnucash.trace, 2 qof.trace, and 3 qof.trace.PID temporary files. Updated package have been patched to correct this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive te...

Mandrake Linux Security Advisory : clamav (MDKSA-2007:043)

Clam AntiVirus ClamAV before 0.90 does not close open file descriptors under certain conditions, which allows remote attackers to cause a denial of service file descriptor consumption and failed scans via CAB archives with a cabinet header record length of zero, which causes a function to return...

MDKA-2006:043 : subversion

One of subversion's operating modes, svnserve, needs some entries in the /etc/services file. These entries are created during package installation, but under some conditions this procedure fails and /etc/services remains without them. The updated packages correct this issue. %NASLMINLEVEL 999999...

MDKA-2006:030 : imlib2

The tiff loader from imlib2 crashes when processing images on the x8664 platform. This was reported when using digikam on x8664, which uses this loader. Updated packages are provided that correct the issue. %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch ...

MDKA-2006:019 : postgresql

Various bugs in the PostgreSQL 8.0.x branch have been corrected with the latest 8.0.7 maintenance release which is being provided for Mandriva Linux 2006 users. %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a security fix. Disabled on...

MDKA-2006:017 : mozilla-thunderbird

Recent security updates to mozilla-thunderbird did not include some changes made to the build from the community branch of 2006.0. The changes include corrections to the packaging of language files and some corrections to the uninstall scripts. New builds of the enigmail-es and enigmail-it packag...

MDKA-2007:009 : perl-SOAP-Lite

SOAP::Lite makes use of auto-generated methods with names that clash with methods exported by UNIVERSAL::require. As a result, using the two modules simultaneously will result in an immediate program crash. The package has been patched with an upstream fix to correct the issue. %NASLMINLEVEL 9999...

MDKA-2006:047 : jabber

The OpenSSL library was not properly initialized in the jabber SSL support code, which prevented SSL support for incoming client connections on the jabber server. This update corrects this issue. %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch is not...

MDKA-2005:052 : ldetect-lst

The updated ldetect-lst packages provide five new PCI modem definitions in the hardware database. This will prevent drakconnect from misconfiguring these modems as a large number of Conexant and Smart Link modems share the same PCI ids, thus requiring additional information in the database. This...