Mandrake Linux Security Advisory : kernel (MDKSA-2007:040)

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel : The isdnpppccpresetallocstate function in drivers/isdn/isdnppp.c in the Linux 2.4 kernel before 2.4.34-rc4, as well as the 2.6 kernel, does not call the inittimer function for the ISDN PPP CCP reset state timer, which ha...

Mandrake Linux Security Advisory : clamav (MDKSA-2006:230)

The latest version of ClamAV, 0.88.7, fixes some bugs, including vulnerabilities with handling base64-encoded MIME attachment files that can lead to either a a crash CVE-2006-5874, or b a bypass of virus detection CVE-2006-6406. As well, a vulnerability was discovered that allows remote attackers...

Mandrake Linux Security Advisory : nvidia (MDKSA-2007:007)

A vulnerability in the NVIDIA Xorg driver was discovered by Derek Abdine who found that it did not correctly verify the size of buffers used to render text glyphs, resulting in a crash of the server when displaying very long strings of text. If a user was tricked into viewing a specially crafted...

Mandrake Linux Security Advisory : gnutls (MDKSA-2006:166)

verify.c in GnuTLS before 1.4.4, when using an RSA key with exponent 3, does not properly handle excess data in the digestAlgorithm.parameters field when generating a hash, which allows remote attackers to forge a PKCS 1 v1.5 signature that is signed by that RSA key and prevents GnuTLS from...

Mandrake Linux Security Advisory : mozilla-thunderbird (MDKSA-2006:206)

A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Thunderbird program, version 1.5.0.8. This update provides the latest Thunderbird to correct these issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

Mandrake Linux Security Advisory : bluez-utils (MDKSA-2007:014)

hidd in BlueZ bluez-utils before 2.25 allows remote attackers to obtain control of the 1 Mouse and 2 Keyboard Human Interface Device HID via a certain configuration of two HID PSM endpoints, operating as a server, aka HidAttack. hidd is not enabled by default on Mandriva 2006.0. This update adds...

Mandrake Linux Security Advisory : krb5 (MDKSA-2007:008)

A vulnerability in the RPC library in Kerberos 1.4.x and 1.5.x as used in the kadmind administration daemon calls an uninitialized function pointer in freed memory, which could allow a remote attacker to cause a Denial of Service and possibly execute arbitrary code via unspecified vectors. Update...

Mandrake Linux Security Advisory : squid (MDKSA-2007:026)

A vulnerability in squid was discovered that could be remotely exploited by using a special ftp:// URL CVE-2007-0247. Another Denial of Service vulnerability was discovered in squid 2.6 that allows remote attackers to crash the server by causing an externalaclqueue overload CVE-2007-0248...

Mandrake Linux Security Advisory : mono (MDKSA-2006:188)

Sebastian Krahmer of the SUSE security team found that the System.CodeDom.Compiler classes in mono used temporary files in an insecure way that could allow a symbolic link attack to overwrite arbitrary files with the privileges of the user running a program that made use of those classes. Updated...

Mandrake Linux Security Advisory : pxelinux (MDKSA-2006:211)

PXELINUX is a PXE bootloader. It is built with a private copy of libpng, and as such could be susceptible to some of the same vulnerabilities : Buffer overflow in the pngdecompresschunk function in pngrutil.c in libpng before 1.2.12 allows context-dependent attackers to cause a denial of service...

Mandrake Linux Security Advisory : screen (MDKSA-2006:191)

Multiple unspecified vulnerabilities in the 'utf8 combining characters handling' utf8handlecomb function in encoding.c in screen before 4.0.3 allows user-assisted attackers to cause a denial of service crash or hang via certain UTF8 sequences. Updated packages have been patched to correct this...

Mandrake Linux Security Advisory : gdm (MDKSA-2006:231)

Local exploitation of a format string vulnerability in GNOME Foundation's GNOME Display Manager host chooser window gdmchooser could allow an unauthenticated attacker to execute arbitrary code on the affected system. The updated packages have been patched to correct this issue. %NASLMINLEVEL 7030...

Mandrake Linux Security Advisory : proftpd (MDKSA-2006:232)

Stack-based buffer overflow in the prctrlsrecvrequest function in ctrls.c in the modctrls module in ProFTPD before 1.3.1rc1 allows local users to execute arbitrary code via a large reqarglen length value. Packages have been patched to correct these issues. %NASLMINLEVEL 70300 C Tenable Network...

Mandrake Linux Security Advisory : qt (MDKSA-2006:187)

An integer overflow was discovered in the way that Qt handled pixmap images. This flaw could be exploited by a remote attacker in a malicious website that, when viewed by an individual using an application that uses Qt like Konqueror, would cause it to crash or possibly execute arbitrary code wit...

Mandrake Linux Security Advisory : openldap (MDKSA-2006:171)

slapd in OpenLDAP before 2.3.25 allows remote authenticated users with selfwrite Access Control List ACL privileges to modify arbitrary Distinguished Names DN. Packages have been patched to correct this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Mandrake Linux Security Advisory : proftpd (MDKSA-2006:217-1)

A stack-based buffer overflow in the sreplace function in ProFTPD 1.3.0 and earlier, allows remote attackers to cause a denial of service, as demonstrated by vdproftpd.pm, a 'ProFTPD remote exploit.' CVE-2006-5815 Buffer overflow in the tlsx509nameoneline function in the modtls module, as used in...

Mandrake Linux Security Advisory : ruby (MDKSA-2006:225)

Another vulnerability has been discovered in the CGI library cgi.rb that ships with Ruby which could be used by a malicious user to create a denial of service attack DoS. Updated packages have been patched to correct this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

MDKA-2005:060 : msec

Bugs in the msec package have been corrected: msec wasn't properly parsing the output on security checks to check ownership of files, reporting files as unowned when they were in fact properly owned by a valid user. The /var/lib/msec/security.conf was no longer being generated which prevented mse...

MDKA-2006:057 : clamav

There are no known security issues with clamav-0.88.5, which was included in the last update MDKSA-2006:184. Upstream has released a new stable 0.88.6, with some bugfixes. This update is to address user reports with regards to clamav's behavior of producing output such as: WARNING: Your ClamAV...

MDKA-2006:066 : evolution-sharp

The evolution-sharp bindings weren't configured properly, preventing beagle from indexing Evolution mailboxes. This update fixes this issue. %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a security fix. Disabled on 2012/09/06. C Tenable...