Mandrake Linux Security Advisory : ruby (MDKSA-2006:225)

Another vulnerability has been discovered in the CGI library cgi.rb that ships with Ruby which could be used by a malicious user to create a denial of service attack DoS. Updated packages have been patched to correct this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Mandrake Linux Security Advisory : openldap (MDKSA-2006:208)

An unspecified vulnerability in OpenLDAP allows remote attackers to cause a denial of service daemon crash via a certain combination of SASL Bind requests that triggers an assertion failure in libldap. Packages have been patched to correct this issue. %NASLMINLEVEL 70300 C Tenable Network Securit...

Mandrake Linux Security Advisory : gdm (MDKSA-2006:231)

Local exploitation of a format string vulnerability in GNOME Foundation's GNOME Display Manager host chooser window gdmchooser could allow an unauthenticated attacker to execute arbitrary code on the affected system. The updated packages have been patched to correct this issue. %NASLMINLEVEL 7030...

Mandrake Linux Security Advisory : proftpd (MDKSA-2006:232)

Stack-based buffer overflow in the prctrlsrecvrequest function in ctrls.c in the modctrls module in ProFTPD before 1.3.1rc1 allows local users to execute arbitrary code via a large reqarglen length value. Packages have been patched to correct these issues. %NASLMINLEVEL 70300 C Tenable Network...

Mandrake Linux Security Advisory : xine-lib (MDKSA-2006:224)

Buffer overflow in the asmrpeval function for the Real Media input plugin allows remote attackers to cause a denial of service and possibly execute arbitrary code via a rulebook with a large number of rulematches. Updated packages have been patched to correct this issue. %NASLMINLEVEL 70300 C...

Mandrake Linux Security Advisory : chromium (MDKSA-2006:213)

Chromium is an OpenGL-based shoot them up game with fine graphics. It is built with a private copy of libpng, and as such could be susceptible to some of the same vulnerabilities : Buffer overflow in the pngdecompresschunk function in pngrutil.c in libpng before 1.2.12 allows context-dependent...

Mandrake Linux Security Advisory : gd (MDKSA-2007:035)

Buffer overflow in the gdImageStringFTEx function in gdft.c in the GD Graphics Library 2.0.33 and earlier allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via a crafted string with a JIS encoded font. Packages have been patched to correct...

Mandrake Linux Security Advisory : kdegraphics (MDKSA-2007:024)

The Adobe PDF specification 1.3, as implemented by xpdf 3.0.1 patch 2, kpdf in KDE before 3.5.5, and other products, allows remote attackers to have an unknown impact, possibly including denial of service infinite loop, arbitrary code execution, or memory corruption, via a PDF file with a 1 craft...

Mandrake Linux Security Advisory : postgresql (MDKSA-2006:194)

A vulnerability in PostgreSQL 8.1.x allowed remote authenticated users to cause a Denial of Service daemon crash via certain aggregate functions in an UPDATE statement which were not handled correctly CVE-2006-5540. Another DoS issue in PostgreSQL 7.4.x, 8.0.x, and 8.1.x allowed remote...

Mandrake Linux Security Advisory : mozilla-firefox (MDKSA-2006:168)

A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox program, version 1.5.0.7. This update provides the latest Firefox to correct these issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Mandrake Linux Security Advisory : mozilla-thunderbird (MDKSA-2007:011)

A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Thunderbird program, version 1.5.0.9. This update provides the latest Thunderbird to correct these issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

Mandrake Linux Security Advisory : xine-ui (MDKSA-2007:027)

Format string vulnerability in the errorscreatewindow function in errors.c in xine-ui allows attackers to execute arbitrary code via unknown vectors. CVE-2007-0254 XINE 0.99.4 allows user-assisted remote attackers to cause a denial of service application crash and possibly execute arbitrary code...

Mandrake Linux Security Advisory : clamav (MDKSA-2006:184)

An integer overflow in previous versions of ClamAV could allow a remote attacker to cause a Denial of Service scanning service crash and execute arbitrary code via a Portable Executable PE file CVE-2006-4182. Another vulnerability could allow a remote attacker to cause a DoS via a crafted...

Mandrake Linux Security Advisory : gv (MDKSA-2006:214-1)

Stack-based buffer overflow in the psgettext function in ps.c for GNU gv 3.6.2, and possibly earlier versions, allows user-assisted attackers to execute arbitrary code via a PostScript PS file with certain headers that contain long comments, as demonstrated using the DocumentMedia header. Package...

Mandrake Linux Security Advisory : mpg123 (MDKSA-2007:032)

The httpopen function in httpget.c in mpg123 before 0.64 allows remote attackers to cause a denial of service infinite loop by closing the HTTP connection early. Packages have been patched to correct this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Mandrake Linux Security Advisory : ruby (MDKSA-2006:192)

The CGI library in Ruby 1.8 allowed a remote attacker to cause a Denial of Service via an HTTP request with a multipart MIME body that contained an invalid boundary specifier, which would result in an infinite loop and CPU consumption. Updated packages have been patched to correct this issue...

Mandrake Linux Security Advisory : python (MDKSA-2006:181)

A vulnerability in python's repr function was discovered by Benjamin C. Wiley Sittler. It was found that the function did not properly handle UTF-32/UCS-4 strings, so an application that used repr on certin untrusted data could possibly be exploited to execute arbitrary code with the privileges o...

Mandrake Linux Security Advisory : rpm (MDKSA-2006:200)

A heap-based buffer overflow was discovered in librpm when the LANG or LCALL environment variable is set to ruRU.UTF-8 and possibly other locales, which could allow for user-assisted attackers to execute arbitrary code via crafted RPM packages. Updated packages have been patched to correct this...

Mandrake Linux Security Advisory : postgresql (MDKSA-2007:037-1)

Jeff Trout discovered that the PostgreSQL server did not sufficiently check data types of SQL function arguments in some cases. A user could then exploit this to crash the database server or read out arbitrary locations of the server's memory, which could be used to retrieve database contents tha...

Mandrake Linux Security Advisory : xorg-x11 (MDKSA-2007:005)

Sean Larsson of iDefense Labs discovered several vulnerabilities in X.Org/XFree86 : Local exploitation of a memory corruption vulnerability in the 'ProcRenderAddGlyphs' function in the X.Org and XFree86 X server could allow an attacker to execute arbitrary code with privileges of the X server,...