Mandrake Linux Security Advisory : mozilla-firefox (MDKSA-2006:205)

A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox program, version 1.5.0.8. This update provides the latest Firefox to correct these issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Mandrake Linux Security Advisory : ntp (MDKSA-2006:178)

Openssl recently had several vulnerabilities which were patched CVE-2006-2937,2940,3738,4339, 4343. Some versions of ntp are built against a static copy of the SSL libraries. As a precaution an updated copy built against the new libraries in being made available. %NASLMINLEVEL 70300 C Tenable...

Mandrake Linux Security Advisory : kdenetwork (MDKSA-2007:009)

KsIRC 1.3.12 allows remote attackers to cause a denial of service crash via a long PRIVMSG string when connecting to an Internet Relay Chat IRC server, which causes an assertion failure and results in a NULL pointer dereference. Updated packages are patched to address this issue. %NASLMINLEVEL...

Mandrake Linux Security Advisory : gtk+2.0 (MDKSA-2007:039)

The GdkPixbufLoader function in GIMP ToolKit GTK+ in GTK 2 gtk2 allows context-dependent attackers to cause a denial of service crash via a malformed image file. CVE-2007-0010 The version of libgtk+2.0 shipped with Mandriva Linux 2007 fails various portions of the lsb-test-desktop test suite, par...

Mandrake Linux Security Advisory : php (MDKSA-2006:185)

PHP 4.x up to 4.4.4 and PHP 5 up to 5.1.6 allows local users to bypass certain Apache HTTP Server httpd.conf options, such as safemode and openbasedir, via the inirestore function, which resets the values to their php.ini Master Value defaults. CVE-2006-4625 A race condition in the symlink functi...

Mandrake Linux Security Advisory : bind (MDKSA-2007:030)

Use-after-free vulnerability in ISC BIND 9.3.0 up to 9.3.3, 9.4.0a1 up to 9.4.0a6, 9.4.0b1 up to 9.4.0b4, 9.4.0rc1, and 9.5.0a1 Bind Forum only allows remote attackers to cause a denial of service named daemon crash via unspecified vectors that cause named to 'dereference a freed fetch context.'...

Mandrake Linux Security Advisory : libx11 (MDKSA-2006:199)

The Xinput module modules/im/ximcp/imLcIm.c in X.Org libX11 1.0.2 and 1.0.3 opens a file for reading twice using the same file descriptor, which causes a file descriptor leak that allows local users to read files specified by the XCOMPOSEFILE environment variable via the duplicate file descriptor...

Mandrake Linux Security Advisory : xine-lib (MDKSA-2006:176)

Xine-lib uses an embedded copy of ffmpeg and as such has been updated to address the following issue: Multiple buffer overflows in libavcodec in ffmpeg before 0.4.9p20060530 allow remote attackers to cause a denial of service or possibly execute arbitrary code via multiple unspecified vectors in ...

Mandrake Linux Security Advisory : php (MDKSA-2007:038)

PHP 5.2.0 and 4.4 allows local users to bypass safemode and openbasedir restrictions via a malicious path and a null byte before a ';' in a sessionsavepath argument, followed by an allowed path, which causes a parsing inconsistency in which PHP validates the allowed path but sets session.savepath...

Mandrake Linux Security Advisory : dbus (MDKSA-2006:233)

A vulnerability was discovered in D-Bus that could be exploited by a local attacker to cause a Denial of Service. Updated packages have been patched to correct this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted fr...

Mandrake Linux Security Advisory : php (MDKSA-2006:196)

The Hardened-PHP Project discovered buffer overflows in htmlentities/htmlspecialchars internal routines to the PHP Project. The purpose of these functions is to be filled with user input. The overflow can only be when UTF-8 is used CVE-2006-5465 Unspecified vulnerabilities in PHP, probably before...

MDKA-2006:018 : ghostscript

A number of bugs have been corrected with this latest ghostscript package including a fix when rendering imaged when converting PostScript to PDF with ps2pdf, a crash when generating PDF files with the pdfwrite device, several segfaults, a fix for vertical japanese text, and a number of other...

Mandrake Linux Security Advisory : mpg123 (MDKSA-2007:032)

The httpopen function in httpget.c in mpg123 before 0.64 allows remote attackers to cause a denial of service infinite loop by closing the HTTP connection early. Packages have been patched to correct this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Mandrake Linux Security Advisory : xpdf (MDKSA-2007:021)

The Adobe PDF specification 1.3, as implemented by xpdf 3.0.1 patch 2, kpdf in KDE before 3.5.5, and other products, allows remote attackers to have an unknown impact, possibly including denial of service infinite loop, arbitrary code execution, or memory corruption, via a PDF file with a 1 craft...

Mandrake Linux Security Advisory : openoffice.org (MDKSA-2007:006)

Several integer overflows were discovered in the OpenOffice.org WMF file processor. An attacker could create a carefully crafted WMF file that would cause OpenOffice.org to execute arbitrary code when opened. Updated packages are patched to address this issue. %NASLMINLEVEL 70300 C Tenable Networ...

Mandrake Linux Security Advisory : postgresql (MDKSA-2006:194)

A vulnerability in PostgreSQL 8.1.x allowed remote authenticated users to cause a Denial of Service daemon crash via certain aggregate functions in an UPDATE statement which were not handled correctly CVE-2006-5540. Another DoS issue in PostgreSQL 7.4.x, 8.0.x, and 8.1.x allowed remote...

Mandrake Linux Security Advisory : mozilla-firefox (MDKSA-2006:168)

A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox program, version 1.5.0.7. This update provides the latest Firefox to correct these issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Mandrake Linux Security Advisory : kernel (MDKSA-2006:197)

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel : Bugs in the netfilter for IPv6 code, as reported by Mark Dowd, were fixed CVE-2006-4572. The ATM subsystem of the Linux kernel could allow a remote attacker to cause a Denial of Service panic via unknown vectors that cau...

Mandrake Linux Security Advisory : gnupg (MDKSA-2006:228)

A 'stack overwrite' vulnerability in GnuPG gpg allows attackers to execute arbitrary code via crafted OpenPGP packets that cause GnuPG to dereference a function pointer from deallocated stack memory. Updated packages have been patched to correct this issue. %NASLMINLEVEL 70300 C Tenable Network...

Mandrake Linux Security Advisory : ImageMagick (MDKSA-2007:041)

Vladimir Nadvornik discovered a buffer overflow in GraphicsMagick and ImageMagick allows user-assisted attackers to cause a denial of service and possibly execute execute arbitrary code via a PALM image that is not properly handled by the ReadPALMImage function in coders/palm.c. This is related t...