Mandrake Linux Security Advisory : MySQL (MDKSA-2006:158)

MySQL before 4.1.13 allows local users to cause a denial of service persistent replication slave crash via a query with multiupdate and subselects. CVE-2006-4380 There is a bug in the MySQL-Max and MySQL init script where the script was not waiting for the mysqld daemon to fully stop. This impact...

Mandrake Linux Security Advisory : krb5 (MDKSA-2006:139)

A flaw was discovered in some bundled Kerberos-aware packages that would fail to check the results of the setuid call. This call can fail in some circumstances on the Linux 2.6 kernel if certain user limits are reached, which could be abused by a local attacker to get the applications to continue...

Mandrake Linux Security Advisory : mozilla-thunderbird (MDKSA-2006:146)

A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Thunderbird program. Corporate 3 had contained the Mozilla suite however, due to the support cycle for Mozilla, it was felt that upgrading Mozilla to Firefox and Thunderbird would allow for better future...

Mandrake Linux Security Advisory : kdelibs (MDKSA-2006:130)

KDE Konqueror 3.5.1 and earlier allows remote attackers to cause a denial of service application crash by calling the replaceChild method on a DOM object, which triggers a null dereference, as demonstrated by calling document.replaceChild with a 0 zero argument. This issue does not affect Corpora...

Mandrake Linux Security Advisory : wireshark (MDKSA-2006:128)

A number of vulnerabilities have been discovered in the Wireshark formerly Ethereal network analyzer. These issues have been corrected in Wireshark version 0.99.2 which is provided with this update. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in th...

Mandrake Linux Security Advisory : ncompress (MDKSA-2006:140)

Tavis Ormandy, of the Google Security Team, discovered that ncompress, when uncompressing data, performed no bounds checking, which could allow a specially crafted datastream to underflow a .bss buffer with attacker controlled data. Updated packages have been patched to correct this issue...

Mandrake Linux Security Advisory : clamav (MDKSA-2006:138)

Damian Put discovered a boundary error in the UPX extraction module in ClamAV which is used to unpack PE Windows executables. This could be abused to cause a Denial of Service issue and potentially allow for the execution of arbitrary code with the permissions of the user running clamscan or clam...

Mandrake Linux Security Advisory : xorg-x11 (MDKSA-2006:164-1)

Local exploitation of an integer overflow vulnerability in the 'CIDAFM' function in the X.Org and XFree86 X server could allow an attacker to execute arbitrary code with privileges of the X server, typically root CVE-2006-3739. Local exploitation of an integer overflow vulnerability in the...

Mandrake Linux Security Advisory : openssl (MDKSA-2006:161)

Daniel Bleichenbacher recently described an attack on PKCS 1 v1.5 signatures where an RSA key with a small exponent used could be vulnerable to forgery of a PKCS 1 v1.5 signature signed by that key. Any software using OpenSSL to verify X.509 certificates is potentially vulnerable to this issue, a...

Mandrake Linux Security Advisory : mailman (MDKSA-2006:165)

A flaw was discovered in how Mailman handles MIME multipart messages where an attacker could send a carefully-crafted MIME multipart message to a Mailman-run mailing list causing that mailing list to stop working CVE-2006-2941. As well, a number of XSS cross-site scripting issues were discovered...

Mandrake Linux Security Advisory : libwmf (MDKSA-2006:132)

Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including 1 wv, 2 abiword, 3 freetype, 4 gimp, 5 libgsf, and 6 imagemagick allows remote attackers to execute arbitrary code via the MaxRecordSize header field in a WMF file. Updated packages have been patched to correct...

Mandrake Linux Security Advisory : ImageMagick (MDKSA-2006:155)

Multiple buffer overflows in ImageMagick before 6.2.9 allow user-assisted attackers to execute arbitrary code via crafted XCF images. CVE-2006-3743 Multiple integer overflows in ImageMagick before 6.2.9 allows user-assisted attackers to execute arbitrary code via crafted Sun bitmap images that...

Mandrake Linux Security Advisory : gnupg (MDKSA-2006:141)

An integer overflow vulnerability was discovered in gnupg where an attacker could create a carefully-crafted message packet with a large length that could cause gnupg to crash or possibly overwrite memory when opened. Updated packages have been patched to correct this issue. %NASLMINLEVEL 70300 C...

Mandrake Linux Security Advisory : libtiff (MDKSA-2006:137)

Tavis Ormandy, Google Security Team, discovered several vulnerabilities the libtiff image processing library : Several buffer overflows have been discovered, including a stack buffer overflow via TIFFFetchShortPair in tifdirread.c, which is used to read two unsigned shorts from the input file...

Mandrake Linux Security Advisory : php (MDKSA-2006:144)

A vulnerability was discovered in the sscanf function that could allow attackers in certain circumstances to execute arbitrary code via argument swapping which incremented an index past the end of an array and triggered a buffer over-read. Updated packages have been patched to correct these issue...

Mandrake Linux Security Advisory : kernel (MDKSA-2006:124)

A race condition in the Linux kernel 2.6.17.4 and earlier allows local users to obtain root privileges due to a race condition in the /proc filesystem. The provided packages are patched to fix these vulnerabilities. All users are encouraged to upgrade to these updated kernels immediately and rebo...

Mandrake Linux 8.2 /usr/mail local exploit (d86mail.pl)

No description provided by source. !/usr/bin/perl Mandrake 8.2 /usr/mail local exploit Usage: perl d86mail.pl offset Then enter "." dot and press 'Enter' Example: satan@localhost my$ perl d86mail.pl eip: 0xbffffddd .enter Cc: too long to edit sh-2.05$ $shellcode = "\x31\xdb\x89\xd8\xb0\x17\xcd\x8...

Mandrake Linux Security Advisory : kernel (MDKSA-2006:123)

A number of vulnerabilities were discovered and corrected in the Linux 2.6 kernel : The kernel did not clear sockaddrin.sinzero before returning IPv4 socket names for the getsockopt function, which could allow a local user to obtain portions of potentially sensitive memory if getsockopt is called...

Mandrake Linux Security Advisory : xine-lib (MDKSA-2006:121)

Stack-based buffer overflow in MiMMS 0.0.9 allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via the 1 sendcommand, 2 stringutf16, 3 getdata, and 4 getmediapacket functions, and possibly other functions. Xine-lib contains an embedded copy o...

Mandrake Linux Security Advisory : ppp (MDKSA-2006:119)

Marcus Meissner discovered that pppd's winbind plugin did not check for the result of the setuid call which could allow an attacker to exploit this on systems with certain PAM limits enabled to execute the NTLM authentication helper as root. This could possibly lead to privilege escalation...