Mandrake Linux Security Advisory : gnupg (MDKSA-2006:043)

Tavis Ormandy discovered it is possible to make gpg incorrectly return success when verifying an invalid signature file. The updated packages have been patched to address this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Mandrake Linux Security Advisory : gnutls (MDKSA-2006:039)

Evgeny Legerov discovered cases of possible out-of-bounds access in the DER decoding schemes of libtasn1, when provided with invalid input. This library is bundled with gnutls. The provided packages have been patched to correct these issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Th...

Mandrake Linux Security Advisory : groff (MDKSA-2006:038)

The Trustix Secure Linux team discovered a vulnerability in the groffer utility, part of the groff package. It created a temporary directory in an insecure way which allowed for the exploitation of a race condition to create or overwrite files the privileges of the user invoking groffer. Likewise...

Mandrake Linux Security Advisory : openssh (MDKSA-2006:034)

A flaw was discovered in the scp local-to-local copy implementation where filenames that contain shell metacharacters or spaces are expanded twice, which could lead to the execution of arbitrary commands if a local user could be tricked into a scp'ing a specially crafted filename. The provided...

Mandrake Linux Security Advisory : php (MDKSA-2006:035)

A flaw in the PHP gd extension in versions prior to 4.4.1 could allow a remote attacker to bypass safemode and openbasedir restrictions via unknown attack vectors. The updated packages have been patched to correct this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive te...

Mandrake Linux Security Advisory : mozilla-firefox (MDKSA-2006:037)

Mozilla and Mozilla Firefox allow remote attackers to cause a denial of service CPU consumption and delayed application startup via a web site with a large title, which is recorded in history.dat but not processed efficiently during startup. CVE-2005-4134 The JavaScript interpreter jsinterp.c in...

Mandrake Linux Security Advisory : xpdf (MDKSA-2006:032)

Heap-based buffer overflow in Splash.cc in xpdf allows attackers to cause a denial of service and possibly execute arbitrary code via crafted splash images that produce certain values that exceed the width or height of the associated bitmap. The updated packages have been patched to correct this...

Mandrake Linux Security Advisory : php (MDKSA-2006:028)

Multiple response splitting vulnerabilities in PHP allow remote attackers to inject arbitrary HTTP headers via unknown attack vectors, possibly involving a crafted Set-Cookie header, related to the 1 session extension aka ext/session and the 2 header function. CVE-2006-0207 Multiple cross-site...

Mandrake Linux Security Advisory : poppler (MDKSA-2006:030)

Heap-based buffer overflow in Splash.cc in xpdf allows attackers to cause a denial of service and possibly execute arbitrary code via crafted splash images that produce certain values that exceed the width or height of the associated bitmap. Poppler uses a copy of the xpdf code and as such has th...

Mandrake Linux Security Advisory : kdegraphics (MDKSA-2006:031)

Heap-based buffer overflow in Splash.cc in xpdf allows attackers to cause a denial of service and possibly execute arbitrary code via crafted splash images that produce certain values that exceed the width or height of the associated bitmap. Kdegraphics-kpdf uses a copy of the xpdf code and as su...

Mandrake Linux Security Advisory : OpenOffice.org (MDKSA-2006:033)

OpenOffice.org 2.0 and earlier, when hyperlinks has been disabled, does not prevent the user from clicking the WWW-browser button in the Hyperlink dialog, which makes it easier for attackers to trick the user into bypassing intended security settings. Updated packages are patched to address this...

Mandrake Linux Security Advisory : libast (MDKSA-2006:029)

Buffer overflow in Library of Assorted Spiffy Things LibAST 0.6.1 and earlier, as used in Eterm and possibly other software, allows local users to execute arbitrary code as the utmp user via a long -X argument. The updated packages have been patched to correct this issue. %NASLMINLEVEL 70300 C...

Mandrake Linux Security Advisory : bzip2 (MDKSA-2006:026)

A bug was found in the way that bzgrep processed file names. If a user could be tricked into running bzgrep on a file with a special file name, it would be possible to execute arbitrary code with the privileges of the user running bzgrep. As well, the bzip2 package provided with Mandriva Linux 20...

Mandrake Linux Security Advisory : gzip (MDKSA-2006:027)

Zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script. This was previously corrected in MDKSA-2005:092, however the fix was incomplete. These updated packages provide a more...

MDKSA-2006:022 : perl-Convert-UUlib

A buffer overflow was discovered in the perl Convert::UUlib module in versions prior to 1.051, which could allow remote attackers to execute arbitrary code via a malformed parameter to a read operation. This update provides version 1.051 which is not vulnerable to this flaw. %NASLMINLEVEL 999999...

Mandrake Linux Security Advisory : ImageMagick (MDKSA-2006:024)

The delegate code in ImageMagick 6.2.4.x allows remote attackers to execute arbitrary commands via shell metacharacters in a filename that is processed by the display command. CVE-2005-4601 A format string vulnerability in the SetImageInfo function in image.c for ImageMagick 6.2.3, and other...

Mandrake Linux Security Advisory : perl-Net_SSLeay (MDKSA-2006:023)

Javier Fernandez-Sanguino Pena discovered that the perl Net::SSLeay module used the file /tmp/entropy as a fallback entropy source if a proper source was not set via the environment variable EGDPATH. This could potentially lead to weakened cryptographic operations if an attacker was able to provi...

Mandrake Linux Security Advisory : net-snmp (MDKSA-2006:025)

The fixproc application in Net-SNMP creates temporary files with predictable file names which could allow a malicious local attacker to change the contents of the temporary file by exploiting a race condition, which could possibly lead to the execution of arbitrary code. As well, a local attacker...

Mandrake Linux Security Advisory : mozilla-thunderbird (MDKSA-2006:021)

GUI display truncation vulnerability in Mozilla Thunderbird 1.0.2, 1.0.6, and 1.0.7 allows user-complicit attackers to execute arbitrary code via an attachment with a filename containing a large number of spaces ending with a dangerous extension that is not displayed by Thunderbird, along with an...

Mandrake Linux Security Advisory : ipsec-tools (MDKSA-2006:020)

The Internet Key Exchange version 1 IKEv1 implementation isakmpagg.c in ipsec-tools racoon before 0.6.3, when running in aggressive mode, allows remote attackers to cause a denial of service null dereference and crash via crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for...