Mandrake Linux Security Advisory : sudo (MDKSA-2005:201)

Tavis Ormandy discovered that sudo does not perform sufficient environment cleaning; in particular the SHELLOPTS and PS4 variables are still passed to the program running as an alternate user which can result in the execution of arbitrary commands as the alternate user when a bash script is...

Mandrake Linux Security Advisory : perl-Compress-Zlib (MDKSA-2005:196)

The perl Compress::Zlib module contains an internal copy of the zlib library that was vulnerable to CVE-2005-1849 and CVE-2005-2096. This library was updated with version 1.35 of Compress::Zlib. An updated perl-Compress-Zlib package is now available to provide the fixed module. %NASLMINLEVEL 7030...

Mandrake Linux Security Advisory : openssl (MDKSA-2005:179)

Yutaka Oiwa discovered vulnerability potentially affects applications that use the SSL/TLS server implementation provided by OpenSSL. Such applications are affected if they use the option SSLOPMSIESSLV2RSAPADDING. This option is implied by use of SSLOPALL, which is intended to work around various...

Mandrake Linux Security Advisory : curl (MDKSA-2005:182)

A vulnerability in libcurl's NTLM function can overflow a stack-based buffer if given too long a user name or domain name in NTLM authentication is enabled and either a pass a user and domain name to libcurl that together are longer than 192 bytes or b allow libcurl to follow HTTP redirects and t...

Mandrake Linux Security Advisory : xine-lib (MDKSA-2005:180)

When playing an Audio CD, a xine-lib based media application contacts a CDDB server to retrieve metadata like the title and artist's name. During processing of this data, a response from the server, which is located in memory on the stack, is passed to the fprintf function as a format string. An...

Mandrake Linux Security Advisory : cfengine (MDKSA-2005:184)

Javier Fernndez-Sanguino Pea discovered several insecure temporary file uses in cfengine = 1.6.5 and = 2.1.16 which allows local users to overwrite arbitrary files via a symlink attack on temporary files used by vicf.in. CVE-2005-2960 In addition, Javier discovered the cfmailfilter and cfcron.in...

Mandrake Linux Security Advisory : hylafax (MDKSA-2005:177)

faxcron, recvstats, and xferfaxstats in HylaFax 4.2.1 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files. CVE-2005-3069 In addition, HylaFax has some provisional support for Unix domain sockets, which is disabled in the default compile configuratio...

Mandrake Linux Security Advisory : texinfo (MDKSA-2005:175)

Frank Lichtenheld has discovered that texindex insecurely creates temporary files with predictable filenames. This is exploitable if a local attacker were to create symbolic links in the temporary files directory, pointing to a valid file on the filesystem. When texindex is executed, the file wou...

Mandrake Linux Security Advisory : clamav (MDKSA-2005:166)

A vulnerability was discovered in ClamAV versions prior to 0.87. A buffer overflow could occure when processing malformed UPX-packed executables. As well, it could be sent into an infinite loop when processing specially crafted FSG-packed executables. ClamAV version 0.87 is provided with this...

Mandrake Linux Security Advisory : squid (MDKSA-2005:162)

Two vulnerabilities were recently discovered in squid : The first is a DoS possible via certain aborted requests that trigger an assertion error related to 'STOPPENDING' CVE-2005-2794. The second is a DoS caused by certain crafted requests and SSL timeouts CVE-2005-2796. The updated packages have...

Mandrake Linux Security Advisory : lm_sensors (MDKSA-2005:149)

Javier Fernandez-Sanguino Pena discovered that the pwmconfig script in the lmsensors package created temporary files in an insecure manner. This could allow a symlink attack to create or overwrite arbitrary files with full root privileges because pwmconfig is typically executed by root. The updat...

Mandrake Linux Security Advisory : ucd-snmp (MDKSA-2005:137)

A Denial of Service vulnerability was discovered in the way that ucd-snmp uses network stream protocols. A remote attacker could send a ucd-snmp agent a specially crafted packet that would cause the agent to crash. The updated packages have been patched to correct this problem. %NASLMINLEVEL 7030...

Mandrake Linux Security Advisory : kdeedu (MDKSA-2005:159)

Ben Burton notified the KDE security team about several tempfile handling related vulnerabilities in langen2kvtml, a conversion script for kvoctrain. This vulnerability was initially discovered by Javier Fernndez-Sanguino Pea. The script uses known filenames in /tmp which allow an local attacker ...

Mandrake Linux Security Advisory : mplayer (MDKSA-2005:158)

Buffer overflow in adpcm.c in MPlayer 1.0pre7 and earlier allows remote attackers to execute arbitrary code via a video file with an audio header containing a large value in a strf chunk. The updated packages have been patched to correct this problem. %NASLMINLEVEL 70300 C Tenable Network Securit...

Mandrake Linux Security Advisory : gaim (MDKSA-2005:139)

"Yet more vulnerabilities have been discovered in the gaim IM client. Invalid characters in a sent file can cause Gaim to crash on some systems CVE-2005-2102 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandrake...

Mandrake Linux Security Advisory : pcre (MDKSA-2005:151)

Integer overflow in pcrecompile.c in Perl Compatible Regular Expressions PCRE before 6.2, as used in multiple products, allows attackers to execute arbitrary code via quantifier values in regular expressions, which leads to a heap-based buffer overflow. The updated packages have been patched to...

Mandrake Linux Security Advisory : vim (MDKSA-2005:148)

A vulnerability was discovered in the way that vim processed modelines. If a user with modelines enabled opened a textfile with a specially crafted modeline, arbitrary commands could be executed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Mandrake Linux Security Advisory : clamav (MDKSA-2005:125)

Neel Mehta and Alex Wheeler discovered integer overflow vulnerabilities in Clam AntiVirus when handling the TNEF, CHM, and FSG file formats. By sending a specially crafted file, an attacker could execute arbitrary code with the permissions of the user running Clam AV. This update provides clamav...

Mandrake Linux Security Advisory : cups (MDKSA-2005:138-1)

A vulnerability was discovered in the CUPS printing package where when processing a PDF file, bounds checking was not correctly performed on some fields. As a result, this could cause the pdtops filter to crash. Update : The patch to correct this problem was not properly applied to the Mandriva...

Mandrake Linux Security Advisory : xpdf (MDKSA-2005:134)

A vulnerability in the xpdf PDF viewer was discovered. An attacker could construct a malicious PDF file that would cause xpdf to consume all available disk space in /tmp when opened. The updated packages have been patched to correct this problem. %NASLMINLEVEL 70300 C Tenable Network Security, In...