Mandrake Linux Security Advisory : Zope (MDKSA-2001:025)

A new Hotfix for Zope has been released that fixes a very important security issue that affects all versions of Zope prior to and including 2.3.1b1. Users can use through-the-web scripting capabilities on a Zope site to view and assign class attributes to ZClasses, possibly allowing them to make...

Mandrake Linux Security Advisory : webmin (MDKSA-2001:016)

Previous versions of webmin would create temporary files insecurely on several occasions. This could be exploited by a local attacker to overwrite or create arbitrary files and possibly gain root privileges. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Mandrake Linux Security Advisory : glibc (MDKSA-2000:045-1)

A bug was discovered in ld.so that could allow local users to obtain root privileges. The dynamic loader, ld.so, is responsible for making shared libraries available within a program at run-time. Normally, a user is allowed to load additional shared libraries when executing a program; they can be...

Mandrake Linux Security Advisory : tetex (MDKSA-2005:044)

Previous updates to correct integer overflow issues affecting xpdf overlooked certain conditions when built for a 64 bit platform. formerly CVE-2004-0888. This also affects applications like tetex, that use embedded versions of xpdf. The updated packages are patched to deal with these issues...

Mandrake Linux Security Advisory : netscape (MDKSA-2000:080)

A buffer overflow exists in the HTML parser code of the Netscape web browser in all versions prior to and including 4.75. This buffer overflow can be exploited by a remote attacker or web site. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Mandrake Linux Security Advisory : xemacs (MDKSA-2000:006)

From the Caldera advisory : under some circumstances, users are able to snoop on other users' keystrokes. This is a serious problems if you use modules that require e.g. input of passwords, such as MailCrypt. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Mandrake Linux Security Advisory : cups (MDKSA-2000:070-1)

A problem existed with previous versions of CUPS that made CUPS printers accessible from anywhere on the internet. A bug also existed where CUPS would broadcast to everywhere and thus keep open dial-on- demand lines. Both problems have been addressed in this update and by an automatic configurati...

Mandrake Linux Security Advisory : nfs-utils (MDKSA-2000:021)

A bug recently discovered in the nfs-utils package can theoretically be used for gaining remote root access. While there are currently no known exploits for this bug, we recommend upgrading to the latest version which fixes the bug. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Mandrake Linux Security Advisory : dump (MDKSA-2000:007)

Dump may cause security problem due to a buffer overflow. This package removes the set gid root on the dump exec file. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandrake Linux Security Advisory MDKSA-2000:007. T...

Mandrake Linux Security Advisory : cvsweb (MDKSA-2000:019)

Cvsweb contains a hole that provides attackers who have write access to a cvs repository with shell access. Thus, attackers who have write access to a cvs repository but not shell access can obtain a shell. In addition, anyone with write access to a cvs repository that is viewable with cvsweb can...

Mandrake Linux Security Advisory : Zope (MDKSA-2000:035)

A problem exists in the Zope package with the getRoles method of user objects contained in the default UserFolder implementation. Users with the ability to edit DTML could arrange to give themselves extra roles for the duration of a single request by mutating the roles list as a part of the reque...

Mandrake Linux Security Advisory : apcupsd (MDKSA-2000:077)

A problem exists with the apcupsd daemon. During startup, apcupsd creates a PID file in /var/run with the ID of the daemon process. This file is used by the shutdown script to kill the daemon process. The /var/run/apcupsd.pid file is created with mode 666 permissions, meaning it is world-writeabl...

Mandrake Linux Security Advisory : glibc (MDKSA-2000:040)

A bug was discovered in ld.so that could allow local users to obtain root privileges. The dynamic loader, ld.so, is responsible for making shared libraries available within a program at run-time. Normally, a user is allowed to load additional shared libraries when executing a program; they can be...

Mandrake Linux Security Advisory : lpr (MDKSA-2000:054)

There is a format string bug in lpr with its calls to the syslog facility. There are no known exploits at ths time, but it may be possible for a user to gain local root access. This new lpr fixes this problem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Mandrake Linux Security Advisory : bind (MDKSA-2001:017)

Four problems exists in all versions of ISC BIND 4.9.x prior to 4.9.8 and 8.2.x prior to 8.2.3 9.x is not affected. Version 8.2.x contains a buffer overflow in transaction signature TSIG handling code that can be exploited by an attacker to gain unauthorized privileged access to the system,...

Mandrake Linux Security Advisory : wu-ftpd (MDKSA-2001:001-2)

WireX discovered a temporary file creation bug in the 2.6.1 release of wu-ftpd. The problem exists in the privatepw helper program. As well, Linux-Mandrake 7.2 users must update to this package as it fixes security problems as discussed in the prior advisory, MDKSA-2000:014, which had not been...

Mandrake Linux Security Advisory : lpr (MDKSA-2003:059)

A buffer overflow was discovered in the lpr printer spooling system that can be exploited by a local user to gain root privileges. This can be done even if the printer is configured properly. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plug...

Mandrake Linux Security Advisory : gpm (MDKSA-2000:002)

A security bug was found in gpm-root; the bug can be exploited to provide local users with root access. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandrake Linux Security Advisory MDKSA-2000:002. The text itself ...

Mandrake Linux Security Advisory : emacs (MDKSA-2000:088)

A vulnerability exists in Emacs 20.6 and prior that allows any user on a multiuser system to eavesdrop on, or forge responses to, an Emacs client. The vulnerability stems from Emacs' failure to properly set permissions for slave PTY devices. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Th...

Mandrake Linux Security Advisory : vixie-cron (MDKSA-2001:022)

A buffer overflow exists in the 'crontab' command if it was called by a user with a username longer than 20 characters. If the system administrator has created usernames of that length, it would be possible for those users to gain elevated privileges. %NASLMINLEVEL 70300 C Tenable Network Securit...