Mandrake Linux Security Advisory : perl-Net-DNS (MDKSA-2007:146)

A flaw was discovered in the perl Net::DNS module in the way it generated the ID field in a DNS query. Because it is so predictable, a remote attacker could exploit this to return invalid DNS data CVE-2007-3377. A denial of service vulnerability was found in how Net::DNS parsed certain DNS...

MDKA-2007:081 : x11-server

The X.org server is wrongly matching the index of GLX visuals, making all OpenGL applications crash the server when using some specific chipsets like sis and fbdev. This update fixes the problem. %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch is not...

MDKA-2007:080 : hdf5

On mandriva 2007.0, hdf5 couldn't be installed due to the lack of libh5test.so.0 in its library packages. This release fixes tests and provides the libh5test.so.0 file. %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a security fix...

Mandrake Linux Security Advisory : openoffice.org (MDKSA-2007:144)

A heap overflow flaw was found in the RTF import filter of OpenOffice.org. If a victim were to open a specially crafted RTF file, OpenOffice.org could crash or possibly execute arbitrary code. Updated packages have been patched to prevent the above issues. %NASLMINLEVEL 70300 C Tenable Network...

Mandrake Linux Security Advisory : wireshark (MDKSA-2007:145)

A number of vulnerabilities in the Wireshark program were found that could cause crashes, excessive looping, or exhaustion of system memory. This updated provides wireshark 0.99.6 which is not vulnerable to these issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text an...

Mandrake Linux Security Advisory : mplayer (MDKSA-2007:143)

Multiple stack-based buffer overflows in stream/streamcddb.c in MPlayer before 1.0rc1try3 allow remote attackers to execute arbitrary code via a CDDB entry with a long 1 album title or 2 category. Updated packages have been patched to prevent this issue. %NASLMINLEVEL 70300 C Tenable Network...

MDKA-2007:077 : console-tools

vt-is-UTF8 utility included in console-tools package, and used by Mandriva initscripts, can hang, causing random problems like preventing a local/remote system reboot, unless user take interactive action 27948. Also, when executed on a terminal different from a linux vt, it can cause errors and...

Mandrake Linux Security Advisory : apache (MDKSA-2007:140)

A vulnerability was discovered in the the Apache modstatus module that could lead to a cross-site scripting attack on sites where the server-status page was publically accessible and ExtendedStatus was enabled CVE-2006-5752. A vulnerability was found in the Apache modcache module that could cause...

Mandrake Linux Security Advisory : MySQL (MDKSA-2007:139)

MySQL 5.x before 5.0.36 allows local users to cause a denial of service database crash by performing informationschema table subselects and using ORDER BY to sort a single-row result, which prevents certain structure elements from being initialized and triggers a NULL dereference in the filesort...

MDKA-2007:079 : postfix

This update to the postfix package fixes two bugs in the chroot script that in some cases could have prevented postfix from working at all: - The chroot script would malfunction if no postfix dynamic maps were installed - The chroot script would not enforce a safe umask, and could create a chroot...

Mandrake Linux Security Advisory : kdebase (MDKSA-2007:138)

An issue with the interaction between the Flash Player and the Konqueror web browser was discovered, which could lead to key presses leaking to the Flash Player instead of to the browser. This only affects users who have actually installed the Adobe Flash Player plugin. Updated packages have been...

MDKA-2007:074 : dhcp

The dhcp server from the x8664 package did not offer dhcp replies, this package update fixes the issue. %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a security fix. Disabled on 2012/09/06. C Tenable Network Security, Inc. This script w...

MDKA-2007:065 : mgetty

The /usr/bin/faxspool script in the mgetty-sendfax package, which can be used to convert files of various types into a format suitable for faxing, attempted to use the 'giftoppm' program to convert .gif files. This is a very old program which does not exist in Mandriva Linux. This update corrects...

Mandrake Linux Security Advisory : xfsdump (MDKSA-2007:134)

xfsfsr in xfsdump creates a .fsr temporary directory with insecure permissions, which allows local users to read or overwrite arbitrary files on xfs filesystems. Updated packages have been patched to prevent this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Mandrake Linux Security Advisory : webmin (MDKSA-2007:135)

Multiple cross-site scripting XSS vulnerabilities were discovered in pamlogin.cgi in webmin prior to version 1.350, which could allow a remote attacker to inject arbitrary web script or HTML. Updated packages have been patched to prevent this issue. %NASLMINLEVEL 70300 C Tenable Network Security,...

Mandrake Linux Security Advisory : evolution (MDKSA-2007:136)

A flaw in Evolution/evolution-data-server was found in how Evolution would process certain IMAP server messages. If a user were tricked into connecting to a malicious IMAP server, it was possible that arbitrary code could be executed with the privileges of the user using Evolution. Updated packag...

MDKA-2007:069 : x11-driver-video-vesa

X.org was crashing and/or corrupting the screen when the screen is resized using the Resize and Rotate randr server extension. The problem identified was that the vesa driver was trying to use outdated values for its frame buffer, and so causing problem. The updated package has a patch fixing thi...

Mandrake Linux Security Advisory : emacs (MDKSA-2007:133)

A vulnerability in emacs was discovered where it would crash when processing certain types of images. Updated packages have been patched to prevent this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandrake...

Mandrake Linux Security Advisory : krb5 (MDKSA-2007:137)

David Coffey discovered an uninitialized pointer free flaw in the RPC library used by kadmind. A remote unauthenticated attacker who could access kadmind could trigger the flaw causing kadmind to crash or possibly execute arbitrary code CVE-2007-2442. David Coffey also discovered an overflow flaw...

Mandrake Linux Security Advisory : madwifi-source (MDKSA-2007:132)

The 802.11 network stack in MadWifi prior to 0.9.3.1 would alloa remote attackers to cause a denial of service system hang via a crafted length field in nested 802.3 Ethernet frames in Fast Frame packets, which results in a NULL pointer dereference CVE-2007-2829. The athbeaconconfig function in...