Mandrake Linux Security Advisory : Zope (MDKSA-2000:043)

The exploit that was not fixed with the previous Zope hotfix involves the getRoles method of user objects contained in the default UserFolder implementation returning a mutable Python type. Because the mutable object is still associated with the persistent User object, users with the ability to...

Mandrake Linux Security Advisory : perl-Digest-MD5 (MDKSA-2002:035)

A bug exists in the UTF8 interaction between the perl-Digest-MD5 module and perl that results in UTF8 strings having improper MD5 digests. The 2.20 version of the module corrects this problem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Mandrake Linux Security Advisory : mutt (MDKSA-2001:031)

A format string vulnerability was present in the IMAP code in versions of the mutt email client previous to 1.2.5. This had the effect that a compromised or malicious IMAP server could possibly execute code on the local machine. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Mandrake Linux Security Advisory : cups (MDKSA-2001:020-1)

A problem exists in all versions of CUPS prior to 1.1.5 with the httpGets function. It could go into an infinite loop if a line longer than the input buffer size was sent by a client. This could be used as a DoS attack. As well, all occurances of sprintf calls were changed to snprintf, and all...

Mandrake Linux Security Advisory : bind (MDKSA-2000:067)

A vulnerability exists with the bind nameserver dealing with compressed zone transfers. This vulnerability can be exploited by authorized zone transfers and used in a DoS attack. The named daemon will crash if it receives this type of zone transfer from an authorized source address. The crash is...

Mandrake Linux Security Advisory : netscape (MDKSA-2000:080)

A buffer overflow exists in the HTML parser code of the Netscape web browser in all versions prior to and including 4.75. This buffer overflow can be exploited by a remote attacker or web site. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Mandrake Linux Security Advisory : getty_ps (MDKSA-2001:004)

WireX discovered a potential temporary file race condition in the gettyps program. This update corrects the problem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandrake Linux Security Advisory MDKSA-2001:004. The...

Mandrake Linux Security Advisory : gpdf (MDKSA-2005:042)

Previous updates to correct integer overflow issues affecting xpdf overlooked certain conditions when built for a 64 bit platform. formerly CVE-2004-0888. This also affects applications like gpdf, that use embedded versions of xpdf. The updated packages are patched to deal with these issues...

Mandrake Linux Security Advisory : exmh (MDKSA-2001:015)

All versions of exmh prior to 2.3.1 use the /tmp directory for storing temporary files. This was done in an insecure manner as exmh did not check to ensure that nobody placed a symlink with the same name in /tmp in the meantime and thus was vulnerable to a symlink attack. This could lead to a...

Mandrake Linux Security Advisory : man (MDKSA-2000:015)

Internet Security Systems ISS X-Force has identified a vulnerability in the makewhatis Bourne shell script that ships with many Linux distributions. It is found in versions 1.5e and higher of man, and handles temporary files insecurely. Local users may gain a variety of privileges depending on th...

Mandrake Linux Security Advisory : pine (MDKSA-2000:073-1)

By adding specific headers to messages, the pine mail reader could be made to exit with an error message when users attempted to manipulate mail folders containing those messages. Update : The previous announcement did not make mention of another vulnerability in pine 4.21 and previous in that it...

Mandrake Linux Security Advisory : perl (MDKSA-2000:031)

There is a vulnerability that exists when using setuidperl together with the mailx program. In some cases, setuidperl will warn root that something has going on. The setuidperl program uses /bin/mail to send the message, as root, with the environment preserved. An undocumented feature of /bin/mai...

Mandrake Linux Security Advisory : MySQL (MDKSA-2001:014-1)

A security problem exists in all versions of MySQL after 3.23.2 and prior to 3.23.31. The problem is that the SHOW GRANTS command could be executed by any user making it possible for anyone with a MySQL account to get the crypted password from the mysql.user table. The new 3.23.31 version fixes...

Mandrake Linux Security Advisory : cups (MDKSA-2000:070-1)

A problem existed with previous versions of CUPS that made CUPS printers accessible from anywhere on the internet. A bug also existed where CUPS would broadcast to everywhere and thus keep open dial-on- demand lines. Both problems have been addressed in this update and by an automatic configurati...

Mandrake Linux Security Advisory : webmin (MDKSA-2001:016)

Previous versions of webmin would create temporary files insecurely on several occasions. This could be exploited by a local attacker to overwrite or create arbitrary files and possibly gain root privileges. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Mandrake Linux Security Advisory : glibc (MDKSA-2000:045-1)

A bug was discovered in ld.so that could allow local users to obtain root privileges. The dynamic loader, ld.so, is responsible for making shared libraries available within a program at run-time. Normally, a user is allowed to load additional shared libraries when executing a program; they can be...

Mandrake Linux Security Advisory : Zope (MDKSA-2001:025)

A new Hotfix for Zope has been released that fixes a very important security issue that affects all versions of Zope prior to and including 2.3.1b1. Users can use through-the-web scripting capabilities on a Zope site to view and assign class attributes to ZClasses, possibly allowing them to make...

Mandrake Linux Security Advisory : MandrakeUpdate (MDKSA-2000:034)

There is a possible race condition in MandrakeUpdate that has the potential for users to tamper with RPMs downloaded by MandrakeUpdate prior to them being installed. This is due to files being stored in the /tmp directory. This is a very low security-risk as most servers that provide user logins...

Mandrake Linux Security Advisory : esound (MDKSA-2000:051)

A problem exists with the esound daemon, which is used in GNOME and responsible for multiplexing access to audio devices. Versions of esound prior to and including 0.2.19 create a world-writable directory in /tmp called .esd which is owned by the user running esound. This directory is used to sto...

Mandrake Linux Security Advisory : mod_php3 (MDKSA-2000:048)

"A problem exists with PHP3 and PHP4 scripts regarding RFC 1867-based file uploads. PHP saves uploaded files in a temporary directory on the server, using a temporary name that is referenced as the variable $FOO where 'FOO' is the name of the file input tag in the submitted form. Many PHP scripts...