Mandrake Linux Security Advisory : spamassassin (MDKSA-2007:125)

SpamAssassin 3.1.x, when running as root with unusual configuration options using vpopmail or virtual users, could allow local users to cause a denial of service via corrupting arbitrary files using a symlink attack on a file used by spamd. SpamAssassin 3.1.9, which corrects this flaw, is provide...

Mandrake Linux Security Advisory : libwmf (MDKSA-2007:123)

A flaw in libgd2 was found by Xavier Roche where it would not correctly validate PNG callback results. If an application linked against libgd2 was tricked into processing a specially crafted PNG file, it could cause a denial of service scenario via CPU resource consumption. Libwmf uses an embedde...

Mandrake Linux Security Advisory : mozilla-thunderbird (MDKSA-2007:119)

A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Thunderbird program, version 1.5.0.12. This update provides the latest Thunderbird to correct these issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

Mandrake Linux Security Advisory : mozilla-firefox (MDKSA-2007:120)

A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox program, version 1.5.0.12. This update provides the latest Firefox to correct these issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Mandrake Linux Security Advisory : freetype2 (MDKSA-2007:121)

An integer overflow vulnerability was discovered in the way the FreeType font engine processed TTF files. If a user were to load a special font file with a program linked against freetype, it could cause the application to crash or possibly execute arbitrary code as the user running the program...

Mandrake Linux Security Advisory : gd (MDKSA-2007:122)

A flaw in libgd2 was found by Xavier Roche where it would not correctly validate PNG callback results. If an application linked against libgd2 was tricked into processing a specially crafted PNG file, it could cause a denial of service scenario via CPU resource consumption. The updated packages...

Mandrake Linux Security Advisory : tetex (MDKSA-2007:124)

A flaw in libgd2 was found by Xavier Roche where it would not correctly validate PNG callback results. If an application linked against libgd2 was tricked into processing a specially crafted PNG file, it could cause a denial of service scenario via CPU resource consumption. Tetex uses an embedded...

Mandrake Linux Security Advisory : libexif (MDKSA-2007:118)

Integer overflow in the exifdataloaddataentry function in exif-data.c in libexif before 0.6.14 allows user-assisted remote attackers to cause a denial of service crash or possibly execute arbitrary code via crafted EXIF data. Updated packages have been patched to prevent this issue. %NASLMINLEVEL...

Mandrake Linux Security Advisory : libpng (MDKSA-2007:116)

A flaw how libpng handled malformed images was discovered. An attacker able to create a carefully crafted PNG image could cause an application linked with libpng to crash when the file was manipulated. The updated packages have been patched to correct this issue. %NASLMINLEVEL 70300 C Tenable...

Mandrake Linux Security Advisory : file (MDKSA-2007:114)

The update to correct CVE-2007-1536 MDKSA-2007:067, a buffer overflow in the fileprintf function, introduced a new integer overflow as reported by Colin Percival. This flaw, if an attacker could trick a user into running file on a specially crafted file, could possibly lead to the execution of...

Mandrake Linux Security Advisory : lha (MDKSA-2007:117)

lharc.c in lha does not securely create temporary files, which might allow local users to read or write files by creating a file before LHA is invoked. Updated packages have been patched to prevent this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Mandrake Linux Security Advisory : mutt (MDKSA-2007:113)

A flaw in the way mutt processed certain APOP authentication requests was discovered. By sending certain responses when mutt attempted to authenticate again an APOP server, a remote attacker could possibly obtain certain portions of the user's authentication credentials CVE-2007-1558. A flaw in h...

Mandrake Linux Security Advisory : mplayer (MDKSA-2007:112)

Buffer overflow in the asmrpeval function for the Real Media input plugin allows remote attackers to cause a denial of service and possibly execute arbitrary code via a rulebook with a large number of rulematches. Updated packages have been patched to correct this issue. %NASLMINLEVEL 70300 C...

Mandrake Linux Security Advisory : clamav (MDKSA-2007:115)

A vulnerability in the OLE2 parser in ClamAV was found that could allow a remote attacker to cause a denial of service via resource consumption with a carefully crafted OLE2 file. Other vulnerabilities and bugs have also been corrected in 0.90.3 which is being provided with this update...

Mandrake Linux Security Advisory : php-pear (MDKSA-2007:110)

A security hole was discovered in all versions of the PEAR Installer http://pear.php.net/PEAR. The security hole is the most serious hole found to date in the PEAR Installer, and would allow a malicious package to install files anywhere in the filesystem. The vulnerability only affects users who...

Mandrake Linux Security Advisory : util-linux (MDKSA-2007:111)

login in util-linux-2.12a and later versions skips pamacctmgmt and chauthtok when authentication is skipped, such as when a Kerberos krlogin session has been established, which might allow users to bypass intended access policies that would be enforced by pamacctmgmt and chauthtok. Updated packag...

OS Identification : Linux Distribution

This plugin attempts to identify the operating system type and version by looking at certain files on the remote operating system e.g., '/etc/redhat-release' on Red Hat. %NASLMINLEVEL 70300 C Tenable, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid25335;...

MDKA-2007:047 : x11-driver-video-sis

The sis video driver would crash during X.org startup, reporting that there were some undefined symbols asserts, resulting in the server aborting its execution. The updated driver corrects the problem by removing the references to assert. %NASLMINLEVEL 999999 @DEPRECATED@ This script has been...

Mandrake Linux Security Advisory : gimp (MDKSA-2007:108)

Marsu discovered a stack overflow issue in the GIMP's RAS file loader. An attacker could create a carefully crafted file that would cause the GIMP to crash or potentially execute arbitrary code as the user opening the file. The updated packages have been patched to prevent this issue. %NASLMINLEV...

MDKA-2007:040-1 : gnome-utils

The gnome-system-log viewer could crash when parsing certain log files. The provided updated packages correct this problem. Update: Packages are now available for Mandriva Linux 2007.0. %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a...