Mandriva Linux Security Advisory : json-c (MDVSA-2015:102)

Updated json-c packages fix security vulnerabilities : Florian Weimer reported that the printbuf APIs used in the json-c library used ints for counting buffer lengths, which is inappropriate for 32bit architectures. These functions need to be changed to using sizet if possible for sizes, or to be...

Mandriva Linux Security Advisory : rsync (MDVSA-2015:131)

Updated rsync package fixes security vulnerability : Ryan Finnie discovered that rsync 3.1.0 contains a denial of service issue when attempting to authenticate using a nonexistent username. A remote attacker could use this flaw to cause a denial of service via CPU consumption CVE-2014-2855...

Mandriva Linux Security Advisory : sendmail (MDVSA-2015:128)

Updated sendmail packages fix security vulnerability : Sendmail before 8.14.9 does not properly closing file descriptors before executing programs. This bug could enable local users to interfere with an open SMTP connection if they can execute their own program for mail delivery e.g., via procmai...

Mandriva Linux Security Advisory : pcre (MDVSA-2015:137)

Updated pcre packages fix security vulnerability : A flaw was found in the way PCRE handled certain malformed regular expressions. This issue could cause an application linked against PCRE to crash while parsing malicious regular expressions CVE-2014-8964. %NASLMINLEVEL 70300 C Tenable Network...

Mandriva Linux Security Advisory : gnutls (MDVSA-2015:072)

Updated gnutls packages fix security vulnerabilities : Suman Jana reported a vulnerability that affects the certificate verification functions of gnutls 3.1.x and gnutls 3.2.x. A version 1 intermediate certificate will be considered as a CA certificate by default something that deviates from the...

Mandriva Linux Security Advisory : e2fsprogs (MDVSA-2015:067)

Updated e2fsprogs packages fix security vulnerabilities : The libext2fs library, part of e2fsprogs and utilized by its utilities, is affected by a boundary check error on block group descriptor information, leading to a heap based buffer overflow. A specially crafted filesystem image can be used ...

Mandriva Linux Security Advisory : nginx (MDVSA-2015:094)

Updated nginx package fixes security vulnerabilities : A bug in the experimental SPDY implementation in nginx was found, which might allow an attacker to cause a heap memory buffer overflow in a worker process by using a specially crafted request, potentially resulting in arbitrary code execution...

Mandriva Linux Security Advisory : libssh (MDVSA-2015:086)

Updated libssh packages fix security vulnerabilities : When using libssh before 0.6.3, a libssh-based server, when accepting a new connection, forks and the child process handles the request. The RANDbytes function of openssl doesn't reset its state after the fork, but simply adds the current...

Mandriva Linux Security Advisory : rsyslog (MDVSA-2015:130)

Updated rsyslog packages fix security vulnerability : Rainer Gerhards, the rsyslog project leader, reported a vulnerability in Rsyslog. As a consequence of this vulnerability an attacker can send malformed messages to a server, if this one accepts data from untrusted sources, and trigger a denial...

Mandriva Linux Security Advisory : libtasn1 (MDVSA-2015:116)

Updated libtasn1 packages fix security vulnerabilities : Multiple buffer boundary check issues were discovered in libtasn1 library, causing it to read beyond the boundary of an allocated buffer. An untrusted ASN.1 input could cause an application using the library to crash CVE-2014-3467. It was...

Mandriva Linux Security Advisory : gtk+3.0 (MDVSA-2015:162)

Updated gtk+3.0 packages fix security vulnerability : Clemens Fries reported that, when using Cinnamon, it was possible to bypass the screensaver lock. An attacker with physical access to the machine could use this flaw to take over the locked desktop session CVE-2014-1949. This was fixed by...

Mandriva Linux Security Advisory : ruby (MDVSA-2015:129)

Updated ruby packages fix security vulnerabilities : Due to unrestricted entity expansion, when reading text nodes from an XML document, the REXML parser in Ruby can be coerced into allocating extremely large string objects which can consume all of the memory on a machine, causing a denial of...

Mandriva Linux Security Advisory : xlockmore (MDVSA-2015:118)

Updated xlockmore packages fix security vulnerability : xlockmore before 5.45 contains a security flaw related to a bad value of fnt for pyro2 which could cause an X error. This update backports the fix for version 5.43. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text an...

Mandriva Linux Security Advisory : dovecot (MDVSA-2015:113)

Updated dovecot packages fix security vulnerability. Dovecot before 2.2.13 is vulnerable to a DoS attack against imap/pop3-login processes. If SSL/TLS handshake was started but wasn't finished, the login process attempted to eventually forcibly disconnect the client, but failed to do it correctly...

Mandriva Linux Security Advisory : icu (MDVSA-2015:161-1)

Updated icu packages fix security vulnerabilities : The Regular Expressions package in International Components for Unicode ICU 52 before SVN revision 292944 allows remote attackers to cause a denial of service memory corruption or possibly have unspecified other impact via vectors related to a...

Mandriva Linux Security Advisory : jbigkit (MDVSA-2015:101)

Updated jbigkit packages fix security vulnerability : Florian Weimer found a stack-based buffer overflow flaw in the libjbig library part of jbigkit. A specially crafted image file read by libjbig could be used to cause a program linked to libjbig to crash or, potentially, to execute arbitrary co...

Mandriva Linux Security Advisory : e2fsprogs (MDVSA-2015:068)

Updated e2fsprogs packages fix security vulnerability : The libext2fs library, part of e2fsprogs and utilized by its utilities, is affected by a boundary check error on block group descriptor information, leading to a heap based buffer overflow. A specially crafted filesystem image can be used to...

Mandriva Linux Security Advisory : ppp (MDVSA-2015:135)

Updated ppp packages fix security vulnerability : A vulnerability in ppp before 2.4.7 may enable an unprivileged attacker to access privileged options CVE-2014-3158. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

Mandriva Linux Security Advisory : torque (MDVSA-2015:124)

Updated torque packages fix security vulnerabilities : Chad Vizino reported that within a TORQUE Resource Manager job a non-root user could use a vulnerability in the tmadopt library call to kill processes he/she doesn't own including root-owned ones on any node in a job CVE-2014-3684. This updat...

Mandriva Linux Security Advisory : cups (MDVSA-2015:108)

Updated cups packages fix security vulnerabilities : Cross-site scripting XSS vulnerability in scheduler/client.c in Common Unix Printing System CUPS before 1.7.2 allows remote attackers to inject arbitrary web script or HTML via the URL path, related to the ispathabsolute function CVE-2014-2856...