Mandriva Linux Security Advisory : clamav (MDVSA-2015:221)

Multiple vulnerabilities has been found and corrected in clamav : Fix infinite loop condition on crafted y0da cryptor file. Identified and patch suggested by Sebastian Andrzej Siewior CVE-2015-2221. Fix crash on crafted petite packed file. Reported and patch supplied by Sebastian Andrzej Siewior...

[ MDVSA-2015:223 ] directfb

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:223 http://www.mandriva.com/en/support/security/ Package : directfb Date : May 4, 2015 Affected: Business Server 1.0, Business Server 2.0 Problem Description: Updated directfb packages fix security...

[ MDVSA-2015:220 ] curl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:220 http://www.mandriva.com/en/support/security/ Package : curl Date : May 4, 2015 Affected: Business Server 1.0 Problem Description: Updated curl packages fix security vulnerabilities: NTLM-authenticated...

Mandriva Linux Security Advisory : glibc (MDVSA-2015:218)

Multiple vulnerabilities has been found and corrected in glibc : It was discovered that, under certain circumstances, glibc's getaddrinfo\ function would send DNS queries to random file descriptors. An attacker could potentially use this flaw to send DNS queries to unintended recipients, resultin...

Mandriva Linux Security Advisory : sqlite3 (MDVSA-2015:217)

Multiple vulnerabilities has been found and corrected in sqlite3 : SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-dependent attackers to cause a denial of service uninitialized memory access and application crash or possibly have...

Mandriva Linux Security Advisory : t1utils (MDVSA-2015:215)

Updated t1utils package fixes security vulnerabilities : The t1utils package has been updated to version 1.39, which fixes a buffer overrun, infinite loop, and stack overflow in t1disasm. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

Mandriva Linux Security Advisory : ntop (MDVSA-2015:216)

Updated ntop package fixes security vulnerability : Lack of filtering in the title parameter of links to rrdPlugin allowed cross-site-scripting XSS attacks against users of the web interface CVE-2014-4165. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package check...

Mandriva Linux Security Advisory : lftp (MDVSA-2015:213)

Updated lftp packages fix security vulnerability : lftp incorrectly validates wildcard SSL certificates containing literal IP addresses, so under certain conditions, it would allow and use a wildcard match specified in the CN field, allowing a malicious server to participate in a MITM attack or...

Mandriva Linux Security Advisory : java-1.7.0-openjdk (MDVSA-2015:212)

Updated java-1.7.0 packages fix security vulnerabilities : An off-by-one flaw, leading to a buffer overflow, was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could possibly cause the Java Virtual Machine to execute arbitrary code, allowing an...

Mandriva Linux Security Advisory : perl-Module-Signature (MDVSA-2015:207)

Updated perl-Module-Signature package fixes the following security vulnerabilities reported by John Lightsey : Module::Signature could be tricked into interpreting the unsigned portion of a SIGNATURE file as the signed portion due to faulty parsing of the PGP signature boundaries. When verifying...

Mandriva Linux Security Advisory : asterisk (MDVSA-2015:206)

Updated asterisk packages fix security vulnerability : When Asterisk registers to a SIP TLS device and and verifies the server, Asterisk will accept signed certificates that match a common name other than the one Asterisk is expecting if the signed certificate has a common name containing a null...

Mandriva Linux Security Advisory : glusterfs (MDVSA-2015:211)

Updated glusterfs packages fix security vulnerability : glusterfs was vulnerable to a fragment header infinite loop denial of service attack CVE-2014-3619. Also, the glusterfsd SysV init script was failing to properly start the service. This was fixed by replacing it with systemd unit files for t...

Mandriva Linux Security Advisory : tor (MDVSA-2015:205)

Updated tor packages fix security vulnerabilities : disgleirio discovered that a malicious client could trigger an assertion failure in a Tor instance providing a hidden service, thus rendering the service inaccessible CVE-2015-2928. DonnchaC discovered that Tor clients would crash with an...

Mandriva Linux Security Advisory : qemu (MDVSA-2015:210)

Updated qemu packages fix security vulnerabilities : A denial of service flaw was found in the way QEMU handled malformed Physical Region Descriptor Table PRDT data sent to the host's IDE and/or AHCI controller emulation. A privileged guest user could use this flaw to crash the system rhbz1204919...

Mandriva Linux Security Advisory : setup (MDVSA-2015:208)

Updated setup package fixes security vulnerability : An issue has been identified in Mandriva Business Server 2's setup package where the /etc/shadow and /etc/gshadow files containing password hashes were created with incorrect permissions, making them world-readable mga14516. This update fixes...

[ MDVSA-2015:077 ] python-numpy

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:077 http://www.mandriva.com/en/support/security/ Package : python-numpy Date : March 27, 2015 Affected: Business Server 2.0 Problem Description: Updated python-numpy packages fix security vulnerabilities: f2...

[ MDVSA-2015:114 ] cifs-utils

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:114 http://www.mandriva.com/en/support/security/ Package : cifs-utils Date : March 29, 2015 Affected: Business Server 2.0 Problem Description: Updated cifs-utils packages fix security vulnerability: Sebastia...

[ MDVSA-2015:141 ] not-yet-commons-ssl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:141 http://www.mandriva.com/en/support/security/ Package : not-yet-commons-ssl Date : March 29, 2015 Affected: Business Server 2.0 Problem Description: Updated not-yet-commons-ssl packages fixes security...

[ MDVSA-2015:134 ] pulseaudio

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:134 http://www.mandriva.com/en/support/security/ Package : pulseaudio Date : March 29, 2015 Affected: Business Server 2.0 Problem Description: Updated pulseaudio package fixes RTP remote crash vulnerability:...

[ MDVSA-2015:177 ] ctdb

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:177 http://www.mandriva.com/en/support/security/ Package : ctdb Date : March 30, 2015 Affected: Business Server 2.0 Problem Description: Updated ctdb packages fix security vulnerability: ctdb before 2.5 is...