Mandriva Linux Security Advisory : php (MDVSA-2009:045)

A number of vulnerabilities have been found and corrected in PHP : improve mbflfiltconvhtmldecflush error handling in ext/mbstring/libmbfl/filters/mbfilterhtmlent.c CVE-2008-5557. Additionally on Mandriva Linux 2009.0 and up the php-mbstring module is linked against a separate shared libmbfl...

Mandriva Linux Security Advisory : clamav (MDVSA-2008:166)

An incomplete fix for CVE-2008-2713 resulted in remote attackers being able to cause a denial of service via a malformed Petite file that triggered an out-of-bounds memory access CVE-2008-3215. This issue is corrected with the 0.93.3 release which is being provided. %NASLMINLEVEL 70300 C Tenable...

Mandriva Linux Security Advisory : xine-lib (MDVSA-2008:124)

A vulnerability in the Speex library was found where it did not properly validate input values read from the Speex files headers. An attacker could create a malicious Speex file that would crash an application or potentially allow the execution of arbitrary code with the privileges of the...

Mandriva Linux Security Advisory : ruby (MDVSA-2008:029)

Ruby network libraries Net::HTTP, Net::IMAP, Net::FTPTLS, Net::Telnet, Net::POP3, and Net::SMTP, up to Ruby version 1.8.6 are affected by a possible man-in-the-middle attack, when using SSL, due to a missing check of the CN common name attribute in SSL certificates against the server's hostname...

Mandriva Linux Security Advisory : emacs (MDVSA-2008:034)

The hack-local-variable function in Emacs 22 prior to version 22.2, when enable-local-variables is set to ':safe', did not properly search lists of unsafe or risky variables, which could allow user-assisted attackers to bypass intended restrictions and modify critical program variables via a file...

Mandriva Linux Security Advisory : emacs (MDVSA-2008:216)

A vulnerability was found in how Emacs would import python scripts from the current working directory during the editing of a python file. This could allow a local user to execute arbitrary code via a trojan python file CVE-2008-3949. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Mandriva Linux Security Advisory : boost (MDVSA-2008:032)

Tavis Ormandy and Will Drewry found that the bost library did not properly perform input validation on regular expressions. An attacker could exploit this by sening a specially crafted regular expression to an application linked against boost and cause a denial of service via an application crash...

Mandriva Linux Security Advisory : openoffice.org (MDVSA-2008:137)

Integer overflow in the rtlallocateMemory function in sal/rtl/source/allocglobal.c in OpenOffice.org OOo 2.0 through 2.4 allows remote attackers to execute arbitrary code via a crafted file that triggers a heap-based buffer overflow. CVE-2008-2152 Also, according to bug 38874 decimal numbers on...

Mandriva Linux Security Advisory : libsoup (MDVSA-2009:081)

An integer overflow in libsoup Base64 encoding and decoding functions enables attackers either to cause denial of service and to execute arbitrary code CVE-2009-0585. This update provides the fix for that security issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text an...

Mandriva Linux Security Advisory : poppler (MDVSA-2009:068-1)

A crafted PDF file that triggers a parsing error allows remote attackers to cause definal of service. This bug is consequence of a wrong processing on FormWidgetChoice::loadDefaults method CVE-2009-0755. A crafted PDF file that triggers a parsing error allows remote attackers to cause definal of...

Mandriva Linux Security Advisory : ruby-gnome2 (MDVSA-2008:033)

A format string vulnerability in Ruby-GNOME 2 0.16.0, and SVN versions before 20071127, allows context-dependent attackers to execute arbitrary code via format string specifiers in the message parameter. The updated packages have been patched to prevent this issue. %NASLMINLEVEL 70300 C Tenable...

Mandriva Linux Security Advisory : mozilla-thunderbird (MDVSA-2008:047)

A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Thunderbird program, version 2.0.0.9. This update provides the latest Thunderbird to correct these issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

Mandriva Linux Security Advisory : wml (MDVSA-2008:076)

Two vulnerabilities were found in the Website META Language WML package that allowed local users to overwrite arbitrary files via symlink attacks. The updated packages have been patched to correct these issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Mandriva Linux Security Advisory : python (MDVSA-2009:003)

Multiple integer overflows in imageop.c in the imageop module in Python 1.5.2 through 2.5.1 allow context-dependent attackers to break out of the Python VM and execute arbitrary code via large integer values in certain arguments to the crop function, leading to a buffer overflow, a different...

Mandriva Linux Security Advisory : lynx (MDVSA-2008:218)

A vulnerability was found in the Lynxcgi: URI handler that could allow an attacker to create a web page redirecting to a malicious URL that would execute arbitrary code as the user running Lynx, if they were using the non-default Advanced user mode CVE-2008-4690. This update corrects these issues...

Mandriva Linux Security Advisory : gstreamer-plugins-good (MDVSA-2008:092)

A vulnerability in the Speex library was found where it did not properly validate input values read from the Speex files headers. An attacker could create a malicious Speex file that would crash an application or potentially allow the execution of arbitrary code with the privileges of the...

Mandriva Linux Security Advisory : cairo (MDVSA-2008:019)

Peter Valchev discovered that Cairo did not correctly decode PNG image data. By tricking a user or automated system into processing a specially crafted PNG with Cairo, a remote attacker could execute arbitrary code with the privileges of the user opening the file. The updated packages have been...

Mandriva Linux Security Advisory : metisse (MDVSA-2008:179)

An input validation flaw was found in X.org's MIT-SHM extension. A client connected to the X.org server could read arbitrary server memory, resulting in the disclosure of sensitive data of other users of the X.org server CVE-2008-1379. Multiple integer overflows were found in X.org's Render...

Mandriva Linux Security Advisory : perl-Net-DNS (MDVSA-2008:073)

A vulnerability in the Net::DNS perl module was found that could allow remote attackers to cause a denial of service via a crafted DNS response. The updated packages have been patched to correct this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package chec...

Mandriva Linux Security Advisory : mozilla-firefox (MDVSA-2008:110)

Security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox program, version 2.0.0.14. This update provides the latest Firefox to correct these issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...