Mandriva Linux Security Advisory : xine-lib (MDVSA-2008:046-1)

An array index vulnerability found in the FLAC audio demuxer might allow remote attackers to execute arbitrary code via a crafted FLAC tag, which triggers a buffer overflow. Although originally an MPlayer issue, it also affects xine-lib due to code similarity. The updated packages have been patch...

Mandriva Linux Security Advisory : mozilla-firefox (MDVSA-2008:080)

A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox program, version 2.0.0.13. This update provides the latest Firefox to correct these issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Mandriva Linux Security Advisory : gnome-screensaver (MDVSA-2008:132)

A vulnerability was found in gnome-screensaver prior to 2.22.1 when a remote authentication server was enabled. During a network outage, gnome-screensaver would crash upon an unlock attempt, allowing physically local users to gain access to locked sessions CVE-2008-0887. The updated packages have...

Mandriva Linux Security Advisory : audacity (MDVSA-2008:074)

Audacity creates a temporary directory with a predictable name without checking for previous existence of that directory, which allows local users to cause a denial of service recording deadlock by creating the directory before Audacity is run. This issue can also be leveraged to delete arbitrary...

Mandriva Linux Security Advisory : pam_krb5 (MDVSA-2008:209-1)

Stphane Bertin discovered a flaw in the pamkrb5 existingticket configuration option where, if enabled and using an existing credential cache, it was possible for a local user to gain elevated privileges by using a different, local user's credential cache CVE-2008-3825. The updated packages have...

Mandriva Linux Security Advisory : dovecot (MDVSA-2008:232)

The ACL plugin in dovecot prior to version 1.1.4 treated negative access rights as though they were positive access rights, which allowed attackers to bypass intended access restrictions CVE-2008-4577. The ACL plugin in dovecot prior to version 1.1.4 allowed attackers to bypass intended access...

Mandriva Linux Security Advisory : firefox (MDVSA-2009:044)

Security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox 3.x, version 3.0.5 CVE-2009-0352, CVE-2009-0353, CVE-2009-0354, CVE-2009-0355, CVE-2009-0356, CVE-2009-0357, CVE-2009-0358. This update provides the latest Mozilla Firefox 3.x to correct these issues. As...

Mandriva Linux Security Advisory : blender (MDVSA-2009:038-1)

Python has a variable called sys.path that contains all paths where Python loads modules by using import scripting procedure. A wrong handling of that variable enables local attackers to execute arbitrary code via Python scripting in the current Blender working directory CVE-2008-4863. This updat...

Mandriva Linux Security Advisory : mozilla-thunderbird (MDVSA-2008:235)

A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Thunderbird program, version 2.0.0.18 CVE-2008-5012, CVE-2008-5014, CVE-2008-5016, CVE-2008-5017, CVE-2008-5018, CVE-2008-5021, CVE-2008-5022, CVE-2008-5024, CVE-2008-5052. This update provides the lates...

Mandriva Linux Security Advisory : mailman (MDVSA-2008:061)

Multiple cross-site scripting XSS vulnerabilities were found in Mailman prior to version 2.1.10b1, which allow remote attackers to inject arbitrary web script or HTML via edting templates and the list's info attribute in the web administrator interface. The updated packages have been patched to...

Mandriva Linux Security Advisory : kdelibs (MDVSA-2008:097)

A vulnerability was found in startkdeinit in KDE 3.5.5 through 3.5.9 where, if it was installed setuid root, it could allow local users to cause a denial of service or possibly execute arbitrary code CVE-2008-1671. By default, startkdeinit is not installed setuid root on Mandriva Linux, however...

Mandriva Linux Security Advisory : ffmpeg (MDVSA-2008:157)

A vulnerability was found in how ffmpeg handled STR file demuxing. If a user were tricked into processing a malicious STR file, a remote attacker could execute arbitrary code with user privileges via applications linked against ffmpeg CVE-2008-3162. The updated packages have been patched to corre...

Mandriva Linux Security Advisory : ffmpeg (MDVSA-2009:015)

Several vulnerabilities have been discovered in ffmpeg, related to the execution of DTS generation code CVE-2008-4866 and incorrect handling of DCAMAXFRAMESIZE value CVE-2008-4867. The updated packages have been patched to prevent this. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Mandriva Linux Security Advisory : libxml2 (MDVSA-2008:010)

A denial of service flaw was discovered by the Google Security Team in the way libxml2 processes malformed XML content. This flaw could cause the application to stop responding. The updated packages have been patched to correct this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Mandriva Linux Security Advisory : yelp (MDVSA-2008:175)

A format string vulnerability was discovered in yelp after version 2.19.90 and before 2.24 that could allow remote attackers to execute arbitrary code via format string specifiers in an invalid URI on the command-line or via URI helpers in Firefox, Evolution, or possibly other programs...

Mandriva Linux Security Advisory : mod_perl (MDVSA-2009:091-1)

A vulnerability has been found and corrected in modperl v1.x and v2.x : Cross-site scripting XSS vulnerability in Status.pm in Apache::Status and Apache2::Status in modperl1 and modperl2 for the Apache HTTP Server, when /perl-status is accessible, allows remote attackers to inject arbitrary web...

Mandriva Linux Security Advisory : policykit (MDVSA-2008:087)

A format string vulnerability in the grant helper, in PolicyKit 0.7 and earlier, allows attackers to cause a denial of service crash and possibly execute arbitrary code via format strings in a password. The updated package has been patched to correct this issue. %NASLMINLEVEL 70300 C Tenable...

Mandriva Linux Security Advisory : python-pycrypto (MDVSA-2009:050-1)

A vulnerability have been discovered and corrected in PyCrypto ARC2 module 2.0.1, which allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large ARC2 key length CVE-2009-0544. The updated packages have been patched to prevent this. Update : The previous...

Mandriva Linux Security Advisory : dia (MDVSA-2009:040)

Python has a variable called sys.path that contains all paths where Python loads modules by using import scripting procedure. A wrong handling of that variable enables local attackers to execute arbitrary code via Python scripting in the current dia working directory CVE-2008-5984. This update...

Mandriva Linux Security Advisory : qemu (MDVSA-2009:008)

Security vulnerabilities have been discovered and corrected in VNC server of qemu version 0.9.1 and earlier, which could lead to denial-of-service attacks CVE-2008-2382, and make it easier for remote crackers to guess the VNC password CVE-2008-5714. The updated packages have been patched to preve...