Mandriva Linux Security Advisory : libxslt (MDVSA-2013:047)

A vulnerability has been discovered and corrected in libxslt : The XSL implementation in libxslt allows remote attackers to cause a denial of service incorrect read operation via unspecified vectors CVE-2012-2825. libxslt 1.1.26 and earlier does not properly manage memory, which might allow remot...

Mandriva Linux Security Advisory : phpmyadmin (MDVSA-2013:144)

Multiple cross-site scripting XSS vulnerabilities in tblgisvisualization.php in phpMyAdmin 3.5.x before 3.5.8 might allow remote attackers to inject arbitrary web script or HTML via the 1 visualizationSettingswidth or 2 visualizationSettingsheight parameter CVE-2013-1937. This upgrade provides th...

Mandriva Linux Security Advisory : accountsservice (MDVSA-2013:060)

Updated accountsservice packages fix security vulnerability : Florian Weimer discovered that AccountsService incorrectly handled privileges when copying certain files to the system cache directory. A local attacker could exploit this issue to read arbitrary files, bypassing intended permissions...

Mandriva Linux Security Advisory : openssl (MDVSA-2013:052)

Multiple vulnerabilities has been found and corrected in openssl : OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1 before 1.0.1d does not properly perform signature verification for OCSP responses, which allows remote attackers to cause a denial of service NULL pointer dereference and...

Mandriva Linux Security Advisory : asterisk (MDVSA-2013:140)

Multiple vulnerablilities was identified and fixed in asterisk : The SIP channel driver in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15 before 1.8.15-cert2; Asterisk Business Edition BE C.3.x before C.3.8.1; and Asterisk...

Mandriva Linux Security Advisory : openconnect (MDVSA-2013:108)

Updated openconnect packages fix security vulnerability : A stack-based buffer overflow flaw was found in the way OpenConnect, a client for Cisco's AnyConnect VPN, performed processing of certain host names, paths, or cookie lists, received from the VPN gateway. A remote VPN gateway could provide...

Mandriva Linux Security Advisory : libxslt (MDVSA-2013:141)

Updated libxslt packages fix security vulnerability : Nicholas Gregoire discovered that libxslt incorrectly handled certain empty values. If a user or automated system were tricked into processing a specially crafted XSLT document, a remote attacker could cause libxslt to crash, causing a denial ...

Mandriva Linux Security Advisory : squashfs-tools (MDVSA-2013:128)

Updated squashfs-tools packages fix security vulnerabilities : remote arbitrary code execution via crafted list file CVE-2012-4024. integer overflow in queueinit may lead to arbitrary code execution CVE-2012-4025. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and packa...

Mandriva Linux Security Advisory : glib2.0 (MDVSA-2013:083)

Updated glib2.0 packages fix security vulnerability : It was discovered that the version of glib shipped with MBS 1 does not sanitise certain DBUS related environment variables. When used in combination with a setuid application which utilises dbus via glib, a local user could gain escalated...

Mandriva Linux Security Advisory : dhcp (MDVSA-2013:059)

A security issue was identified and fixed in ISC DHCP : libdns in ISC DHCP 4.2.x before 4.2.5-P1 allows remote name servers to cause a denial of service memory consumption via vectors involving a regular expression, as demonstrated by a memory-exhaustion attack against a machine running a dhcpd...

Mandriva Linux Security Advisory : ettercap (MDVSA-2013:077)

Updated ettercap package fixes security vulnerability : The GTK version of ettercap uses a global settings file at /tmp/.ettercapgtk and does not verify ownership of this file. When parsing this file for settings in gtkuiconfread\ src/interfaces/gtk/ecgtkconf.c, an unchecked sscanf\ call allows a...

Mandriva Linux Security Advisory : viewvc (MDVSA-2013:134)

Updated viewvc packages fix security vulnerabilities : complete authz support for remote SVN views CVE-2012-3356. log msg leak in SVN revision view with unreadable copy source CVE-2012-3357. function name lines returned by diff are not properly escaped, allowing attackers with commit access to...

Mandriva Linux Security Advisory : gimp (MDVSA-2013:082)

Updated gimp packages fix security vulnerabilities : An integer overflow flaw, leading to a heap-based buffer overflow, was found in the GIMP's GIF image format plug-in. An attacker could create a specially crafted GIF image file that, when opened, could cause the GIF plug-in to crash or,...

Mandriva Linux Security Advisory : pixman (MDVSA-2013:116)

Updated pixman packages fix security vulnerability : Stack-based buffer overflow in libpixman has unspecified impact and attack vectors CVE-2013-1591. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandriva Linux...

Mandriva Linux Security Advisory : rpmdevtools (MDVSA-2013:123)

Updated rpmdevtools package fixes security vulnerability : A TOCTOU race condition was found in the way 'annotate-output' used to execute a program annotating the output linewise with time and stream tool of rpmdevtools before 8.3 performed management of its temporary files used for standard outp...

Mandriva Linux Security Advisory : freeradius (MDVSA-2013:038)

Updated freeradius packages fixes security vulnerabilities : It was found that the unix module ignored the password expiration setting in /etc/shadow. If FreeRADIUS was configured to use this module for user authentication, this flaw could allow users with an expired password to successfully...

Mandriva Linux Security Advisory : libupnp (MDVSA-2013:098)

Updated libupnp packages fix security vulnerabilities : The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet...

Mandriva Linux Security Advisory : sleuthkit (MDVSA-2013:125)

Updated sleuthkit packages fix security vulnerabilities : A security flaw was found in the way the Sleuth Kit TSK, a collection of UNIX-based command line tools allowing to investigate a computer, performed management of '.' dotfile file system entry. An attacker could use this flaw to evade...

Mandriva Linux Security Advisory : stunnel (MDVSA-2013:130)

Updated stunnel packages fix security vulnerability : stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not correctly perform integer conversion, which allows remote proxy servers to execute arbitrary code via a crafted request that triggers a...

Mandriva Linux Security Advisory : mesa (MDVSA-2013:103)

Updated mesa packages fix security vulnerability : The glsl shaders are vulnerable to a buffer overrun in parceloutuniformstorage::visitfield. When too many uniforms are used, the error will now be caught in checkresources src/glsl/linker.cpp CVE-2012-2864. Additionally, Mesa has been updated to...