Mandriva Linux Security Advisory : gcc (MDVSA-2015:170)

Updated gcc packages fix the following security issue : Multiple integer overflow issues were found in libgfortran, the run-time support library for the Fortran compiler. These could possibly be used to crash a Fortran application or cause it to execute arbitrary code CVE-2014-5044. They also fix...

Mandriva Linux Security Advisory : libpng (MDVSA-2015:090)

Updated libpng package fixes security vulnerabilities : The pngpushreadchunk function in pngpread.c in the progressive decoder in libpng 1.6.x through 1.6.9 allows remote attackers to cause a denial of service infinite loop and CPU consumption via an IDAT chunk with a length of zero CVE-2014-0333...

Mandriva Linux Security Advisory : php (MDVSA-2015:080)

Multiple vulnerabilities has been discovered and corrected in php : It was discovered that the file utility contains a flaw in the handling of indirect magic rules in the libmagic library, which leads to an infinite recursion when trying to determine the file type of certain files CVE-2014-1943. ...

Mandriva Linux Security Advisory : libxfont (MDVSA-2015:145-1)

Updated libxfont packages fix security vulnerabilities : Ilja van Sprundel discovered that libXfont incorrectly handled font metadata file parsing. A local attacker could use this issue to cause libXfont to crash, or possibly execute arbitrary code in order to gain privileges CVE-2014-0209. Ilja...

Mandriva Linux Security Advisory : libarchive (MDVSA-2015:157)

Updated libarchive packages fix security vulnerability : Alexander Cherepanov discovered that bsdcpio, an implementation of the cpio program part of the libarchive project, is susceptible to a directory traversal vulnerability via absolute paths CVE-2015-2304. %NASLMINLEVEL 70300 C Tenable Networ...

Mandriva Linux Security Advisory : python-numpy (MDVSA-2015:077)

Updated python-numpy packages fix security vulnerabilities : f2py insecurely used a temporary file. A local attacker could use this flaw to perform a symbolic link attack to modify an arbitrary file accessible to the user running f2py CVE-2014-1858, CVE-2014-1859. %NASLMINLEVEL 70300 C Tenable...

Mandriva Linux Security Advisory : libksba (MDVSA-2015:151)

Updated libksba packages fix security vulnerability : By using special crafted S/MIME messages or ECC based OpenPGP data, it is possible to create a buffer overflow, which could lead to a denial of service CVE-2014-9087. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text an...

Mandriva Linux Security Advisory : libjpeg (MDVSA-2015:152)

Updated libjpeg packages fix security vulnerability : Passing a specially crafted jpeg file to libjpeg-turbo could lead to stack smashing CVE-2014-9092. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandriva Linux...

Mandriva Linux Security Advisory : cpio (MDVSA-2015:066)

Updated cpio package fixes security vulnerability : In GNU Cpio 2.11, the --no-absolute-filenames option limits extracting contents of an archive to be strictly inside a current directory. However, it can be bypassed with symlinks. While extracting an archive, it will extract symlinks and then...

Mandriva Linux Security Advisory : openldap (MDVSA-2015:074)

A vulnerability has been discovered and corrected in openldap : The derefparseCtrl function in servers/slapd/overlays/deref.c in OpenLDAP 2.4.13 through 2.4.40 allows remote attackers to cause a denial of service NULL pointer dereference and crash via an empty attribute list in a deref control in...

Mandriva Linux Security Advisory : libssh2 (MDVSA-2015:148-1)

Updated libssh2 packages fix security vulnerability : Mariusz Ziulek reported that libssh2, a SSH2 client-side library, was reading and using the SSHMSGKEXINIT packet without doing sufficient range checks when negotiating a new SSH session with a remote server. A malicious attacker could man in t...

Mandriva Linux Security Advisory : python3 (MDVSA-2015:076)

Updated python3 packages fix security vulnerabilities : ZipExtFile.read goes into 100% CPU infinite loop on maliciously binary edited zips CVE-2013-7338. A vulnerability was reported in Python's socket module, due to a boundary error within the sockrecvfrominto function, which could be exploited ...

Mandriva Linux Security Advisory : squid (MDVSA-2015:103)

Updated squid packages fix security vulnerabilities : Due to incorrect state management, Squid before 3.3.12 is vulnerable to a denial of service attack when processing certain HTTPS requests if the SSL-Bump feature is enabled CVE-2014-0128. Matthew Daley discovered that Squid 3 did not properly...

Mandriva Linux Security Advisory : jython (MDVSA-2015:158)

Updated jython packages fix security vulnerability : There are serveral problems with the way Jython creates class cache files, potentially leading to arbitrary code execution or information disclosure CVE-2013-2027. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Mandriva Linux Security Advisory : patch (MDVSA-2015:138)

Updated patch package fixes security vulnerabilities : It was reported that a crafted diff file can make patch eat memory and later segfault CVE-2014-9637. It was reported that the versions of the patch utility that support Git-style patches are vulnerable to a directory traversal flaw. This coul...

Mandriva Linux Security Advisory : ipython (MDVSA-2015:160)

Updated ipython package fixes security vulnerability : In IPython before 1.2, the origin of websocket requests was not verified within the IPython notebook server. If an attacker has knowledge of an IPython kernel id they can run arbitrary code on a user's machine when the client visits a crafted...

Mandriva Linux Security Advisory : openvpn (MDVSA-2015:139)

Updated openvpn packages fix security vulnerability : Dragana Damjanovic discovered that OpenVPN incorrectly handled certain control channel packets. An authenticated attacker could use this issue to cause an OpenVPN server to crash, resulting in a denial of service CVE-2014-8104. %NASLMINLEVEL...

Mandriva Linux Security Advisory : python-lxml (MDVSA-2015:112)

Updated python-lxml packages fix security vulnerability : The cleanhtml function, provided by the lxml.html.clean module, did not properly clean HTML input if it included non-printed characters \x01-\x08. A remote attacker could use this flaw to serve malicious content to an application using the...

Mandriva Linux Security Advisory : udisks2 (MDVSA-2015:088)

Updated udisks2 packages fixes security vulnerability : A flaw was found in the way udisks and udisks2 handled long path names. A malicious, local user could use this flaw to create a specially crafted directory structure that could lead to arbitrary code execution with the privileges of the udis...

Mandriva Linux Security Advisory : mpfr (MDVSA-2015:143)

Updated mpfr packages fix security vulnerability : A buffer overflow was reported in mpfr. This is due to incorrect GMP documentation for mpnsetstr about the size of a buffer CVE-2014-9474. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...