Mandriva Linux Security Advisory : otrs (MDVSA-2013:112)

Updated otrs package fixes security vulnerabilities : Multiple cross-site scripting XSS vulnerabilities in Open Ticket Request System OTRS Help Desk 2.4.x before 2.4.13, 3.0.x before 3.0.15, and 3.1.x before 3.1.9, and OTRS ITSM 2.1.x before 2.1.5, 3.0.x before 3.0.6, and 3.1.x before 3.1.6, allo...

Mandriva Linux Security Advisory : argyllcms (MDVSA-2013:090)

A security issue was identified and fixed in argyllcms : An integer overflow flaw, leading to a heap-based buffer overflow, was found in Ghostscript's International Color Consortium Format library icclib. An attacker could create a specially crafted PostScript or PDF file with embedded images tha...

Mandriva Linux Security Advisory : fail2ban (MDVSA-2013:078)

Updated fail2ban package fixes security vulnerability : fail2ban before 0.8.8 didn't escape the content of \ if used in custom action files, which could cause issues on the system running fail2ban as it scans log files, depending on what content is matched, since that content could contain...

Mandriva Linux Security Advisory : quagga (MDVSA-2013:122)

Updated quagga package fixes security vulnerability : The bgpcapabilityorf function in bgpd in Quagga 0.99.20.1 and earlier allows remote attackers to cause a denial of service assertion failure and daemon exit by leveraging a BGP peering relationship and sending a malformed Outbound Route...

Mandriva Linux Security Advisory : bip (MDVSA-2013:063)

Updated bip package fixes security vulnerability : Buffer overflow in Bip 0.8.8 and earlier might allow remote authenticated users to execute arbitrary code via vectors involving a series of TCP connections that triggers use of many open file descriptors CVE-2012-0806. %NASLMINLEVEL 70300 C Tenab...

Mandriva Linux Security Advisory : cronie (MDVSA-2013:033)

Updated cronie package fixes the following issue : It was reported that cronie 1.4.8 would leak certain file descriptors. On systems where /etc/crontab is not world-readable this could be an information disclosure concern CVE-2012-6097. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Mandriva Linux Security Advisory : libxslt (MDVSA-2013:047)

A vulnerability has been discovered and corrected in libxslt : The XSL implementation in libxslt allows remote attackers to cause a denial of service incorrect read operation via unspecified vectors CVE-2012-2825. libxslt 1.1.26 and earlier does not properly manage memory, which might allow remot...

Mandriva Linux Security Advisory : weechat (MDVSA-2013:136)

Updated weechat packages fix security vulnerability : A buffer overflow is causing a crash or freeze of WeeChat 0.36 to 0.39 when decoding IRC colors in strings. The packages have been patched to fix this problem CVE-2012-5854. Untrusted command for function hookprocess in WeeChat before 0.3.9.2...

Mandriva Linux Security Advisory : apache-mod_security (MDVSA-2013:029)

A vulnerability has been discovered and corrected in apache-modsecurity : ModSecurity = 2.6.8 is vulnerable to multipart/invalid part ruleset bypass, this was fixed in 2.7.0 released on2012-10-16 CVE-2012-4528. The updated packages have been patched to correct this issue. NOTE: This advisory was...

Mandriva Linux Security Advisory : icecast (MDVSA-2013:091)

Updated icecast package fixes security vulnerability : Icecast didn't strip newlines from log entries, therefore allowing users to forge log entries CVE-2011-4612 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandri...

Mandriva Linux Security Advisory : courier-authlib (MDVSA-2013:068)

When using the authpgsql module and if the Postgres server goes down, authpgsql will start leaking memory. A packaging flaw was discovered that caused the courier-authlib-devel package to be installed when installing for example maildrop. This update fixes both of these issues. %NASLMINLEVEL 7030...

Mandriva Linux Security Advisory : freetype2 (MDVSA-2013:039)

Updated freetype2 packages fixes security vulnerabilities : A NULL pointer de-reference flaw was found in the way Freetype font rendering engine handled Glyph bitmap distribution format BDF fonts. A remote attacker could provide a specially crafted BDF font file, which once processed in an...

Mandriva Linux Security Advisory : openconnect (MDVSA-2013:108)

Updated openconnect packages fix security vulnerability : A stack-based buffer overflow flaw was found in the way OpenConnect, a client for Cisco's AnyConnect VPN, performed processing of certain host names, paths, or cookie lists, received from the VPN gateway. A remote VPN gateway could provide...

Mandriva Linux Security Advisory : dhcp (MDVSA-2013:059)

A security issue was identified and fixed in ISC DHCP : libdns in ISC DHCP 4.2.x before 4.2.5-P1 allows remote name servers to cause a denial of service memory consumption via vectors involving a regular expression, as demonstrated by a memory-exhaustion attack against a machine running a dhcpd...

Mandriva Linux Security Advisory : x11-driver-video-qxl (MDVSA-2013:138)

Updated x11-driver-video-qxl package fixes security vulnerability : A flaw was found in the way the host's qemu-kvm qxl driver and the guest's X.Org qxl driver interacted when a SPICE connection terminated. A user able to initiate a SPICE connection to a guest could use this flaw to make the gues...

Mandriva Linux Security Advisory : libytnef (MDVSA-2013:099)

Updated libytnef package fixes security vulnerability : Function DecompressRTF in libytnef 1.5 leads to a buffer overflow on certain TNEF files presumably, on files, generated by some recent versions of MS software. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Mandriva Linux Security Advisory : groff (MDVSA-2013:086)

Multiple vulnerabilities has been found and corrected in groff : contrib/pdfmark/pdfroff.sh in GNU troff aka groff before 1.21 allows local users to overwrite arbitrary files via a symlink attack on a pdf.tmp temporary file CVE-2009-5044. The 1 gendef.sh, 2 doc/fixinfo.sh, and 3...

Mandriva Linux Security Advisory : exif (MDVSA-2013:036)

A vulnerability has been discovered and corrected in exif : An integer overflow in the function jpegdataloaddata in the exif program could cause a data read beyond the end of a buffer, causing an application crash or leakage of potentially sensitive information when parsing a crafted JPEG file...

Mandriva Linux Security Advisory : keepalived (MDVSA-2013:096)

Updated keepalived package fixes security vulnerability : The pidfilewrite function in core/pidfile.c in keepalived 1.2.2 and earlier uses 0666 permissions for the 1 keepalived.pid, 2 checkers.pid, and 3 vrrp.pid files in /var/run/, which allows local users to kill arbitrary processes by writing ...

Mandriva Linux Security Advisory : qemu (MDVSA-2013:121)

Updated qemu packages fix security vulnerability : A flaw was found in how qemu, in snapshot mode -snapshot command line argument, handled the creation and opening of the temporary file used to store the difference of the virtualized guest's read-only image and the current state. In snapshot mode...