Mandriva Linux Security Advisory : libxml2 (MDVSA-2012:126)

A vulnerability was found and corrected in libxml2 : Multiple integer overflows in libxml2, on 64-bit Linux platforms allow remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors CVE-2012-2807. The updated packages have been patched to correct...

Mandriva Linux Security Advisory : wireshark (MDVSA-2012:015)

Multiple file parser and NULL pointer vulnerabilities including a RLC dissector buffer overflow was found and corrected in Wireshark. This advisory provides the latest version of Wireshark 1.6.5 which is not vulnerable to these issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Mandriva Linux Security Advisory : python-sqlalchemy (MDVSA-2012:059)

It was discovered that SQLAlchemy did not sanitize values for the limit and offset keywords for SQL select statements. If an application using SQLAlchemy accepted values for these keywords, and did not filter or sanitize them before passing them to SQLAlchemy, it could allow an attacker to perfor...

Mandriva Linux Security Advisory : usbmuxd (MDVSA-2012:133)

It was discovered that usbmuxd did not correctly perform bounds checking when processing the SerialNumber field of USB devices. An attacker with physical access could use this to crash usbmuxd or potentially execute arbitrary code as the 'usbmux' user CVE-2012-0065. The updated packages have been...

Mandriva Linux Security Advisory : wireshark (MDVSA-2011:164)

This advisory updates wireshark to the latest version 1.6.3, fixing several security issues : An uninitialized variable in the CSN.1 dissector could cause a crash CVE-2011-4100. Huzaifa Sidhpurwala of Red Hat Security Response Team discovered that the Infiniband dissector could dereference a NULL...

Mandriva Linux Security Advisory : mono (MDVSA-2012:140)

A vulnerability has been discovered and corrected in mono : Cross-site scripting XSS vulnerability in the ProcessRequest function in mcs/class/System.Web/System.Web/HttpForbiddenHandler.cs in Mono 2.10.8 and earlier allows remote attackers to inject arbitrary web script or HTML via a file with a...

Mandriva Linux Security Advisory : perl-DBD-Pg (MDVSA-2012:112)

A vulnerability has been discovered and corrected in perl-DBD-Pg : Two format string flaws were found in the way perl-DBD-Pg. A rogue server could provide a specially crafted database warning or specially crafted DBD statement, which once processed by the perl-DBD-Pg interface would lead to...

Mandriva Linux Security Advisory : ffmpeg (MDVSA-2012:148)

Multiple vulnerabilities has been found and corrected in ffmpeg. This advisory provides updated versions which resolves various security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandriva Linux Security...

Mandriva Linux Security Advisory : busybox (MDVSA-2012:129-1)

Multiple vulnerabilities was found and corrected in busybox : The decompress function in ncompress allows remote attackers to cause a denial of service crash, and possibly execute arbitrary code, via crafted data that leads to a buffer underflow CVE-2006-1168. A missing DHCP option checking /...

Mandriva Linux Security Advisory : acpid (MDVSA-2012:137)

Multiple vulnerabilities has been discovered and corrected in acpid : Oliver-Tobias Ripka discovered that an ACPI script incorrectly handled power button events. A local attacker could use this to execute arbitrary code, and possibly escalate privileges CVE-2011-2777. Helmut Grohne and Michael...

Mandriva Linux Security Advisory : libotr (MDVSA-2012:131)

A vulnerability was found and corrected in libotr : Just Ferguson discovered that libotr, an off-the-record OTR messaging library, can be forced to perform zero-length allocations for heap buffers that are used in base64 decoding routines. An attacker can exploit this flaw by sending crafted...

Mandriva Linux Security Advisory : krb5 (MDVSA-2011:184)

A vulnerability has been discovered and corrected in krb5 : The processtgsreq function in dotgsreq.c in the Key Distribution Center KDC in MIT Kerberos 5 aka krb5 1.9 through 1.9.2 allows remote authenticated users to cause a denial of service NULL pointer dereference and daemon crash via a craft...

Mandriva Linux Security Advisory : krb5 (MDVSA-2011:159)

Multiple vulnerabilities has been found and corrected in krb5 : The kdbldap plugin in the Key Distribution Center KDC in MIT Kerberos 5 aka krb5 1.9 through 1.9.1, when the LDAP back end is used, allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a...

Mandriva Linux Security Advisory : wireshark (MDVSA-2012:134)

Multiple vulnerabilities was found and corrected in Wireshark : The DCP ETSI dissector could trigger a zero division CVE-2012-4285. The MongoDB dissector could go into a large loop CVE-2012-4287. The XTP dissector could go into an infinite loop CVE-2012-4288. The AFP dissector could go into a lar...

Mandriva Linux Security Advisory : automake (MDVSA-2012:103)

A vulnerability has been discovered and corrected in automake : A race condition in automake lib/am/distdir.am could allow a local attacker to run arbitrary code with the privileges of the user running make distcheck CVE-2012-3386. The updated packages have been patched to correct this issue...

Mandriva Linux Security Advisory : libjpeg-turbo (MDVSA-2012:121)

A vulnerability has been discovered and corrected in libjpeg-turbo : A Heap-based buffer overflow was found in the way libjpeg-turbo decompressed certain corrupt JPEG images in which the component count was erroneously set to a large value. An attacker could create a specially crafted JPEG image...

Mandriva Linux Security Advisory : squid (MDVSA-2011:193)

A vulnerability has been discovered and corrected in squid : The idnsGrokReply function in Squid before 3.1.16 does not properly free memory, which allows remote attackers to cause a denial of service daemon abort via a DNS reply containing a CNAME record that references another CNAME record that...

Mandriva Linux Security Advisory : glibc (MDVSA-2011:179)

Multiple vulnerabilities was discovered and fixed in glibc : The addmntent function in the GNU C Library aka glibc or libc6 2.13 and earlier does not report an error status for failed attempts to write to the /etc/mtab file, which makes it easier for local users to trigger corruption of this file...

Mandriva Linux Security Advisory : pidgin (MDVSA-2012:105)

A vulnerability has been discovered and corrected in pidgin : Incorrect handing of inline images in incoming instant messages can cause a buffer overflow and in some cases can be exploited to execute arbitrary code CVE-2012-3374. This update provides pidgin 2.10.6, which is not vulnerable to this...

Mandriva Linux Security Advisory : networkmanager (MDVSA-2011:171)

Security issues were identified and fixed in networkmanager : GNOME NetworkManager before 0.8.6 does not properly enforce the authadmin element in PolicyKit, which allows local users to bypass intended wireless network sharing restrictions via unspecified vectors CVE-2011-2176. Incomplete blackli...