Mandriva Linux Security Advisory : python-sqlalchemy (MDVSA-2012:059)

It was discovered that SQLAlchemy did not sanitize values for the limit and offset keywords for SQL select statements. If an application using SQLAlchemy accepted values for these keywords, and did not filter or sanitize them before passing them to SQLAlchemy, it could allow an attacker to perfor...

Mandriva Linux Security Advisory : pidgin (MDVSA-2012:082)

Multiple vulnerabilities has been discovered and corrected in pidgin : A series of specially crafted file transfer requests can cause clients to reference invalid memory. The user must have accepted one of the file transfer requests CVE-2012-2214. Incoming messages with certain characters or...

Mandriva Linux Security Advisory : pidgin (MDVSA-2012:029)

Multiple vulnerabilities has been discovered and corrected in pidgin : The pidginconvchatrenameuser function in gtkconv.c in Pidgin before 2.10.2 allows remote attackers to cause a denial of service NULL pointer dereference and application crash by changing a nickname while in an XMPP chat room...

Mandriva Linux Security Advisory : usbmuxd (MDVSA-2012:133)

It was discovered that usbmuxd did not correctly perform bounds checking when processing the SerialNumber field of USB devices. An attacker with physical access could use this to crash usbmuxd or potentially execute arbitrary code as the 'usbmux' user CVE-2012-0065. The updated packages have been...

Mandriva Linux Security Advisory : perl-DBD-Pg (MDVSA-2012:112)

A vulnerability has been discovered and corrected in perl-DBD-Pg : Two format string flaws were found in the way perl-DBD-Pg. A rogue server could provide a specially crafted database warning or specially crafted DBD statement, which once processed by the perl-DBD-Pg interface would lead to...

Mandriva Linux Security Advisory : wireshark (MDVSA-2011:164)

This advisory updates wireshark to the latest version 1.6.3, fixing several security issues : An uninitialized variable in the CSN.1 dissector could cause a crash CVE-2011-4100. Huzaifa Sidhpurwala of Red Hat Security Response Team discovered that the Infiniband dissector could dereference a NULL...

Mandriva Linux Security Advisory : iproute2 (MDVSA-2011:135)

It was discovered that the iproute2 package was not rebuilt against the latest iptables libraries. This may have security issues, as the current iproute2 should be calling an interface in the iptables libraries with incorrect arguments. The updated packages have been patched to correct this issue...

Mandriva Linux Security Advisory : libxml2 (MDVSA-2012:126)

A vulnerability was found and corrected in libxml2 : Multiple integer overflows in libxml2, on 64-bit Linux platforms allow remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors CVE-2012-2807. The updated packages have been patched to correct...

Mandriva Linux Security Advisory : libreoffice (MDVSA-2012:091)

Security issues were identified and fixed in libreoffice : An integer overflow vulnerability in the libreoffice graphic loading code could allow a remote attacker to cause a denial of service application crash or potentially execute arbitrary code CVE-2012-1149. An integer overflow flaw, leading ...

Mandriva Linux Security Advisory : wireshark (MDVSA-2012:015)

Multiple file parser and NULL pointer vulnerabilities including a RLC dissector buffer overflow was found and corrected in Wireshark. This advisory provides the latest version of Wireshark 1.6.5 which is not vulnerable to these issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Mandriva Linux Security Advisory : mozilla (MDVSA-2011:192)

Security issues were identified and fixed in mozilla firefox and thunderbird : The SVG implementation in Mozilla Firefox 8.0, Thunderbird 8.0, and SeaMonkey 2.5 does not properly interact with DOMAttrModified event handlers, which allows remote attackers to cause a denial of service out-of-bounds...

Mandriva Linux Security Advisory : wireshark (MDVSA-2012:134)

Multiple vulnerabilities was found and corrected in Wireshark : The DCP ETSI dissector could trigger a zero division CVE-2012-4285. The MongoDB dissector could go into a large loop CVE-2012-4287. The XTP dissector could go into an infinite loop CVE-2012-4288. The AFP dissector could go into a lar...

Mandriva Linux Security Advisory : glibc (MDVSA-2011:179)

Multiple vulnerabilities was discovered and fixed in glibc : The addmntent function in the GNU C Library aka glibc or libc6 2.13 and earlier does not report an error status for failed attempts to write to the /etc/mtab file, which makes it easier for local users to trigger corruption of this file...

Mandriva Linux Security Advisory : python (MDVSA-2012:097)

Multiple vulnerabilities has been discovered and corrected in python : The ssl module would always disable the CBC IV attack countermeasure CVE-2011-3389. A race condition was found in the way the Python distutils module set file permissions during the creation of the .pypirc file. If a local use...

Mandriva Linux Security Advisory : krb5 (MDVSA-2011:184)

A vulnerability has been discovered and corrected in krb5 : The processtgsreq function in dotgsreq.c in the Key Distribution Center KDC in MIT Kerberos 5 aka krb5 1.9 through 1.9.2 allows remote authenticated users to cause a denial of service NULL pointer dereference and daemon crash via a craft...

Mandriva Linux Security Advisory : bind (MDVSA-2012:119)

A vulnerability was discovered and corrected in bind : High numbers of queries with DNSSEC validation enabled can cause an assertion failure in named, caused by using a bad cache data structure before it has been initialized CVE-2012-3817. The updated packages have been upgraded to bind 9.7.6-P2...

Mandriva Linux Security Advisory : libjpeg-turbo (MDVSA-2012:121)

A vulnerability has been discovered and corrected in libjpeg-turbo : A Heap-based buffer overflow was found in the way libjpeg-turbo decompressed certain corrupt JPEG images in which the component count was erroneously set to a large value. An attacker could create a specially crafted JPEG image...

Mandriva Update for ffmpeg MDVSA-2012:148 (ffmpeg)

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Mandriva Update for ffmpeg MDVSA-2012:148 (ffmpeg)

Check for the Version of ffmpeg OpenVAS Vulnerability Test Mandriva Update for ffmpeg MDVSA-2012:148 ffmpeg Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under t...

Mandriva Update for fetchmail MDVSA-2012:149 (fetchmail)

Check for the Version of fetchmail OpenVAS Vulnerability Test Mandriva Update for fetchmail MDVSA-2012:149 fetchmail Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify i...