Mandriva Linux Security Advisory : perl-Plack (MDVSA-2014:235)

Updated perl-Plack package fixes security vulnerability : Plack::App::File would previously strip trailing slashes off provided paths. This in combination with the common pattern of serving files with Plack::Middleware::Static could allow an attacker to bypass a whitelist of generated files...

Mandriva Linux Security Advisory : file (MDVSA-2014:236)

Updated file packages fix security vulnerability : An out-of-bounds read flaw was found in file's donote function in the way the file utility determined the note headers of a elf file. This could possibly lead to file executable crash CVE-2014-3710. %NASLMINLEVEL 70300 C Tenable Network Security,...

Mandriva Linux Security Advisory : glibc (MDVSA-2014:232)

Updated glibc package fixes security vulnerability : The function wordexp\ fails to properly handle the WRDENOCMD flag when processing arithmetic inputs in the form of $... where ... can be anything valid. The backticks in the arithmetic epxression are evaluated by in a shell even if WRDENOCMD...

Mandriva Linux Security Advisory : icecast (MDVSA-2014:231)

Updated icecast package fixes security vulnerability : Icecast did not properly handle the launching of scripts on connect or disconnect of sources. This could result in sensitive information from these scripts leaking to external clients CVE-2014-9018. %NASLMINLEVEL 70300 C Tenable Network...

Mandriva Linux Security Advisory : wordpress (MDVSA-2014:233)

Updated wordpress package fixes security vulnerabilities : XSS in wptexturize via comments or posts, exploitable for unauthenticated users CVE-2014-9031. XSS in media playlists CVE-2014-9032. CSRF in the password reset process CVE-2014-9033. Denial of service for giant passwords. The phpass libra...

Mandriva Linux Security Advisory : phpmyadmin (MDVSA-2014:228)

Multiple vulnerabilities has been discovered and corrected in phpmyadmin : - Multiple XSS vulnerabilities CVE-2014-8958. - Local file inclusion vulnerability CVE-2014-8959. - XSS vulnerability in error reporting functionality CVE-2014-8960. - Leakage of line count of an arbitrary file...

Mandriva Linux Security Advisory : imagemagick (MDVSA-2014:226)

Updated imagemagick packages fix security vulnerabilities : ImageMagick is vulnerable to a denial of service due to out-of-bounds memory accesses in the resize code CVE-2014-8354, PCX parser CVE-2014-8355, DCM decoder CVE-2014-8562, and JPEG decoder CVE-2014-8716. %NASLMINLEVEL 70300 C Tenable...

[ MDVSA-2014:223 ] wireshark

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:223 http://www.mandriva.com/en/support/security/ Package : wireshark Date : November 21, 2014 Affected: Business Server 1.0 Problem Description: Updated wireshark packages fix security vulnerabilities: SigCo...

[ MDVSA-2014:215 ] gnutls

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:215 http://www.mandriva.com/en/support/security/ Package : gnutls Date : November 19, 2014 Affected: Business Server 1.0 Problem Description: Updated gnutls package fix security vulnerability: An out-of-boun...

Mandriva Linux Security Advisory : wireshark (MDVSA-2014:223)

Updated wireshark packages fix security vulnerabilities : SigComp UDVM buffer overflow CVE-2014-8710. AMQP crash CVE-2014-8711. NCP crashes CVE-2014-8712, CVE-2014-8713. TN5250 infinite loops CVE-2014-8714. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package chec...

Mandriva Linux Security Advisory : libvirt (MDVSA-2014:222)

Updated libvirt packages fix security vulnerability : Eric Blake discovered that libvirt incorrectly handled permissions when processing the qemuDomainFormatXML command. An attacker with read-only privileges could possibly use this to gain access to certain information from the domain xml file...

Mandriva Linux Security Advisory : php-smarty (MDVSA-2014:221)

An XSS vulnerability in the SmartyException class in Smarty aka smarty-php before 3.1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors that trigger a Smarty exception CVE-2012-4437. Smarty before 3.1.21 allows remote attackers to bypass the secure mode...

[ MDVSA-2014:213 ] curl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:213 http://www.mandriva.com/en/support/security/ Package : curl Date : November 18, 2014 Affected: Business Server 1.0 Problem Description: Updated curl packages fix security vulnerability: Symeon Paraschoud...

Mandriva Linux Security Advisory : krb5 (MDVSA-2014:224)

Updated krb5 packages fix security vulnerability : The kadm5randkeyprincipal3 function in lib/kadm5/srv/svrprincipal.c in kadmind in MIT Kerberos 5 aka krb5 before 1.13 sends old keys in a response to a -randkey -keepold request, which allows remote authenticated users to forge tickets by...

Mandriva Linux Security Advisory : srtp (MDVSA-2014:219)

Updated srtp package fixes security vulnerability : Fernando Russ from Groundworks Technologies reported a buffer overflow flaw in srtp, Cisco's reference implementation of the Secure Real-time Transport Protocol SRTP, in how the cryptopolicysetfromprofileforrtp function applies cryptographic...

Mandriva Linux Security Advisory : clamav (MDVSA-2014:217)

ClamAV 0.98.5 addresses several reported potential security bugs. Certain JavaScript files causes ClamAV to segfault when scanned with the -a list archived files CVE-2013-6497. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extract...

Mandriva Linux Security Advisory : curl (MDVSA-2014:213)

Updated curl packages fix security vulnerability : Symeon Paraschoudis discovered that the curleasyduphandle function in cURL has a bug that can lead to libcurl eventually sending off sensitive data that was not intended for sending, while performing a HTTP POST operation. This bug requires...

[ MDVSA-2014:200 ] bugzilla

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:200 http://www.mandriva.com/en/support/security/ Package : bugzilla Date : October 21, 2014 Affected: Business Server 1.0 Problem Description: Updated bugzilla packages fix security vulnerabilities: If a new...

Mandriva Linux Security Advisory : wpa_supplicant (MDVSA-2014:211)

Updated wpasupplicant packages fix security vulnerability : A vulnerability was found in the mechanism wpacli and hostapdcli use for executing action scripts. An unsanitized string received from a remote device can be passed to a system call resulting in arbitrary command execution under the...

Mandriva Linux Security Advisory : wget (MDVSA-2014:212)

Updated wget package fixes security vulnerability : Wget was susceptible to a symlink attack which could create arbitrary files, directories or symbolic links and set their permissions when retrieving a directory recursively through FTP CVE-2014-4877. The default settings in wget have been change...