Mandriva Linux Security Advisory : libvirt (MDVSA-2014:195)

Multiple vulnerabilities has been discovered and corrected in libvirt : An out-of-bounds read flaw was found in the way libvirt's qemuDomainGetBlockIoTune function looked up the disk index in a non-persistent live disk configuration while a persistent disk configuration was being indexed. A remot...

Mandriva Linux Security Advisory : phpmyadmin (MDVSA-2014:194)

A vulnerability has been discovered and corrected in phpmyadmin : With a crafted ENUM value it is possible to trigger an XSS in table search and table structure pages CVE-2014-7217. This upgrade provides the latest phpmyadmin version 4.2.9.1 to address this vulnerability. %NASLMINLEVEL 70300 C...

Mandriva Linux Security Advisory : xerces-j2 (MDVSA-2014:193)

A resource consumption issue was found in the way Xerces-J handled XML declarations. A remote attacker could use an XML document with a specially crafted declaration using a long pseudo-attribute name that, when parsed by an application using Xerces-J, would cause that application to use an...

Mandriva Linux Security Advisory : perl-Email-Address (MDVSA-2014:192)

Updated perl-Email-Address package fixes security vulnerability : The parse function in Email::Address module before 1.905 for Perl uses an inefficient regular expression, which allows remote attackers to cause a denial of service CPU consumption via an empty quoted string in an RFC 2822 address...

[ MDVSA-2014:184 ] net-snmp

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:184 http://www.mandriva.com/en/support/security/ Package : net-snmp Date : September 24, 2014 Affected: Business Server 1.0 Problem Description: Updated net-snmp packages fix security vulnerabilities: A remo...

Mandriva Linux Security Advisory : bash (MDVSA-2014:190)

It was found that the fix for CVE-2014-6271 was incomplete, and Bash still allowed certain characters to be injected into other environments via specially crafted environment variables. An attacker could potentially use this flaw to override or bypass environment restrictions to execute shell...

[ MDVSA-2014:185 ] libgadu

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:185 http://www.mandriva.com/en/support/security/ Package : libgadu Date : September 24, 2014 Affected: Business Server 1.0 Problem Description: Updated libgadu packages fix security vulnerability: Libgadu...

Mandriva Linux Security Advisory : curl (MDVSA-2014:187)

Updated curl packages fix security vulnerabilities : In cURL before 7.38.0, libcurl can be fooled to both sending cookies to wrong sites and into allowing arbitrary sites to set cookies for others. For this problem to trigger, the client application must use the numerical IP address in the URL to...

Mandriva Linux Security Advisory : nss (MDVSA-2014:189)

A vulnerability has been discovered and corrected in Mozilla NSS : Antoine Delignat-Lavaud, security researcher at Inria Paris in team Prosecco, reported an issue in Network Security Services NSS libraries affecting all versions. He discovered that NSS is vulnerable to a variant of a signature...

Mandriva Linux Security Advisory : wireshark (MDVSA-2014:188)

Updated wireshark packages fix security vulnerabilities : RTP dissector crash CVE-2014-6421, CVE-2014-6422. MEGACO dissector infinite loop CVE-2014-6423. Netflow dissector crash CVE-2014-6424. RTSP dissector crash CVE-2014-6427. SES dissector crash CVE-2014-6428. Sniffer file parser crash...

Mandriva Linux Security Advisory : dump (MDVSA-2014:181)

Updated dump packages fix security vulnerability : An integer overflow in liblzo before 2.07 allows attackers to cause a denial of service or possibly code execution in applications using performing LZO decompression on a compressed payload from the attacker CVE-2014-4607. The dump package is bui...

Mandriva Linux Security Advisory : phpmyadmin (MDVSA-2014:183)

Updated phpmyadmin package fixes security vulnerability : In phpMyAdmin before 4.2.9, by deceiving a logged-in user to click on a crafted URL, it is possible to perform remote code execution and in some cases, create a root account due to a DOM based XSS vulnerability in the micro history feature...

Mandriva Linux Security Advisory : net-snmp (MDVSA-2014:184)

Updated net-snmp packages fix security vulnerabilities : A remote denial-of-service flaw was found in the way snmptrapd handled certain SNMP traps when started with the -OQ option. If an attacker sent an SNMP trap containing a variable with a NULL type where an integer variable type was expected,...

Mandriva Linux Security Advisory : bash (MDVSA-2014:186)

A flaw was found in the way Bash evaluated certain specially crafted environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Certain services and applications allow remote unauthenticated attackers to provide environment...

Mandriva Linux Security Advisory : zarafa (MDVSA-2014:182)

Updated zarafa packages fix security vulnerabilities : Robert Scheck reported that Zarafa's WebAccess stored session information, including login credentials, on-disk in PHP session files. This session file would contain a user's username and password to the Zarafa IMAP server CVE-2014-0103. Robe...

Mandriva Linux Security Advisory : libgadu (MDVSA-2014:185)

Updated libgadu packages fix security vulnerability : Libgadu before 1.12.0 was found to not be performing SSL certificate validation CVE-2013-4488. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandriva Linux...

Mandriva Linux Security Advisory : gnupg (MDVSA-2014:180)

Updated gnupg packages fix security vulnerability : The gnupg program before version 1.4.16 is vulnerable to an ELGAMAL side-channel attack CVE-2014-5270. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandriva Linux...

Mandriva Linux Security Advisory : glibc (MDVSA-2014:175)

Multiple vulnerabilities has been found and corrected in glibc : When converting IBM930 code with iconv, if IBM930 code which includes invalid multibyte character 0xffff is specified, then iconv segfaults CVE-2012-6656. Off-by-one error in the gconvtranslitfind function in gconvtrans.c in GNU C...

Mandriva Linux Security Advisory : squid (MDVSA-2014:177)

Updated squid packages fix security vulnerability : Matthew Daley discovered that Squid 3 did not properly perform input validation in request parsing. A remote attacker could send crafted Range requests to cause a denial of service CVE-2014-3609. %NASLMINLEVEL 70300 C Tenable Network Security,...

Mandriva Linux Security Advisory : phpmyadmin (MDVSA-2014:164)

Updated phpmyadmin package fixes security vulnerabilities : In phpMyAdmin before 4.1.14.3, multiple XSS vulnerabilities exist in browse table, ENUM editor, monitor, query charts and table relations pages CVE-2014-5273. In phpMyAdmin before 4.1.14.3, with a crafted view name it is possible to...