Mandriva Linux Security Advisory : fetchmail (MDVSA-2008:117)

A flaw in fetchmail was discovered that allowed remote attackers to cause a denial of service crash and persistent mail failure via a malformed message with long headers. The crash only occured when fetchmail was called in '-v -v' mode CVE-2008-2711. The updated packages have been patched to...

Mandriva Linux Security Advisory : krb5 (MDVSA-2008:069)

Multiple memory management flaws were found in the GSSAPI library used by Kerberos that could result in the use of already freed memory or an attempt to free already freed memory, possibly leading to a crash or allowing the execution of arbitrary code CVE-2007-5901, CVE-2007-5971. A flaw was...

Mandriva Linux Security Advisory : cups (MDVSA-2008:170)

Thomas Pollet discovered an integer overflow vulnerability in the PNG image handling filter in CUPS. This could allow a malicious user to execute arbitrary code with the privileges of the user running CUPS, or cause a denial of service by sending a specially crafted PNG image to the print server...

Mandriva Linux Security Advisory : pam_mount (MDVSA-2009:004)

passwdehd script in pammount would allow local users to overwrite arbitrary files via a symlink attack on a temporary file. The updated packages have been patched to prevent this. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Mandriva Linux Security Advisory : shadow-utils (MDVSA-2009:062)

A security vulnerability has been identified and fixed in login application from shadow-utils, which could allow local users in the utmp group to overwrite arbitrary files via a symlink attack on a temporary file referenced in a line aka utline field in a utmp entry CVE-2008-5394. The updated...

Mandriva Linux Security Advisory : php (MDVSA-2009:045)

A number of vulnerabilities have been found and corrected in PHP : improve mbflfiltconvhtmldecflush error handling in ext/mbstring/libmbfl/filters/mbfilterhtmlent.c CVE-2008-5557. Additionally on Mandriva Linux 2009.0 and up the php-mbstring module is linked against a separate shared libmbfl...

Mandriva Linux Security Advisory : nfs-utils (MDVSA-2009:060)

A security vulnerability has been identified and fixed in nfs-utils, which caused TCP Wrappers to ignore netgroups and allows remote attackers to bypass intended access restrictions CVE-2008-4552. The updated packages have been patched to prevent this. %NASLMINLEVEL 70300 C Tenable Network...

Mandriva Linux Security Advisory : net-snmp (MDVSA-2008:225)

A denial of service vulnerability was discovered in how Net-SNMP processed GETBULK requests. A remote attacker with read access to the SNMP server could issue a specially crafted request which would cause snmpd to crash CVE-2008-4309. Please note that for this to be successfully exploited, an...

Mandriva Linux Security Advisory : ruby (MDVSA-2008:029)

Ruby network libraries Net::HTTP, Net::IMAP, Net::FTPTLS, Net::Telnet, Net::POP3, and Net::SMTP, up to Ruby version 1.8.6 are affected by a possible man-in-the-middle attack, when using SSL, due to a missing check of the CN common name attribute in SSL certificates against the server's hostname...

Mandriva Linux Security Advisory : madwifi-source (MDVSA-2008:007)

MadWifi prior to 0.9.3.3 allowed remote attackers to cause a denial of service panic via a beacon frame with a large length value in the extended supported rates xrates element, which would trigger an assertion error. Updated packages have been updated to 0.9.3.3 to correct this issue...

Mandriva Linux Security Advisory : php (MDVSA-2008:128)

A number of vulnerabilities have been found and corrected in PHP : php-cgi in PHP prior to 5.2.6 does not properly calculate the length of PATHTRANSLATED, which has unknown impact and attack vectors CVE-2008-0599. The escapeshellcmd API function in PHP prior to 5.2.6 has unknown impact and...

Mandriva Linux Security Advisory : gstreamer0.10-plugins-base (MDVSA-2009:085)

Integer overflows in gstreamer0.10-plugins-base Base64 encoding and decoding functions related with glib2.0 issue CVE-2008-4316 may lead attackers to cause denial of service. Altough vector attacks are not known yet CVE-2009-0586. This update provide the fix for that security issue. %NASLMINLEVEL...

Mandriva Linux Security Advisory : gstreamer0.10-plugins-good (MDVSA-2009:035)

Security vulnerabilities have been discovered and corrected in gstreamer0.10-plugins-good, might allow remote attackers to execute arbitrary code via a malformed QuickTime media file CVE-2009-0386, CVE-2009-0387, CVE-2009-0397. The updated packages have been patched to prevent this. %NASLMINLEVEL...

Mandriva Linux Security Advisory : pam (MDVSA-2009:077)

A security vulnerability has been identified and fixed in pam : Integer signedness error in the pamStrTok function in libpam/pammisc.c in Linux-PAM aka pam 1.0.3 and earlier, when a configuration file contains non-ASCII usernames, might allow remote attackers to cause a denial of service, and mig...

Mandriva Linux Security Advisory : php (MDVSA-2009:021)

A buffer overflow in the imageloadfont function in PHP allowed context-dependent attackers to cause a denial of service crash and potentially execute arbitrary code via a crafted font file CVE-2008-3658. A buffer overflow in the memnstr function allowed context-dependent attackers to cause a deni...

Mandriva Linux Security Advisory : samba (MDVSA-2008:108)

Secunia Research has discovered a vulnerability in Samba, which can be exploited by malicious people to compromise a vulnerable system. A boundary error within the receivesmbraw function in lib/utilsock.c can be exploited to cause a heap-based buffer overflow via an overly large SMB packet receiv...

Mandriva Linux Security Advisory : xterm (MDVSA-2009:005)

A vulnerability has been discovered in xterm, which can be exploited by malicious people to compromise a user's system. The vulnerability is caused due to xterm not properly processing the DECRQSS Device Control Request Status String escape sequence. This can be exploited to inject and execute...

Mandriva Linux Security Advisory : wml (MDVSA-2008:076)

Two vulnerabilities were found in the Website META Language WML package that allowed local users to overwrite arbitrary files via symlink attacks. The updated packages have been patched to correct these issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Mandriva Linux Security Advisory : cups (MDVSA-2008:211)

A buffer overflow in the SGI image format decoding routines used by the CUPS image converting filter imagetops was discovered. An attacker could create malicious SGI image files that could possibly execute arbitrary code if the file was printed CVE-2008-3639. An integer overflow flaw leading to a...

Mandriva Linux Security Advisory : imlib2 (MDVSA-2008:123)

Stefan Cornelius discovered two buffer overflows in Imlib's image loaders for PNM and XPM images, which could possibly result in the execution of arbitrary code CVE-2008-2426. The updated packages have been patched to prevent this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...