Mandriva Linux Security Advisory : cups (MDVSA-2008:170)

Thomas Pollet discovered an integer overflow vulnerability in the PNG image handling filter in CUPS. This could allow a malicious user to execute arbitrary code with the privileges of the user running CUPS, or cause a denial of service by sending a specially crafted PNG image to the print server...

Mandriva Linux Security Advisory : libxml2 (MDVSA-2008:231)

Drew Yao of the Apple Product Security Team found two flaws in libxml2. The first is a denial of service flaw in libxml2's XML parser. If an application linked against libxml2 were to process certain malformed XML content, it cause the application to enter an infinite loop CVE-2008-4225. The seco...

MDVA-2009:015 : openct

This update fixes issue with a non-LSB initscript of openct, which could cause init to switch to non LSB compat mode, and result in a loop between resolvconf and network bug 47299. %NASLMINLEVEL 70300 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a security...

MDVA-2008:071 : nfs-utils

The nfs server initscript in Mandriva Linux 2008 and 2008 Spring releases lacked support for NFS quota, preventing quota information to be available on user side. The updated packages fix this issue. %NASLMINLEVEL 70300 @DEPRECATED@ This script has been deprecated as the associated patch is not...

MDVA-2009:043 : module-init-tools

This stable update for module-init-tools fixes a number of problems found since the initial Mandriva Linux 2009 release, the most important ones are: - depmod may corrupt dependency files 46884 - mkinitrd crash when adding AES encryption modules 46260 - mkinitrd failure when installing recent...

MDVA-2008:180 : cracklib

The cracklib library package was incorrectly providing the development package, which was preventing the compilation of anything relying on cracklib-devel. This update fixes the incorrect Provides. It also corrects an issue when /usr is a separate partition the fails to mount at start, logging in...

MDVA-2008:033 : rpmdrake

rpmdrake in Mandriva Linux 2007.1 cannot install packages that are excluded by /etc/urpmi/skip.list. This is not how the system is intended to work these packages should be left out of automatic updates, but should be installable manually if the user wishes. This bug made it difficult to install,...

Mandriva Linux Security Advisory : php (MDVSA-2009:021)

A buffer overflow in the imageloadfont function in PHP allowed context-dependent attackers to cause a denial of service crash and potentially execute arbitrary code via a crafted font file CVE-2008-3658. A buffer overflow in the memnstr function allowed context-dependent attackers to cause a deni...

Mandriva Linux Security Advisory : php (MDVSA-2009:022)

A vulnerability in PHP allowed context-dependent attackers to cause a denial of service crash via a certain long string in the glob or fnmatch functions CVE-2007-4782. A vulnerability in the cURL library in PHP allowed context-dependent attackers to bypass safemode and openbasedir restrictions an...

Mandriva Linux Security Advisory : gd (MDVSA-2008:038)

Buffer overflow in the LWZReadByte function in gdgifin.c in GD prior to 2.0.34 allows remote attackers to have an unknown impact via a GIF file with inputcodesize greater than MAXLWZBITS, which triggers an overflow when initializing the table array. This was originally fixed in PHP's embedded GD...

Mandriva Linux Security Advisory : evolution-data-server (MDVSA-2009:078)

A wrong handling of signed Secure/Multipurpose Internet Mail Extensions S/MIME e-mail messages enables attackers to spoof its signatures by modifying the latter copy CVE-2009-0547. Crafted authentication challange packets NT Lan Manager type 2 sent by a malicious remote mail server enables remote...

Mandriva Linux Security Advisory : python (MDVSA-2008:085)

Integer signedness error in the zlib extension module in Python 2.5.2 and earlier allows remote attackers to execute arbitrary code via a negative signed integer, which triggers insufficient memory allocation and a buffer overflow CVE-2008-1721. A buffer overflow vulnerability was also found in t...

Mandriva Linux Security Advisory : sarg (MDVSA-2008:079)

A stack-based buffer overflow in sarg Squid Analysis Report Generator allowed remote attackers to execute arbitrary code via a long Squid proxy server User-Agent header CVE-2008-1167. A cross-site scripting vulnerability in sarg version 2.x prior to 2.2.5 allowed remote attackers to inject...

Mandriva Linux Security Advisory : nasm (MDVSA-2008:120)

An off-by-one error was found in nasm 2.02 that allowed context-dependent attackers to cause a denial of service crash or possibly execute arbitrary code via a crafted file that triggers a stack-based buffer overflow CVE-2008-2719. The updated packages have been patched to prevent this issue...

Mandriva Linux Security Advisory : pidgin (MDVSA-2008:143)

An integer overflow flaw was found in Pidgin's MSN protocol handler that could allow for the execution of arbitrary code if a user received a malicious MSN message CVE-2008-2927. In addition, this update provides the ability to use ICQ networks again on Mandriva Linux 2008.0, as in MDVA-2008:103...

Mandriva Linux Security Advisory : tomcat5 (MDVSA-2009:018)

Apache Tomcat does not properly handle certain characters in a cookie value, which could possibly lead to the leak of sensitive information such as session IDs CVE-2007-5333. The updated packages have been patched to prevent this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Mandriva Linux Security Advisory : mysql (MDVSA-2008:150)

Multiple buffer overflows in yaSSL, which is used in MySQL, allowed remote attackers to execute arbitrary code CVE-2008-0226 or cause a denial of service via a special Hello packet CVE-2008-0227. Sergei Golubchik found that MySQL did not properly validate optional data or index directory paths...

Mandriva Linux Security Advisory : tk (MDVSA-2008:041)

The ReadImage function in Tk did not check codeSize read from GIF images prior to initializing the append array, which could lead to a buffer overflow with unknown impact. The updated packages have been patched to correct this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Mandriva Linux Security Advisory : vinagre (MDVSA-2008:240)

Alfredo Ortega found a flaw in how Vinagre uses format strings. A remote attacker could exploit this vulnerability if they were able to trick a user into connecting to a malicious VNC server, or opening a specially crafted URI with Vinagre. With older versions of Vinagre, it was possible to execu...

Mandriva Linux Security Advisory : openoffice.org (MDVSA-2008:095)

A vulnerability in HSQLDB before 1.8.0.9 in OpenOffice.org could allow user-assisted remote attackers to execute arbitrary Java code via crafted database documents CVE-2007-4575. A heap overflow was discovered in OpenOffice.org's EMF parser. An attacker could create a carefully crafted EMF file...