Mandriva Linux Security Advisory : wireshark (MDVSA-2008:199)

A number of vulnerabilities were discovered in Wireshark that could cause it to crash while processing malicious packets CVE-2008-3146, CVE-2008-3932, CVE-2008-3933, CVE-2008-3934. This update provides Wireshark 1.0.3, which is not vulnerable to these issues. %NASLMINLEVEL 70300 C Tenable Network...

Mandriva Linux Security Advisory : mozilla-firefox (MDVSA-2008:148)

Security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox program, version 2.0.0.16 CVE-2008-2785, CVE-2008-2933. This update provides the latest Firefox to correct these issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Mandriva Linux Security Advisory : wordnet (MDVSA-2008:182-1)

Rob Holland found several programming errors in WordNet which could lead to the execution or arbitrary code when used with untrusted input CVE-2008-2149, CVE-2008-3908. Update : The previous patch had a typo that caused incorrect behaviour in WordNet. This update uses an update patch that correct...

Mandriva Linux Security Advisory : poppler (MDVSA-2008:146)

A memory management issue was found in libpoppler by Felipe Andres Manzano that could allow for the execution of arbitrary code with the privileges of the user running a poppler-based application, if they opened a specially crafted PDF file CVE-2008-2950. The updated packages have been patched to...

Mandriva Linux Security Advisory : R-base (MDVSA-2008:198)

A symlink vulnerability was found in the javareconf script in R that allows local users to overwrite arbitrary files CVE-2008-3931. The updated packages have been patched to prevent this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Mandriva Linux Security Advisory : gnutls (MDVSA-2008:106)

Flaws discovered in versions prior to 2.2.4 stable and 2.3.10 development of GnuTLS allow an attacker to cause denial of service application crash, and maybe so far undetermined execute arbitrary code. The updated packages have been patched to fix these flaws. Note that any applications using thi...

Mandriva Linux Security Advisory : clamav (MDVSA-2008:189-1)

Multiple vulnerabilities were discovered in ClamAV and corrected with the 0.94 release, including : A vulnerability in ClamAV's chm-parser allowed remote attackers to cause a denial of service application crash via a malformed CHM file CVE-2008-1389. A vulnerability in libclamav would allow...

Mandriva Linux Security Advisory : squid (MDVSA-2009:034)

Due to an internal error Squid is vulnerable to a denial of service attack when processing specially crafted requests. This problem allows any client to perform a denial of service attack on the Squid service CVE-2009-0478. The updated packages have been patched to adress this. %NASLMINLEVEL 7030...

Mandriva Linux Security Advisory : pulseaudio (MDVSA-2008:065)

Luigi Auriemma found a few programming errors in Pulseaudio, that can be used to crash the Pulseaudio daemon, by authenticated and unauthenticated users. The updated packages fix these issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Mandriva Linux Security Advisory : pidgin (MDVSA-2009:025)

The NSS plugin in libpurple in Pidgin 2.4.1 does not verify SSL certificates, which makes it easier for remote attackers to trick a user into accepting an invalid server certificate for a spoofed service. CVE-2008-3532 Pidgin 2.4.1 allows remote attackers to cause a denial of service crash via a...

Mandriva Linux Security Advisory : ImageMagick (MDVSA-2008:035)

Multiple vulnerabilities were discovered in the image decoders of ImageMagick. If a user or automated system were tricked into processing malicious DCM, DIB, XBM, XCF, or XWD images, a remote attacker could execute arbitrary code with user privileges. The updated packages have been patched to...

Mandriva Linux Security Advisory : epiphany (MDVSA-2009:048-2)

Python has a variable called sys.path that contains all paths where Python loads modules by using import scripting procedure. A wrong handling of that variable enables local attackers to execute arbitrary code via Python scripting in the current Epiphany working directory CVE-2008-5985. This upda...

Mandriva Linux Security Advisory : libxfont (MDVSA-2008:024)

A heap-based buffer overflow flaw was found in how the X.org server handled malformed font files that could allow a malicious local user to potentially execute arbitrary code with the privileges of the X.org server CVE-2008-0006. The updated packages have been patched to correct this issue...

Mandriva Linux Security Advisory : vorbis-tools (MDVSA-2008:093)

A vulnerability in the Speex library was found where it did not properly validate input values read from the Speex files headers. An attacker could create a malicious Speex file that would crash an application or potentially allow the execution of arbitrary code with the privileges of the...

Mandriva Linux Security Advisory : clamav (MDVSA-2008:003)

An integer overflow vulnerability was reported by iDefense with clamav when parsing Portable Executable PE files packed in he MEW format. This could be exploited to cause a heap-based buffer overflow CVE-2007-6335. Toeroek Edwin reported an off-by-one error when decompressing MS-ZIP compressed CA...

Mandriva Linux Security Advisory : firefox (MDVSA-2009:084)

Security vulnerabilities have been discovered in previous versions, and corrected in the latest Mozilla Firefox 3.x, version 3.0.8 CVE-2009-1044, CVE-2009-1169. This update provides the latest Mozilla Firefox 3.x to correct these issues. Additionally, some packages requiring it have also been...

Mandriva Linux Security Advisory : libtiff (MDVSA-2008:184)

Drew Yao of the Apple Product Security Team reported multiple uses of uninitialized values in libtiff's LZW compression algorithm decoder. An attacker could create a carefully crafted LZW-encoded TIFF file that would cause an application linked to libtiff to crash or potentially execute arbitrary...

Mandriva Linux Security Advisory : python (MDVSA-2008:163)

Multiple integer overflows in the imageop module in Python prior to 2.5.3 allowed context-dependent attackers to cause a denial of service crash or possibly execute arbitrary code via crafted images that trigger heap-based buffer overflows CVE-2008-1679. This was due to an incomplete fix for...

Mandriva Linux Security Advisory : clamav (MDVSA-2008:229)

An off-by-one error was found in ClamAV versions prior to 0.94.1 that could allow remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted VBA project file CVE-2008-5050. Other bugs have also been corrected in 0.94.1 which is being provided with this update...

Mandriva Linux Security Advisory : php (MDVSA-2008:126)

A number of vulnerabilities have been found and corrected in PHP : PHP 5.2.1 would allow context-dependent attackers to read portions of heap memory by executing certain scripts with a serialized data input string beginning with 'S:', which did not properly track the number of input bytes being...