Mandriva Linux Security Advisory : cups (MDVSA-2014:151)

Updated cups packages fix security vulnerability : In CUPS before 1.7.4, a local user with privileges of group=lp can write symbolic links in the rss directory and use that to gain '@SYSTEM' group privilege with cupsd CVE-2014-3537. It was discovered that the web interface in CUPS incorrectly...

Mandriva Linux Security Advisory : tor (MDVSA-2014:150)

Updated tor package fixes security vulnerability : Tor before 0.2.4.23 maintains a circuit after an inbound RELAYEARLY cell is received by a client, which makes it easier for remote attackers to conduct traffic-confirmation attacks by using the pattern of RELAY and RELAYEARLY cells as a means of...

Mandriva Linux Security Advisory : php (MDVSA-2014:149)

Multiple vulnerabilities has been discovered and corrected in php : Use-after-free vulnerability in ext/spl/splarray.c in the SPL component in PHP through 5.5.14 allows context-dependent attackers to cause a denial of service or possibly have unspecified other impact via crafted ArrayIterator usa...

Mandriva Linux Security Advisory : readline (MDVSA-2014:154)

Updated readline packages fix security vulnerability : Steve Kemp discovered the rltropen function in readline insecurely handled a temporary file. This could allow a local attacker to perform symbolic link attacks CVE-2014-2524. Also, upstream patches have been added to fix an infinite loop in v...

Mandriva Linux Security Advisory : glibc (MDVSA-2014:152)

Updated glibc packages fix security issues : Stephane Chazelas discovered that directory traversal issue in locale handling in glibc. glibc accepts relative paths with .. components in the LC and LANG variables. Together with typical OpenSSH configurations with suitable AcceptEnv settings in...

Mandriva Linux Security Advisory : mediawiki (MDVSA-2014:153)

Updated mediawiki packages fix security vulnerabilities : MediaWiki before 1.23.2 is vulnerable to JSONP injection in Flash, XSS in mediawiki.page.image.pagination.js, and clickjacking between OutputPage and ParserOutput. This update provides MediaWiki 1.23.2, fixing these and other issues...

Mandriva Linux Security Advisory : file (MDVSA-2014:146)

A vulnerability has been found and corrected in file : file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service CPU consumption via a crafted file that triggers backtracking during processing of an awk...

Mandriva Linux Security Advisory : php-ZendFramework (MDVSA-2014:145)

A vulnerability has been found and corrected in php-ZendFramework : The implementation of the ORDER BY SQL statement in ZendDbSelect of Zend Framework 1 contains a potential SQL injection when the query string passed contains parentheses CVE-2014-4914. The updated packages have been upgraded to t...

Mandriva Linux Security Advisory : dbus (MDVSA-2014:148)

Updated dbus packages fix security vulnerabilities : A flaw was reported in D-Bus's file descriptor passing feature. A local attacker could use this flaw to cause a service or application to disconnect from the bus, typically resulting in that service or application exiting CVE-2014-3532. A flaw...

Mandriva Linux Security Advisory : sendmail (MDVSA-2014:147)

Updated sendmail packages fix security vulnerability : Sendmail before 8.14.9 does not properly closing file descriptors before executing programs. This bug could enable local users to interfere with an open SMTP connection if they can execute their own program for mail delivery e.g., via procmai...

Mandriva Linux Security Advisory : apache (MDVSA-2014:142)

Updated apache package fixes security vulnerabilities : A race condition flaw, leading to heap-based buffer overflows, was found in the modstatus httpd module. A remote attacker able to access a status page served by modstatus on a server using a threaded Multi-Processing Module MPM could send a...

Mandriva Linux Security Advisory : live (MDVSA-2014:144)

Updated live fix security vulnerability : The live555 RTSP streaming server and client libraries before 2013.11.29 are vulnerable to buffer overflows in RTSP command parsing that potentially allow for arbitrary code execution when connected to a malicious client or server. %NASLMINLEVEL 70300 C...

Mandriva Linux Security Advisory : owncloud (MDVSA-2014:140)

Updated owncloud package fixes security vulnerability : In ownCloud before 5.0.17 and 6.0.4, there exists a limited local file inclusion vulnerability due to an improper control of the filename for a requireonce statement in the routing component CVE-2014-4929. See the upstream Changelog for more...

Mandriva Linux Security Advisory : java-1.7.0-openjdk (MDVSA-2014:141)

Updated java-1.7.0-openjdk packages fix security vulnerabilities : It was discovered that the Hotspot component in OpenJDK did not properly verify bytecode from the class files. An untrusted Java application or applet could possibly use these flaws to bypass Java sandbox restrictions CVE-2014-421...

[ MDVSA-2014:133 ] gd

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:133 http://www.mandriva.com/en/support/security/ Package : gd Date : July 10, 2014 Affected: Business Server 1.0 Problem Description: Updated gd and libgd packages fix security vulnerability: The...

Mandriva Linux Security Advisory : samba (MDVSA-2014:136)

Updated samba packages fix security vulnerabilities : Information leak vulnerability in the VFS code, allowing an authenticated user to retrieve eight bytes of uninitialized memory when shadow copy is enabled CVE-2014-0178. Samba versions before 3.6.24, 4.0.19, and 4.1.9 are vulnerable to a denia...

Mandriva Linux Security Advisory : asterisk (MDVSA-2014:138)

Multiple vulnerabilities has been discovered and corrected in asterisk : Asterisk Open Source 11.x before 11.10.1 and 12.x before 12.3.1 and Certified Asterisk 11.6 before 11.6-cert3 allows remote authenticated Manager users to execute arbitrary shell commands via a MixMonitor action CVE-2014-404...

Mandriva Linux Security Advisory : apache-mod_wsgi (MDVSA-2014:137)

Multiple vulnerabilities has been discovered and corrected in apache-modwsgi : It was found that modwsgi did not properly drop privileges if the call to setuid\ failed. If modwsgi was set up to allow unprivileged users to run WSGI applications, a local user able to run a WSGI application could...

Mandriva Linux Security Advisory : python (MDVSA-2014:135)

Updated python and python-simplejson package fixes security vulnerability Python are susceptible to arbitrary process memory reading by a user or adversary due to a bug in the json module caused by insufficient bounds checking. The bug is caused by allowing the user to supply a negative value tha...

Mandriva Linux Security Advisory : liblzo (MDVSA-2014:134)

Updated liblzo packages fix security vulnerability : An integer overflow in liblzo before 2.07 allows attackers to cause a denial of service or possibly code execution in applications performing LZO decompression on a compressed payload from the attacker CVE-2014-4607. %NASLMINLEVEL 70300 C Tenab...