[ MDVSA-2014:062 ] webmin

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:062 http://www.mandriva.com/en/support/security/ Package : webmin Date : March 17, 2014 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: Multiple vulnerabilities was discovered and...

Mandriva Linux Security Advisory : json-c (MDVSA-2014:079)

Updated json-c packages fix security vulnerabilities : Florian Weimer reported that the printbuf APIs used in the json-c library used ints for counting buffer lengths, which is inappropriate for 32bit architectures. These functions need to be changed to using sizet if possible for sizes, or to be...

Mandriva Linux Security Advisory : jbigkit (MDVSA-2014:077)

A vulnerability has been discovered and corrected in jbigkit : Stack-based buffer overflow in the jbgdecin function in libjbig/jbig.c in JBIG-KIT before 2.1 allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via a crafted image file...

Mandriva Linux Security Advisory : a2ps (MDVSA-2014:076)

Updated a2ps packages fix security vulnerability : Brian M. Carlson reported that a2ps's fixps script does not invoke gs with the -dSAFER option. Consequently executing fixps on a malicious PostScript file could result in files being deleted or arbitrary commands being executed with the privilege...

Mandriva Linux Security Advisory : php (MDVSA-2014:075)

A vulnerability has been discovered and corrected in php : The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5.15 uses multiple wildcards with unlimited repetitions, which allows context-dependent attackers to cause a denial of service CPU consumption...

Mandriva Linux Security Advisory : perl-YAML-LibYAML (MDVSA-2014:069)

Updated perl-YAML-LibYAML packages fix security vulnerabilities : Florian Weimer of the Red Hat Product Security Team discovered a heap-based buffer overflow flaw in LibYAML, a fast YAML 1.1 parser and emitter library. A remote attacker could provide a YAML document with a specially crafted tag...

Mandriva Linux Security Advisory : file (MDVSA-2014:073)

Updated file packages fix security vulnerabilities : The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5.15 uses multiple wildcards with unlimited repetitions, which allows context-dependent attackers to cause a denial of service CPU consumption via a...

Mandriva Linux Security Advisory : openssh (MDVSA-2014:068)

Updated openssh packages fixes security vulnerabilities : sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshdconfig, which allows remote attackers to bypass intended environment restrictions by using a substring located before a wildcard character...

Mandriva Linux Security Advisory : openssl (MDVSA-2014:067)

Updated openssl packages fix security vulnerability : The Montgomery ladder implementation in OpenSSL through 1.0.0l does not ensure that certain swap operations have a constant-time behavior, which makes it easier for local users to obtain ECDSA nonces via a FLUSH+RELOAD cache side-channel attac...

Mandriva Linux Security Advisory : python (MDVSA-2014:074)

Updated python package fixes security vulnerabilities : Denial of service flaws due to unbound readline calls in the imaplib, poplib, and smtplib modules CVE-2013-1752. A gzip bomb and unbound read denial of service flaw in python XMLRPC library CVE-2013-1753. %NASLMINLEVEL 70300 C Tenable Networ...

[ MDVSA-2014:065 ] apache

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:065 http://www.mandriva.com/en/support/security/ Package : apache Date : March 20, 2014 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: Multiple vulnerabilities has been found and...

Mandriva Linux Security Advisory : udisks (MDVSA-2014:064)

Updated udisks packages fixes security vulnerability : A flaw was found in the way udisks and udisks2 handled long path names. A malicious, local user could use this flaw to create a specially crafted directory structure that could lead to arbitrary code execution with the privileges of the udisk...

Mandriva Linux Security Advisory : webmin (MDVSA-2014:062)

Multiple vulnerabilities was discovered and corrected in webmin : Multiple XSS, CSRF, and arbitrary code execution vulnerabilities that impact Webmin versions prior to 1.620 CVE-2012-2981, CVE-2012-2982, CVE-2012-2983, CVE-2012-4893, SA51201. The 1.680 version fixed security issues that could be...

Mandriva Linux Security Advisory : x2goserver (MDVSA-2014:063)

Updated x2goserver package fixes security vulnerability : A vulnerability in x2goserver before 4.0.0.2 in the setgid wrapper x2gosqlitewrapper.c, which does not hardcode an internal path to x2gosqlitewrapper.pl, allowing a remote attacker to change that path. A remote attacker may be able to...

Mandriva Linux Security Advisory : oath-toolkit (MDVSA-2014:061)

Updated oath-toolkit packages fix security vulnerability : It was found that comments lines starting with a hash in /etc/users.oath could prevent one-time-passwords OTP from being invalidated, leaving the OTP vulnerable to replay attacks CVE-2013-7322. %NASLMINLEVEL 70300 C Tenable Network...

Mandriva Linux Security Advisory : owncloud (MDVSA-2014:055)

Updated owncloud packages fix security vulnerabilities and bugs : Owncloud versions 5.0.15 and 6.0.2 fix several unspecified security vulnerabilities, as well as many other bugs. See the upstream Changelog for more information. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Mandriva Linux Security Advisory : freeradius (MDVSA-2014:058)

Updated freeradius package fixes security vulnerability : SSHA processing in freeradius before 2.2.3 runs into a stack-based buffer overflow in the freeradius rlmpap module if the password source uses an unusually long hashed password CVE-2014-2015. %NASLMINLEVEL 70300 C Tenable Network Security,...

Mandriva Linux Security Advisory : net-snmp (MDVSA-2014:052)

Updated net-snmp packages fix two vulnerabilities : Remotely exploitable denial of service vulnerability in Net-SNMP, in the Linux implementation of the ICMP-MIB, making the SNMP agent vulnerable if it is making use of the ICMP-MIB table objects CVE-2014-2284. Remotely exploitable denial of servi...

Mandriva Linux Security Advisory : otrs (MDVSA-2014:054)

Updated otrs package fixes security vulnerability : An attacker could send a specially prepared HTML email to OTRS. If he can then trick an agent into following a special link to display this email, JavaScript code would be executed CVE-2014-1695. %NASLMINLEVEL 70300 C Tenable Network Security,...

Mandriva Linux Security Advisory : libssh (MDVSA-2014:053)

Updated libssh package fixes security vulnerability : When using libssh before 0.6.3, a libssh-based server, when accepting a new connection, forks and the child process handles the request. The RANDbytes function of openssl doesn't reset its state after the fork, but simply adds the current...