Mandriva Linux Security Advisory : socat (MDVSA-2014:033)

A vulnerability has been discovered and corrected in socat : Stack-based buffer overflow in socat 1.3.0.0 through 1.7.2.2 and 2.0.0-b1 through 2.0.0-b6 allows local users to cause a denial of service segmentation fault via a long server name in the PROXY-CONNECT address in the command line...

Mandriva Linux Security Advisory : drupal (MDVSA-2014:031)

Multiple security issues was identified and fixed in drupal : The OpenID module in Drupal 6.x before 6.30 and 7.x before 7.26 allows remote OpenID users to authenticate as other users via unspecified vectors CVE-2014-1475. The Taxonomy module in Drupal 7.x before 7.26, when upgraded from an earli...

Mandriva Linux Security Advisory : flite (MDVSA-2014:032)

Multiple vulnerabilities has been discovered and corrected in flite : The playwavefromsocket function in audio/auserver.c in Flite 1.4 allows local users to modify arbitrary files via a symlink attack on /tmp/awb.wav. NOTE: some of these details are obtained from third party information...

Mandriva Linux Security Advisory : php (MDVSA-2014:027)

A vulnerability has been discovered and corrected in php : - Fixed bug 66356 Heap Overflow Vulnerability in imagecrop CVE-2013-7226. The updated php packages have been upgraded to the 5.5.9 version which is not vulnerable to this issue. Additionally, the PECL packages which requires so has been...

[ MDVSA-2014:021 ] perl-Proc-Daemon

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:021 http://www.mandriva.com/en/support/security/ Package : perl-Proc-Daemon Date : January 24, 2014 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: Updated perl-Proc-Daemon package...

[ MDVSA-2014:009 ] librsvg

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:009 http://www.mandriva.com/en/support/security/ Package : librsvg Date : January 17, 2014 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: Updated librsvg and gtk+3.0 packages fix...

[ MDVSA-2014:022 ] augeas

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:022 http://www.mandriva.com/en/support/security/ Package : augeas Date : January 24, 2014 Affected: Business Server 1.0 Problem Description: Updated augeas packages fix security vulnerabilities: Multiple fla...

[ MDVSA-2014:008 ] openjpeg

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:008 http://www.mandriva.com/en/support/security/ Package : openjpeg Date : January 17, 2014 Affected: Business Server 1.0 Problem Description: Updated openjpeg package fixes security vulnerabilities: Multipl...

Mandriva Linux Security Advisory : perl-Proc-Daemon (MDVSA-2014:021)

Updated perl-Proc-Daemon package fixes security vulnerability : It was reported that perl-Proc-Daemon, when instructed to write a pid file, does that with a umask set to 0, so the pid file ends up with mode 666, allowing any user on the system to overwrite it CVE-2013-7135. %NASLMINLEVEL 70300 C...

Mandriva Linux Security Advisory : graphviz (MDVSA-2014:024)

Updated graphviz packages fix security vulnerabilities : Multiple buffer overflow vulnerabilities in graphviz due to an error within the yyerror function lib/cgraph/scan.l which can be exploited to cause a stack-based buffer overflow via a specially crafted file CVE-2014-0978 and the acceptance o...

Mandriva Linux Security Advisory : augeas (MDVSA-2014:022)

Updated augeas packages fix security vulnerabilities : Multiple flaws were found in the way Augeas handled configuration files when updating them. An application using Augeas to update configuration files in a directory that is writable to by a different user for example, an application running a...

Mandriva Linux Security Advisory : hplip (MDVSA-2014:023)

Updated hplip packages fix security vulnerabilities : It was discovered that the HPLIP Polkit daemon incorrectly handled temporary files. A local attacker could possibly use this issue to overwrite arbitrary files CVE-2013-6402. It was discovered that HPLIP contained an upgrade tool that would...

Mandriva Linux Security Advisory : x11-server (MDVSA-2014:020)

Updated x11-server package fixes security vulnerability : Bryan Quigley discovered an integer underflow in the Xorg X server which could lead to denial of service or the execution of arbitrary code CVE-2013-6424. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and packag...

Mandriva Linux Security Advisory : elinks (MDVSA-2014:019)

Updated elinks package fixes security vulnerability : When verifying SSL certificates, elinks fails to warn the user if the hostname of the certificate does not match the hostname of the website. The elinks package has been updated to version 0.12-pre6 and patched to fix this issue. %NASLMINLEVEL...

Mandriva Linux Security Advisory : spice (MDVSA-2014:016)

Updated spice packages fix security vulnerability : A stack-based buffer overflow flaw was found in the way the redshandleticket function in the spice-server library handled decryption of ticket data provided by the client. A remote user able to initiate a SPICE connection to an application actin...

Mandriva Linux Security Advisory : cups (MDVSA-2014:015)

Updated cups packages fix security vulnerability : Jann Horn discovered that the CUPS lppasswd tool incorrectly read a user configuration file in certain configurations. A local attacker could use this to read sensitive information from certain files, bypassing access restrictions CVE-2013-6891...

Mandriva Linux Security Advisory : net-snmp (MDVSA-2014:017)

Updated net-snmp packages fix security vulnerability : Net-SNMP 5.7.1 and earlier, when AgentX is registering to handle a MIB and processing GETNEXT requests, allows remote attackers to cause a denial of service crash or infinite loop, CPU consumption, and hang by causing the AgentX subagent to...

Mandriva Linux Security Advisory : libxfont (MDVSA-2014:013)

A vulnerability has been discovered and corrected in libxfont : Stack-based buffer overflow in the bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont 1.1 through 1.4.6 allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via a long string in ...

Mandriva Linux Security Advisory : nss (MDVSA-2014:012)

A vulnerability has been discovered and corrected in Mozilla NSS : The sslDo1stHandshake function in sslsecur.c in libssl in Mozilla Network Security Services NSS before 3.15.4, when the TLS False Start feature is enabled, allows man-in-the-middle attackers to spoof SSL servers by using an...

Mandriva Linux Security Advisory : librsvg (MDVSA-2014:009)

Updated librsvg and gtk+3.0 packages fix security vulnerability : librsvg before version 2.39.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference CVE-2013-1881. For Business Server 1 gtk+3.0 has be...