Mandriva Linux Security Advisory : drupal (MDVSA-2013:287-1)

Multiple security issues was identified and fixed in drupal : Drupal core's Image module allows for the on-demand generation of image derivatives. This capability can be abused by requesting a large number of new derivatives which can fill up the server disk space, and which can cause a very high...

[ MDVSA-2013:276 ] curl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:276 http://www.mandriva.com/en/support/security/ Package : curl Date : November 21, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: Updated curl packages fix security...

[ MDVSA-2013:275 ] krb5

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:275 http://www.mandriva.com/en/support/security/ Package : krb5 Date : November 21, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: Updated krb5 package fixes security...

[ MDVSA-2013:280 ] memcached

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:280 http://www.mandriva.com/en/support/security/ Package : memcached Date : November 22, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: A vulnerability was found and corrected...

[ MDVSA-2013:274 ] libjpeg

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:274 http://www.mandriva.com/en/support/security/ Package : libjpeg Date : November 21, 2013 Affected: Enterprise Server 5.0 Problem Description: Updated libjpeg packages fix security vulnerabilities: A...

Mandriva Linux Security Advisory : perl-HTTP-Body (MDVSA-2013:282)

Updated perl-HTTP-Body package fixes security vulnerability : Jonathan Dolle reported a design error in HTTP::Body, a Perl module for processing data from HTTP POST requests. The HTTP body multipart parser creates temporary files which preserve the suffix of the uploaded file. An attacker able to...

Mandriva Linux Security Advisory : memcached (MDVSA-2013:280)

A vulnerability was found and corrected in memcached : Memcached is vulnerable to a denial of service as it can be made to crash when it receives a specially crafted packet over the network CVE-2011-4971. The updated packages for Enterprise Server 5 has beed patched to resolve this flaw. The...

Mandriva Linux Security Advisory : nginx (MDVSA-2013:281)

Updated nginx package fixes security vulnerability : Ivan Fratric of the Google Security Team discovered a bug in nginx, which might allow an attacker to bypass security restrictions in certain configurations by using a specially crafted request, or might have potential other impact CVE-2013-4547...

Mandriva Linux Security Advisory : wireshark (MDVSA-2013:279)

Multiple vulnerabilities was found and corrected in Wireshark : The ieee802154maprec function in epan/dissectors/packet-ieee802154.c in the IEEE 802.15.4 dissector in Wireshark 1.8.x before 1.8.11 and 1.10.x before 1.10.3 uses an incorrect pointer chain, which allows remote attackers to cause a...

Mandriva Linux Security Advisory : samba (MDVSA-2013:278)

A vulnerability has been found and corrected in samba : Samba 3.x before 3.6.20, 4.0.x before 4.0.11, and 4.1.x before 4.1.1, when vfsstreamsdepot or vfsstreamsxattr is enabled, allows remote attackers to bypass intended file restrictions by leveraging ACL differences between a file and an...

Mandriva Linux Security Advisory : poppler (MDVSA-2013:272)

Updated poppler packages fix security vulnerabilities : Poppler is found to be affected by a stack based buffer overflow vulnerability in the pdfseparate utility. Successfully exploiting this issue could allow remote attackers to execute arbitrary code in the context of the affected application...

Mandriva Linux Security Advisory : libjpeg (MDVSA-2013:273)

Updated libjpeg packages fix security vulnerabilities : libjpeg 6b and libjpeg-turbo will use uninitialized memory when decoding images with missing SOS data for the luminance component Y in presence of valid chroma data Cr, Cb CVE-2013-6629. libjpeg-turbo will use uninitialized memory when...

Mandriva Linux Security Advisory : krb5 (MDVSA-2013:275)

Updated krb5 package fixes security vulnerabily : If a KDC serves multiple realms, certain requests can cause setupserverrealm to dereference a NULL pointer, crashing the KDC. This can be triggered by an unauthenticated user CVE-2013-1418. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Mandriva Linux Security Advisory : nss (MDVSA-2013:270)

Multiple security issues was identified and fixed in mozilla NSPR and NSS : Mozilla Network Security Services NSS before 3.15.2 does not ensure that data structures are initialized before read operations, which allows remote attackers to cause a denial of service or possibly have unspecified othe...

Mandriva Linux Security Advisory : torque (MDVSA-2013:268)

Updated torque packages fix security vulnerability : A user could submit executable shell commands on the tail of what is passed with the -M switch for qsub. This was later passed to a pipe, making it possible for these commands to be executed as root on the pbsserver CVE-2013-4495. %NASLMINLEVEL...

[ MDVSA-2013:262 ] python-pycrypto

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:262 http://www.mandriva.com/en/support/security/ Package : python-pycrypto Date : October 28, 2013 Affected: Business Server 1.0 Problem Description: Updated python-pycrypto package fixes security...

[ MDVSA-2013:258 ] icu

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:258 http://www.mandriva.com/en/support/security/ Package : icu Date : October 28, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: Updated icu packages fix security...

Mandriva Linux Security Advisory : roundcubemail (MDVSA-2013:263)

A vulnerability has been discovered and corrected in roundcubemail : It was discovered that roundcube does not properly sanitize the session parameter in steps/utils/savepref.inc during saving preferences. The vulnerability can be exploited to overwrite configuration settings and subsequently...

Mandriva Linux Security Advisory : dropbear (MDVSA-2013:261)

Updated dropbear package fixes security vulnerability : Possible memory exhaustion denial of service due to the size of decompressed payloads in dropbear before 2013.59 CVE-2013-4421. Inconsistent delays in authorization failures could be used to disclose the existence of valid user accounts in...

Mandriva Linux Security Advisory : python-pycrypto (MDVSA-2013:262)

Updated python-pycrypto package fixes security vulnerability : In PyCrypto before v2.6.1, the Crypto.Random pseudo-random number generator PRNG exhibits a race condition that may cause it to generate the same 'random' output in multiple processes that are forked from each other. Depending on the...