Mandriva Linux Security Advisory : xymon (MDVSA-2013:213)

Updated xymon package fixes security vulnerability : A security vulnerability has been found in version 4.x of the Xymon Systems Network Monitor tool The error permits a remote attacker to delete files on the server running the Xymon trend-data daemon xymondrrd. File deletion is done with the...

Mandriva Linux Security Advisory : otrs (MDVSA-2013:212)

Updated otrs package fixes security vulnerability : It was discovered that otrs2, the Open Ticket Request System, does not properly sanitise user-supplied data that is used on SQL queries. An attacker with a valid agent login could exploit this issue to craft SQL queries by injecting arbitrary SQ...

Mandriva Linux Security Advisory : lcms2 (MDVSA-2013:211)

Updated lcms2 packages fixes security vulnerability : It was discovered that Little CMS did not properly verify certain memory allocations. If a user or automated system using Little CMS were tricked into opening a specially crafted file, an attacker could cause Little CMS to crash CVE-2013-4160...

Mandriva Linux Security Advisory : libtiff (MDVSA-2013:208)

Updated libtiff packages fix security vulnerabilities : A heap-based buffer overflow flaw was found in the way tiff2pdf of libtiff performed write of TIFF image content into particular PDF document file, in the tpprocessjpegstrip function. A remote attacker could provide a specially crafted TIFF...

Mandriva Linux Security Advisory : subversion (MDVSA-2013:209)

A vulnerability has been found and corrected in subversion : The moddavsvn Apache HTTPD server module in Subversion 1.7.0 through 1.7.10 and 1.8.x before 1.8.1 allows remote authenticated users to cause a denial of service assertion failure or out-of-bounds read via a certain 1 COPY, 2 DELETE, or...

Mandriva Linux Security Advisory : gnupg (MDVSA-2013:205)

A vulnerability has been discovered and corrected in gnupg and in libgcrypt : Yarom and Falkner discovered that RSA secret keys in applications using GnuPG 1.x, and using the libgcrypt library, could be leaked via a side channel attack, where a malicious local user could obtain private key...

[ MDVSA-2013:199 ] squid

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:199 http://www.mandriva.com/en/support/security/ Package : squid Date : July 25, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: Multiple vulnerabilities has been discovered an...

Mandriva Linux Security Advisory : squid (MDVSA-2013:199)

Multiple vulnerabilities has been discovered and corrected in squid : Due to incorrect data validation Squid is vulnerable to a buffer overflow attack when processing specially crafted HTTP requests. This problem allows any trusted client or client script who can generate HTTP requests to trigger...

[ MDVSA-2013:195 ] php

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:195 http://www.mandriva.com/en/support/security/ Package : php Date : July 12, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: A vulnerability has been discovered and corrected...

[ MDVSA-2013:192 ] php-radius

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:192 http://www.mandriva.com/en/support/security/ Package : php-radius Date : July 2, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: A security vulnerability was discovered and...

Mandriva Linux Security Advisory : apache-mod_security (MDVSA-2013:187)

Updated apache-modsecurity packages fix security vulnerability : When ModSecurity receives a request body with a size bigger than the value set by the SecRequestBodyInMemoryLimit and with a Content-Type that has no request body processor mapped to it, ModSecurity will systematically crash on ever...

Mandriva Linux Security Advisory : otrs (MDVSA-2013:188)

Updated otrs package fixes security vulnerabilities : An attacker with a valid agent login could manipulate URLs in the ticket watch mechanism to see contents of tickets they are not permitted to see CVE-2013-3551, CVE-2013-4088. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptiv...

Mandriva Linux Security Advisory : fail2ban (MDVSA-2013:191)

Updated fail2ban packages fix CVE-2013-2178 Krzysztof Katowicz-Kowalewski discovered a vulnerability in Fail2ban, a log monitoring and system which can act on attack by preventing hosts to connect to specified services using the local firewall. When using Fail2ban to monitor Apache logs, improper...

Mandriva Linux Security Advisory : php-radius (MDVSA-2013:192)

A security vulnerability was discovered and fixed in php-radius. Fix a security issue in radiusgetvendorattr by enforcing checks of the VSA length field against the buffer size CVE-2013-2220. The updated packages have been upgraded to the 1.2.7 version which is not affected by this issue...

[ MDVSA-2013:180 ] curl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:180 http://www.mandriva.com/en/support/security/ Package : curl Date : June 27, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: A vulnerability has been discovered and correcte...

[ MDVSA-2013:178 ] nfs-utils

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:178 http://www.mandriva.com/en/support/security/ Package : nfs-utils Date : June 25, 2013 Affected: Business Server 1.0 Problem Description: Updated nfs-utils packages fix security vulnerability It was...

Mandriva Linux Security Advisory : puppet (MDVSA-2013:186)

Updated puppet packages fix remote code execution vulnerability When making REST api calls, the puppet master takes YAML from an untrusted client, deserializes it, and then calls methods on the resulting object. A YAML payload can be crafted to cause the deserialization to construct an instance o...

Mandriva Linux Security Advisory : java-1.7.0-openjdk (MDVSA-2013:183)

Updated java-1.7.0-openjdk packages fix multiple security vulnerabilities Multiple flaws were discovered in the ImagingLib and the image attribute, channel, layout and raster processing in the 2D component. An untrusted Java application or applet could possibly use these flaws to trigger Java...

Mandriva Linux Security Advisory : mesa (MDVSA-2013:182)

Updated mesa packages fix multiple vulnerabilities An out-of-bounds access flaw was found in Mesa. If an application using Mesa exposed the Mesa API to untrusted inputs Mozilla Firefox does this, an attacker could cause the application to crash or, potentially, execute arbitrary code with the...

Mandriva Linux Security Advisory : perl-Dancer (MDVSA-2013:184)

Updated perl-Dancer package fixes CVE-2012-5572 A security flaw was found in the way Dancer.pm, lightweight yet powerful web application framework / Perl language module, performed sanitization of values to be used for cookie and cookies methods. A remote attacker could use this flaw to inject...