Mandriva Linux Security Advisory : automake (MDVSA-2013:031)

A vulnerability has been discovered and corrected in automake : A race condition in automake lib/am/distdir.am could allow a local attacker to run arbitrary code with the privileges of the user running make distcheck CVE-2012-3386. The updated packages have been patched to correct this issue. NOT...

Mandriva Linux Security Advisory : nss-pam-ldapd (MDVSA-2013:106)

Updated nss-pam-ldapd packages fixes the following security vulnerability : Garth Mollett discovered that a file descriptor overflow issue in the use of FDSET in nss-pam-ldapd can lead to a stack-based buffer overflow. An attacker could, under some circumstances, use this flaw to cause a process...

Mandriva Linux Security Advisory : bip (MDVSA-2013:063)

Updated bip package fixes security vulnerability : Buffer overflow in Bip 0.8.8 and earlier might allow remote authenticated users to execute arbitrary code via vectors involving a series of TCP connections that triggers use of many open file descriptors CVE-2012-0806. %NASLMINLEVEL 70300 C Tenab...

Mandriva Linux Security Advisory : gegl (MDVSA-2013:081)

Updated gegl packages fix security vulnerability : An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way the gegl utility processed .ppm Portable Pixel Map image files. An attacker could create a specially crafted .ppm file that, when opened in gegl, would cause...

Mandriva Linux Security Advisory : keepalived (MDVSA-2013:096)

Updated keepalived package fixes security vulnerability : The pidfilewrite function in core/pidfile.c in keepalived 1.2.2 and earlier uses 0666 permissions for the 1 keepalived.pid, 2 checkers.pid, and 3 vrrp.pid files in /var/run/, which allows local users to kill arbitrary processes by writing ...

Mandriva Linux Security Advisory : quagga (MDVSA-2013:122)

Updated quagga package fixes security vulnerability : The bgpcapabilityorf function in bgpd in Quagga 0.99.20.1 and earlier allows remote attackers to cause a denial of service assertion failure and daemon exit by leveraging a BGP peering relationship and sending a malformed Outbound Route...

Mandriva Linux Security Advisory : wireshark (MDVSA-2013:055)

Multiple vulnerabilities has been found and corrected in wireshark : Infinite and large loops in ANSI MAP, BACapp, Bluetooth HCI, IEEE 802.3, LTP, and R3 dissectors have been fixed. Discovered by Laurent Butti http://www.wireshark.org/security/wnpa-sec-2012-08.html CVE-2012-2392 The DIAMETER...

Mandriva Linux Security Advisory : bind (MDVSA-2013:058)

A security issue was identified and fixed in ISC BIND : libdns in ISC BIND 9.7.x and 9.8.x before 9.8.4-P2, 9.8.5 before 9.8.5b2, 9.9.x before 9.9.2-P2, and 9.9.3 before 9.9.3b2 on UNIX platforms allows remote attackers to cause a denial of service memory consumption via a crafted regular...

Mandriva Linux Security Advisory : qemu (MDVSA-2013:121)

Updated qemu packages fix security vulnerability : A flaw was found in how qemu, in snapshot mode -snapshot command line argument, handled the creation and opening of the temporary file used to store the difference of the virtualized guest's read-only image and the current state. In snapshot mode...

Mandriva Linux Security Advisory : hplip (MDVSA-2013:088)

This hplip update addresses the folloving issues : Print/Fax queues can now be analyzed by running hp-diagnose-queues fixes some issues and duplex scanning support with newer AIO devices fixes Wireless configuration using hp-wificonfig command for HP Deskjet 3000 J310 series and HP Deskjet 3050...

Mandriva Linux Security Advisory : stunnel (MDVSA-2013:130)

Updated stunnel packages fix security vulnerability : stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not correctly perform integer conversion, which allows remote proxy servers to execute arbitrary code via a crafted request that triggers a...

Mandriva Linux Security Advisory : socat (MDVSA-2013:127)

Updated socat package fixes security vulnerability : Heap-based buffer overflow in the xioscanreadline function in xio-readline.c in socat 1.4.0.0 through 1.7.2.0 and 2.0.0-b1 through 2.0.0-b4 allows local users to execute arbitrary code via the READLINE address CVE-2012-0219. %NASLMINLEVEL 70300...

Mandriva Linux Security Advisory : jakarta-poi (MDVSA-2013:094)

Updated jakarta-poi packages fix security vulnerability : It was discovered that Apache POI, a Java implementation of the Microsoft Office file formats, would allocate arbitrary amounts of memory when processing crafted documents. This could impact the stability of the Java virtual machine...

Mandriva Linux Security Advisory : open-iscsi (MDVSA-2013:109)

Updated open-iscsi package fixes security vulnerability : Colin Watson discovered that iscsidiscovery in Open-iSCSI did not safely create temporary files. A local attacker could exploit this to overwrite arbitrary files with root privileges CVE-2009-1297. %NASLMINLEVEL 70300 C Tenable Network...

Mandriva Linux Security Advisory : gnutls (MDVSA-2013:040)

Nadhem Alfardan and Kenny Paterson devised an attack that recovers some bits of the plaintext of a GnuTLS session that utilizes that CBC ciphersuites, by using timing information CVE-2013-1619. The gnutls package has been updated to latest 3.0.28 version to fix above problem. %NASLMINLEVEL 70300 ...

Mandriva Linux Security Advisory : openslp (MDVSA-2013:111)

Updated openslp packages fix security vulnerability : The extension parser in slpv2message.c in OpenSLP 1.2.1 allows remote attackers to cause a denial of service infinite loop via a packet with a next extension offset that references this extension or a previous extension CVE-2010-3609...

Mandriva Linux Security Advisory : ncpfs (MDVSA-2013:048)

Multiple vulnerabilities has been discovered and corrected in ncpfs : ncpfs 2.2.6 and earlier attempts to use 1 ncpmount to append to the /etc/mtab file and 2 ncpumount to append to the /etc/mtab.tmp file without first checking whether resource limits would interfere, which allows local users to...

Mandriva Linux Security Advisory : html2ps (MDVSA-2013:041)

A vulnerability has been found and corrected in html2ps : Directory traversal vulnerability in html2ps before 1.0b7 allows remote attackers to read arbitrary files via directory traversal sequences in SSI directives CVE-2009-5067. The updated packages have been upgraded to the 1.0b7 version which...

Mandriva Linux Security Advisory : groff (MDVSA-2013:086)

Multiple vulnerabilities has been found and corrected in groff : contrib/pdfmark/pdfroff.sh in GNU troff aka groff before 1.21 allows local users to overwrite arbitrary files via a symlink attack on a pdf.tmp temporary file CVE-2009-5044. The 1 gendef.sh, 2 doc/fixinfo.sh, and 3...

Mandriva Linux Security Advisory : icecast (MDVSA-2013:091)

Updated icecast package fixes security vulnerability : Icecast didn't strip newlines from log entries, therefore allowing users to forge log entries CVE-2011-4612 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandri...