Mandriva Linux Security Advisory : glibc (MDVSA-2011:179)

Multiple vulnerabilities was discovered and fixed in glibc : The addmntent function in the GNU C Library aka glibc or libc6 2.13 and earlier does not report an error status for failed attempts to write to the /etc/mtab file, which makes it easier for local users to trigger corruption of this file...

Mandriva Linux Security Advisory : wireshark (MDVSA-2012:042)

Multiple vulnerabilities was found and corrected in Wireshark : - The ANSI A dissector could dereference a NULL pointer and crash. - The IEEE 802.11 dissector could go into an infinite loop. - The pcap and pcap-ng file parsers could crash trying to read ERF data. - The MP2T dissector could try to...

Mandriva Linux Security Advisory : wireshark (MDVSA-2011:164)

This advisory updates wireshark to the latest version 1.6.3, fixing several security issues : An uninitialized variable in the CSN.1 dissector could cause a crash CVE-2011-4100. Huzaifa Sidhpurwala of Red Hat Security Response Team discovered that the Infiniband dissector could dereference a NULL...

Mandriva Linux Security Advisory : libtiff (MDVSA-2012:127)

A vulnerability was found and corrected in libtiff : A heap-based buffer overflow flaw was found in the way tiff2pdf, a TIFF image to a PDF document conversion tool, of libtiff, a library of functions for manipulating TIFF Tagged Image File Format image format files, performed write of TIFF image...

Mandriva Linux Security Advisory : perl-DBD-Pg (MDVSA-2012:112)

A vulnerability has been discovered and corrected in perl-DBD-Pg : Two format string flaws were found in the way perl-DBD-Pg. A rogue server could provide a specially crafted database warning or specially crafted DBD statement, which once processed by the perl-DBD-Pg interface would lead to...

Mandriva Linux Security Advisory : bind (MDVSA-2012:119)

A vulnerability was discovered and corrected in bind : High numbers of queries with DNSSEC validation enabled can cause an assertion failure in named, caused by using a bad cache data structure before it has been initialized CVE-2012-3817. The updated packages have been upgraded to bind 9.7.6-P2...

Mandriva Linux Security Advisory : squid (MDVSA-2011:193)

A vulnerability has been discovered and corrected in squid : The idnsGrokReply function in Squid before 3.1.16 does not properly free memory, which allows remote attackers to cause a denial of service daemon abort via a DNS reply containing a CNAME record that references another CNAME record that...

Mandriva Linux Security Advisory : arpwatch (MDVSA-2012:113)

A vulnerability has been discovered and corrected in arpwatch : arpwatch 2.1a15, as used by Red Hat, Debian, Fedora, and possibly others, does not properly drop supplementary groups, which might allow attackers to gain root privileges by leveraging other vulnerabilities in the daemon CVE-2012-265...

Mandriva Linux Security Advisory : usbmuxd (MDVSA-2012:133)

It was discovered that usbmuxd did not correctly perform bounds checking when processing the SerialNumber field of USB devices. An attacker with physical access could use this to crash usbmuxd or potentially execute arbitrary code as the 'usbmux' user CVE-2012-0065. The updated packages have been...

Mandriva Linux Security Advisory : ffmpeg (MDVSA-2012:148)

Multiple vulnerabilities has been found and corrected in ffmpeg. This advisory provides updated versions which resolves various security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandriva Linux Security...

Mandriva Linux Security Advisory : libxslt (MDVSA-2012:109)

A vulnerability has been discovered and corrected in libxslt : The XSL implementation in libxslt allows remote attackers to cause a denial of service incorrect read operation via unspecified vectors CVE-2012-2825. The updated packages have been patched to correct this issue. %NASLMINLEVEL 70300 C...

Mandriva Linux Security Advisory : gimp (MDVSA-2012:142)

Multiple vulnerabilities has been discovered and corrected in gimp : A heap-based buffer overflow flaw, leading to invalid free, was found in the way KISS CEL file format plug-in of Gimp, the GNU Image Manipulation Program, performed loading of certain palette files. A remote attacker could provi...

Mandriva Linux Security Advisory : wireshark (MDVSA-2012:134)

Multiple vulnerabilities was found and corrected in Wireshark : The DCP ETSI dissector could trigger a zero division CVE-2012-4285. The MongoDB dissector could go into a large loop CVE-2012-4287. The XTP dissector could go into an infinite loop CVE-2012-4288. The AFP dissector could go into a lar...

Mandriva Linux Security Advisory : pidgin (MDVSA-2012:082)

Multiple vulnerabilities has been discovered and corrected in pidgin : A series of specially crafted file transfer requests can cause clients to reference invalid memory. The user must have accepted one of the file transfer requests CVE-2012-2214. Incoming messages with certain characters or...

Mandriva Linux Security Advisory : mozilla (MDVSA-2011:192)

Security issues were identified and fixed in mozilla firefox and thunderbird : The SVG implementation in Mozilla Firefox 8.0, Thunderbird 8.0, and SeaMonkey 2.5 does not properly interact with DOMAttrModified event handlers, which allows remote attackers to cause a denial of service out-of-bounds...

Mandriva Linux Security Advisory : cups (MDVSA-2011:147)

A vulnerability has been discovered and corrected in cups : The gifreadlzw function in filter/image-gif.c in CUPS 1.4.8 and earlier does not properly handle the first code word in an LZW stream, which allows remote attackers to trigger a heap-based buffer overflow, and possibly execute arbitrary...

Mandriva Linux Security Advisory : mono (MDVSA-2012:140)

A vulnerability has been discovered and corrected in mono : Cross-site scripting XSS vulnerability in the ProcessRequest function in mcs/class/System.Web/System.Web/HttpForbiddenHandler.cs in Mono 2.10.8 and earlier allows remote attackers to inject arbitrary web script or HTML via a file with a...

Mandriva Linux Security Advisory : busybox (MDVSA-2012:129-1)

Multiple vulnerabilities was found and corrected in busybox : The decompress function in ncompress allows remote attackers to cause a denial of service crash, and possibly execute arbitrary code, via crafted data that leads to a buffer underflow CVE-2006-1168. A missing DHCP option checking /...

Mandriva Linux Security Advisory : python-sqlalchemy (MDVSA-2012:059)

It was discovered that SQLAlchemy did not sanitize values for the limit and offset keywords for SQL select statements. If an application using SQLAlchemy accepted values for these keywords, and did not filter or sanitize them before passing them to SQLAlchemy, it could allow an attacker to perfor...

Mandriva Linux Security Advisory : freeradius (MDVSA-2012:047)

A vulnerability has been found and corrected in freeradius : The ocspcheck function in rlmeaptls.c in FreeRADIUS 2.1.11, when OCSP is enabled, does not properly parse replies from OCSP responders, which allows remote attackers to bypass authentication by using the EAP-TLS protocol with a revoked...