Mandriva Linux Security Advisory : gstreamer0.10-plugins-good (MDVSA-2009:035)

Security vulnerabilities have been discovered and corrected in gstreamer0.10-plugins-good, might allow remote attackers to execute arbitrary code via a malformed QuickTime media file CVE-2009-0386, CVE-2009-0387, CVE-2009-0397. The updated packages have been patched to prevent this. %NASLMINLEVEL...

Mandriva Linux Security Advisory : ruby (MDVSA-2008:029)

Ruby network libraries Net::HTTP, Net::IMAP, Net::FTPTLS, Net::Telnet, Net::POP3, and Net::SMTP, up to Ruby version 1.8.6 are affected by a possible man-in-the-middle attack, when using SSL, due to a missing check of the CN common name attribute in SSL certificates against the server's hostname...

Mandriva Linux Security Advisory : shadow-utils (MDVSA-2009:062)

A security vulnerability has been identified and fixed in login application from shadow-utils, which could allow local users in the utmp group to overwrite arbitrary files via a symlink attack on a temporary file referenced in a line aka utline field in a utmp entry CVE-2008-5394. The updated...

Mandriva Linux Security Advisory : krb5 (MDVSA-2008:069)

Multiple memory management flaws were found in the GSSAPI library used by Kerberos that could result in the use of already freed memory or an attempt to free already freed memory, possibly leading to a crash or allowing the execution of arbitrary code CVE-2007-5901, CVE-2007-5971. A flaw was...

Mandriva Linux Security Advisory : emacs (MDVSA-2008:216)

A vulnerability was found in how Emacs would import python scripts from the current working directory during the editing of a python file. This could allow a local user to execute arbitrary code via a trojan python file CVE-2008-3949. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Mandriva Linux Security Advisory : pam_mount (MDVSA-2009:004)

passwdehd script in pammount would allow local users to overwrite arbitrary files via a symlink attack on a temporary file. The updated packages have been patched to prevent this. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Mandriva Linux Security Advisory : wireshark (MDVSA-2009:088)

Multiple vulnerabilities has been identified and corrected in wireshark : o The PROFINET dissector was vulnerable to a format string overflow CVE-2009-1210. o The Check Point High-Availability Protocol CPHAP dissecto could crash CVE-2009-1268. o Wireshark could crash while loading a Tektronix .rf...

MDVA-2008:026 : desktop-common-data

In Mandriva Linux 2008.0 some utilities were not correctly displayed in Tools menu such as Yakuake, and settings:// was not working properly in KDE konqueror. This update fixes the problems. %NASLMINLEVEL 70300 @DEPRECATED@ This script has been deprecated as the associated patch is not currently ...

Mandriva Linux Security Advisory : xterm (MDVSA-2009:005)

A vulnerability has been discovered in xterm, which can be exploited by malicious people to compromise a user's system. The vulnerability is caused due to xterm not properly processing the DECRQSS Device Control Request Status String escape sequence. This can be exploited to inject and execute...

MDVA-2008:091-1 : gnome-applets

The clock applet in GNOME could crash when using some specific locations or when using updated timezone data. The Recent Documents menu was not always able to start the right application for a specific document. Update: The previous gnome-applets package on x8664 was improperly built and included...

MDVA-2008:129 : apache-conf

The Apache init script did not take into consideration using non-default MPM's, which prevented it from properly handling httpd processes that were named, for example, httpd-worker rather than just httpd. This update corrects the init script to properly handle these non-default cases. %NASLMINLEV...

MDVA-2009:009 : kdemultimedia

A bug in KDE 3.5.10 as shipped with Mandriva Linux 2009.0, using the lame encode with the audiocd kioslave gives a noise sound as output. This updates fixes the issue. %NASLMINLEVEL 70300 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a security fix. Disable...

Mandriva Linux Security Advisory : net-snmp (MDVSA-2008:225)

A denial of service vulnerability was discovered in how Net-SNMP processed GETBULK requests. A remote attacker with read access to the SNMP server could issue a specially crafted request which would cause snmpd to crash CVE-2008-4309. Please note that for this to be successfully exploited, an...

Mandriva Linux Security Advisory : wml (MDVSA-2008:076)

Two vulnerabilities were found in the Website META Language WML package that allowed local users to overwrite arbitrary files via symlink attacks. The updated packages have been patched to correct these issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Mandriva Linux Security Advisory : xine-lib (MDVSA-2008:124)

A vulnerability in the Speex library was found where it did not properly validate input values read from the Speex files headers. An attacker could create a malicious Speex file that would crash an application or potentially allow the execution of arbitrary code with the privileges of the...

Mandriva Linux Security Advisory : samba (MDVSA-2008:108)

Secunia Research has discovered a vulnerability in Samba, which can be exploited by malicious people to compromise a vulnerable system. A boundary error within the receivesmbraw function in lib/utilsock.c can be exploited to cause a heap-based buffer overflow via an overly large SMB packet receiv...

Mandriva Linux Security Advisory : libcdaudio (MDVSA-2008:233-1)

A heap overflow was found in the CDDB retrieval code of libcdaudio, which could result in the execution of arbitrary code CVE-2008-5030. In addition, the fixes for CVE-2005-0706 were not applied to newer libcdaudio packages as shipped with Mandriva Linux, so the patch to fix that issue has been...

Mandriva Linux Security Advisory : mpg123 (MDVSA-2009:093-1)

A vulnerability has been found and corrected in mpg123 : Integer signedness error in the storeid3text function in the ID3v2 code in mpg123 before 1.7.2 allows remote attackers to cause a denial of service out-of-bounds memory access and possibly execute arbitrary code via an ID3 tag with a negati...

Mandriva Linux Security Advisory : nasm (MDVSA-2008:120)

An off-by-one error was found in nasm 2.02 that allowed context-dependent attackers to cause a denial of service crash or possibly execute arbitrary code via a crafted file that triggers a stack-based buffer overflow CVE-2008-2719. The updated packages have been patched to prevent this issue...

Mandriva Linux Security Advisory : tomcat5 (MDVSA-2008:188)

A number of vulnerabilities have been discovered in the Apache Tomcat server : The default catalina.policy in the JULI logging component did not restrict certain permissions for web applications which could allow a remote attacker to modify logging configuration options and overwrite arbitrary...