Mandriva Linux Security Advisory : dbus (MDVSA-2008:213)

The D-Bus library did not correctly validate certain corrupted signatures which could cause a crash of applications linked against the D-Bus library if a local user were to send a specially crafted D-Bus request CVE-2008-3834. The updated packages have been patched to prevent this issue...

Mandriva Linux Security Advisory : nss_ldap (MDVSA-2008:049)

A race condition in nssldap, when used in applications that use pthread and fork after a call to nssldap, does not properly handle the LDAP connection, which might cause nssldap to return the wrong user data to the wrong process, giving one user access to data belonging to another user, in some...

Mandriva Linux Security Advisory : mozilla-thunderbird (MDVSA-2009:012)

A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Thunderbird program, version 2.0.0.19 CVE-2008-5500, CVE-2008-5503, CVE-2008-5506, CVE-2008-5507, CVE-2008-5508, CVE-2008-5510, CVE-2008-5511, CVE-2008-5512. This update provides the latest Thunderbird t...

Mandriva Linux Security Advisory : sudo (MDVSA-2009:033)

A vulnerability has been identified in sudo which allowed - depending on the sudoers rules - a sudo-user to execute arbitrary shell commands as root CVE-2009-0034. The updated packages have been patched to prevent this. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Mandriva Linux Security Advisory : mysql (MDVSA-2008:028)

The mysqlchangedb function in MySQL 5.0.x before 5.0.40 did not restore THD::dbaccess privileges when returning from SQL SECURITY INVOKER stored routines, which allowed remote authenticated users to gain privileges CVE-2007-2692. The federated engine in MySQL 5.0.x, when performing a certain SHOW...

Mandriva Linux Security Advisory : wireshark (MDVSA-2008:215)

A number of vulnerabilities were discovered in Wireshark that could cause it to crash or abort while processing malicious packets CVE-2008-4680, CVE-2008-4681, CVE-2008-4682, CVE-2008-4683, CVE-2008-4684, CVE-2008-4685. This update provides Wireshark 1.0.4, which is not vulnerable to these issues...

Mandriva Linux Security Advisory : gnumeric (MDVSA-2008:056)

A vulnerability was found in the excelreadHLINK function in the Microsoft Excel plugin in Gnumeric prior to version 1.8.1 that would allow for the execution of arbitrary code via a crafted XLS file containing XLS HLINK opcodes. The updated packages have been patched to correct this issues...

Mandriva Linux Security Advisory : wireshark (MDVSA-2009:058)

Buffer overflow in wiretap/netscreen.c in Wireshark 0.99.7 through 1.0.5 allows user-assisted remote attackers to cause a denial of service application crash via a malformed NetScreen snoop file. CVE-2009-0599 Wireshark 0.99.6 through 1.0.5 allows user-assisted remote attackers to cause a denial ...

Mandriva Linux Security Advisory : mozilla-firefox (MDVSA-2008:205)

Security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox program, version 2.0.0.17 CVE-2008-0016, CVE-2008-3835, CVE-2008-3836, CVE-2008-3837, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062, CVE-2008-4065, CVE-2008-4066, CVE-2008-4067,...

Mandriva Linux Security Advisory : mozilla-firefox (MDVSA-2008:228)

Security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox 2.x, version 2.0.0.18 CVE-2008-0017, CVE-2008-5012, CVE-2008-5013, CVE-2008-5014, CVE-2008-5017, CVE-2008-5018, CVE-2008-5019, CVE-2008-5021, CVE-2008-5022, CVE-2008-5023, CVE-2008-5024, CVE-2008-5052. This...

Mandriva Linux Security Advisory : wireshark (MDVSA-2008:242)

Two vulnerabilities were discovered in Wireshark. The first is a vulnerability in the SMTP dissector that could cause it to consume excessive CPU and memory via a long SMTP request CVE-2008-5285. The second is an issue with the WLCCP dissector that could cause it to go into an infinite loop. This...

Mandriva Linux Security Advisory : avahi (MDVSA-2009:031)

A vulnerability has been discovered in Avahi before 0.6.24, which allows remote attackers to cause a denial of service crash via a crafted mDNS packet with a source port of 0 CVE-2008-5081. The updated packages have been patched to prevent this. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Mandriva Linux Security Advisory : xine-lib (MDVSA-2008:178)

Alin Rad Pop found an array index vulnerability in the SDP parser of xine-lib. If a user or automated system were tricked into opening a malicious RTSP stream, a remote attacker could possibly execute arbitrary code with the privileges of the user using the program CVE-2008-0073. The ASF demuxer ...

Mandriva Linux Security Advisory : krb5 (MDVSA-2008:070)

A memory management flaw was found in the GSSAPI library used by Kerberos that could result in an attempt to free already freed memory, possibly leading to a crash or allowing the execution of arbitrary code CVE-2007-5971. A flaw was discovered in how the Kerberos krb5kdc handled Kerberos v4...

Mandriva Linux Security Advisory : wireshark (MDVSA-2008:057)

A few vulnerabilities were found in Wireshark, that could cause it to crash or consume excessive memory under certain conditions. This update rovides Wireshark 0.99.8 which is not vulnerable to the issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package check...

Mandriva Linux Security Advisory : vim (MDVSA-2009:047-1)

Python has a variable called sys.path that contains all paths where Python loads modules by using import scripting procedure. A wrong handling of that variable enables local attackers to execute arbitrary code via Python scripting in the current Vim working directory CVE-2009-0316. This update...

Mandriva Linux Security Advisory : emacs (MDVSA-2008:096)

Steve Grubb found that the vcdiff script in Emacs create temporary files insecurely when used with SCCS. A local user could exploit a race condition to create or overwrite files with the privileges of the user invoking the program CVE-2008-1694. The updated packages have been patched to correct...

Mandriva Linux Security Advisory : samba (MDVSA-2009:042)

Samba 3.2.0 through 3.2.6, when registry shares are enabled, allows remote authenticated users to access the root filesystem via a crafted connection request that specifies a blank share name CVE-2009-0022. This update provides samba 3.2.7 to address this issue. %NASLMINLEVEL 70300 C Tenable...

Mandriva Linux Security Advisory : mozilla-firefox (MDVSA-2008:048)

A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox program, version 2.0.0.12. This update provides the latest Firefox to correct these issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Mandriva Linux Security Advisory : pcre (MDVSA-2008:053)

A buffer overflow in PCRE 7.x before 7.6 allows remote attackers to execute arbitrary code via a regular expression that contains a character class with a large number of characters with Unicode code points greater than 255. The updated packages have been patched to correct these issues...