Mandriva Linux Security Advisory : ghostscript (MDVSA-2008:055)

Chris Evans found a buffer overflow condition in Ghostscript, which can lead to arbitrary code execution as the user running any application using it to process a maliciously crafted Postscript file. The updated packages have been patched to prevent this issue. %NASLMINLEVEL 70300 C Tenable Netwo...

Mandriva Linux Security Advisory : wireshark (MDVSA-2008:199)

A number of vulnerabilities were discovered in Wireshark that could cause it to crash while processing malicious packets CVE-2008-3146, CVE-2008-3932, CVE-2008-3933, CVE-2008-3934. This update provides Wireshark 1.0.3, which is not vulnerable to these issues. %NASLMINLEVEL 70300 C Tenable Network...

Mandriva Linux Security Advisory : krb5 (MDVSA-2008:069)

Multiple memory management flaws were found in the GSSAPI library used by Kerberos that could result in the use of already freed memory or an attempt to free already freed memory, possibly leading to a crash or allowing the execution of arbitrary code CVE-2007-5901, CVE-2007-5971. A flaw was...

Mandriva Linux Security Advisory : evolution (MDVSA-2008:111)

Alan Rad Pop of Secunia Research discovered the following two vulnerabilities in Evolution : Evolution did not properly validate timezone data when processing iCalendar attachments. If a user disabled the Itip Formatter plugin and viewed a crafted iCalendar attachment, an attacker could cause a...

Mandriva Linux Security Advisory : openssl (MDVSA-2009:087)

A security vulnerability has been identified and fixed in OpenSSL, which could crash applications using OpenSSL library when parsing malformed certificates CVE-2009-0590. The updated packages have been patched to prevent this. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Mandriva Linux Security Advisory : libxml2 (MDVSA-2008:010)

A denial of service flaw was discovered by the Google Security Team in the way libxml2 processes malformed XML content. This flaw could cause the application to stop responding. The updated packages have been patched to correct this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Mandriva Linux Security Advisory : net-snmp (MDVSA-2009:056)

A vulnerability has been identified and corrected in net-snmp : The netsnmpudpfmtaddr function snmplib/snmpUDPDomain.c in net-snmp 5.0.9 through 5.4.2, when using TCP wrappers for client authorization, does not properly parse hosts.allow rules, which allows remote attackers to bypass intended...

Mandriva Linux Security Advisory : mod_perl (MDVSA-2009:091-1)

A vulnerability has been found and corrected in modperl v1.x and v2.x : Cross-site scripting XSS vulnerability in Status.pm in Apache::Status and Apache2::Status in modperl1 and modperl2 for the Apache HTTP Server, when /perl-status is accessible, allows remote attackers to inject arbitrary web...

Mandriva Linux Security Advisory : emacs (MDVSA-2008:034)

The hack-local-variable function in Emacs 22 prior to version 22.2, when enable-local-variables is set to ':safe', did not properly search lists of unsafe or risky variables, which could allow user-assisted attackers to bypass intended restrictions and modify critical program variables via a file...

Mandriva Linux Security Advisory : nasm (MDVSA-2008:120)

An off-by-one error was found in nasm 2.02 that allowed context-dependent attackers to cause a denial of service crash or possibly execute arbitrary code via a crafted file that triggers a stack-based buffer overflow CVE-2008-2719. The updated packages have been patched to prevent this issue...

Mandriva Linux Security Advisory : php (MDVSA-2008:126)

A number of vulnerabilities have been found and corrected in PHP : PHP 5.2.1 would allow context-dependent attackers to read portions of heap memory by executing certain scripts with a serialized data input string beginning with 'S:', which did not properly track the number of input bytes being...

Mandriva Linux Security Advisory : wireshark (MDVSA-2009:058)

Buffer overflow in wiretap/netscreen.c in Wireshark 0.99.7 through 1.0.5 allows user-assisted remote attackers to cause a denial of service application crash via a malformed NetScreen snoop file. CVE-2009-0599 Wireshark 0.99.6 through 1.0.5 allows user-assisted remote attackers to cause a denial ...

Mandriva Linux Security Advisory : imlib2 (MDVSA-2008:123)

Stefan Cornelius discovered two buffer overflows in Imlib's image loaders for PNM and XPM images, which could possibly result in the execution of arbitrary code CVE-2008-2426. The updated packages have been patched to prevent this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Mandriva Linux Security Advisory : gstreamer0.10-plugins-base (MDVSA-2009:085)

Integer overflows in gstreamer0.10-plugins-base Base64 encoding and decoding functions related with glib2.0 issue CVE-2008-4316 may lead attackers to cause denial of service. Altough vector attacks are not known yet CVE-2009-0586. This update provide the fix for that security issue. %NASLMINLEVEL...

Mandriva Linux Security Advisory : php (MDVSA-2008:128)

A number of vulnerabilities have been found and corrected in PHP : php-cgi in PHP prior to 5.2.6 does not properly calculate the length of PATHTRANSLATED, which has unknown impact and attack vectors CVE-2008-0599. The escapeshellcmd API function in PHP prior to 5.2.6 has unknown impact and...

Mandriva Linux Security Advisory : mozilla-firefox (MDVSA-2008:228)

Security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox 2.x, version 2.0.0.18 CVE-2008-0017, CVE-2008-5012, CVE-2008-5013, CVE-2008-5014, CVE-2008-5017, CVE-2008-5018, CVE-2008-5019, CVE-2008-5021, CVE-2008-5022, CVE-2008-5023, CVE-2008-5024, CVE-2008-5052. This...

Mandriva Linux Security Advisory : kernel (MDVSA-2008:044)

The waittaskstopped function in the Linux kernel before 2.6.23.8 checks a TASKTRACED bit instead of an exitstate value, which allows local users to cause a denial of service machine crash via unspecified vectors. NOTE: some of these details are obtained from third-party information. CVE-2007-5500...

Mandriva Linux Security Advisory : libexif (MDVSA-2008:005)

An infinite recursion flaw was found in the way that libexif parses Exif image tags. A carefully crafted Exif image file opened by an application linked against libexif could cause the application to crash CVE-2007-6351. An integer overflow flaw was also found in how libexif parses Exif image tag...

Mandriva Linux Security Advisory : mozilla-firefox (MDVSA-2008:205)

Security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox program, version 2.0.0.17 CVE-2008-0016, CVE-2008-3835, CVE-2008-3836, CVE-2008-3837, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062, CVE-2008-4065, CVE-2008-4066, CVE-2008-4067,...

Mandriva Linux Security Advisory : mozilla-thunderbird (MDVSA-2008:206)

A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Thunderbird program, version 2.0.0.17 CVE-2008-0016, CVE-2008-3835, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062, CVE-2008-4065, CVE-2008-4066, CVE-2008-4067, CVE-2008-4068,...