Mandriva Linux Security Advisory : python (MDVSA-2008:163)

Multiple integer overflows in the imageop module in Python prior to 2.5.3 allowed context-dependent attackers to cause a denial of service crash or possibly execute arbitrary code via crafted images that trigger heap-based buffer overflows CVE-2008-1679. This was due to an incomplete fix for...

Mandriva Linux Security Advisory : pulseaudio (MDVSA-2008:065)

Luigi Auriemma found a few programming errors in Pulseaudio, that can be used to crash the Pulseaudio daemon, by authenticated and unauthenticated users. The updated packages fix these issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Mandriva Linux Security Advisory : squid (MDVSA-2009:034)

Due to an internal error Squid is vulnerable to a denial of service attack when processing specially crafted requests. This problem allows any client to perform a denial of service attack on the Squid service CVE-2009-0478. The updated packages have been patched to adress this. %NASLMINLEVEL 7030...

Mandriva Linux Security Advisory : pidgin (MDVSA-2009:025)

The NSS plugin in libpurple in Pidgin 2.4.1 does not verify SSL certificates, which makes it easier for remote attackers to trick a user into accepting an invalid server certificate for a spoofed service. CVE-2008-3532 Pidgin 2.4.1 allows remote attackers to cause a denial of service crash via a...

Mandriva Linux Security Advisory : clamav (MDVSA-2008:189-1)

Multiple vulnerabilities were discovered in ClamAV and corrected with the 0.94 release, including : A vulnerability in ClamAV's chm-parser allowed remote attackers to cause a denial of service application crash via a malformed CHM file CVE-2008-1389. A vulnerability in libclamav would allow...

Mandriva Linux Security Advisory : hplip (MDVSA-2008:169)

Marc Schoenefeld of the Red Hat Security Response Team discovered a vulnerability in the hplip alert-mailing functionality that could allow a local attacker to elevate their privileges by using specially crafted packets to trigger alert mails that are sent by the root account CVE-2008-2940. Anoth...

Mandriva Linux Security Advisory : opensc (MDVSA-2008:183)

Chaskiel M Grundman found that OpenSC would initialize smart cards with the Siemens CardOS M4 card operating system without proper access rights. This allowed everyone to change the card's PIN without first having the PIN or PUK, or the superuser's PIN or PUK CVE-2008-2235. Please note that this...

Mandriva Linux Security Advisory : clamav (MDVSA-2008:229)

An off-by-one error was found in ClamAV versions prior to 0.94.1 that could allow remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted VBA project file CVE-2008-5050. Other bugs have also been corrected in 0.94.1 which is being provided with this update...

Mandriva Linux Security Advisory : bzip2 (MDVSA-2008:075)

Bzip2 versions before 1.0.5 are vulnerable to a denial of service attack via malicious compressed data. The updated packages have been patched to prevent the issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

Mandriva Linux Security Advisory : net-snmp (MDVSA-2008:118)

A vulnerability was found in how Net-SNMP checked an SNMPv3 packet's Keyed-Hash Message Authentication Code HMAC. An attacker could exploit this flaw to spoof an authenticated SNMPv3 packet CVE-2008-0960. A buffer overflow was found in the perl bindings for Net-SNMP that could be exploited if an...

Mandriva Linux Security Advisory : pam_mount (MDVSA-2008:208-1)

pammount 0.10 through 0.45, when luserconf is enabled, does not verify mountpoint and source ownership before mounting a user-defined volume, which allows local users to bypass intended access restrictions via a local mount. The updated packages have been patched to fix the issue. Update : The fi...

Mandriva Linux Security Advisory : policykit (MDVSA-2008:087)

A format string vulnerability in the grant helper, in PolicyKit 0.7 and earlier, allows attackers to cause a denial of service crash and possibly execute arbitrary code via format strings in a password. The updated package has been patched to correct this issue. %NASLMINLEVEL 70300 C Tenable...

Mandriva Linux Security Advisory : libexif (MDVSA-2008:005)

An infinite recursion flaw was found in the way that libexif parses Exif image tags. A carefully crafted Exif image file opened by an application linked against libexif could cause the application to crash CVE-2007-6351. An integer overflow flaw was also found in how libexif parses Exif image tag...

Mandriva Linux Security Advisory : openldap (MDVSA-2008:144)

A denial of service vulnerability was discovered in the way the OpenLDAP slapd daemon processed certain network messages. An unauthenticated remote attacker could send a specially crafted request that would crash the slapd daemon CVE-2008-2952. The updated packages have been patched to correct th...

Mandriva Linux Security Advisory : python-pycrypto (MDVSA-2009:050-1)

A vulnerability have been discovered and corrected in PyCrypto ARC2 module 2.0.1, which allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large ARC2 key length CVE-2009-0544. The updated packages have been patched to prevent this. Update : The previous...

Mandriva Linux Security Advisory : mysql (MDVSA-2009:094)

Multiple vulnerabilities has been found and corrected in mysql : MySQL 5.0 before 5.0.66, 5.1 before 5.1.26, and 6.0 before 6.0.6 does not properly handle a b'' b single-quote single-quote token, aka an empty bit-string literal, which allows remote attackers to cause a denial of service daemon...

Mandriva Linux Security Advisory : gnutls (MDVSA-2008:106)

Flaws discovered in versions prior to 2.2.4 stable and 2.3.10 development of GnuTLS allow an attacker to cause denial of service application crash, and maybe so far undetermined execute arbitrary code. The updated packages have been patched to fix these flaws. Note that any applications using thi...

Mandriva Linux Security Advisory : squid (MDVSA-2008:134)

An incorrect fix for CVE-2007-6239 resulted in Squid not performing proper bounds checking when processing cache update replies. Because of this, a remote authenticated user might have been able to trigger an assertion error and cause a denial of service CVE-2008-1612. The updated packages have...

Mandriva Linux Security Advisory : libsamplerate (MDVSA-2008:238)

A buffer overflow was found by Russell O'Conner in the libsamplerate library versions prior to 0.1.4 that could possibly lead to the execution of arbitrary code via a specially crafted audio file CVE-2008-5008. The updated packages have been patched to prevent this issue. %NASLMINLEVEL 70300 C...

Mandriva Linux Security Advisory : libid3tag (MDVSA-2008:103)

field.c in the libid3tag 0.15.0b library allows context-dependent attackers to cause a denial of service CPU and memory consumption via an ID3FIELDTYPESTRINGLIST field that ends in '', which triggers an infinite loop. The updated packages have been patched to correct this. %NASLMINLEVEL 70300 C...