Mandriva Linux Security Advisory : otrs (MDVSA-2014:111)

Updated otrs package fixes security vulnerabilities : A logged in attacker could insert special content in dynamic fields, leading to JavaScript code being executed in OTRS CVE-2014-2553. An attacker could embed OTRS in a hidden iframe tag of another page, tricking the user into clicking links in...

Mandriva Linux Security Advisory : wordpress (MDVSA-2014:103)

Multiple vulnerabilities has been discovered and corrected in wordpress : WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php...

Mandriva Linux Security Advisory : rxvt-unicode (MDVSA-2014:094)

Updated rxvt-unicode package fixes security vulnerability : rxvt-unicode aka urxvt before 9.20 is vulnerable to a user-assisted arbitrary commands execution issue. This can be exploited by the unprocessed display of certain escape sequences in a crafted text file or program output. Arbitrary...

Mandriva Linux Security Advisory : python-jinja2 (MDVSA-2014:096)

Updated python-jinja2 packages fix security vulnerability : Jinja2, a template engine written in pure python, was found to use /tmp as a default directory for jinja2.bccache.FileSystemBytecodeCache, which is insecure because the /tmp directory is world-writable and the filenames used like...

Mandriva Linux Security Advisory : nagios (MDVSA-2014:089)

Updated nagios packages fix security vulnerability : Stack-based buffer overflow in the cmdsubmitf function in cgi/cmd.c in Nagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9 before 1.9.5, and 1.10 before 1.10.3 allows remote attackers to cause a denial of service segmentati...

Mandriva Linux Security Advisory : libvirt (MDVSA-2014:097)

Multiple vulnerabilities has been discovered and corrected in libvirt : The LXC driver lxc/lxcdriver.c in libvirt 1.0.1 through 1.2.1 allows local users to 1 delete arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container; 2 create arbitrary nodes...

Mandriva Linux Security Advisory : owncloud (MDVSA-2014:101)

Updated owncloud packages fix security vulnerabilities : Owncloud versions 5.0.16 and 6.0.3 fix several unspecified security vulnerabilities, as well as many other bugs. See the upstream Changelog for more information. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Mandriva Linux Security Advisory : egroupware (MDVSA-2014:104)

Updated egroupware packages fix security vulnerabilities : eGroupWare before 1.8.007 allows logged in users with administrative priviledges to remotely execute arbitrary commands on the server. It is also vulnerable to a cross site request forgery vulnerability that allows creating new...

Mandriva Linux Security Advisory : couchdb (MDVSA-2014:093)

Updated couchdb packages fix security vulnerability : Apache CouchDB 1.5.0 and earlier allows remote attackers to cause a denial of service CPU and memory consumption via the count parameter to /uuids CVE-2014-2668. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Mandriva Linux Security Advisory : openssl (MDVSA-2014:090)

Updated openssl packages fix security vulnerability : A read buffer can be freed even when it still contains data that is used later on, leading to a use-after-free. Given a race condition in a multi-threaded application it may permit an attacker to inject data from one connection into another or...

Mandriva Linux Security Advisory : dovecot (MDVSA-2014:099)

A vulnerability has been discovered and corrected in dovecot : Dovecot 1.1 before 2.2.13 and dovecot-ee before 2.1.7.7 and 2.2.x before 2.2.12.12 does not properly close old connections, which allows remote attackers to cause a denial of service resource consumption via an incomplete SSL/TLS...

Mandriva Linux Security Advisory : mariadb (MDVSA-2014:102)

Multiple vulnerabilities has been discovered and corrected in mariadb : Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.35 and earlier and 5.6.15 and earlier allows remote authenticated users to affect availability via vectors related to XML CVE-2014-0384. Unspecified...

Mandriva Linux Security Advisory : rawtherapee (MDVSA-2014:098)

Updated rawtherapee package fixes security vulnerability : Due to flaws in the embedded copy of dcraw in rawtherapee, corrupt input files might trigger a division by zero, an infinite loop, or a NULL pointer dereference CVE-2013-1438. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

[ MDVSA-2014:084 ] libpng

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:084 http://www.mandriva.com/en/support/security/ Package : libpng Date : May 12, 2014 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: Updated libpng packages fix security...

Mandriva Linux Security Advisory : ldns (MDVSA-2014:085)

Updated ldns packages fix security vulnerability : ldns-keygen creates a private key with the default permissions according to the users umask, which in most cases will cause the private key to be world-readable CVE-2014-3209. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Mandriva Linux Security Advisory : libpng (MDVSA-2014:084)

Updated libpng packages fix security vulnerabilities : An integer overflow leading to a heap-based buffer overflow was found in the pngsetsPLT and pngsettext2 API functions of libpng. An attacker could create a specially crafted image file and render it with an application written to explicitly...

Mandriva Linux Security Advisory : python-imaging (MDVSA-2014:082)

Updated python-imaging packages fix security vulnerabilities : Jakub Wilk discovered that temporary files were insecurely created via mktemp in the IptcImagePlugin.py, Image.py, JpegImagePlugin.py, and EpsImagePlugin.py files of Python Imaging Library. A local attacker could use this flaw to...

Mandriva Linux Security Advisory : apache-mod_security (MDVSA-2014:081)

Updated apache-modsecurity packages fix security vulnerability : Martin Holst Swende discovered a flaw in the way modsecurity handled chunked requests. A remote attacker could use this flaw to bypass intended modsecurity restrictions, allowing them to send requests containing content that should...

Mandriva Linux Security Advisory : openssl (MDVSA-2014:080)

Updated openssl packages fix security vulnerability : A NULL pointer dereference bug in OpenSSL 1.0.1g and earlier in sossl3write could possibly allow an attacker to cause generate an SSL alert which would cause OpenSSL to crash, resulting in a denial of service CVE-2014-0198. %NASLMINLEVEL 70300...

[ MDVSA-2014:054 ] otrs

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:054 http://www.mandriva.com/en/support/security/ Package : otrs Date : March 13, 2014 Affected: Business Server 1.0 Problem Description: Updated otrs package fixes security vulnerability: An attacker could...