Mandriva Linux Security Advisory : owncloud (MDVSA-2014:055)

Updated owncloud packages fix security vulnerabilities and bugs : Owncloud versions 5.0.15 and 6.0.2 fix several unspecified security vulnerabilities, as well as many other bugs. See the upstream Changelog for more information. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Mandriva Linux Security Advisory : libssh (MDVSA-2014:053)

Updated libssh package fixes security vulnerability : When using libssh before 0.6.3, a libssh-based server, when accepting a new connection, forks and the child process handles the request. The RANDbytes function of openssl doesn't reset its state after the fork, but simply adds the current...

[ MDVSA-2014:048 ] gnutls

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:048 http://www.mandriva.com/en/support/security/ Package : gnutls Date : March 10, 2014 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: Updated gnutls packages fix security...

Mandriva Linux Security Advisory : gnutls (MDVSA-2014:048)

Updated gnutls packages fix security vulnerability : It was discovered that GnuTLS did not correctly handle certain errors that could occur during the verification of an X.509 certificate, causing it to incorrectly report a successful verification. An attacker could use this flaw to create a...

Mandriva Linux Security Advisory : subversion (MDVSA-2014:049)

A vulnerability has been discovered and corrected in subversion : The getresource function in repos.c in the moddavsvn module in Apache Subversion before 1.7.15 and 1.8.x before 1.8.6, when SVNListParentPath is enabled, allows remote attackers to cause a denial of service crash via vectors relate...

Mandriva Linux Security Advisory : wireshark (MDVSA-2014:050)

Multiple vulnerabilities was found and corrected in Wireshark : - The NFS dissector could crash. Discovered by Moshe Kaplan CVE-2014-2281. - The RLC dissector could crash CVE-2014-2283. - The MPEG file parser could overflow a buffer. Discovered by Wesley Neelen CVE-2014-2299. This advisory provid...

[ MDVSA-2014:041 ] python

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:041 http://www.mandriva.com/en/support/security/ Package : python Date : February 19, 2014 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: A vulnerability was reported in Pythons...

[ MDVSA-2014:045 ] libtar

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:045 http://www.mandriva.com/en/support/security/ Package : libtar Date : February 20, 2014 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: A directory traversal attack was reported...

Mandriva Linux Security Advisory : phpmyadmin (MDVSA-2014:046)

A vulnerability has been discovered and corrected in phpmyadmin : Cross-site scripting XSS vulnerability in import.php in phpMyAdmin before 4.1.7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename in an import action CVE-2014-1879. This upgrade provide...

Mandriva Linux Security Advisory : libtar (MDVSA-2014:045)

A directory traversal attack was reported against libtar, a C library for manipulating tar archives. The application does not validate the filenames inside the tar archive, allowing to extract files in arbitrary path. An attacker can craft a tar file to override files beyond the tarextractglob an...

Mandriva Linux Security Advisory : gnutls (MDVSA-2014:043)

Updated gnutls packages fix security vulnerability : Suman Jana reported a vulnerability that affects the certificate verification functions of gnutls 3.1.x and gnutls 3.2.x. A version 1 intermediate certificate will be considered as a CA certificate by default something that deviates from the...

Mandriva Linux Security Advisory : python (MDVSA-2014:041)

A vulnerability was reported in Python's socket module, due to a boundary error within the sockrecvfrominto function, which could be exploited to cause a buffer overflow. This could be used to crash a Python application that uses the socket.recvfrominfo function or, possibly, execute arbitrary co...

Mandriva Linux Security Advisory : zarafa (MDVSA-2014:044)

Robert Scheck discovered multiple vulnerabilities in Zarafa that could allow a remote unauthenticated attacker to crash the zarafa-server daemon, preventing access to any other legitimate Zarafa users CVE-2014-0037, CVE-2014-0079. The updated packages have been upgraded to the 7.1.8 version which...

Mandriva Linux Security Advisory : puppet (MDVSA-2014:040)

A vulnerability has been discovered and corrected in puppet : Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise PE before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files CVE-2013-4969. The updated packages have been...

Mandriva Linux Security Advisory : libgadu (MDVSA-2014:039)

Updated libgadu packages fix security vulnerability : A malicious server or man-in-the-middle could send a large value for Content-Length and cause an integer overflow which could lead to a buffer overflow in Gadu-Gadu HTTP parsing CVE-2013-6487. %NASLMINLEVEL 70300 C Tenable Network Security, In...

[ MDVSA-2014:033 ] socat

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:033 http://www.mandriva.com/en/support/security/ Package : socat Date : February 14, 2014 Affected: Business Server 1.0 Problem Description: A vulnerability has been discovered and corrected in socat:...

Mandriva Linux Security Advisory : ffmpeg (MDVSA-2014:037)

Updated ffmpeg packages fix security vulnerabilities : This updates provides ffmpeg version 0.5.13 and 0.10.11, which fixes several unspecified security vulnerabilities and other bugs which were corrected upstream. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Mandriva Linux Security Advisory : varnish (MDVSA-2014:036)

Updated varnish packages fix security vulnerabilities : Varnish before 3.0.5 allows remote attackers to cause a denial of service child-process crash and temporary caching outage via a GET request with trailing whitespace characters and no URI CVE-2013-4484. Also, the services have been converted...

Mandriva Linux Security Advisory : libpng (MDVSA-2014:035)

Updated libpng and libpng12 packages fix security vulnerability : The pngdoexpandpalette function in libpng before 1.6.8 allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a PLTE chunk of zero bytes or a NULL palette, related to pngrtran.c and...

[ MDVSA-2014:035 ] libpng

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:035 http://www.mandriva.com/en/support/security/ Package : libpng Date : February 17, 2014 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: Updated libpng and libpng12 packages fix...