Mandriva Linux Security Advisory : perl-Dancer (MDVSA-2013:184)

Updated perl-Dancer package fixes CVE-2012-5572 A security flaw was found in the way Dancer.pm, lightweight yet powerful web application framework / Perl language module, performed sanitization of values to be used for cookie and cookies methods. A remote attacker could use this flaw to inject...

Mandriva Linux Security Advisory : dbus (MDVSA-2013:177)

Updated dbus packages fix security vulnerability. Alexandru Cornea discovered a vulnerability in libdbus caused by an implementation bug in dbusprintfstringupperbound. This vulnerability can be exploited by a local user to crash system services that use libdbus, causing denial of service. Dependi...

Mandriva Linux Security Advisory : apache (MDVSA-2013:174)

Multiple vulnerabilities has been found and corrected in apache : modrewrite.c in the modrewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP...

Mandriva Linux Security Advisory : subversion (MDVSA-2013:173)

Multiple vulnerabilities has been found and corrected in subversion : If a filename which contains a newline character ASCII 0x0a is committed to a repository using the FSFS format, the resulting revision is corrupt. This can lead to disruption for users of the repository CVE-2013-1968...

Mandriva Linux Security Advisory : wireshark (MDVSA-2013:172)

Multiple vulnerabilities has been found and corrected in wireshark : - The ASN.1 BER dissector could crash CVE-2013-3557. - The CAPWAP dissector could crash CVE-2013-4074. - The HTTP dissector could overrun the stack CVE-2013-4081. - The DCP ETSI dissector could crash CVE-2013-4083. This advisory...

[ MDVSA-2013:168 ] python-httplib2

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:168 http://www.mandriva.com/en/support/security/ Package : python-httplib2 Date : May 27, 2013 Affected: Business Server 1.0 Problem Description: Updated python-httplib2 packages fix security vulnerability:...

[ MDVSA-2013:167 ] openvpn

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:167 http://www.mandriva.com/en/support/security/ Package : openvpn Date : May 27, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: Updated openvpn package fixes security...

Mandriva Linux Security Advisory : socat (MDVSA-2013:170)

A vulnerability has been discovered and corrected in socat : Under certain circumstances an FD leak occurs and can be misused for denial of service attacks against socat running in server mode CVE-2013-3571. The updated packages have been upgraded to the latest version 1.7.2.2 which is not...

Mandriva Linux Security Advisory : openvpn (MDVSA-2013:167)

Updated openvpn package fixes security vulnerability : OpenVPN 2.3.0 and earlier running in UDP mode are subject to chosen ciphertext injection due to a non-constant-time HMAC comparison function. Plaintext recovery may be possible using a padding oracle attack on the CBC mode cipher implementati...

Mandriva Linux Security Advisory : python-httplib2 (MDVSA-2013:168)

Updated python-httplib2 packages fix security vulnerability : httplib2 only validates SSL certificates on the first request to a connection, and doesn't report validation failures on subsequent requests CVE-2013-2037. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Mandriva Linux Security Advisory : krb5 (MDVSA-2013:166)

A vulnerability has been discovered and corrected in krb5 : The kpasswd service provided by kadmind was vulnerable to a UDP ping-pong attack CVE-2002-2443. The updated packages have been patched to correct this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Mandriva Linux Security Advisory : mesa (MDVSA-2013:164)

Updated mesa packages fix security vulnerability : It was discovered that Mesa incorrectly handled certain arrays. An attacker could use this issue to cause Mesa to crash, resulting in a denial of service, or possibly execute arbitrary code CVE-2012-5129. Mesa has also been updated to version...

[ MDVSA-2013:163 ] glibc

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:163 http://www.mandriva.com/en/support/security/ Package : glibc Date : May 7, 2013 Affected: Business Server 1.0 Problem Description: Multiple vulnerabilities has been discovered and corrected in glibc:...

[ MDVSA-2013:147 ] libarchive

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:147 http://www.mandriva.com/en/support/security/ Package : libarchive Date : April 19, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: A vulnerability has been found and...

[ MDVSA-2013:149 ] roundcubemail

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:149 http://www.mandriva.com/en/support/security/ Package : roundcubemail Date : April 21, 2013 Affected: Business Server 1.0 Problem Description: A vulnerability has been found and corrected in roundcubemail...

Mandriva Linux Security Advisory : phpmyadmin (MDVSA-2013:160)

Updated phpmyadmin package fixes security vulnerabilities : In some PHP versions, the pregreplace\ function can be tricked into executing arbitrary PHP code on the server. This is done by passing a crafted argument as the regular expression, containing a null byte. phpMyAdmin does not correctly...

Mandriva Linux Security Advisory : krb5 (MDVSA-2013:158)

A vulnerability has been discovered and corrected in krb5 : The prepreprocessreq function in dotgsreq.c in the Key Distribution Center KDC in MIT Kerberos 5 aka krb5 before 1.10.5 does not properly perform service-principal realm referral, which allows remote authenticated users to cause a denial...

Mandriva Linux Security Advisory : apache-mod_security (MDVSA-2013:156)

A vulnerability has been found and corrected in apache-modsecurity : ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service CPU and memory consumption via an XML external entity declaration in conjunction with...

Mandriva Linux Security Advisory : curl (MDVSA-2013:151)

Updated curl packages fix security vulnerability : libcurl is vulnerable to a cookie leak vulnerability when doing requests across domains with matching tails. This vulnerability can be used to hijack sessions in targetted attacks since registering domains using a known domain's name as an ending...

Mandriva Linux Security Advisory : roundcubemail (MDVSA-2013:149)

A vulnerability has been found and corrected in roundcubemail : A local file inclusion flaw was found in the way RoundCube Webmail, a browser-based multilingual IMAP client, performed validation of the 'genericmessagefooter' value provided via web user interface in certain circumstances. A remote...