Mandriva Linux Security Advisory : argyllcms (MDVSA-2013:090)

A security issue was identified and fixed in argyllcms : An integer overflow flaw, leading to a heap-based buffer overflow, was found in Ghostscript's International Color Consortium Format library icclib. An attacker could create a specially crafted PostScript or PDF file with embedded images tha...

Mandriva Linux Security Advisory : qemu (MDVSA-2013:121)

Updated qemu packages fix security vulnerability : A flaw was found in how qemu, in snapshot mode -snapshot command line argument, handled the creation and opening of the temporary file used to store the difference of the virtualized guest's read-only image and the current state. In snapshot mode...

Mandriva Linux Security Advisory : python (MDVSA-2013:117)

Updated python packages fix security vulnerabilities : A race condition was found in the way the Python distutils module set file permissions during the creation of the .pypirc file. If a local user had access to the home directory of another user who is running distutils, they could use this fla...

Mandriva Linux Security Advisory : quagga (MDVSA-2013:122)

Updated quagga package fixes security vulnerability : The bgpcapabilityorf function in bgpd in Quagga 0.99.20.1 and earlier allows remote attackers to cause a denial of service assertion failure and daemon exit by leveraging a BGP peering relationship and sending a malformed Outbound Route...

Mandriva Linux Security Advisory : awstats (MDVSA-2013:061)

Multiple XXS vulnerabilities was found and corrected in awstats CVE-2012-4547. The updated packages have been patched to correct this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandriva Linux Security...

Mandriva Linux Security Advisory : otrs (MDVSA-2013:112)

Updated otrs package fixes security vulnerabilities : Multiple cross-site scripting XSS vulnerabilities in Open Ticket Request System OTRS Help Desk 2.4.x before 2.4.13, 3.0.x before 3.0.15, and 3.1.x before 3.1.9, and OTRS ITSM 2.1.x before 2.1.5, 3.0.x before 3.0.6, and 3.1.x before 3.1.6, allo...

Mandriva Linux Security Advisory : gnutls (MDVSA-2013:040)

Nadhem Alfardan and Kenny Paterson devised an attack that recovers some bits of the plaintext of a GnuTLS session that utilizes that CBC ciphersuites, by using timing information CVE-2013-1619. The gnutls package has been updated to latest 3.0.28 version to fix above problem. %NASLMINLEVEL 70300 ...

Mandriva Linux Security Advisory : snack (MDVSA-2013:126)

Updated snack packages fix security vulnerability : Two vulnerabilities have been discovered in Snack Sound Toolkit, which are caused due to missing boundary checks in the GetWavHeader function generic/jkSoundFile.c when parsing either format sub-chunks or unknown sub-chunks. This can be exploite...

Mandriva Linux Security Advisory : dokuwiki (MDVSA-2013:073)

Updated dokuwiki package fixes security vulnerabilities : DokuWiki 2009-12-25c allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by lib/tpl/index.php and certain other files...

Mandriva Linux Security Advisory : squid (MDVSA-2013:129)

Updated squid packages fix security vulnerability : Due to missing input validation, the Squid cachemgr.cgi tool in Squid before 3.1.22 and 3.2.4 is vulnerable to a denial of service attack when processing specially crafted requests CVE-2012-5643. It was discovered that the patch for CVE-2012-564...

Mandriva Linux Security Advisory : net-snmp (MDVSA-2013:049)

A vulnerability has been discovered and corrected in net-snmp : An array index error, leading to out-of heap-based buffer read flaw was found in the way net-snmp agent performed entries lookup in the extension table. When certain MIB subtree was handled by the extend directive, a remote attacker...

Mandriva Linux Security Advisory : ruby (MDVSA-2013:124)

Updated ruby packages fix security vulnerabilities : Shugo Maedo and Vit Ondruch discovered that Ruby incorrectly allowed untainted strings to be modified in protective safe levels. An attacker could use this flaw to bypass intended access restrictions CVE-2012-4466, CVE-2012-4481. It was...

Mandriva Linux Security Advisory : automake (MDVSA-2013:031)

A vulnerability has been discovered and corrected in automake : A race condition in automake lib/am/distdir.am could allow a local attacker to run arbitrary code with the privileges of the user running make distcheck CVE-2012-3386. The updated packages have been patched to correct this issue. NOT...

Mandriva Linux Security Advisory : bind (MDVSA-2013:058)

A security issue was identified and fixed in ISC BIND : libdns in ISC BIND 9.7.x and 9.8.x before 9.8.4-P2, 9.8.5 before 9.8.5b2, 9.9.x before 9.9.2-P2, and 9.9.3 before 9.9.3b2 on UNIX platforms allows remote attackers to cause a denial of service memory consumption via a crafted regular...

Mandriva Linux Security Advisory : libarchive (MDVSA-2013:147)

A vulnerability has been found and corrected in libarchive : Fabian Yamaguchi reported a read buffer overflow flaw in libarchive on 64-bit systems where sizeofsizet is equal to 8. In the archivewritezipdata function in libarchive/ archivewritesetformatzip.c, the 's' parameter is of type sizet 64...

Mandriva Linux Security Advisory : cups-pk-helper (MDVSA-2013:069)

Updated cups-pk-helper package fixes security vulnerability : cups-pk-helper, a PolicyKit helper to configure CUPS with fine-grained privileges, wraps CUPS function calls in an insecure way. This could lead to uploading sensitive data to a CUPS resource, or overwriting specific files with the...

Mandriva Linux Security Advisory : bip (MDVSA-2013:063)

Updated bip package fixes security vulnerability : Buffer overflow in Bip 0.8.8 and earlier might allow remote authenticated users to execute arbitrary code via vectors involving a series of TCP connections that triggers use of many open file descriptors CVE-2012-0806. %NASLMINLEVEL 70300 C Tenab...

Mandriva Linux Security Advisory : openssh (MDVSA-2013:051)

A vulnerability has been found and corrected in openssh : The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and completing a login, which makes it easier for remote attackers to cause a denial of service connection-slot exhaustion b...

Mandriva Linux Security Advisory : openjpeg (MDVSA-2013:110)

Updated openjpeg packages fix security vulnerability : An out-of heap-based buffer bounds read and write flaw, leading to invalid free, was found in the way a tile coder / decoder TCD implementation of OpenJPEG, an open source JPEG 2000 codec written in C language, performed releasing of previous...

Mandriva Linux Security Advisory : clamav (MDVSA-2013:027-1)

ClamAV 0.97.7 addresses several reported potential security bugs. Thanks to Felix Groebert, Mateusz Jurczyk and Gynvael Coldwind of the Google Security Team for finding and reporting these issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...