Mandriva Linux Security Advisory : bogofilter (MDVSA-2013:064)

Updated bogofilter package fixes security vulnerability : In bogofilter before 1.2.3, bogofilter's/bogolexer's base64 could overwrite heap memory in the character set conversion in certain pathological cases of invalid base64 code that decodes to incomplete multibyte characters CVE-2012-5468...

Mandriva Linux Security Advisory : libssh (MDVSA-2013:045)

Updated libssh packages fix security vulnerabilities : Multiple double free flaws, buffer overflow flaws, invalid free flaws, and improper overflow checks in libssh before 0.5.3 could enable a denial of service attack against libssh clients, or possibly arbitrary code execution CVE-2012-4559,...

Mandriva Linux Security Advisory : dbus (MDVSA-2013:070)

Updated dbus packages fix security vulnerability : It was discovered that the D-Bus library honored environment settings even when running with elevated privileges. A local attacker could possibly use this flaw to escalate their privileges, by setting specific environment variables before running...

Mandriva Linux Security Advisory : wireshark (MDVSA-2013:055)

Multiple vulnerabilities has been found and corrected in wireshark : Infinite and large loops in ANSI MAP, BACapp, Bluetooth HCI, IEEE 802.3, LTP, and R3 dissectors have been fixed. Discovered by Laurent Butti http://www.wireshark.org/security/wnpa-sec-2012-08.html CVE-2012-2392 The DIAMETER...

Mandriva Linux Security Advisory : libxslt (MDVSA-2013:141)

Updated libxslt packages fix security vulnerability : Nicholas Gregoire discovered that libxslt incorrectly handled certain empty values. If a user or automated system were tricked into processing a specially crafted XSLT document, a remote attacker could cause libxslt to crash, causing a denial ...

Mandriva Linux Security Advisory : xinetd (MDVSA-2013:057)

A security issue was identified and fixed in xinetd : builtins.c in Xinetd before 2.3.15 does not check the service type when the tcpmux-server service is enabled, which exposes all enabled services and allows remote attackers to bypass intended access restrictions via a request to tcpmux port 1...

Mandriva Linux Security Advisory : phpmyadmin (MDVSA-2013:144)

Multiple cross-site scripting XSS vulnerabilities in tblgisvisualization.php in phpMyAdmin 3.5.x before 3.5.8 might allow remote attackers to inject arbitrary web script or HTML via the 1 visualizationSettingswidth or 2 visualizationSettingsheight parameter CVE-2013-1937. This upgrade provides th...

Mandriva Linux Security Advisory : squashfs-tools (MDVSA-2013:128)

Updated squashfs-tools packages fix security vulnerabilities : remote arbitrary code execution via crafted list file CVE-2012-4024. integer overflow in queueinit may lead to arbitrary code execution CVE-2012-4025. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and packa...

Mandriva Linux Security Advisory : openssl (MDVSA-2013:052)

Multiple vulnerabilities has been found and corrected in openssl : OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1 before 1.0.1d does not properly perform signature verification for OCSP responses, which allows remote attackers to cause a denial of service NULL pointer dereference and...

Mandriva Linux Security Advisory : glib2.0 (MDVSA-2013:083)

Updated glib2.0 packages fix security vulnerability : It was discovered that the version of glib shipped with MBS 1 does not sanitise certain DBUS related environment variables. When used in combination with a setuid application which utilises dbus via glib, a local user could gain escalated...

Mandriva Linux Security Advisory : accountsservice (MDVSA-2013:060)

Updated accountsservice packages fix security vulnerability : Florian Weimer discovered that AccountsService incorrectly handled privileges when copying certain files to the system cache directory. A local attacker could exploit this issue to read arbitrary files, bypassing intended permissions...

Mandriva Linux Security Advisory : asterisk (MDVSA-2013:140)

Multiple vulnerablilities was identified and fixed in asterisk : The SIP channel driver in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15 before 1.8.15-cert2; Asterisk Business Edition BE C.3.x before C.3.8.1; and Asterisk...

Mandriva Linux Security Advisory : dnsmasq (MDVSA-2013:072)

Updated dnsmasq packages fix security vulnerabilities : When dnsmasq before 2.63 is used in conjunctions with certain configurations of libvirtd, network packets from prohibited networks e.g. packets that should not be passed in may be sent to the dnsmasq application and processed. This can resul...

Mandriva Linux Security Advisory : arpwatch (MDVSA-2013:030)

A vulnerability has been discovered and corrected in arpwatch : arpwatch 2.1a15, as used by Red Hat, Debian, Fedora, and possibly others, does not properly drop supplementary groups, which might allow attackers to gain root privileges by leveraging other vulnerabilities in the daemon CVE-2012-265...

Mandriva Linux Security Advisory : vte (MDVSA-2013:135)

Updated vte packages fix security vulnerability : A denial of service flaw was found in the way VTE, a terminal emulator widget, processed certain escape sequences with large repeat counts. A remote attacker could provide a specially crafted file, which once opened in a terminal using the VTE...

Mandriva Linux Security Advisory : python-httplib2 (MDVSA-2013:119)

python-httplib2 ships its own copy of the Mozilla NSS certificates, but it should use the system-wide ones provided by the rootcerts package instead. This has been corrected. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

Mandriva Linux Security Advisory : libgssglue (MDVSA-2013:043)

This update fixes insecure getenv usage in libgssglue, which could be used under some circumstances by local attackers do gain root privileges CVE-2011-2709. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandriva...

Mandriva Linux Security Advisory : libupnp (MDVSA-2013:098)

Updated libupnp packages fix security vulnerabilities : The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet...

Mandriva Linux Security Advisory : stunnel (MDVSA-2013:130)

Updated stunnel packages fix security vulnerability : stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not correctly perform integer conversion, which allows remote proxy servers to execute arbitrary code via a crafted request that triggers a...

Mandriva Linux Security Advisory : sleuthkit (MDVSA-2013:125)

Updated sleuthkit packages fix security vulnerabilities : A security flaw was found in the way the Sleuth Kit TSK, a collection of UNIX-based command line tools allowing to investigate a computer, performed management of '.' dotfile file system entry. An attacker could use this flaw to evade...