Mandriva Linux Security Advisory : bind (MDVSA-2013:058)

A security issue was identified and fixed in ISC BIND : libdns in ISC BIND 9.7.x and 9.8.x before 9.8.4-P2, 9.8.5 before 9.8.5b2, 9.9.x before 9.9.2-P2, and 9.9.3 before 9.9.3b2 on UNIX platforms allows remote attackers to cause a denial of service memory consumption via a crafted regular...

Mandriva Linux Security Advisory : gegl (MDVSA-2013:081)

Updated gegl packages fix security vulnerability : An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way the gegl utility processed .ppm Portable Pixel Map image files. An attacker could create a specially crafted .ppm file that, when opened in gegl, would cause...

Mandriva Linux Security Advisory : quagga (MDVSA-2013:122)

Updated quagga package fixes security vulnerability : The bgpcapabilityorf function in bgpd in Quagga 0.99.20.1 and earlier allows remote attackers to cause a denial of service assertion failure and daemon exit by leveraging a BGP peering relationship and sending a malformed Outbound Route...

Mandriva Linux Security Advisory : courier-authlib (MDVSA-2013:068)

When using the authpgsql module and if the Postgres server goes down, authpgsql will start leaking memory. A packaging flaw was discovered that caused the courier-authlib-devel package to be installed when installing for example maildrop. This update fixes both of these issues. %NASLMINLEVEL 7030...

Mandriva Linux Security Advisory : freetype2 (MDVSA-2013:039)

Updated freetype2 packages fixes security vulnerabilities : A NULL pointer de-reference flaw was found in the way Freetype font rendering engine handled Glyph bitmap distribution format BDF fonts. A remote attacker could provide a specially crafted BDF font file, which once processed in an...

Mandriva Linux Security Advisory : bash (MDVSA-2013:032)

A vulnerability was found and corrected in bash : A stack-based buffer overflow flaw was found in the way bash, the GNU Bourne Again shell, expanded certain /dev/fd file names when checking file names 'test' command and evaluating /dev/fd file names in conditinal command expressions. A remote...

Mandriva Linux Security Advisory : phpmyadmin (MDVSA-2013:144)

Multiple cross-site scripting XSS vulnerabilities in tblgisvisualization.php in phpMyAdmin 3.5.x before 3.5.8 might allow remote attackers to inject arbitrary web script or HTML via the 1 visualizationSettingswidth or 2 visualizationSettingsheight parameter CVE-2013-1937. This upgrade provides th...

Mandriva Linux Security Advisory : accountsservice (MDVSA-2013:060)

Updated accountsservice packages fix security vulnerability : Florian Weimer discovered that AccountsService incorrectly handled privileges when copying certain files to the system cache directory. A local attacker could exploit this issue to read arbitrary files, bypassing intended permissions...

Mandriva Linux Security Advisory : ircd-hybrid (MDVSA-2013:093)

Updated ircd-hybrid packages fix security vulnerability : Bob Nomnomnom reported a Denial of Service vulnerability in IRCD-Hybrid, an Internet Relay Chat server. A remote attacker may use an error in the masks validation and crash the server CVE-2013-0238. Please note that due to the previously...

Mandriva Linux Security Advisory : sudo (MDVSA-2013:054)

Multiple vulnerabilities has been found and corrected in sudo : A flaw exists in the IP network matching code in sudo versions 1.6.9p3 through 1.8.4p4 that may result in the local host being matched even though it is not actually part of the network described by the IP address and associated...

Mandriva Linux Security Advisory : qemu (MDVSA-2013:121)

Updated qemu packages fix security vulnerability : A flaw was found in how qemu, in snapshot mode -snapshot command line argument, handled the creation and opening of the temporary file used to store the difference of the virtualized guest's read-only image and the current state. In snapshot mode...

Mandriva Linux Security Advisory : openssh (MDVSA-2013:051)

A vulnerability has been found and corrected in openssh : The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and completing a login, which makes it easier for remote attackers to cause a denial of service connection-slot exhaustion b...

Mandriva Linux Security Advisory : argyllcms (MDVSA-2013:090)

A security issue was identified and fixed in argyllcms : An integer overflow flaw, leading to a heap-based buffer overflow, was found in Ghostscript's International Color Consortium Format library icclib. An attacker could create a specially crafted PostScript or PDF file with embedded images tha...

Mandriva Linux Security Advisory : ruby (MDVSA-2013:124)

Updated ruby packages fix security vulnerabilities : Shugo Maedo and Vit Ondruch discovered that Ruby incorrectly allowed untainted strings to be modified in protective safe levels. An attacker could use this flaw to bypass intended access restrictions CVE-2012-4466, CVE-2012-4481. It was...

Mandriva Linux Security Advisory : gnutls (MDVSA-2013:040)

Nadhem Alfardan and Kenny Paterson devised an attack that recovers some bits of the plaintext of a GnuTLS session that utilizes that CBC ciphersuites, by using timing information CVE-2013-1619. The gnutls package has been updated to latest 3.0.28 version to fix above problem. %NASLMINLEVEL 70300 ...

Mandriva Linux Security Advisory : vte (MDVSA-2013:135)

Updated vte packages fix security vulnerability : A denial of service flaw was found in the way VTE, a terminal emulator widget, processed certain escape sequences with large repeat counts. A remote attacker could provide a specially crafted file, which once opened in a terminal using the VTE...

Mandriva Linux Security Advisory : socat (MDVSA-2013:127)

Updated socat package fixes security vulnerability : Heap-based buffer overflow in the xioscanreadline function in xio-readline.c in socat 1.4.0.0 through 1.7.2.0 and 2.0.0-b1 through 2.0.0-b4 allows local users to execute arbitrary code via the READLINE address CVE-2012-0219. %NASLMINLEVEL 70300...

Mandriva Linux Security Advisory : python-pycrypto (MDVSA-2013:120)

Updated python-pycrypto package fixes security vulnerability : PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it easier for attackers to conduct brute-force attacks to...

Mandriva Linux Security Advisory : php-ZendFramework (MDVSA-2013:115)

Updated php-ZendFramework packages fix security vulnerabilities : ZendDom, ZendFeed, ZendSoap, and ZendXmlRpc in Zend Framework before 1.11.13 and 1.12.0 are vulnerable to XML Entity Expansion XEE vectors, leading to Denial of Service vectors. XEE attacks occur when the XML DOCTYPE declaration...

Mandriva Linux Security Advisory : python-httplib2 (MDVSA-2013:119)

python-httplib2 ships its own copy of the Mozilla NSS certificates, but it should use the system-wide ones provided by the rootcerts package instead. This has been corrected. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...