Mandriva Linux Security Advisory : sleuthkit (MDVSA-2013:125)

Updated sleuthkit packages fix security vulnerabilities : A security flaw was found in the way the Sleuth Kit TSK, a collection of UNIX-based command line tools allowing to investigate a computer, performed management of '.' dotfile file system entry. An attacker could use this flaw to evade...

Mandriva Linux Security Advisory : pixman (MDVSA-2013:116)

Updated pixman packages fix security vulnerability : Stack-based buffer overflow in libpixman has unspecified impact and attack vectors CVE-2013-1591. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandriva Linux...

Mandriva Linux Security Advisory : squashfs-tools (MDVSA-2013:128)

Updated squashfs-tools packages fix security vulnerabilities : remote arbitrary code execution via crafted list file CVE-2012-4024. integer overflow in queueinit may lead to arbitrary code execution CVE-2012-4025. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and packa...

Mandriva Linux Security Advisory : libssh (MDVSA-2013:045)

Updated libssh packages fix security vulnerabilities : Multiple double free flaws, buffer overflow flaws, invalid free flaws, and improper overflow checks in libssh before 0.5.3 could enable a denial of service attack against libssh clients, or possibly arbitrary code execution CVE-2012-4559,...

Mandriva Linux Security Advisory : cronie (MDVSA-2013:033)

Updated cronie package fixes the following issue : It was reported that cronie 1.4.8 would leak certain file descriptors. On systems where /etc/crontab is not world-readable this could be an information disclosure concern CVE-2012-6097. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Mandriva Linux Security Advisory : ncpfs (MDVSA-2013:048)

Multiple vulnerabilities has been discovered and corrected in ncpfs : ncpfs 2.2.6 and earlier attempts to use 1 ncpmount to append to the /etc/mtab file and 2 ncpumount to append to the /etc/mtab.tmp file without first checking whether resource limits would interfere, which allows local users to...

Mandriva Linux Security Advisory : html2ps (MDVSA-2013:041)

A vulnerability has been found and corrected in html2ps : Directory traversal vulnerability in html2ps before 1.0b7 allows remote attackers to read arbitrary files via directory traversal sequences in SSI directives CVE-2009-5067. The updated packages have been upgraded to the 1.0b7 version which...

Mandriva Linux Security Advisory : openslp (MDVSA-2013:111)

Updated openslp packages fix security vulnerability : The extension parser in slpv2message.c in OpenSLP 1.2.1 allows remote attackers to cause a denial of service infinite loop via a packet with a next extension offset that references this extension or a previous extension CVE-2010-3609...

Mandriva Linux Security Advisory : jakarta-poi (MDVSA-2013:094)

Updated jakarta-poi packages fix security vulnerability : It was discovered that Apache POI, a Java implementation of the Microsoft Office file formats, would allocate arbitrary amounts of memory when processing crafted documents. This could impact the stability of the Java virtual machine...

Mandriva Linux Security Advisory : ettercap (MDVSA-2013:077)

Updated ettercap package fixes security vulnerability : The GTK version of ettercap uses a global settings file at /tmp/.ettercapgtk and does not verify ownership of this file. When parsing this file for settings in gtkuiconfread\ src/interfaces/gtk/ecgtkconf.c, an unchecked sscanf\ call allows a...

Mandriva Linux Security Advisory : apache-mod_security (MDVSA-2013:029)

A vulnerability has been discovered and corrected in apache-modsecurity : ModSecurity = 2.6.8 is vulnerable to multipart/invalid part ruleset bypass, this was fixed in 2.7.0 released on2012-10-16 CVE-2012-4528. The updated packages have been patched to correct this issue. NOTE: This advisory was...

Mandriva Linux Security Advisory : exif (MDVSA-2013:036)

A vulnerability has been discovered and corrected in exif : An integer overflow in the function jpegdataloaddata in the exif program could cause a data read beyond the end of a buffer, causing an application crash or leakage of potentially sensitive information when parsing a crafted JPEG file...

Mandriva Linux Security Advisory : icecast (MDVSA-2013:091)

Updated icecast package fixes security vulnerability : Icecast didn't strip newlines from log entries, therefore allowing users to forge log entries CVE-2011-4612 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandri...

Mandriva Linux Security Advisory : open-iscsi (MDVSA-2013:109)

Updated open-iscsi package fixes security vulnerability : Colin Watson discovered that iscsidiscovery in Open-iSCSI did not safely create temporary files. A local attacker could exploit this to overwrite arbitrary files with root privileges CVE-2009-1297. %NASLMINLEVEL 70300 C Tenable Network...

Mandriva Linux Security Advisory : openconnect (MDVSA-2013:108)

Updated openconnect packages fix security vulnerability : A stack-based buffer overflow flaw was found in the way OpenConnect, a client for Cisco's AnyConnect VPN, performed processing of certain host names, paths, or cookie lists, received from the VPN gateway. A remote VPN gateway could provide...

Mandriva Linux Security Advisory : libarchive (MDVSA-2013:147)

A vulnerability has been found and corrected in libarchive : Fabian Yamaguchi reported a read buffer overflow flaw in libarchive on 64-bit systems where sizeofsizet is equal to 8. In the archivewritezipdata function in libarchive/ archivewritesetformatzip.c, the 's' parameter is of type sizet 64...

Mandriva Linux Security Advisory : otrs (MDVSA-2013:112)

Updated otrs package fixes security vulnerabilities : Multiple cross-site scripting XSS vulnerabilities in Open Ticket Request System OTRS Help Desk 2.4.x before 2.4.13, 3.0.x before 3.0.15, and 3.1.x before 3.1.9, and OTRS ITSM 2.1.x before 2.1.5, 3.0.x before 3.0.6, and 3.1.x before 3.1.6, allo...

Mandriva Linux Security Advisory : xinetd (MDVSA-2013:057)

A security issue was identified and fixed in xinetd : builtins.c in Xinetd before 2.3.15 does not check the service type when the tcpmux-server service is enabled, which exposes all enabled services and allows remote attackers to bypass intended access restrictions via a request to tcpmux port 1...

Mandriva Linux Security Advisory : libxslt (MDVSA-2013:047)

A vulnerability has been discovered and corrected in libxslt : The XSL implementation in libxslt allows remote attackers to cause a denial of service incorrect read operation via unspecified vectors CVE-2012-2825. libxslt 1.1.26 and earlier does not properly manage memory, which might allow remot...

Mandriva Linux Security Advisory : python (MDVSA-2013:117)

Updated python packages fix security vulnerabilities : A race condition was found in the way the Python distutils module set file permissions during the creation of the .pypirc file. If a local user had access to the home directory of another user who is running distutils, they could use this fla...