Mandriva Linux Security Advisory : arpwatch (MDVSA-2012:113)

A vulnerability has been discovered and corrected in arpwatch : arpwatch 2.1a15, as used by Red Hat, Debian, Fedora, and possibly others, does not properly drop supplementary groups, which might allow attackers to gain root privileges by leveraging other vulnerabilities in the daemon CVE-2012-265...

Mandriva Linux Security Advisory : gimp (MDVSA-2012:142)

Multiple vulnerabilities has been discovered and corrected in gimp : A heap-based buffer overflow flaw, leading to invalid free, was found in the way KISS CEL file format plug-in of Gimp, the GNU Image Manipulation Program, performed loading of certain palette files. A remote attacker could provi...

Mandriva Linux Security Advisory : mozilla-thunderbird (MDVSA-2012:018)

Use-after-free vulnerability in Mozilla Firefox 10.x before 10.0.1, Thunderbird 10.x before 10.0.1, and SeaMonkey 2.7 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via vectors that trigger failure of an...

Mandriva Linux Security Advisory : libreoffice (MDVSA-2012:123)

A Security issue was identified and fixed in libreoffice : Multiple heap-based buffer overflow flaws were found in the XML manifest encryption tag parsing code of LibreOffice. An attacker could create a specially crafted file in the Open Document Format for Office Applications ODF format which wh...

Mandriva Linux Security Advisory : ffmpeg (MDVSA-2012:148)

Multiple vulnerabilities has been found and corrected in ffmpeg. This advisory provides updated versions which resolves various security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandriva Linux Security...

Mandriva Linux Security Advisory : wireshark (MDVSA-2012:015)

Multiple file parser and NULL pointer vulnerabilities including a RLC dissector buffer overflow was found and corrected in Wireshark. This advisory provides the latest version of Wireshark 1.6.5 which is not vulnerable to these issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Mandriva Linux Security Advisory : perl-DBD-Pg (MDVSA-2012:112)

A vulnerability has been discovered and corrected in perl-DBD-Pg : Two format string flaws were found in the way perl-DBD-Pg. A rogue server could provide a specially crafted database warning or specially crafted DBD statement, which once processed by the perl-DBD-Pg interface would lead to...

Mandriva Linux Security Advisory : usbmuxd (MDVSA-2012:133)

It was discovered that usbmuxd did not correctly perform bounds checking when processing the SerialNumber field of USB devices. An attacker with physical access could use this to crash usbmuxd or potentially execute arbitrary code as the 'usbmux' user CVE-2012-0065. The updated packages have been...

Mandriva Linux Security Advisory : wireshark (MDVSA-2011:164)

This advisory updates wireshark to the latest version 1.6.3, fixing several security issues : An uninitialized variable in the CSN.1 dissector could cause a crash CVE-2011-4100. Huzaifa Sidhpurwala of Red Hat Security Response Team discovered that the Infiniband dissector could dereference a NULL...

Mandriva Linux Security Advisory : iproute2 (MDVSA-2011:135)

It was discovered that the iproute2 package was not rebuilt against the latest iptables libraries. This may have security issues, as the current iproute2 should be calling an interface in the iptables libraries with incorrect arguments. The updated packages have been patched to correct this issue...

Mandriva Linux Security Advisory : bind (MDVSA-2012:119)

A vulnerability was discovered and corrected in bind : High numbers of queries with DNSSEC validation enabled can cause an assertion failure in named, caused by using a bad cache data structure before it has been initialized CVE-2012-3817. The updated packages have been upgraded to bind 9.7.6-P2...

Mandriva Linux Security Advisory : wireshark (MDVSA-2012:042)

Multiple vulnerabilities was found and corrected in Wireshark : - The ANSI A dissector could dereference a NULL pointer and crash. - The IEEE 802.11 dissector could go into an infinite loop. - The pcap and pcap-ng file parsers could crash trying to read ERF data. - The MP2T dissector could try to...

Mandriva Linux Security Advisory : acpid (MDVSA-2012:137)

Multiple vulnerabilities has been discovered and corrected in acpid : Oliver-Tobias Ripka discovered that an ACPI script incorrectly handled power button events. A local attacker could use this to execute arbitrary code, and possibly escalate privileges CVE-2011-2777. Helmut Grohne and Michael...

Mandriva Linux Security Advisory : wireshark (MDVSA-2012:125)

Multiple vulnerabilities was found and corrected in Wireshark : It may be possible to make Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file CVE-2012-4048. It may be possible to make Wireshark consume excessive CPU resourc...

Mandriva Linux Security Advisory : libotr (MDVSA-2012:131)

A vulnerability was found and corrected in libotr : Just Ferguson discovered that libotr, an off-the-record OTR messaging library, can be forced to perform zero-length allocations for heap buffers that are used in base64 decoding routines. An attacker can exploit this flaw by sending crafted...

Mandriva Linux Security Advisory : libxslt (MDVSA-2012:109)

A vulnerability has been discovered and corrected in libxslt : The XSL implementation in libxslt allows remote attackers to cause a denial of service incorrect read operation via unspecified vectors CVE-2012-2825. The updated packages have been patched to correct this issue. %NASLMINLEVEL 70300 C...

Mandriva Linux Security Advisory : cups (MDVSA-2011:147)

A vulnerability has been discovered and corrected in cups : The gifreadlzw function in filter/image-gif.c in CUPS 1.4.8 and earlier does not properly handle the first code word in an LZW stream, which allows remote attackers to trigger a heap-based buffer overflow, and possibly execute arbitrary...

Mandriva Linux Security Advisory : networkmanager (MDVSA-2011:171)

Security issues were identified and fixed in networkmanager : GNOME NetworkManager before 0.8.6 does not properly enforce the authadmin element in PolicyKit, which allows local users to bypass intended wireless network sharing restrictions via unspecified vectors CVE-2011-2176. Incomplete blackli...

Mandriva Linux Security Advisory : openslp (MDVSA-2012:141)

A vulnerability has been discovered and corrected in openslp : The extension parser in slpv2message.c in OpenSLP 1.2.1 allows remote attackers to cause a denial of service infinite loop via a packet with a next extension offset that references this extension or a previous extension CVE-2010-3609...

Mandriva Linux Security Advisory : libtiff (MDVSA-2012:127)

A vulnerability was found and corrected in libtiff : A heap-based buffer overflow flaw was found in the way tiff2pdf, a TIFF image to a PDF document conversion tool, of libtiff, a library of functions for manipulating TIFF Tagged Image File Format image format files, performed write of TIFF image...