Mandriva Linux Security Advisory : grub2 (MDVSA-2015:163)

Updated grub2 package fixes security vulnerability : An integer overflow in liblzo before 2.07 allows attackers to cause a denial of service or possibly code execution in applications using performing LZO decompression on a compressed payload from the attacker CVE-2014-4607. The grub2 package is...

Mandriva Linux Security Advisory : lcms2 (MDVSA-2015:107)

Updated lcms2 packages fix security vulnerability : Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect availability via unknown vectors related to 2D CVE-2014-0459. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descripti...

Mandriva Linux Security Advisory : gnupg (MDVSA-2015:155)

Updated gnupg and libgcrypt packages fix security vulnerabilities : GnuPG before 1.4.19 is vulnerable to a side-channel attack which can potentially lead to an information leak CVE-2014-3591. GnuPG before 1.4.19 is vulnerable to a side-channel attack on data-dependent timing variations in modular...

Mandriva Linux Security Advisory : readline (MDVSA-2015:132)

Updated readline packages fix security vulnerability : Steve Kemp discovered the rltropen function in readline insecurely handled a temporary file. This could allow a local attacker to perform symbolic link attacks CVE-2014-2524. Also, upstream patches have been added to fix an infinite loop in v...

Mandriva Linux Security Advisory : libvncserver (MDVSA-2015:146)

Updated libvncserver packages fix security vulnerabilities : An integer overflow in liblzo before 2.07 allows attackers to cause a denial of service or possibly code execution in applications using performing LZO decompression on a compressed payload from the attacker CVE-2014-4607. The...

Mandriva Linux Security Advisory : ruby (MDVSA-2015:129)

Updated ruby packages fix security vulnerabilities : Due to unrestricted entity expansion, when reading text nodes from an XML document, the REXML parser in Ruby can be coerced into allocating extremely large string objects which can consume all of the memory on a machine, causing a denial of...

Mandriva Linux Security Advisory : libxml2 (MDVSA-2015:111)

Updated libxml2 packages fix security vulnerabilities : It was discovered that libxml2, a library providing support to read, modify and write XML files, incorrectly performs entity substituton in the doctype prolog, even if the application using libxml2 disabled any entity substitution. A remote...

Mandriva Linux Security Advisory : cifs-utils (MDVSA-2015:114)

Updated cifs-utils packages fix security vulnerability : Sebastian Krahmer discovered a stack-based buffer overflow flaw in cifscreds.c CVE-2014-2830. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandriva Linux...

Mandriva Linux Security Advisory : libssh (MDVSA-2015:086)

Updated libssh packages fix security vulnerabilities : When using libssh before 0.6.3, a libssh-based server, when accepting a new connection, forks and the child process handles the request. The RANDbytes function of openssl doesn't reset its state after the fork, but simply adds the current...

Mandriva Linux Security Advisory : json-c (MDVSA-2015:102)

Updated json-c packages fix security vulnerabilities : Florian Weimer reported that the printbuf APIs used in the json-c library used ints for counting buffer lengths, which is inappropriate for 32bit architectures. These functions need to be changed to using sizet if possible for sizes, or to be...

Mandriva Linux Security Advisory : gnutls (MDVSA-2015:072)

Updated gnutls packages fix security vulnerabilities : Suman Jana reported a vulnerability that affects the certificate verification functions of gnutls 3.1.x and gnutls 3.2.x. A version 1 intermediate certificate will be considered as a CA certificate by default something that deviates from the...

Mandriva Linux Security Advisory : cups (MDVSA-2015:108)

Updated cups packages fix security vulnerabilities : Cross-site scripting XSS vulnerability in scheduler/client.c in Common Unix Printing System CUPS before 1.7.2 allows remote attackers to inject arbitrary web script or HTML via the URL path, related to the ispathabsolute function CVE-2014-2856...

Mandriva Linux Security Advisory : ppp (MDVSA-2015:135)

Updated ppp packages fix security vulnerability : A vulnerability in ppp before 2.4.7 may enable an unprivileged attacker to access privileged options CVE-2014-3158. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

Mandriva Linux Security Advisory : e2fsprogs (MDVSA-2015:068)

Updated e2fsprogs packages fix security vulnerability : The libext2fs library, part of e2fsprogs and utilized by its utilities, is affected by a boundary check error on block group descriptor information, leading to a heap based buffer overflow. A specially crafted filesystem image can be used to...

Mandriva Linux Security Advisory : dovecot (MDVSA-2015:113)

Updated dovecot packages fix security vulnerability. Dovecot before 2.2.13 is vulnerable to a DoS attack against imap/pop3-login processes. If SSL/TLS handshake was started but wasn't finished, the login process attempted to eventually forcibly disconnect the client, but failed to do it correctly...

Mandriva Linux Security Advisory : xlockmore (MDVSA-2015:118)

Updated xlockmore packages fix security vulnerability : xlockmore before 5.45 contains a security flaw related to a bad value of fnt for pyro2 which could cause an X error. This update backports the fix for version 5.43. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text an...

Mandriva Linux Security Advisory : x11-server (MDVSA-2015:119)

Updated x11-server packages fix security vulnerabilities : Ilja van Sprundel of IOActive discovered several security issues in the X.org X server, which may lead to privilege escalation or denial of service CVE-2014-8091, CVE-2014-8092, CVE-2014-8093, CVE-2014-8094, CVE-2014-8095, CVE-2014-8096,...

Mandriva Linux Security Advisory : icu (MDVSA-2015:161-1)

Updated icu packages fix security vulnerabilities : The Regular Expressions package in International Components for Unicode ICU 52 before SVN revision 292944 allows remote attackers to cause a denial of service memory corruption or possibly have unspecified other impact via vectors related to a...

Mandriva Linux Security Advisory : not-yet-commons-ssl (MDVSA-2015:141)

Updated not-yet-commons-ssl packages fixes security vulnerability : It was discovered that the implementation used by the Not Yet Commons SSL project to check that the server hostname matches the domain name in the subject's CN field was flawed. This can be exploited by a Man-in-the-middle MITM...

Mandriva Linux Security Advisory : subversion (MDVSA-2015:085)

Updated subversion packages fix security vulnerabilities : The moddavsvn module in Apache Subversion before 1.8.8, when SVNListParentPath is enabled, allows remote attackers to cause a denial of service crash via an OPTIONS request CVE-2014-0032. Ben Reser discovered that Subversion did not...