Mandriva Linux Security Advisory : nss (MDVSA-2014:252)

Updated nss packages fix security vulnerabilities : In the QuickDER decoder in NSS before 3.17.3, ASN.1 DER decoding of lengths is too permissive, allowing undetected smuggling of arbitrary data CVE-2014-1569. This update adds support for the TLS Fallback Signaling Cipher Suite Value...

Mandriva Linux Security Advisory : jasper (MDVSA-2014:247)

Updated jasper packages fix security vulnerability : Josh Duart of the Google Security Team discovered heap-based buffer overflow flaws in JasPer, which could lead to denial of service application crash or the execution of arbitrary code CVE-2014-9029. %NASLMINLEVEL 70300 C Tenable Network...

Mandriva Linux Security Advisory : mediawiki (MDVSA-2014:241)

Updated mediawiki packages fix security vulnerabilies : In MediaWiki before 1.23.7, a missing CSRF check could allow reflected XSS on wikis that allow raw HTML CVE-2014-9276. MediaWiki's mangling, in MediaWiki before 1.23.7, could allow an article editor to inject code into API consumers that...

Mandriva Linux Security Advisory : rpm (MDVSA-2014:251)

Updated rpm packages fix security vulnerabilities : It was found that RPM wrote file contents to the target installation directory under a temporary name, and verified its cryptographic signature only after the temporary file has been written completely. Under certain conditions, the system...

Mandriva Linux Security Advisory : flac (MDVSA-2014:239)

Updated flac packages fix security vulnerabilities : In libFLAC before 1.3.1, a stack overflow CVE-2014-8962 and a heap overflow CVE-2014-9028, which may result in arbitrary code execution, can be triggered by passing a maliciously crafted .flac file to the libFLAC decoder. %NASLMINLEVEL 70300 C...

Mandriva Linux Security Advisory : cpio (MDVSA-2014:250)

Updated cpio package fixes security vulnerability : Heap-based buffer overflow in the processcopyin function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive CVE-2014-9112. Additionally, a NULL pointer dereference in the copyinlink...

Mandriva Linux Security Advisory : tcpdump (MDVSA-2014:240)

Updated tcpdump package fixes security vulnerabilities : The Tcpdump program could crash when processing a malformed OLSR payload when the verbose output flag was set CVE-2014-8767. The application decoder for the Ad hoc On-Demand Distance Vector AODV protocol in Tcpdump fails to perform input...

Mandriva Linux Security Advisory : mutt (MDVSA-2014:245)

Updated mutt packages fix security vulnerability : A flaw was discovered in mutt. A specially crafted mail header could cause mutt to crash, leading to a denial of service condition CVE-2014-9116. The mutt package has been updated to version 1.5.23 and patched to fix this issue. %NASLMINLEVEL 703...

Mandriva Linux Security Advisory : bind (MDVSA-2014:238)

Updated bind packages fix security vulnerability : By making use of maliciously-constructed zones or a rogue server, an attacker can exploit an oversight in the code BIND 9 uses to follow delegations in the Domain Name Service, causing BIND to issue unlimited queries in an attempt to follow the...

Mandriva Linux Security Advisory : openvpn (MDVSA-2014:246)

Updated openvpn packages fix security vulnerability : Dragana Damjanovic discovered that OpenVPN incorrectly handled certain control channel packets. An authenticated attacker could use this issue to cause an OpenVPN server to crash, resulting in a denial of service CVE-2014-8104. The openvpn...

Mandriva Linux Security Advisory : yaml (MDVSA-2014:242)

Updated yaml and perl-YAML-LibYAML packages fix security vulnerability : An assertion failure was found in the way the libyaml library parsed wrapped strings. An attacker able to load specially crafted YAML input into an application using libyaml could cause the application to crash CVE-2014-9130...

Mandriva Linux Security Advisory : graphviz (MDVSA-2014:248)

Updated graphviz packages fix security vulnerability : Format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows remote attackers to have unspecified impact via format string specifiers in unknown vector, which are not properly handled in an error string...

[ MDVSA-2014:237 ] perl-Mojolicious

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:237 http://www.mandriva.com/en/support/security/ Package : perl-Mojolicious Date : November 28, 2014 Affected: Business Server 1.0 Problem Description: Updated perl-Mojolicious package fixes security...

[ MDVSA-2014:221 ] php-smarty

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:221 http://www.mandriva.com/en/support/security/ Package : php-smarty Date : November 21, 2014 Affected: Business Server 1.0 Problem Description: References: https://vulners.com/cve/CVE-2012-4437...

Mandriva Linux Security Advisory : perl-Mojolicious (MDVSA-2014:237)

Updated perl-Mojolicious package fixes security vulnerability : An assumption in Mojolicious before 5.48 CGI parameter handling that can result in parameter injection attacks. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracte...

Mandriva Linux Security Advisory : libksba (MDVSA-2014:234)

Updated libksba packages fix security vulnerability : By using special crafted S/MIME messages or ECC based OpenPGP data, it is possible to create a buffer overflow, which could lead to a denial of service CVE-2014-9087. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text an...

[ MDVSA-2014:235 ] perl-Plack

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:235 http://www.mandriva.com/en/support/security/ Package : perl-Plack Date : November 28, 2014 Affected: Business Server 1.0 Problem Description: Updated perl-Plack package fixes security vulnerability:...

[ MDVSA-2014:216 ] php-ZendFramework

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:216 http://www.mandriva.com/en/support/security/ Package : php-ZendFramework Date : November 20, 2014 Affected: Business Server 1.0 Problem Description: A vulnerability has been found and corrected in...

[ MDVSA-2014:232 ] glibc

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:232 http://www.mandriva.com/en/support/security/ Package : glibc Date : November 27, 2014 Affected: Business Server 1.0 Problem Description: Updated glibc package fixes security vulnerability: The function...

Mandriva Linux Security Advisory : perl-Plack (MDVSA-2014:235)

Updated perl-Plack package fixes security vulnerability : Plack::App::File would previously strip trailing slashes off provided paths. This in combination with the common pattern of serving files with Plack::Middleware::Static could allow an attacker to bypass a whitelist of generated files...