[ MDVSA-2014:234 ] libksba

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:234 http://www.mandriva.com/en/support/security/ Package : libksba Date : November 28, 2014 Affected: Business Server 1.0 Problem Description: Updated libksba packages fix security vulnerability: By using...

[ MDVSA-2014:226 ] imagemagick

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:226 http://www.mandriva.com/en/support/security/ Package : imagemagick Date : November 25, 2014 Affected: Business Server 1.0 Problem Description: Updated imagemagick packages fix security vulnerabilities:...

Mandriva Linux Security Advisory : file (MDVSA-2014:236)

Updated file packages fix security vulnerability : An out-of-bounds read flaw was found in file's donote function in the way the file utility determined the note headers of a elf file. This could possibly lead to file executable crash CVE-2014-3710. %NASLMINLEVEL 70300 C Tenable Network Security,...

Mandriva Linux Security Advisory : icecast (MDVSA-2014:231)

Updated icecast package fixes security vulnerability : Icecast did not properly handle the launching of scripts on connect or disconnect of sources. This could result in sensitive information from these scripts leaking to external clients CVE-2014-9018. %NASLMINLEVEL 70300 C Tenable Network...

Mandriva Linux Security Advisory : glibc (MDVSA-2014:232)

Updated glibc package fixes security vulnerability : The function wordexp\ fails to properly handle the WRDENOCMD flag when processing arithmetic inputs in the form of $... where ... can be anything valid. The backticks in the arithmetic epxression are evaluated by in a shell even if WRDENOCMD...

Mandriva Linux Security Advisory : wordpress (MDVSA-2014:233)

Updated wordpress package fixes security vulnerabilities : XSS in wptexturize via comments or posts, exploitable for unauthenticated users CVE-2014-9031. XSS in media playlists CVE-2014-9032. CSRF in the password reset process CVE-2014-9033. Denial of service for giant passwords. The phpass libra...

Mandriva Linux Security Advisory : phpmyadmin (MDVSA-2014:228)

Multiple vulnerabilities has been discovered and corrected in phpmyadmin : - Multiple XSS vulnerabilities CVE-2014-8958. - Local file inclusion vulnerability CVE-2014-8959. - XSS vulnerability in error reporting functionality CVE-2014-8960. - Leakage of line count of an arbitrary file...

Mandriva Linux Security Advisory : imagemagick (MDVSA-2014:226)

Updated imagemagick packages fix security vulnerabilities : ImageMagick is vulnerable to a denial of service due to out-of-bounds memory accesses in the resize code CVE-2014-8354, PCX parser CVE-2014-8355, DCM decoder CVE-2014-8562, and JPEG decoder CVE-2014-8716. %NASLMINLEVEL 70300 C Tenable...

Mandriva Linux Security Advisory : php-smarty (MDVSA-2014:221)

An XSS vulnerability in the SmartyException class in Smarty aka smarty-php before 3.1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors that trigger a Smarty exception CVE-2012-4437. Smarty before 3.1.21 allows remote attackers to bypass the secure mode...

Mandriva Linux Security Advisory : wireshark (MDVSA-2014:223)

Updated wireshark packages fix security vulnerabilities : SigComp UDVM buffer overflow CVE-2014-8710. AMQP crash CVE-2014-8711. NCP crashes CVE-2014-8712, CVE-2014-8713. TN5250 infinite loops CVE-2014-8714. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package chec...

[ MDVSA-2014:223 ] wireshark

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:223 http://www.mandriva.com/en/support/security/ Package : wireshark Date : November 21, 2014 Affected: Business Server 1.0 Problem Description: Updated wireshark packages fix security vulnerabilities: SigCo...

[ MDVSA-2014:215 ] gnutls

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:215 http://www.mandriva.com/en/support/security/ Package : gnutls Date : November 19, 2014 Affected: Business Server 1.0 Problem Description: Updated gnutls package fix security vulnerability: An out-of-boun...

[ MDVSA-2014:213 ] curl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:213 http://www.mandriva.com/en/support/security/ Package : curl Date : November 18, 2014 Affected: Business Server 1.0 Problem Description: Updated curl packages fix security vulnerability: Symeon Paraschoud...

Mandriva Linux Security Advisory : libvirt (MDVSA-2014:222)

Updated libvirt packages fix security vulnerability : Eric Blake discovered that libvirt incorrectly handled permissions when processing the qemuDomainFormatXML command. An attacker with read-only privileges could possibly use this to gain access to certain information from the domain xml file...

Mandriva Linux Security Advisory : srtp (MDVSA-2014:219)

Updated srtp package fixes security vulnerability : Fernando Russ from Groundworks Technologies reported a buffer overflow flaw in srtp, Cisco's reference implementation of the Secure Real-time Transport Protocol SRTP, in how the cryptopolicysetfromprofileforrtp function applies cryptographic...

Mandriva Linux Security Advisory : krb5 (MDVSA-2014:224)

Updated krb5 packages fix security vulnerability : The kadm5randkeyprincipal3 function in lib/kadm5/srv/svrprincipal.c in kadmind in MIT Kerberos 5 aka krb5 before 1.13 sends old keys in a response to a -randkey -keepold request, which allows remote authenticated users to forge tickets by...

Mandriva Linux Security Advisory : clamav (MDVSA-2014:217)

ClamAV 0.98.5 addresses several reported potential security bugs. Certain JavaScript files causes ClamAV to segfault when scanned with the -a list archived files CVE-2013-6497. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extract...

Mandriva Linux Security Advisory : php-ZendFramework (MDVSA-2014:216)

A vulnerability has been found and corrected in php-ZendFramework : The 1 ZendLdap class in Zend before 1.12.9 and 2 Zend\Ldap component in Zend 2.x before 2.2.8 and 2.3.x before 2.3.3 allows remote attackers to bypass authentication via a password starting with a null byte, which triggers an...

Mandriva Linux Security Advisory : gnutls (MDVSA-2014:215)

Updated gnutls package fix security vulnerability : An out-of-bounds memory write flaw was found in the way GnuTLS parsed certain ECC Elliptic Curve Cryptography certificates or certificate signing requests CSR. A malicious user could create a specially crafted ECC certificate or a certificate...

Mandriva Linux Security Advisory : curl (MDVSA-2014:213)

Updated curl packages fix security vulnerability : Symeon Paraschoudis discovered that the curleasyduphandle function in cURL has a bug that can lead to libcurl eventually sending off sensitive data that was not intended for sending, while performing a HTTP POST operation. This bug requires...