Mandriva Linux Security Advisory : ntp (MDVSA-2009:007)

A flaw was found in how NTP checked the return value of signature verification. A remote attacker could use this to bypass certificate validation by using a malformed SSL/TLS signature CVE-2009-0021. The updated packages have been patched to prevent this issue. %NASLMINLEVEL 70300 C Tenable Netwo...

Mandriva Linux Security Advisory : ffmpeg (MDVSA-2008:157)

A vulnerability was found in how ffmpeg handled STR file demuxing. If a user were tricked into processing a malicious STR file, a remote attacker could execute arbitrary code with user privileges via applications linked against ffmpeg CVE-2008-3162. The updated packages have been patched to corre...

Mandriva Linux Security Advisory : mplayer (MDVSA-2008:196)

Uncontrolled array index in the sdpplinparse function in stream/realrtsp/sdpplin.c in MPlayer 1.0 rc2 allows remote attackers to overwrite memory and execute arbitrary code via a large streamid SDP parameter. The updated packages have been patched to fix this issue. %NASLMINLEVEL 70300 C Tenable...

Mandriva Linux Security Advisory : mailman (MDVSA-2008:061)

Multiple cross-site scripting XSS vulnerabilities were found in Mailman prior to version 2.1.10b1, which allow remote attackers to inject arbitrary web script or HTML via edting templates and the list's info attribute in the web administrator interface. The updated packages have been patched to...

Mandriva Linux Security Advisory : kdelibs (MDVSA-2008:097)

A vulnerability was found in startkdeinit in KDE 3.5.5 through 3.5.9 where, if it was installed setuid root, it could allow local users to cause a denial of service or possibly execute arbitrary code CVE-2008-1671. By default, startkdeinit is not installed setuid root on Mandriva Linux, however...

Mandriva Linux Security Advisory : perl (MDVSA-2008:165)

The rmtree function in lib/File/Path.pm in Perl 5.10 does not properly check permissions before performing a chmod, which allows local users to modify the permissions of arbitrary files via a symlink attack. The updated packages have been patched to fix this. %NASLMINLEVEL 70300 C Tenable Network...

Mandriva Linux Security Advisory : php (MDVSA-2009:066)

PHP 4.4.4, 5.1.6, and other versions, when running on Apache, allows local users to modify behavior of other sites hosted on the same web server by modifying the mbstring.funcoverload setting within .htaccess, which causes this setting to be applied to other virtual hosts on the same server...

Mandriva Linux Security Advisory : postgresql (MDVSA-2008:004)

Index Functions Privilege Escalation CVE-2007-6600: as a unique feature, PostgreSQL allows users to create indexes on the results of user-defined functions, known as expression indexes. This provided two vulnerabilities to privilege escalation: 1 index functions were executed as the superuser and...

Mandriva Linux Security Advisory : amarok (MDVSA-2008:172)

A flaw in Amarok prior to 1.4.10 would allow local users to overwrite arbitrary files via a symlink attack on a temporary file that Amarok created with a predictable name CVE-2008-3699. The updated packages have been patched to correct this issue. %NASLMINLEVEL 70300 C Tenable Network Security,...

Mandriva Linux Security Advisory : openssh (MDVSA-2008:098)

A vulnerability in OpenSSH 4.4 through 4.8 allowed local attackers to bypass intended security restrictions enabling them to execute commands other than those specified by the ForceCommand directive, provided they are able to modify to /.ssh/rc CVE-2008-1657. The updated packages have been patche...

Mandriva Linux Security Advisory : tcl (MDVSA-2008:059)

A flaw in the Tcl regular expression handling engine was originally discovered by Will Drewry in the PostgreSQL database server's Tcl regular expression engine. This flaw can result in an infinite loop when processing certain regular expressions. The updated packages have been patched to correct...

Mandriva Linux Security Advisory : libcdio (MDVSA-2008:037)

A stack-based buffer overflow was discovered in libcdio that allowed context-dependent attackers to cause a denial of service core dump and possibly execute arbitrary code via a disk or image file that contains a long joliet file name. In addition, a fix for failed UTF-8 conversions that would...

Mandriva Linux Security Advisory : php (MDVSA-2008:127)

A number of vulnerabilities have been found and corrected in PHP : The htmlentities and htmlspecialchars functions in PHP prior to 5.2.5 accepted partial multibyte sequences, which has unknown impact and attack vectors CVE-2007-5898. The outputaddrewritevar function in PHP prior to 5.2.5 rewrites...

Mandriva Linux Security Advisory : mozilla-firefox (MDVSA-2008:244)

Security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox 2.x, version 2.0.0.19 CVE-2008-5500, CVE-2008-5503, CVE-2008-5504, CVE-2008-5506, CVE-2008-5507, CVE-2008-5508, CVE-2008-5510, CVE-2008-5511, CVE-2008-5512, CVE-2008-5513. This update provides the latest...

Mandriva Linux Security Advisory : python-pycrypto (MDVSA-2009:050-1)

A vulnerability have been discovered and corrected in PyCrypto ARC2 module 2.0.1, which allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large ARC2 key length CVE-2009-0544. The updated packages have been patched to prevent this. Update : The previous...

Mandriva Linux Security Advisory : mysql (MDVSA-2009:094)

Multiple vulnerabilities has been found and corrected in mysql : MySQL 5.0 before 5.0.66, 5.1 before 5.1.26, and 6.0 before 6.0.6 does not properly handle a b'' b single-quote single-quote token, aka an empty bit-string literal, which allows remote attackers to cause a denial of service daemon...

Mandriva Linux Security Advisory : mozilla-firefox (MDVSA-2008:148)

Security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox program, version 2.0.0.16 CVE-2008-2785, CVE-2008-2933. This update provides the latest Firefox to correct these issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Mandriva Linux Security Advisory : libxml2 (MDVSA-2008:010)

A denial of service flaw was discovered by the Google Security Team in the way libxml2 processes malformed XML content. This flaw could cause the application to stop responding. The updated packages have been patched to correct this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Mandriva Linux Security Advisory : apache (MDVSA-2008:016)

A number of vulnerabilities were found and fixed in the Apache 2.2.x packages : A flaw found in the modimagemap module could lead to a cross-site scripting attack on sites where modimagemap was enabled and an imagemap file was publically available CVE-2007-5000. A flaw found in the modstatus modu...

Mandriva Linux Security Advisory : wordnet (MDVSA-2008:182-1)

Rob Holland found several programming errors in WordNet which could lead to the execution or arbitrary code when used with untrusted input CVE-2008-2149, CVE-2008-3908. Update : The previous patch had a typo that caused incorrect behaviour in WordNet. This update uses an update patch that correct...