Mandriva Linux Security Advisory : libjpeg (MDVSA-2013:273)

Updated libjpeg packages fix security vulnerabilities : libjpeg 6b and libjpeg-turbo will use uninitialized memory when decoding images with missing SOS data for the luminance component Y in presence of valid chroma data Cr, Cb CVE-2013-6629. libjpeg-turbo will use uninitialized memory when...

Mandriva Linux Security Advisory : poppler (MDVSA-2013:272)

Updated poppler packages fix security vulnerabilities : Poppler is found to be affected by a stack based buffer overflow vulnerability in the pdfseparate utility. Successfully exploiting this issue could allow remote attackers to execute arbitrary code in the context of the affected application...

Mandriva Linux Security Advisory : curl (MDVSA-2013:276)

Updated curl packages fix security vulnerability : Scott Cantor discovered that curl, a file retrieval tool, would disable the CURLOPTSSLVERIFYHOST check when the CURLOPTSSLVERIFYPEER setting was disabled. This would also disable ssl certificate host name checks when it should have only disabled...

Mandriva Linux Security Advisory : krb5 (MDVSA-2013:275)

Updated krb5 package fixes security vulnerabily : If a KDC serves multiple realms, certain requests can cause setupserverrealm to dereference a NULL pointer, crashing the KDC. This can be triggered by an unauthenticated user CVE-2013-1418. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Mandriva Linux Security Advisory : pmake (MDVSA-2013:271)

Updated pmake package fixes security vulnerability : The make include files in NetBSD before 1.6.2, as used in pmake 1.111 and earlier, allow local users to overwrite arbitrary files via a symlink attack on a /tmp/depend temporary file, related to bsd.lib.mk and bsd.prog.mk CVE-2011-1920...

Mandriva Linux Security Advisory : nss (MDVSA-2013:270)

Multiple security issues was identified and fixed in mozilla NSPR and NSS : Mozilla Network Security Services NSS before 3.15.2 does not ensure that data structures are initialized before read operations, which allows remote attackers to cause a denial of service or possibly have unspecified othe...

Mandriva Linux Security Advisory : torque (MDVSA-2013:268)

Updated torque packages fix security vulnerability : A user could submit executable shell commands on the tail of what is passed with the -M switch for qsub. This was later passed to a pipe, making it possible for these commands to be executed as root on the pbsserver CVE-2013-4495. %NASLMINLEVEL...

Mandriva Linux Security Advisory : kernel (MDVSA-2013:265)

Multiple vulnerabilities has been found and corrected in the Linux kernel : The ipcrcuputref function in ipc/util.c in the Linux kernel before 3.10 does not properly manage a reference count, which allows local users to cause a denial of service memory consumption or system crash via a crafted...

[ MDVSA-2013:258 ] icu

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:258 http://www.mandriva.com/en/support/security/ Package : icu Date : October 28, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: Updated icu packages fix security...

[ MDVSA-2013:262 ] python-pycrypto

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:262 http://www.mandriva.com/en/support/security/ Package : python-pycrypto Date : October 28, 2013 Affected: Business Server 1.0 Problem Description: Updated python-pycrypto package fixes security...

[ MDVSA-2013:261 ] dropbear

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:261 http://www.mandriva.com/en/support/security/ Package : dropbear Date : October 28, 2013 Affected: Business Server 1.0 Problem Description: Updated dropbear package fixes security vulnerability: Possible...

Mandriva Linux Security Advisory : roundcubemail (MDVSA-2013:263)

A vulnerability has been discovered and corrected in roundcubemail : It was discovered that roundcube does not properly sanitize the session parameter in steps/utils/savepref.inc during saving preferences. The vulnerability can be exploited to overwrite configuration settings and subsequently...

Mandriva Linux Security Advisory : python-pycrypto (MDVSA-2013:262)

Updated python-pycrypto package fixes security vulnerability : In PyCrypto before v2.6.1, the Crypto.Random pseudo-random number generator PRNG exhibits a race condition that may cause it to generate the same 'random' output in multiple processes that are forked from each other. Depending on the...

Mandriva Linux Security Advisory : dropbear (MDVSA-2013:261)

Updated dropbear package fixes security vulnerability : Possible memory exhaustion denial of service due to the size of decompressed payloads in dropbear before 2013.59 CVE-2013-4421. Inconsistent delays in authorization failures could be used to disclose the existence of valid user accounts in...

Mandriva Linux Security Advisory : x11-server (MDVSA-2013:259)

Updated x11-server packages fix security vulnerability : Use-after-free vulnerability in the doImageText function in dix/dixfonts.c in the xorg-server module before 1.14.4 in X.Org X11 allows remote authenticated users to cause a denial of service daemon crash or possibly execute arbitrary code v...

Mandriva Linux Security Advisory : icu (MDVSA-2013:258)

Updated icu packages fix security vulnerabilities : It was discovered that ICU contained a race condition affecting multi-threaded applications. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the...

[ MDVSA-2013:257 ] nss

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:257 http://www.mandriva.com/en/support/security/ Package : nss Date : October 23, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: A vulnerability has been discovered and...

Mandriva Linux Security Advisory : apache-mod_fcgid (MDVSA-2013:256)

Updated apache-modfcgid package fixes security vulnerability : Apache modfcgid before version 2.3.9 fails to perform adequate boundary checks on user-supplied input. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing th...

Mandriva Linux Security Advisory : aircrack-ng (MDVSA-2013:251)

Updated aircrack-ng package fixes security vulnerability : A buffer overflow vulnerability has been discovered in Aircrack-ng. A remote attacker could entice a user to open a specially crafted dump file using Aircrack-ng, possibly resulting in execution of arbitrary code with the privileges of th...

Mandriva Linux Security Advisory : quagga (MDVSA-2013:254)

Updated quagga packages fix security vulnerability : Remotely exploitable buffer overflow in ospfapi.c and ospfclient.c when processing LSA messages in quagga before 0.99.22.2 CVE-2013-2236. Note: We have worked around this vulnerability by disabling the ospfapi and ospfclient features, which did...