[ MDVSA-2015:114 ] cifs-utils

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:114 http://www.mandriva.com/en/support/security/ Package : cifs-utils Date : March 29, 2015 Affected: Business Server 2.0 Problem Description: Updated cifs-utils packages fix security vulnerability: Sebastia...

[ MDVSA-2015:158 ] jython

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:158 http://www.mandriva.com/en/support/security/ Package : jython Date : March 29, 2015 Affected: Business Server 2.0 Problem Description: Updated jython packages fix security vulnerability: There are server...

[ MDVSA-2015:199 ] less

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:199 http://www.mandriva.com/en/support/security/ Package : less Date : April 10, 2015 Affected: Business Server 1.0, Business Server 2.0 Problem Description: Updated less package fixes security vulnerability...

[ MDVSA-2015:174 ] erlang

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:174 http://www.mandriva.com/en/support/security/ Package : erlang Date : March 30, 2015 Affected: Business Server 2.0 Problem Description: Updated erlang packages fixes security vulnerability: An FTP command...

[ MDVSA-2015:147-1 ] libtiff

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:147-1 http://www.mandriva.com/en/support/security/ Package : libtiff Date : March 30, 2015 Affected: Business Server 1.0 Problem Description: Updated libtiff packages fix security vulnerabilities: The libtif...

Mandriva Business Server weak permissions

Password files weak permissions...

Mandriva Linux Security Advisory : arj (MDVSA-2015:201)

Multiple vulnerabilities has been found and corrected in arj : Jakub Wilk discovered that arj follows symlinks created during unpacking of an arj archive. A remote attacker could use this flaw to perform a directory traversal attack if a user or automated system were tricked into processing a...

[ MDVSA-2015:184 ] setup

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:184 http://www.mandriva.com/en/support/security/ Package : setup Date : March 30, 2015 Affected: Business Server 2.0 Problem Description: Updated setup package fixes security vulnerability: An issue has been...

[ MDVSA-2015:177 ] ctdb

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:177 http://www.mandriva.com/en/support/security/ Package : ctdb Date : March 30, 2015 Affected: Business Server 2.0 Problem Description: Updated ctdb packages fix security vulnerability: ctdb before 2.5 is...

[ MDVSA-2015:170 ] gcc

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:170 http://www.mandriva.com/en/support/security/ Package : gcc Date : March 30, 2015 Affected: Business Server 2.0 Problem Description: Updated gcc packages fix the following security issue: Multiple integer...

Mandriva Linux Security Advisory : batik (MDVSA-2015:203)

Updated batik packages fix security vulnerability : Nicolas Gregoire and Kevin Schaller discovered that Batik would load XML external entities by default. If a user or automated system were tricked into opening a specially crafted SVG file, an attacker could possibly obtain access to arbitrary...

Mandriva Linux Security Advisory : less (MDVSA-2015:199)

Updated less package fixes security vulnerability : Malformed UTF-8 data could have caused an out of bounds read in the UTF-8 decoding routines, causing an invalid read access CVE-2014-9488. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugi...

Mandriva Linux Security Advisory : cups-filters (MDVSA-2015:196)

Updated cups-filters package fixes security vulnerability : cups-browsed in cups-filters before 1.0.66 contained a bug in the removebadchars\ function, where it failed to reliably filter out illegal characters if there were two or more subsequent illegal characters, allowing execution of arbitrar...

Mandriva Linux Security Advisory : python-django (MDVSA-2015:195)

A vulnerability has been discovered and corrected in python-django : The utils.http.issafeurl function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting XSS...

Mandriva Linux Security Advisory : libtasn1 (MDVSA-2015:193)

Updated libtasn1 packages fix security vulnerability : The libtasn1 library before version 4.4 is vulnerable to a two-byte stack overflow in asn1derdecoding CVE-2015-2806. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted fr...

Mandriva Linux Security Advisory : graphviz (MDVSA-2015:187)

Updated graphviz packages fix security vulnerability : Format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows remote attackers to have unspecified impact via format string specifiers in unknown vector, which are not properly handled in an error string...

Mandriva Linux Security Advisory : subversion (MDVSA-2015:192)

Multiple vulnerabilities has been discovered and corrected in subversion : Subversion HTTP servers with FSFS repositories are vulnerable to a remotely triggerable excessive memory use with certain REPORT requests CVE-2015-0202. Subversion moddavsvn and svnserve are vulnerable to a remotely...

Mandriva Linux Security Advisory : flac (MDVSA-2015:188)

Multiple vulnerabilities has been discovered and corrected in flac : Heap-based buffer overflow in streamdecoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file CVE-2014-9028. Stack-based buffer overflow in streamdecoder.c in libFLAC before 1.3...

Mandriva Linux Security Advisory : tor (MDVSA-2015:189)

Updated tor packages fix security vulnerabilities : The tor package has been updated to version 0.2.4.26, which fixes possible crashes that may be remotely trigger-able, which would result in a denial of service, and also fixes a few other bugs. See the release announcement for details...

Mandriva Linux Security Advisory : dokuwiki (MDVSA-2015:185)

Updated dokuwiki packages fix security vulnerabilities : inc/template.php in DokuWiki before 2014-05-05a only checks for access to the root namespace, which allows remote attackers to access arbitrary images via a media file details ajax call CVE-2014-8761. The ajaxmediadiff function in DokuWiki...