Mandriva Linux Security Advisory : puppet (MDVSA-2013:222)

Updated puppet and puppet3 package fix security vulnerabilities : It was discovered that Puppet incorrectly handled the resourcetype service. A local attacker on the master could use this issue to execute arbitrary Ruby files CVE-2013-4761. It was discovered that Puppet incorrectly handled...

Mandriva Linux Security Advisory : perl-Proc-ProcessTable (MDVSA-2013:216)

Updated perl-Proc-ProcessTable package fixes security vulnerability : ProcessTable.pm in the Proc::ProcessTable module 0.45 for Perl, when TTY information caching is enabled, allows local users to overwrite arbitrary files via a symlink attack on /tmp/TTYDEVS CVE-2011-4363. %NASLMINLEVEL 70300 C...

Mandriva Linux Security Advisory : spice (MDVSA-2013:217)

Updated spice packages fix security vulnerability : An user able to initiate spice connection to the guest could use a flaw in server/redchannel.c to crash the guest CVE-2013-4130. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Mandriva Linux Security Advisory : python (MDVSA-2013:214)

Updated python packages fix security vulnerability : Ryan Sleevi of the Google Chrome Security Team has discovered that Python's SSL module doesn't handle NULL bytes inside subjectAltNames general names. This could lead to a breach when an application uses ssl.matchhostname to match the hostname...

Mandriva Linux Security Advisory : xymon (MDVSA-2013:213)

Updated xymon package fixes security vulnerability : A security vulnerability has been found in version 4.x of the Xymon Systems Network Monitor tool The error permits a remote attacker to delete files on the server running the Xymon trend-data daemon xymondrrd. File deletion is done with the...

Mandriva Linux Security Advisory : otrs (MDVSA-2013:212)

Updated otrs package fixes security vulnerability : It was discovered that otrs2, the Open Ticket Request System, does not properly sanitise user-supplied data that is used on SQL queries. An attacker with a valid agent login could exploit this issue to craft SQL queries by injecting arbitrary SQ...

Mandriva Linux Security Advisory : lcms2 (MDVSA-2013:211)

Updated lcms2 packages fixes security vulnerability : It was discovered that Little CMS did not properly verify certain memory allocations. If a user or automated system using Little CMS were tricked into opening a specially crafted file, an attacker could cause Little CMS to crash CVE-2013-4160...

[ MDVSA-2013:209 ] subversion

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:209 http://www.mandriva.com/en/support/security/ Package : subversion Date : August 6, 2013 Affected: Business Server 1.0 Problem Description: A vulnerability has been found and corrected in subversion: The...

Mandriva Linux Security Advisory : samba (MDVSA-2013:207)

A vulnerability has been found and corrected in samba : Integer overflow in the readnttransealist function in nttrans.c in smbd in Samba 3.x before 3.5.22, 3.6.x before 3.6.17, and 4.x before 4.0.8 allows remote attackers to cause a denial of service memory consumption via a malformed packet...

Mandriva Linux Security Advisory : subversion (MDVSA-2013:209)

A vulnerability has been found and corrected in subversion : The moddavsvn Apache HTTPD server module in Subversion 1.7.0 through 1.7.10 and 1.8.x before 1.8.1 allows remote authenticated users to cause a denial of service assertion failure or out-of-bounds read via a certain 1 COPY, 2 DELETE, or...

Mandriva Linux Security Advisory : libtiff (MDVSA-2013:208)

Updated libtiff packages fix security vulnerabilities : A heap-based buffer overflow flaw was found in the way tiff2pdf of libtiff performed write of TIFF image content into particular PDF document file, in the tpprocessjpegstrip function. A remote attacker could provide a specially crafted TIFF...

Mandriva Linux Security Advisory : owncloud (MDVSA-2013:206)

Updated owncloud package fixes security vulnerabilities : XSS vulnerability in Share Interface oC-SA-2013-029. Authentication bypass in userwebdavauth oC-SA-2013-030. This update provides OwnCloud 5.0.9, which fixes these issues, as well as several other bugs. %NASLMINLEVEL 70300 C Tenable Networ...

Mandriva Linux Security Advisory : gnupg (MDVSA-2013:205)

A vulnerability has been discovered and corrected in gnupg and in libgcrypt : Yarom and Falkner discovered that RSA secret keys in applications using GnuPG 1.x, and using the libgcrypt library, could be leaked via a side channel attack, where a malicious local user could obtain private key...

[ MDVSA-2013:199 ] squid

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:199 http://www.mandriva.com/en/support/security/ Package : squid Date : July 25, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: Multiple vulnerabilities has been discovered an...

Mandriva Linux Security Advisory : bind (MDVSA-2013:202)

A vulnerability has been discovered and corrected in bind : The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and 9.9.4b1, and DNSco BIND 9.9.3-S1 before 9.9.3-S1-P1 and 9.9.4-S1b1, allows remote attackers to cause a denial of...

Mandriva Linux Security Advisory : squid (MDVSA-2013:199)

Multiple vulnerabilities has been discovered and corrected in squid : Due to incorrect data validation Squid is vulnerable to a buffer overflow attack when processing specially crafted HTTP requests. This problem allows any trusted client or client script who can generate HTTP requests to trigger...

[ MDVSA-2013:188 ] otrs

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:188 http://www.mandriva.com/en/support/security/ Package : otrs Date : July 2, 2013 Affected: Business Server 1.0 Problem Description: Updated otrs package fixes security vulnerabilities: An attacker with a...

[ MDVSA-2013:195 ] php

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:195 http://www.mandriva.com/en/support/security/ Package : php Date : July 12, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: A vulnerability has been discovered and corrected...

Mandriva Linux Security Advisory : php (MDVSA-2013:195)

A vulnerability has been discovered and corrected in php : - Fixed PHP bug 65236 heap corruption in xml parser CVE-2013-4113. The updated packages have been upgraded to the 5.3.27 version which is not vulnerable to this issue. The php-timezonedb package has been updated to the 2013.4 version...

[ MDVSA-2013:192 ] php-radius

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:192 http://www.mandriva.com/en/support/security/ Package : php-radius Date : July 2, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: A security vulnerability was discovered and...