[ MDVSA-2013:190 ] autotrace

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:190 http://www.mandriva.com/en/support/security/ Package : autotrace Date : July 2, 2013 Affected: Business Server 1.0 Problem Description: Updated autotrace package fixes security vulnerability: Stack-based...

Mandriva Linux Security Advisory : php-radius (MDVSA-2013:192)

A security vulnerability was discovered and fixed in php-radius. Fix a security issue in radiusgetvendorattr by enforcing checks of the VSA length field against the buffer size CVE-2013-2220. The updated packages have been upgraded to the 1.2.7 version which is not affected by this issue...

Mandriva Linux Security Advisory : fail2ban (MDVSA-2013:191)

Updated fail2ban packages fix CVE-2013-2178 Krzysztof Katowicz-Kowalewski discovered a vulnerability in Fail2ban, a log monitoring and system which can act on attack by preventing hosts to connect to specified services using the local firewall. When using Fail2ban to monitor Apache logs, improper...

Mandriva Linux Security Advisory : apache-mod_security (MDVSA-2013:187)

Updated apache-modsecurity packages fix security vulnerability : When ModSecurity receives a request body with a size bigger than the value set by the SecRequestBodyInMemoryLimit and with a Content-Type that has no request body processor mapped to it, ModSecurity will systematically crash on ever...

Mandriva Linux Security Advisory : otrs (MDVSA-2013:188)

Updated otrs package fixes security vulnerabilities : An attacker with a valid agent login could manipulate URLs in the ticket watch mechanism to see contents of tickets they are not permitted to see CVE-2013-3551, CVE-2013-4088. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptiv...

Mandriva Linux Security Advisory : autotrace (MDVSA-2013:190)

Updated autotrace package fixes security vulnerability : Stack-based buffer overflow in bmp parser CVE-2013-1953. Updated autotrace package corrects the issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandriva...

[ MDVSA-2013:178 ] nfs-utils

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:178 http://www.mandriva.com/en/support/security/ Package : nfs-utils Date : June 25, 2013 Affected: Business Server 1.0 Problem Description: Updated nfs-utils packages fix security vulnerability It was...

[ MDVSA-2013:180 ] curl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:180 http://www.mandriva.com/en/support/security/ Package : curl Date : June 27, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: A vulnerability has been discovered and correcte...

Mandriva Linux Security Advisory : puppet (MDVSA-2013:186)

Updated puppet packages fix remote code execution vulnerability When making REST api calls, the puppet master takes YAML from an untrusted client, deserializes it, and then calls methods on the resulting object. A YAML payload can be crafted to cause the deserialization to construct an instance o...

Mandriva Linux Security Advisory : java-1.7.0-openjdk (MDVSA-2013:183)

Updated java-1.7.0-openjdk packages fix multiple security vulnerabilities Multiple flaws were discovered in the ImagingLib and the image attribute, channel, layout and raster processing in the 2D component. An untrusted Java application or applet could possibly use these flaws to trigger Java...

Mandriva Linux Security Advisory : mesa (MDVSA-2013:182)

Updated mesa packages fix multiple vulnerabilities An out-of-bounds access flaw was found in Mesa. If an application using Mesa exposed the Mesa API to untrusted inputs Mozilla Firefox does this, an attacker could cause the application to crash or, potentially, execute arbitrary code with the...

Mandriva Linux Security Advisory : perl-Module-Signature (MDVSA-2013:185)

Updated perl-Module-Signature package fixes CVE-2013-2145 Arbitrary code execution vulnerability in Module::Signature before 0.72 CVE-2013-2145. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandriva Linux Security...

Mandriva Linux Security Advisory : curl (MDVSA-2013:180)

A vulnerability has been discovered and corrected in curl : libcurl is vulnerable to a case of bad checking of the input data which may lead to heap corruption. The function curleasyunescape decodes URL encoded strings to raw binary data. URL encoded octets are represented with %HH combinations...

Mandriva Linux Security Advisory : perl-Dancer (MDVSA-2013:184)

Updated perl-Dancer package fixes CVE-2012-5572 A security flaw was found in the way Dancer.pm, lightweight yet powerful web application framework / Perl language module, performed sanitization of values to be used for cookie and cookies methods. A remote attacker could use this flaw to inject...

Mandriva Linux Security Advisory : dbus (MDVSA-2013:177)

Updated dbus packages fix security vulnerability. Alexandru Cornea discovered a vulnerability in libdbus caused by an implementation bug in dbusprintfstringupperbound. This vulnerability can be exploited by a local user to crash system services that use libdbus, causing denial of service. Dependi...

Mandriva Linux Security Advisory : apache (MDVSA-2013:174)

Multiple vulnerabilities has been found and corrected in apache : modrewrite.c in the modrewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP...

Mandriva Linux Security Advisory : subversion (MDVSA-2013:173)

Multiple vulnerabilities has been found and corrected in subversion : If a filename which contains a newline character ASCII 0x0a is committed to a repository using the FSFS format, the resulting revision is corrupt. This can lead to disruption for users of the repository CVE-2013-1968...

Mandriva Linux Security Advisory : wireshark (MDVSA-2013:172)

Multiple vulnerabilities has been found and corrected in wireshark : - The ASN.1 BER dissector could crash CVE-2013-3557. - The CAPWAP dissector could crash CVE-2013-4074. - The HTTP dissector could overrun the stack CVE-2013-4081. - The DCP ETSI dissector could crash CVE-2013-4083. This advisory...

[ MDVSA-2013:168 ] python-httplib2

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:168 http://www.mandriva.com/en/support/security/ Package : python-httplib2 Date : May 27, 2013 Affected: Business Server 1.0 Problem Description: Updated python-httplib2 packages fix security vulnerability:...

[ MDVSA-2013:167 ] openvpn

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:167 http://www.mandriva.com/en/support/security/ Package : openvpn Date : May 27, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: Updated openvpn package fixes security...