Mandriva Linux Security Advisory : libxslt (MDVSA-2013:141)

Updated libxslt packages fix security vulnerability : Nicholas Gregoire discovered that libxslt incorrectly handled certain empty values. If a user or automated system were tricked into processing a specially crafted XSLT document, a remote attacker could cause libxslt to crash, causing a denial ...

Mandriva Linux Security Advisory : openjpeg (MDVSA-2013:110)

Updated openjpeg packages fix security vulnerability : An out-of heap-based buffer bounds read and write flaw, leading to invalid free, was found in the way a tile coder / decoder TCD implementation of OpenJPEG, an open source JPEG 2000 codec written in C language, performed releasing of previous...

Mandriva Linux Security Advisory : clamav (MDVSA-2013:027-1)

ClamAV 0.97.7 addresses several reported potential security bugs. Thanks to Felix Groebert, Mateusz Jurczyk and Gynvael Coldwind of the Google Security Team for finding and reporting these issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Mandriva Linux Security Advisory : fail2ban (MDVSA-2013:078)

Updated fail2ban package fixes security vulnerability : fail2ban before 0.8.8 didn't escape the content of \ if used in custom action files, which could cause issues on the system running fail2ban as it scans log files, depending on what content is matched, since that content could contain...

Mandriva Linux Security Advisory : x11-server (MDVSA-2013:139)

This fixes a format string vulnerability in the LogVHdrMessageVerb function in os/log.c when handling input device names in X.Org X11 server CVE-2012-2118. MBS1 is not vulnerable to arbitrary code execution via this vulnerability because of the compiler options that were used to build it, but it...

Mandriva Linux Security Advisory : cups-pk-helper (MDVSA-2013:069)

Updated cups-pk-helper package fixes security vulnerability : cups-pk-helper, a PolicyKit helper to configure CUPS with fine-grained privileges, wraps CUPS function calls in an insecure way. This could lead to uploading sensitive data to a CUPS resource, or overwriting specific files with the...

Mandriva Linux Security Advisory : dbus (MDVSA-2013:070)

Updated dbus packages fix security vulnerability : It was discovered that the D-Bus library honored environment settings even when running with elevated privileges. A local attacker could possibly use this flaw to escalate their privileges, by setting specific environment variables before running...

Mandriva Linux Security Advisory : libgssglue (MDVSA-2013:043)

This update fixes insecure getenv usage in libgssglue, which could be used under some circumstances by local attackers do gain root privileges CVE-2011-2709. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandriva...

Mandriva Linux Security Advisory : freeradius (MDVSA-2013:038)

Updated freeradius packages fixes security vulnerabilities : It was found that the unix module ignored the password expiration setting in /etc/shadow. If FreeRADIUS was configured to use this module for user authentication, this flaw could allow users with an expired password to successfully...

Mandriva Linux Security Advisory : arpwatch (MDVSA-2013:030)

A vulnerability has been discovered and corrected in arpwatch : arpwatch 2.1a15, as used by Red Hat, Debian, Fedora, and possibly others, does not properly drop supplementary groups, which might allow attackers to gain root privileges by leveraging other vulnerabilities in the daemon CVE-2012-265...

Mandriva Linux Security Advisory : lynx (MDVSA-2013:101)

Updated lynx package fixes security vulnerability : Lynx does not verify that the server's certificate is signed by a trusted certification authority, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate, related to improper use of a certain GnuTLS function...

Mandriva Linux Security Advisory : squid (MDVSA-2013:129)

Updated squid packages fix security vulnerability : Due to missing input validation, the Squid cachemgr.cgi tool in Squid before 3.1.22 and 3.2.4 is vulnerable to a denial of service attack when processing specially crafted requests CVE-2012-5643. It was discovered that the patch for CVE-2012-564...

Mandriva Linux Security Advisory : dnsmasq (MDVSA-2013:072)

Updated dnsmasq packages fix security vulnerabilities : When dnsmasq before 2.63 is used in conjunctions with certain configurations of libvirtd, network packets from prohibited networks e.g. packets that should not be passed in may be sent to the dnsmasq application and processed. This can resul...

Mandriva Linux Security Advisory : gimp (MDVSA-2013:082)

Updated gimp packages fix security vulnerabilities : An integer overflow flaw, leading to a heap-based buffer overflow, was found in the GIMP's GIF image format plug-in. An attacker could create a specially crafted GIF image file that, when opened, could cause the GIF plug-in to crash or,...

Mandriva Linux Security Advisory : gnome-keyring (MDVSA-2013:084)

Updated gnome-keyring package fixes security vulnerability : gnome-keyring seems to obey the configuration asking it to stop caching passphrases, but after a while it doesn't cache nor does it ask for the passphrase CVE-2012-3466. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descripti...

Mandriva Linux Security Advisory : net-snmp (MDVSA-2013:049)

A vulnerability has been discovered and corrected in net-snmp : An array index error, leading to out-of heap-based buffer read flaw was found in the way net-snmp agent performed entries lookup in the extension table. When certain MIB subtree was handled by the extend directive, a remote attacker...

Mandriva Linux Security Advisory : snack (MDVSA-2013:126)

Updated snack packages fix security vulnerability : Two vulnerabilities have been discovered in Snack Sound Toolkit, which are caused due to missing boundary checks in the GetWavHeader function generic/jkSoundFile.c when parsing either format sub-chunks or unknown sub-chunks. This can be exploite...

Mandriva Linux Security Advisory : dokuwiki (MDVSA-2013:073)

Updated dokuwiki package fixes security vulnerabilities : DokuWiki 2009-12-25c allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by lib/tpl/index.php and certain other files...

Mandriva Linux Security Advisory : perl (MDVSA-2013:113)

Updated perl packages fix security vulnerability : It was discovered that Perl's 'x' string repeat operator is vulnerable to a heap-based buffer overflow. An attacker could use this to execute arbitrary code CVE-2012-5195. The compile function in Maketext.pm in the Locale::Maketext implementation...

Mandriva Linux Security Advisory : viewvc (MDVSA-2013:134)

Updated viewvc packages fix security vulnerabilities : complete authz support for remote SVN views CVE-2012-3356. log msg leak in SVN revision view with unreadable copy source CVE-2012-3357. function name lines returned by diff are not properly escaped, allowing attackers with commit access to...