Mandriva Linux Security Advisory : dbus (MDVSA-2013:070)

Updated dbus packages fix security vulnerability : It was discovered that the D-Bus library honored environment settings even when running with elevated privileges. A local attacker could possibly use this flaw to escalate their privileges, by setting specific environment variables before running...

Mandriva Linux Security Advisory : bogofilter (MDVSA-2013:064)

Updated bogofilter package fixes security vulnerability : In bogofilter before 1.2.3, bogofilter's/bogolexer's base64 could overwrite heap memory in the character set conversion in certain pathological cases of invalid base64 code that decodes to incomplete multibyte characters CVE-2012-5468...

Mandriva Linux Security Advisory : clamav (MDVSA-2013:027-1)

ClamAV 0.97.7 addresses several reported potential security bugs. Thanks to Felix Groebert, Mateusz Jurczyk and Gynvael Coldwind of the Google Security Team for finding and reporting these issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Mandriva Linux Security Advisory : libxslt (MDVSA-2013:141)

Updated libxslt packages fix security vulnerability : Nicholas Gregoire discovered that libxslt incorrectly handled certain empty values. If a user or automated system were tricked into processing a specially crafted XSLT document, a remote attacker could cause libxslt to crash, causing a denial ...

Mandriva Linux Security Advisory : fail2ban (MDVSA-2013:078)

Updated fail2ban package fixes security vulnerability : fail2ban before 0.8.8 didn't escape the content of \ if used in custom action files, which could cause issues on the system running fail2ban as it scans log files, depending on what content is matched, since that content could contain...

Mandriva Linux Security Advisory : openjpeg (MDVSA-2013:110)

Updated openjpeg packages fix security vulnerability : An out-of heap-based buffer bounds read and write flaw, leading to invalid free, was found in the way a tile coder / decoder TCD implementation of OpenJPEG, an open source JPEG 2000 codec written in C language, performed releasing of previous...

Mandriva Linux Security Advisory : openssl (MDVSA-2013:052)

Multiple vulnerabilities has been found and corrected in openssl : OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1 before 1.0.1d does not properly perform signature verification for OCSP responses, which allows remote attackers to cause a denial of service NULL pointer dereference and...

Mandriva Linux Security Advisory : glib2.0 (MDVSA-2013:083)

Updated glib2.0 packages fix security vulnerability : It was discovered that the version of glib shipped with MBS 1 does not sanitise certain DBUS related environment variables. When used in combination with a setuid application which utilises dbus via glib, a local user could gain escalated...

Mandriva Linux Security Advisory : asterisk (MDVSA-2013:140)

Multiple vulnerablilities was identified and fixed in asterisk : The SIP channel driver in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15 before 1.8.15-cert2; Asterisk Business Edition BE C.3.x before C.3.8.1; and Asterisk...

Mandriva Linux Security Advisory : nss-pam-ldapd (MDVSA-2013:106)

Updated nss-pam-ldapd packages fixes the following security vulnerability : Garth Mollett discovered that a file descriptor overflow issue in the use of FDSET in nss-pam-ldapd can lead to a stack-based buffer overflow. An attacker could, under some circumstances, use this flaw to cause a process...

Mandriva Linux Security Advisory : rpmdevtools (MDVSA-2013:123)

Updated rpmdevtools package fixes security vulnerability : A TOCTOU race condition was found in the way 'annotate-output' used to execute a program annotating the output linewise with time and stream tool of rpmdevtools before 8.3 performed management of its temporary files used for standard outp...

Mandriva Linux Security Advisory : mosh (MDVSA-2013:104)

Updated mosh package fixes security vulnerability : Mosh versions 1.2 and earlier allow an application to cause the mosh-server to consume large amounts of CPU time with a short ANSI escape sequence. In addition, a malicious mosh-server can cause the mosh-client to consume large amounts of CPU ti...

Mandriva Linux Security Advisory : automake (MDVSA-2013:031)

A vulnerability has been discovered and corrected in automake : A race condition in automake lib/am/distdir.am could allow a local attacker to run arbitrary code with the privileges of the user running make distcheck CVE-2012-3386. The updated packages have been patched to correct this issue. NOT...

Mandriva Linux Security Advisory : elinks (MDVSA-2013:075)

Updated elinks package fixes security vulnerability : Marko Myllynen discovered that ELinks, a powerful text-mode browser, incorrectly delegates user credentials during GSS-Negotiate CVE-2012-4545. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in thi...

Mandriva Linux Security Advisory : hplip (MDVSA-2013:088)

This hplip update addresses the folloving issues : Print/Fax queues can now be analyzed by running hp-diagnose-queues fixes some issues and duplex scanning support with newer AIO devices fixes Wireless configuration using hp-wificonfig command for HP Deskjet 3000 J310 series and HP Deskjet 3050...

Mandriva Linux Security Advisory : ircd-hybrid (MDVSA-2013:093)

Updated ircd-hybrid packages fix security vulnerability : Bob Nomnomnom reported a Denial of Service vulnerability in IRCD-Hybrid, an Internet Relay Chat server. A remote attacker may use an error in the masks validation and crash the server CVE-2013-0238. Please note that due to the previously...

Mandriva Linux Security Advisory : libytnef (MDVSA-2013:099)

Updated libytnef package fixes security vulnerability : Function DecompressRTF in libytnef 1.5 leads to a buffer overflow on certain TNEF files presumably, on files, generated by some recent versions of MS software. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Mandriva Linux Security Advisory : ganglia (MDVSA-2013:080)

Updated ganglia packages fix security vulnerability : There is a security issue in Ganglia Web going back to at least 3.1.7 which can lead to arbitrary script being executed with web user privileges possibly leading to a machine compromise. Additionally, an issue where active NFS mounts caused...

Mandriva Linux Security Advisory : taglib (MDVSA-2013:131)

Updated taglib packages fix security vulnerabilities : taglib before 1.7.2 allows remote attackers to cause a denial of service divide-by-zero error and application crash via a crafted MP4 file CVE-2012-2396. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Mandriva Linux Security Advisory : freetype2 (MDVSA-2013:039)

Updated freetype2 packages fixes security vulnerabilities : A NULL pointer de-reference flaw was found in the way Freetype font rendering engine handled Glyph bitmap distribution format BDF fonts. A remote attacker could provide a specially crafted BDF font file, which once processed in an...