Mandriva Linux Security Advisory : pixman (MDVSA-2013:116)

Updated pixman packages fix security vulnerability : Stack-based buffer overflow in libpixman has unspecified impact and attack vectors CVE-2013-1591. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandriva Linux...

Mandriva Linux Security Advisory : imagemagick (MDVSA-2013:092)

Updated imagemagick packages fix security vulnerability : The Magickpngmalloc function in coders/png.c in ImageMagick 6.7.8-6 and earlier does not use the proper variable type for the allocation size, which might allow remote attackers to cause a denial of service crash via a crafted PNG file tha...

Mandriva Linux Security Advisory : php-ZendFramework (MDVSA-2013:115)

Updated php-ZendFramework packages fix security vulnerabilities : ZendDom, ZendFeed, ZendSoap, and ZendXmlRpc in Zend Framework before 1.11.13 and 1.12.0 are vulnerable to XML Entity Expansion XEE vectors, leading to Denial of Service vectors. XEE attacks occur when the XML DOCTYPE declaration...

Mandriva Linux Security Advisory : python-httplib2 (MDVSA-2013:119)

python-httplib2 ships its own copy of the Mozilla NSS certificates, but it should use the system-wide ones provided by the rootcerts package instead. This has been corrected. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

Mandriva Linux Security Advisory : html2ps (MDVSA-2013:041)

A vulnerability has been found and corrected in html2ps : Directory traversal vulnerability in html2ps before 1.0b7 allows remote attackers to read arbitrary files via directory traversal sequences in SSI directives CVE-2009-5067. The updated packages have been upgraded to the 1.0b7 version which...

Mandriva Linux Security Advisory : ncpfs (MDVSA-2013:048)

Multiple vulnerabilities has been discovered and corrected in ncpfs : ncpfs 2.2.6 and earlier attempts to use 1 ncpmount to append to the /etc/mtab file and 2 ncpumount to append to the /etc/mtab.tmp file without first checking whether resource limits would interfere, which allows local users to...

Mandriva Linux Security Advisory : openslp (MDVSA-2013:111)

Updated openslp packages fix security vulnerability : The extension parser in slpv2message.c in OpenSLP 1.2.1 allows remote attackers to cause a denial of service infinite loop via a packet with a next extension offset that references this extension or a previous extension CVE-2010-3609...

Mandriva Linux Security Advisory : jakarta-poi (MDVSA-2013:094)

Updated jakarta-poi packages fix security vulnerability : It was discovered that Apache POI, a Java implementation of the Microsoft Office file formats, would allocate arbitrary amounts of memory when processing crafted documents. This could impact the stability of the Java virtual machine...

Mandriva Linux Security Advisory : open-iscsi (MDVSA-2013:109)

Updated open-iscsi package fixes security vulnerability : Colin Watson discovered that iscsidiscovery in Open-iSCSI did not safely create temporary files. A local attacker could exploit this to overwrite arbitrary files with root privileges CVE-2009-1297. %NASLMINLEVEL 70300 C Tenable Network...

Mandriva Linux Security Advisory : python-feedparser (MDVSA-2013:118)

Updated python-feedparser package fixes security vulnerability : Universal Feed Parser aka feedparser or python-feedparser before 5.1.2 allows remote attackers to cause a denial of service memory consumption via a crafted XML ENTITY declaration in a non-ASCII encoded document CVE-2012-2921...

Mandriva Linux Security Advisory : groff (MDVSA-2013:086)

Multiple vulnerabilities has been found and corrected in groff : contrib/pdfmark/pdfroff.sh in GNU troff aka groff before 1.21 allows local users to overwrite arbitrary files via a symlink attack on a pdf.tmp temporary file CVE-2009-5044. The 1 gendef.sh, 2 doc/fixinfo.sh, and 3...

Mandriva Linux Security Advisory : fetchmail (MDVSA-2013:037)

Multiple vulnerabilities has been found and corrected in fetchmail : Fetchmail version 6.3.9 enabled all SSL workarounds SSLOPALL which contains a switch to disable a countermeasure against certain attacks against block ciphers that permit guessing the initialization vectors, providing that an...

Mandriva Linux Security Advisory : python-pycrypto (MDVSA-2013:120)

Updated python-pycrypto package fixes security vulnerability : PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it easier for attackers to conduct brute-force attacks to...

Mandriva Linux Security Advisory : libotr (MDVSA-2013:097)

A vulnerability was found and corrected in libotr : Just Ferguson discovered that libotr, an off-the-record OTR messaging library, can be forced to perform zero-length allocations for heap buffers that are used in base64 decoding routines. An attacker can exploit this flaw by sending crafted...

Mandriva Linux Security Advisory : cronie (MDVSA-2013:033)

Updated cronie package fixes the following issue : It was reported that cronie 1.4.8 would leak certain file descriptors. On systems where /etc/crontab is not world-readable this could be an information disclosure concern CVE-2012-6097. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Mandriva Linux Security Advisory : apache-mod_security (MDVSA-2013:029)

A vulnerability has been discovered and corrected in apache-modsecurity : ModSecurity = 2.6.8 is vulnerable to multipart/invalid part ruleset bypass, this was fixed in 2.7.0 released on2012-10-16 CVE-2012-4528. The updated packages have been patched to correct this issue. NOTE: This advisory was...

Mandriva Linux Security Advisory : exif (MDVSA-2013:036)

A vulnerability has been discovered and corrected in exif : An integer overflow in the function jpegdataloaddata in the exif program could cause a data read beyond the end of a buffer, causing an application crash or leakage of potentially sensitive information when parsing a crafted JPEG file...

Mandriva Linux Security Advisory : openssh (MDVSA-2013:051)

A vulnerability has been found and corrected in openssh : The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and completing a login, which makes it easier for remote attackers to cause a denial of service connection-slot exhaustion b...

Mandriva Linux Security Advisory : python (MDVSA-2013:117)

Updated python packages fix security vulnerabilities : A race condition was found in the way the Python distutils module set file permissions during the creation of the .pypirc file. If a local user had access to the home directory of another user who is running distutils, they could use this fla...

Mandriva Linux Security Advisory : argyllcms (MDVSA-2013:090)

A security issue was identified and fixed in argyllcms : An integer overflow flaw, leading to a heap-based buffer overflow, was found in Ghostscript's International Color Consortium Format library icclib. An attacker could create a specially crafted PostScript or PDF file with embedded images tha...