6277 matches found
MGASA-2013-0234 Updated chromium-browser-stable packages fix security vulnerabilities
Updated chromium-browser-stable packages fix security vulnerabilities: The HTTPS implementation does not ensure that headers are terminated by \r\n\r\n carriage return, newline, carriage return, newline CVE-2013-2853. Chrome does not properly prevent pop-under windows CVE-2013-2867...
MGASA-2013-0233 Updated php packages fix CVE-2013-4113
Updated php packages fix security vulnerability: Fixed PHP bug 65236 heap corruption in xml parser CVE-2013-4113. Additionally the php-timezonedb packages have been upgraded to the latest version 2013.4...
MGASA-2013-0232 Updated file-roller package fixes CVE-2013-4668
Updated file-roller package fixes security vulnerability: Directory traversal vulnerability in File Roller 3.6.x before 3.6.4 when libarchive is used, allows remote attackers to create arbitrary files via a crafted archive that is not properly handled in a "Keep directory structure" action, relat...
MGASA-2013-0231 Updated apache packages fix security vulnerabilities
Updated apache packages fix security vulnerabilities: moddav.c in the Apache HTTP Server before 2.4.6 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service segmentation fault via a MERGE request in which the URI is configured for...
MGASA-2013-0230 Updated apache packages fix CVE-2013-1896
Updated apache packages fix security vulnerability: moddav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service segmentation fault via a MERGE request in which the URI is configured for...
MGASA-2013-0229 Updated ruby packages fix CVE-2013-4073
A vulnerability in Ruby's SSL client that could allow man-in-the-middle attackers to spoof SSL servers via valid certificate issued by a trusted certification authority CVE-2013-4073...
MGASA-2013-0228 Updated squid packages fix security vulnerabilities
Due to incorrect data validation Squid is vulnerable to a buffer overflow attack when processing specially crafted HTTP requests. This problem allows any trusted client or client script who can generate HTTP requests to trigger a buffer overflow in Squid, resulting in a termination of the Squid...
MGASA-2013-0227 Updated squid packages fix security vulnerability
Due to incorrect data validation Squid is vulnerable to a buffer overflow attack when processing specially crafted HTTP requests. This problem allows any trusted client or client script who can generate HTTP requests to trigger a buffer overflow in Squid, resulting in a termination of the Squid...
MGASA-2013-0226 Updated mediawiki packages fix security vulnerabilities
This update provides MediaWiki 1.20.6, fixing several unspecified security issues. This replaces the MediaWiki 1.16.5 version, which has been EOL upstream for quite some time now, that was shipped with Mageia 2. MediaWiki removed the Math extension for the 1.18 release, but it is now available...
MGASA-2013-0225 Updated xlockmore package fixes security vulnerability
xlockmore before 5.43 contains a security flaw related to potential NULL pointer dereferences when authenticating via glibc 2.17+'s crypt function. Under certain conditions the NULL pointers can trigger a crash in xlockmore effectively bypassing the screen lock CVE-2013-4143...
MGASA-2013-0224 Updated python-suds package fixes security vulnerability
An insecure temporary directory use flaw was found in the way python-suds performed initialization of its internal file-based URL cache predictable location was used for directory to store the cached files. A local attacker could use this flaw to conduct symbolic link attacks, possibly leading to...
MGASA-2013-0223 Updated darktable package fixes security vulnerability
A double-free error exits when handling damaged full-color within Foveon and sRAW files in libraw, which is embedded in darktable CVE-2013-2126...
MGASA-2013-0222 Updated virtualbox package fixes security issue
This virtualbox update provides the 4.2.16 maintenance release, which fixes the following security issue: Thomas Dreibholz has discovered a vulnerability in Oracle VirtualBox, which can be exploited by malicious, local users in a guest virtual machine to cause a DoS Denial of Service. The...
MGASA-2013-0221 Updated mediawiki packages fix security vulnerability
MediaWiki user Marco discovered that security checks for file uploads were not being run when the file was uploaded in chunks through the API. This option has been available to users who can upload files since MediaWiki 1.19 CVE-2013-2114...
MGASA-2013-0220 Updated owncloud package fixes security vulnerabilities
XSS vulnerability in "Share Interface" oC-SA-2013-029. Authentication bypass in "userwebdavauth" oC-SA-2013-030. This update provides OwnCloud 5.0.9, which fixes these issues, as well as several other bugs...
MGASA-2013-0219 Updated libkdcraw package fixes security issue.
This update fixes a security issue due to a possible double-free on error recovery on damaged full-color Foveon, sRAW files. CVE-2013-2126...
MGASA-2013-0218 Updated libxml2 packages fix CVE-2013-2877
It was discovered that libxml2 incorrectly handled documents that end abruptly. If a user or automated system were tricked into opening a specially crafted document, an attacker could possibly cause libxml2 to crash, resulting in a denial of service CVE-2013-2877...
MGASA-2013-0217 Updated moodle package fixes multiple security vulnerabilities
Flash files distributed with the YUI library in Moodle before 2.4.5 may have allowed for cross-site scripting attacks MSA-13-0025. Privacy settings for the IMS-LTI External tool module in Moodle before 2.4.5 were not able to be changed so personal information was always transferred MSA-13-0026...
MGASA-2013-0216 Updated php packages fix CVE-2013-4113
Fixed PHP bug 65236 heap corruption in xml parser CVE-2013-4113. Additionally the php-timezonedb packages has been upgraded to the latest version 2013.4...
MGASA-2013-0215 Updated kernel-rt package fixes security issues.
This kernel-rt update provides the extended stable 3.8.13.4 kernel and fixes the follwing security issues: The pcibackenablemsi function in the PCI backend driver drivers/xen/pciback/confspacecapabilitymsi.c in Xen for the Linux kernel 2.6.18 and 3.8 allows guest OS users with PCI device access t...
MGASA-2013-0214 Updated kernel-linus package fixes multiple security vulnerabilities
This kernel-linus update provides the extended stable 3.8.13.4 kernel and fixes the follwing security issues: The pcibackenablemsi function in the PCI backend driver drivers/xen/pciback/confspacecapabilitymsi.c in Xen for the Linux kernel 2.6.18 and 3.8 allows guest OS users with PCI device acces...
MGASA-2013-0213 Updated kernel-tmb packages fix multiple security vulnerabilities
This kernel-tmb update provides the extended stable 3.8.13.4 kernel and fixes the following security issues: The pcibackenablemsi function in the PCI backend driver drivers/xen/pciback/confspacecapabilitymsi.c in Xen for the Linux kernel 2.6.18 and 3.8 allows guest OS users with PCI device access...
MGASA-2013-0212 Updated kernel-vserver package fixes security issues
This kernel-vserver update provides the upstream 3.4.52 kernel and fixes the follwing security issues: The pcibackenablemsi function in the PCI backend driver drivers/xen/pciback/confspacecapabilitymsi.c in Xen for the Linux kernel 2.6.18 and 3.8 allows guest OS users with PCI device access to...
MGASA-2013-0211 Updated kernel-rt package fixes security issues
This kernel-rt update provides the upstream 3.4.52 kernel and fixes the follwing security issues: The pcibackenablemsi function in the PCI backend driver drivers/xen/pciback/confspacecapabilitymsi.c in Xen for the Linux kernel 2.6.18 and 3.8 allows guest OS users with PCI device access to cause a...
MGASA-2013-0210 Updated kernel-linus package fixes security issues
This kernel update provides the upstream 3.4.52 kernel and fixes the follwing security issues: The pcibackenablemsi function in the PCI backend driver drivers/xen/pciback/confspacecapabilitymsi.c in Xen for the Linux kernel 2.6.18 and 3.8 allows guest OS users with PCI device access to cause a...
MGASA-2013-0209 Updated kernel-tmb package fixes security issues.
This kernel-tmb update provides the upstream 3.4.52 kernel and fixes the follwing security issues: The pcibackenablemsi function in the PCI backend driver drivers/xen/pciback/confspacecapabilitymsi.c in Xen for the Linux kernel 2.6.18 and 3.8 allows guest OS users with PCI device access to cause ...
MGASA-2013-0208 Updated java-1.6.0-openjdk packages fix security vulnerabilities
Multiple flaws were discovered in the ImagingLib and the image attribute, channel, layout and raster processing in the 2D component. An untrusted Java application or applet could possibly use these flaws to trigger Java Virtual Machine memory corruption CVE-2013-2470, CVE-2013-2471, CVE-2013-2472...
MGASA-2013-0207 Updated flash-player-plugin packages fix multiple security vulnerabilities
Adobe Flash Player 11.2.202.297 contains fixes to critical security vulnerabilities found in earlier versions. These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system. This update resolves a heap buffer overflow vulnerability that could...
MGASA-2013-0206 Updated php-radius packages fix CVE-2013-2220
Updated php-radius package fixes security vulnerability: Fix a security issue in radiusgetvendorattr by enforcing checks of the VSA length field against the buffer size CVE-2013-2220...
MGASA-2013-0205 Updated rubygem-passenger package fixes CVE-2013-2119
Phusion Passengers code did not always create temporary files and directories in a secure manner. Temporary files and directories were sometimes created with a predictable filename. A local attacker can pre-create temporary files, resulting in a denial of service. In addition, this vulnerability...
MGASA-2013-0204 Updated kernel packages fix multiple security vulnerabilities
This kernel update provides the extended stable 3.8.13.4 kernel and fixes the follwing security issues: The pcibackenablemsi function in the PCI backend driver drivers/xen/pciback/confspacecapabilitymsi.c in Xen for the Linux kernel 2.6.18 and 3.8 allows guest OS users with PCI device access to...
MGASA-2013-0203 Updated kernel packages fix multiple security vulnerabilities
This kernel update provides the upstream 3.4.52 kernel and fixes the following security issues: The pcibackenablemsi function in the PCI backend driver drivers/xen/pciback/confspacecapabilitymsi.c in Xen for the Linux kernel 2.6.18 and 3.8 allows guest OS users with PCI device access to cause a...
MGASA-2013-0202 Updated opera packages replace code signing certificate
Opera 12.16 contains a replaced code signing certificate. Opera Software recently experienced an attack on the internal infrastructure. Following best practices, Opera Software is replacing signing certificates in Opera with newly issued certificates. Certificates in Opera include the code signin...
MGASA-2013-0201 Updated python-pymongo packages fix CVE-2013-2132
PyMongo before 2.5.2 is prone to a denial-of-service vulnerability. An attacker can remotely trigger a NULL pointer dereference causing MongoDB to crash CVE-2013-2132...
MGASA-2013-0200 Updated axis package fixes security vulnerability
Apache Axis did not verify that the server hostname matched the domain name in the subject's Common Name CN or subjectAltName field in X.509 certificates. This could allow a man-in-the-middle attacker to spoof an SSL server if they had a certificate that was valid for any domain name CVE-2012-578...
MGASA-2013-0199 Updated jakarta-commons-httpclient package fixes security vulnerability
The Jakarta Commons HttpClient component did not verify that the server hostname matched the domain name in the subject's Common Name CN or subjectAltName field in X.509 certificates. This could allow a man-in-the-middle attacker to spoof an SSL server if they had a certificate that was valid for...
MGASA-2013-0198 Updated wordpress package fixes security vulnerabilities
A denial of service flaw was found in the way Wordpress, a blog tool and publishing platform, performed hash computation when checking password for password protected blog posts. A remote attacker could provide a specially- crafted input that, when processed by the password checking mechanism of...
MGASA-2013-0197 Updated xen package fixes security issues
This update fixes the following security issues: XSA-52/CVE-2013-2076: Information leak on XSAVE/XRSTOR capable AMD CPUs XSA-53/CVE-2013-2077: Hypervisor crash due to missing exception recovery on XRSTOR XSA-54/CVE-2013-2078: Hypervisor crash due to missing exception recovery on XSETBV...
MGASA-2013-0196 Updated otrs package fixes security vulnerabilities
An attacker with a valid agent login could manipulate URLs in the ticket watch mechanism to see contents of tickets they are not permitted to see CVE-2013-3551, CVE-2013-4088...
MGASA-2013-0195 Updated autotrace package fixes security vulnerability
Stack-based buffer overflow in bmp parser CVE-2013-1953. Updated autotrace package corrects the issue...
MGASA-2013-0194 Updated chromium-browser-stable packages fixes security vulnerabilities
Use-after-free vulnerability in the SVG implementation allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors CVE-2013-2837. Google V8, as used in Chromium before 27.0.1453.93, allows remote attackers to cause a denial of service...
MGASA-2013-0193 Updated xml-security-c package fixes multiple security vulnerabilities
The implementation of XML digital signatures in the Santuario-C++ library is vulnerable to a spoofing issue allowing an attacker to reuse existing signatures with arbitrary content CVE-2013-2153. A stack overflow, possibly leading to arbitrary code execution, exists in the processing of malformed...
MGASA-2013-0192 Updated fail2ban packages fix CVE-2013-2178
Krzysztof Katowicz-Kowalewski discovered a vulnerability in Fail2ban, a log monitoring and system which can act on attack by preventing hosts to connect to specified services using the local firewall. When using Fail2ban to monitor Apache logs, improper input validation in log parsing could enabl...
MGASA-2013-0191 Updated tomcat7 packages fix CVE-2013-2071
java/org/apache/catalina/core/AsyncContextImpl.java in Apache Tomcat 7.x before 7.0.40 does not properly handle the throwing of a RuntimeException in an AsyncListener in an application, which allows context-dependent attackers to obtain sensitive request information intended for other application...
MGASA-2013-0190 Updated mesa packages fix multiple vulnerabilties
An out-of-bounds access flaw was found in Mesa. If an application using Mesa exposed the Mesa API to untrusted inputs Mozilla Firefox does this, an attacker could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application...
MGASA-2013-0189 Updated Firefox and Thunderbird packages fix multiple vulnerabilities
Updated firefox packages fix security vulnerabilities.. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox CVE-2013-1682,...
MGASA-2013-0188 Updated curl packages fix CVE-2013-2174
libcurl is vulnerable to a case of bad checking of the input data which may lead to heap corruption. The function curleasyunescape decodes URL encoded strings to raw binary data. URL encoded octets are represented with %HH combinations where HH is a two-digit hexadecimal number. The decoded strin...
MGASA-2013-0187 Updated puppet packages fix remote code execution vulnerability
When making REST api calls, the puppet master takes YAML from an untrusted client, deserializes it, and then calls methods on the resulting object. A YAML payload can be crafted to cause the deserialization to construct an instance of any class available in the ruby process, which allows an...
MGASA-2013-0186 Updated X.org packages fix multiple security vulnerabilities
Ilja van Sprundel of IOActive discovered several security issues in multiple components of the X.org graphics stack and the related libraries: Various integer overflows, sign handling errors in integer conversions, buffer overflows, memory corruption and missing input sanitising may lead to...
MGASA-2013-0185 Updated java-1.7.0-openjdk packages fix multiple security vulnerabilities
Multiple flaws were discovered in the ImagingLib and the image attribute, channel, layout and raster processing in the 2D component. An untrusted Java application or applet could possibly use these flaws to trigger Java Virtual Machine memory corruption CVE-2013-2470, CVE-2013-2471, CVE-2013-2472...