MGASA-2017-0463 Updated kernel packages fix security vulnerabilities

This kernel update is based on upstream 4.4.105 and fixes at least the following security issues: A security flaw was discovered in nl80211setrekeydata function in the Linux kernel since v3.1-rc1 through v4.13. This function does not check whether the required attributes are present in a netlink...

MGASA-2017-0461 Updated mariadb packages fix security vulnerabilities

Difficult to exploit vulnerability in MariaDB Server allows high privileged attacker with logon to the infrastructure where MariaDB Server executes to compromise MariaDB Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all...

MGASA-2017-0462 Updated flash-player-plugin packages fix security vulnerability

A regression affecting Adobe Flash Player version 27.0.0.187 and earlier versions causes the unintended reset of the global settings preference file when a user clears browser data. CVE-2017-11305...

MGASA-2017-0460 Updated java-1.8.0-openjdk packages fix security vulnerabilities

Multiple flaws were discovered in the RMI and Hotspot components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions. CVE-2017-10285, CVE-2017-10346 It was discovered that the Kerberos client implementation in the Libraries...

MGASA-2017-0455 Updated graphicsmagick packages fix security vulnerabilities

The updated packages fix many security vulnerabilities...

MGASA-2017-0459 Updated rsync package fixes security vulnerability

The receivexattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character in an xattr name, which allows remote attackers to cause a denial of service heap-based buffer over-read and application crash or possibly have unspecified other impact by sendi...

MGASA-2017-0456 Updated xrdp packages fix security vulnerability

The scpv0saccept function in sesman/libscp/libscpv0.c in the session manager in xrdp through 0.9.4 uses an untrusted integer as a write length, which allows local users to cause a denial of service buffer overflow and application crash or possibly have unspecified other impact via a crafted input...

MGASA-2017-0454 Updated pcre packages fix security vulnerabilities

The compilebracketmatchingpath function in pcrejitcompile.c in PCRE through 8.x before revision 1680 e.g., the PHP 7.1.1 bundled version allows remote attackers to cause a denial of service out-of-bounds read and application crash via a crafted regular expression CVE-2017-6004. A vulnerability wa...

MGASA-2017-0457 Updated rootcerts packages fix security vulnerability

The rootcerts have been updated to the latest certdata from Mozilla November 22 and it now virtual provides ca-certificates, to allow the installation of packages such as google-chrome, that expect it...

MGASA-2017-0458 Updated dhcp packages fix security vulnerability

It was found that the DHCP daemon does not free socket descriptors when handling empty OMAPI messages. An adjacent network attacker could potentially use this flaw to send crafted OMAPI messages to the DHCP daemon, thereby leading to denial of service due to exhaustion of file descriptors in the...

MGASA-2017-0449 Updated deluge packages fix security vulnerability

The WebUI component in Deluge before 1.3.15 contains a directory traversal vulnerability involving a request in which the name of the render file is not associated with any template fileCVE-2017-9031. Updated deluge package adds systemd services required to autostart deluge daemon and web service...

MGASA-2017-0450 Updated evince packages fix security vulnerability

It was discovered that Evince incorrectly handled printing certain DVI files. If a user were tricked into opening and printing a specially-named DVI file, an attacker could use this issue to execute arbitrary code CVE-2017-1000159...

MGASA-2017-0451 Updated lynx package fixes security vulnerability

Lynx before 2.8.9dev.16 is vulnerable to a use after free in the HTML parser resulting in memory disclosure, because HTMLputstring can append a chunk onto itself. CVE-2017-1000211...

MGASA-2017-0453 Updated openssl packages fix security vulnerabilities

OpenSSL 1.0.2 starting from version 1.0.2b introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediately fail if you attempted to continue the handshake. This works as designed for the...

MGASA-2017-0452 Updated rsync package fixes security vulnerabilities

The recvfiles function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds with certain file metadata updates before checking for a filename in the daemonfilterlist data structure, which allows remote attackers to bypass intended access restrictions...

MGASA-2017-0447 Updated optipng packages fix security vulnerability

CVE-2017-1000229: Fix integer overflow bug in function minitiffreadinfo allows an attacker to remotely execute code or cause denial of service. - CVE-2017-16938: Fix a global buffer overflow that allows attackers to cause DoS via a maliciously crafted GIF file...

MGASA-2017-0448 Updated firefox packages fix security vulnerability

Web worker in Private Browsing mode can write IndexedDB data. CVE-2017-7843...

MGASA-2017-0445 Updated wireshark packages fix security vulnerability

The wireshark package has been updated to version 2.2.11, which fixes a few security issues where a malformed packet trace could cause it to crash, and fixes several other bugs as well. See the release notes for details...

MGASA-2017-0444 Updated tor packages fix security vulnerability

When checking for replays in the INTRODUCE1 cell data for a legacy onion service, Tor didn't correctly detect replays in the RSA- encrypted part of the cell. It was previously checking for replays on the entire cell, but those can be circumvented due to the malleability of Tor's legacy hybrid...

MGASA-2017-0446 Updated ffmpeg packages fix security vulnerability

This update provides ffmpeg version 3.3.5, which fixes several security vulnerabilities and other bugs which were corrected upstream...

MGASA-2017-0442 Updated libxfont/libxfont2 packages fix security vulnerability

Fixes open files with ONOFOLLOW. CVE-2017-16611...

MGASA-2017-0443 Updated libxcursor packages fix security vulnerability

Heap overflows when parsing malicious files. CVE-2017-16612...

MGASA-2017-0440 Updated git packages fix security vulnerability

Git through 2.14.2 mishandles layers of tree objects, which allows remote attackers to cause a denial of service memory consumption via a crafted repository, aka a Git bomb. This can also have an impact of disk consumption; however, an affected process typically would not survive its attempt to...

MGASA-2017-0435 Updated varnish packages fix security vulnerability

vbfstperror in bin/varnishd/cache/cachefetch.c in Varnish HTTP Cache 4.1.x before 4.1.9 and 5.x before 5.2.1 allows remote attackers to obtain sensitive information from process memory because a VFPGetStorage buffer is larger than intended in certain circumstances involving -sfile Stevedore...

MGASA-2017-0437 Updated nagios packages fix security vulnerability

It was found that nagios daemon creates its PID file after dropping privileges, which allows to change its content by non-root user with PID of any other process, resulting into denial-of-service when daemon is stopped CVE-2017-12847. Note that the nagios package on Mageia 5 is no longer supporte...

MGASA-2017-0441 Updated memcached packages fix security vulnerability

The tryreadcommand function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a denial of service segmentation fault via a request to add/set a key, which makes a comparison between signed and unsigned int and triggers a heap-based buffer over-read CVE-2017-9951...

MGASA-2017-0436 Updated shadowsocks-libev packages fix security vulnerability

In manager.c in ss-manager in shadowsocks-libev 3.1.0, improper parsing allows command injection via shell metacharacters in a JSON configuration request received via 127.0.0.1 UDP traffic, related to the addserver, buildconfig, and constructcommandline functions...

MGASA-2017-0439 Updated perl-Catalyst-Plugin-Static-Simple package fixes security vulnerability

The Catalyst-Plugin-Static-Simple module before 0.34 for Perl allows remote attackers to read arbitrary files if there is a '.' character anywhere in the pathname, which differs from the intended policy of allowing access only when the filename itself has a '.' character CVE-2017-16248...

MGASA-2017-0438 Updated php-phpmailer packages fix security vulnerability

Debugoutput wasn't set in constructor according to SAPI in use, resulting in potential XSS in default debug output...

MGASA-2017-0434 Updated lame packages fix security vulnerabilities

LAME 3.100 has been released including fixes to security vulnerabilities. Note the MP3 patents have expired...

MGASA-2017-0431 Updated libtiff packages fix security vulnerabilities & bugs

The updated packages fix many bugs. Some of those bugs can be related to security problems as well...

MGASA-2017-0428 Updated postgresql packages fix security vulnerabilities

The startup log file for the postmaster in newer releases, "postgres" process was opened while the process was still owned by root. With this setup, the database owner could specify a file that they did not have access to and cause the file to be corrupted with logged data CVE-2017-12172. Crash d...

MGASA-2017-0433 Updated vlc packages fix security vulnerability

avcodec 2.2.x, as used in VideoLAN VLC media player before 2.2.7, allows out-of-bounds heap memory write due to calling memcpy with a wrong size, leading to a denial of service application crash or possibly code execution CVE-2017-10699. The VLC packages have been updated to version 2.2.8, which...

MGASA-2017-0430 Updated ghostscript packages fix security vulnerabilities

Multiple use-after-free vulnerabilities in the gximageenumbegin function in base/gxipixel.c in Ghostscript before ecceafe3abba2714ef9b432035fe0739d9b1a283 allow remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a crafted PostScript...

MGASA-2017-0432 Updated thunderbird packages fix security vulnerabilities & bugs

The updated packages fix several bugs and some security issues: Use-after-free of PressShell while restyling layout. CVE-2017-7828 Cross-origin URL information leak through Resource Timing API. CVE-2017-7830 Memory safety bugs fixed in Firefox 57, Firefox ESR 52.5, and Thunderbird 52.5...

MGASA-2017-0429 Updated mediawiki packages fix security vulnerabilities

XSS when $wgShowExceptionDetails = false and browser sends non-standard url escaping CVE-2017-8808. Reflected File Download from api.php CVE-2017-8809. On private wikis, login form shouldn't distinguish between login failure due to bad username and bad password CVE-2017-8810. It's possible to...

MGASA-2017-0424 Updated vlc packages fix security vulnerability

avcodec 2.2.x, as used in VideoLAN VLC media player before 2.2.7, allows out-of-bounds heap memory write due to calling memcpy with a wrong size, leading to a denial of service application crash or possibly code execution CVE-2017-10699. The VLC packages have been updated to version 2.2.8, which...

MGASA-2017-0426 Updated bchunk package fixes security vulnerabilities

bchunk related to BinChunker 1.2.0 and 1.2.1 is vulnerable to a heap-based buffer overflow and crash when processing a malformed CUE .cue file. CVE-2017-15953 bchunk related to BinChunker 1.2.0 and 1.2.1 is vulnerable to a heap-based buffer overflow with a resultant invalid free and crash when...

MGASA-2017-0423 Updated chromium-browser-stable packages fix security issues

Chromium-browser 62.0.3202.94 fixes security issues: Multiple flaws were found in the way Chromium 60 processes various types of web content, where loading a web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information...

MGASA-2017-0425 Updated webkit2 packages fix security vulnerabilities

The webkit2 package has been updated to version 2.18.3, fixing several security issues and other bugs...

MGASA-2017-0427 Updated apr-util packages fix security vulnerability

Apache Portable Runtime Utility APR-util 1.6.0 and prior fail to validate the integrity of SDBM database files used by aprsdbm functions, resulting in a possible out of bound read access. A local user with write access to the database can make a program or process using these functions crash, and...

MGASA-2017-0422 Updated botan packages fix security vulnerability

In the Montgomery exponentiation code, a table of precomputed values is used. An attacker able to analyze which cache lines were accessed perhaps via an active attack such as Prime+Probe could recover information about the exponent CVE-2017-14737...

MGASA-2017-0421 Updated sssd packages fix security vulnerability

SSSD stores its cached data in an LDAP like local database file using libldb. To lookup cached data LDAP search filters like 'objectClass=user name=username' are used. However, in sysdbsearchuserbyupnres, the input is not sanitized and allows to manipulate the search filter for cache lookups. Thi...

MGASA-2017-0420 Updated krb5 packages fix security vulnerabilities

An authentication bypass flaw was found in the way krb5's certauth interface handled the validation of client certificates. A remote attacker able to communicate with the KDC could potentially use this flaw to impersonate arbitrary principals under rare and erroneous circumstances CVE-2017-7562...

MGASA-2017-0418 Updated firefox packages fix security vulnerabilities

Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox CVE-2017-7826, CVE-2017-7828, CVE-2017-7830...

MGASA-2017-0419 Updated konversation packages fix security vulnerability

Joseph Bisch discovered that Konversation could crash when parsing certain IRC color formatting codes CVE-2017-15923...

MGASA-2017-0416 Updated quagga packages fix security vulnerability

The bgpd daemon in the Quagga routing suite does not properly calculate the length of multi-segment ASPATH UPDATE messages, causing bgpd to drop a session and potentially resulting in loss of network connectivity CVE-2017-16227...

MGASA-2017-0413 Updated libextractor packages fix security vulnerabilities

In 'EXTRACTORwavextractmethod' function of wavextractor.c, the program does not check the value of samplerate, with a crafted file, the samplerate can be set to zero, resulting in a divide by zero and a crash CVE-2017-15266. NULL Pointer Dereference vulnerability in libextract when getting flac...

MGASA-2017-0415 Updated jq packages fix security vulnerabilities

A heap-based buffer overflow flaw was found in jq's tokenadd function. By tricking a victim into processing a specially crafted JSON file, an attacker could use this flaw to crash jq or, potentially, execute arbitrary code on the victim's system CVE-2015-8863. Stack exhaustion could affect...

MGASA-2017-0417 Updated apr packages fix security vulnerability

An out-of-bounds array dereference was found in aprtimeexpget. An attacker could abuse an unvalidated usage of this function to cause a denial of service or potentially lead to data leak CVE-2017-12613...