Mandriva Security

https://mandriva.com/security/advisories Mandriva security advisories en-us https://mandriva.com/security/advisories?name=MDKSA-2006:046 Gnu tar versions 1.14 and above have a buffer overflow vulnerability and some other issues including: - Carefully crafted invalid headers can cause buffer overrun. - Invalid header fields go undiagnosed. - Some valid time strings are ignored. The updated packages have been patched to address this issue. https://mandriva.com/security/advisories?name=MDKSA-2006:045 Eric Romang discovered a temporary file vulnerability in the mysql_install_db script provided with MySQL. This vulnerability only affects versions of MySQL 4.1.x prior to 4.1.12. The updated packages have been patched to address this issue. https://mandriva.com/security/advisories?name=MDKSA-2006:044 A number of vulnerabilities have been discovered and corrected in the Linux 2.4 kernel: A numeric casting discrepancy in sdla_xfer could allow a local user to read portions of kernel memory via a large len argument (CVE-2004-2607). The traps.c file executes stack segment faults on an exception stack, which could allow a local user to cause an oops and stack fault exception (CVE-2005-1767). The find_target function in ptrace32.c does not properly handle a NULL return value from another function, allowing local users to cause a kernel crash/oops by running a 32-bit ltrace program with the -i option on a 64-bit executable program (CVE-2005-2553). A race condition in ip_vs_conn_flush, when running on SMP systems, could allow a local attacker to cause null dereference DoS by causing a connection timer to expire while the connection table is being flushed before the appropriate lock is acquired (CVE-2005-3274). The NAT code in ip_nat_proto_tcp.c and ip_nat_proto_udp.c incorrectly declares a variable to be static, which could allow a remote attacker to cause a Denial of Service via memory corruption by causing two packets for the same protocol to be NATed at the same time (CVE-2005-3275). The IPv6 flowlabel handling code modified the wrong variable in certain circumstances, which could allow a local user to corrupt kernel memory or cause a Denial of Service (crash) by triggering a free of non- allocated memory (CVE-2005-3806). The wan/sdla.c file does not require CAP_SYS_RAWIO privilege for an SDLA firmware upgrade with unknown impact and local attack vectors (CVE-2006-0096). The provided packages are patched to fix these vulnerabilities. All users are encouraged to upgrade to these updated kernels. To update your kernel, please follow the directions located at: https://mandriva.com/en/security/kernelupdate https://mandriva.com/security/advisories?name=MDKSA-2006:043 Tavis Ormandy discovered it is possible to make gpg incorrectly return success when verifying an invalid signature file. The updated packages have been patched to address this issue. https://mandriva.com/security/advisories?name=MDKSA-2006:042 Stack-based buffer overflow in libTIFF before 3.7.2 allows remote attackers to execute arbitrary code via a TIFF file with a malformed BitsPerSample tag. Although some of the previous updates appear to already catch this issue, this update adds some additional checks. The updated packages have been patched to correct this issue. https://mandriva.com/security/advisories?name=MDKSA-2006:041 Buffer overflow in l2cap.c in hcidump allows remote attackers to cause a denial of service (crash) through a wireless Bluetooth connection via a malformed Logical Link Control and Adaptation Protocol (L2CAP) packet. The updated packages have been patched to correct this issue. https://mandriva.com/security/advisories?name=MDKSA-2006:040 A number of vulnerabilities were discovered and corrected in the Linux 2.6 kernel: The udp_v6_get_port function in udp.c, when running IPv6, allows local users to cause a Denial of Service (infinite loop and crash) (CVE-2005-2973). The mq_open system call in certain situations can decrement a counter twice as a result of multiple calls to the mntput function when the dentry_open function call fails, allowing a local user to cause a DoS (panic) via unspecified attack vectors (CVE-2005-3356). The procfs code allows attackers to read sensitive kernel memory via unspecified vectors in which a signed value is added to an unsigned value (CVE-2005-4605). A buffer overflow in sysctl allows local users to cause a DoS and possibly execute arbitrary code via a long string, which causes sysctl to write a zero byte outside the buffer (CVE-2005-4618). A buffer overflow in the CA-driver for TwinHan DST Frontend/Card allows local users to cause a DoS (crash) and possibly execute arbitrary code by reading more than eight bytes into an eight byte long array (CVE-2005-4639). dm-crypt does not clear a structure before it is freed, which leads to a memory disclosure that could allow local users to obtain sensitive information about a cryptographic key (CVE-2006-0095). Remote attackers can cause a DoS via unknown attack vectors related to an "extra dst release when ip_options_echo fails" in icmp.c (CVE-2006-0454). In addition to these security fixes, other fixes have been included such as: - support for mptsas - fix for IPv6 with sis190 - a problem with the time progressing twice as fast - a fix for Audigy 2 ZS Video Editor sample rates - a fix for a supermount crash when accessing a supermount-ed CD/DVD drive - a fix for improperly unloading sbp2 module The provided packages are patched to fix these vulnerabilities. All users are encouraged to upgrade to these updated kernels. To update your kernel, please follow the directions located at: https://mandriva.com/en/security/kernelupdate https://mandriva.com/security/advisories?name=MDKA-2006:019 Various bugs in the PostgreSQL 8.0.x branch have been corrected with the latest 8.0.7 maintenance release which is being provided for Mandriva Linux 2006 users. https://mandriva.com/security/advisories?name=MDKSA-2006:039 Evgeny Legerov discovered cases of possible out-of-bounds access in the DER decoding schemes of libtasn1, when provided with invalid input. This library is bundled with gnutls. The provided packages have been patched to correct these issues. https://mandriva.com/security/advisories?name=MDKA-2006:018 A number of bugs have been corrected with this latest ghostscript package including a fix when rendering imaged when converting PostScript to PDF with ps2pdf, a crash when generating PDF files with the pdfwrite device, several segfaults, a fix for vertical japanese text, and a number of other fixes.