Linux.org.uk: Mandriva Security Advisories

Mandriva security advisories

MDVSA-2009:302: php
Some vulnerabilities were discovered and corrected in php-5.3.1:

- Added max_file_uploads INI directive, which can be set to limit
the number of file uploads per-request to 20 by default, to prevent
possible DOS via temporary file exhaustion. (Ilia)
- Added missing sanity checks around exif processing. (CVE-2009-3292,
Ilia)
- Fixed a safe_mode bypass in tempnam() identified by Grzegorz
Stachowiak. (CVE-2009-3557, Rasmus)
- Fixed a open_basedir bypass in posix_mkfifo() identified by Grzegorz
Stachowiak. (CVE-2009-3558, Rasmus)
- Fixed bug #50063 (safe_mode_include_dir fails). (CVE-2009-3559,
Johannes, christian at elmerot dot se)

Additionally, some packages which require so, have been rebuilt and
are being provided as updates.

MDVSA-2009:301: kernel
Some vulnerabilities were discovered and corrected in the Linux
2.6 kernel:

Memory leak in the appletalk subsystem in the Linux kernel 2.4.x
through 2.4.37.6 and 2.6.x through 2.6.31, when the appletalk and
ipddp modules are loaded but the ipddpN device is not found, allows
remote attackers to cause a denial of service (memory consumption)
via IP-DDP datagrams. (CVE-2009-2903)

Multiple race conditions in fs/pipe.c in the Linux kernel before
2.6.32-rc6 allow local users to cause a denial of service (NULL pointer
dereference and system crash) or gain privileges by attempting to
open an anonymous pipe via a /proc/*/fd/ pathname. (CVE-2009-3547)

The tcf_fill_node function in net/sched/cls_api.c in the netlink
subsystem in the Linux kernel 2.6.x before 2.6.32-rc5, and 2.4.37.6
and earlier, does not initialize a certain tcm__pad2 structure member,
which might allow local users to obtain sensitive information from
kernel memory via unspecified vectors. NOTE: this issue exists
because of an incomplete fix for CVE-2005-4881. (CVE-2009-3612)

net/unix/af_unix.c in the Linux kernel 2.6.31.4 and earlier allows
local users to cause a denial of service (system hang) by creating an
abstract-namespace AF_UNIX listening socket, performing a shutdown
operation on this socket, and then performing a series of connect
operations to this socket. (CVE-2009-3621)

Integer overflow in the kvm_dev_ioctl_get_supported_cpuid function
in arch/x86/kvm/x86.c in the KVM subsystem in the Linux kernel
before 2.6.31.4 allows local users to have an unspecified impact
via a KVM_GET_SUPPORTED_CPUID request to the kvm_arch_dev_ioctl
function. (CVE-2009-3638)

The nfs4_proc_lock function in fs/nfs/nfs4proc.c in the NFSv4 client in
the Linux kernel before 2.6.31-rc4 allows remote NFS servers to cause
a denial of service (NULL pointer dereference and panic) by sending a
certain response containing incorrect file attributes, which trigger
attempted use of an open file that lacks NFSv4 state. (CVE-2009-3726)

Additionaly, it includes the fixes from the stable kernel version
2.6.27.39. It also fixes issues with the bnx2 module in which the
machine could become unresponsive. For details, see the package
changelog.

To update your kernel, please follow the directions located at:

http://www.mandriva.com/en/security/kernelupdate

MDVA-2009:214: glpi
This is a maintenance and bugfix release that updates glpi to 0.72.3.

MDVA-2009:213: perl-URPM
perl-URPM can sometimes get confused about which GPG pubkey belong
to which media. This update fixes this issue.

MDVA-2009:212: SDL_image
SDL_image shipped in Mandriva Linux 2010.0 contains a hidden link on
libjpeg62, which is incompatible with libjpeg7 shipped in 2010.0. The
hidden link will cause downstream applications such as tuxmath unable
to launch.

This update fixes this issue.

MDVA-2009:211: pango
A bug in pango was preventing correct location of some glyphs when
scaling was in effect. This update fixes this issue and enforce version
dependency on cairo, which could cause crashes when upgrading Mandriva
Linux distribution to release 2010.0.

MDVA-2009:210: kino
The version of kino shipped with 2010.0 does not use the soundwrapper
system to allow output to legacy OSS sound device in a friendly way
(without soundwrapper the first application to use OSS for sound
will hog the device and prevent any other apps using sound). This
update changes the .desktop file used to launch kino from the menus
to ensure that soundwrapper is used.

Additionally, this update also provides soundwrapper package in
main/updates media, as it is a new dependency required by kino.

MDVA-2009:209: drakx-net
This update to drakx-net fixes two issues:
- Wireless passwords for WPA networks which contain only hex-parseable
characters could be corrupted by conversion to lower-case (#52128)
- Pending Interactive Firewall notifications could show in tray even
after modifying drakfirewall configuration (#48493)

This update fixes these issues.

MDVA-2009:208: alsa-oss
The aoss script which redirect OSS sound output to Alsa contains an
error which makes it fail to preload the correct library. Because
of this error, old applications using OSS may fail to play sound if
PulseAudio is not used.

This update corrects this error.

MDVA-2009:207: tcsh
Tcsh as shipped with Mandriva Linux 2010.0 would abort on startup
with the Unknown colorls variable mh. error, caused by inability to
handle the MULTIHARDLINK color parameter (bug #53139).

This update fixes this issue.