Mandriva

CRLF injection vulnerability in Sys.Web in Mono 2.0 and earlier allows
remote attackers to inject arbitrary HTTP headers and conduct HTTP
response splitting attacks via CRLF sequences in the query string.

The updated packages have been patched to fix the issue.

Update:

This update was too late for inclusion in Mandriva Linux 2009, so it
is being released now for that version.

A buffer overflow in the SGI image format decoding routines used by the
CUPS image converting filter imagetops was discovered. An attacker
could create malicious SGI image files that could possibly execute
arbitrary code if the file was printed (CVE-2008-3639).

An integer overflow flaw leading to a heap buffer overflow was found
in the Text-to-PostScript texttops filter. An attacker could create
a malicious text file that could possibly execute arbitrary code if
the file was printed (CVE-2008-3640).

Finally, an insufficient buffer bounds checking flaw was found in
the HP-GL/2-to-PostScript hpgltops filter. An attacker could create
a malicious HP-GL/2 file that could possibly execute arbitrary code
if the file was printed (CVE-2008-3641).

The updated packages have been patched to prevent this issue; for
Mandriva Linux 2009.0 the latest CUPS version (1.3.9) is provided
that corrects these issues and also provides other bug fixes.

A bug was found in the gdb package that prevented the build of the
gdbserver binary and its manpage. Updated packages are being provided
to fix the issue.

This update ensures distribution upgrade notification is not detected
in incorrect cases and the distribution upgrade confirmation dialog
is not displayed after security updates are applied.

The symlinks program did not work on files larger than 2GB, reporting
the error Value too large for defined data type. This update fixes
this issue in addition to an error where symlinks converted from
absolute to relative paths were not shortened (Red Hat bug #89655).

The lirc_dev module contained in the dkms-lirc package shipped with
Mandriva Linux 2009 contains a bug which would cause it to crash (oops)
immediately on load. The result of this is that lirc is unusable,
and if you have dkms-lirc installed and the 'lircd' service enabled,
the system may fail to boot correctly. The updated package fixes this
bug and provides a set of lirc modules that load and work correctly.

Please note that this issue only affects systems with the actual IR
hardware that lirc works with.

The updated mdkonline package improves the upgrade process to Mandriva
Linux 2009.0 and includes many other bugfixes and enhancements.

These updated packages improve the urpmi graphical interface and add
support for online distribution upgrades.

This update fixes several issues in draksnapshot:

The draksnapshot applet received the following fixes:

- on desktop startup, it will wait for 30s before checking for
available disc so that notification is positioned at the right place,
on the applet icon
- it prevents crashing if DBus is not reachable, and reports DBus
errors
- it prevents crashing if DBus is active, but HAL is not (#44434)
- if all discs are unmounted, the applet will hide (#41176)
- it prevents running more than once
- it uses HAL in order to detect discs available for backup, thus
fixing detecting some internal SATA discs as discs available for backup
(#41107)

It also uses new icons from Mandriva Linux 2009.0.

The draksnapshot configuration tool also received the following fixes:

- it stops saving config when clicking Close (#39790); one has to
click on Apply in order to save the config
- on first run, it offers backup in mounted disc path, instead of
defaulting to some place in the root filesystem which could previously
be filled up (#39802)
- it no longer offers to configure some obscure advanced options
- it now allows for disabling backups
- it generates anacron-friendly cron files

Update:

An updated draksnapshot is now available for Mandriva Linux 2009.0.

These updated packages add support for notification of new distribution
releases and allow users to easily upgrade Mandriva Linux 2008.1 to
future Mandriva Linux releases online.

To disable new distribution release notification on a system-wide
basis, change the DO_NOT_ASK_FOR_DISTRO_UPGRADE to 'true' in
/etc/sysconfig/mdkapplet.

This update fixes several issues in draksnapshot:

The draksnapshot applet received the following fixes:

- on desktop startup, it will wait for 30s before checking for
available disc so that notification is positioned at the right place,
on the applet icon
- it prevents crashing if DBus is not reachable, and reports DBus
errors
- it prevents crashing if DBus is active, but HAL is not (#44434)
- if all discs are unmounted, the applet will hide (#41176)
- it prevents running more than once
- it uses HAL in order to detect discs available for backup, thus
fixing detecting some internal SATA discs as discs available for backup
(#41107)

It also uses new icons from Mandriva Linux 2009.0.

The draksnapshot configuration tool also received the following fixes:

- it stops saving config when clicking Close (#39790); one has to
click on Apply in order to save the config
- on first run, it offers backup in mounted disc path, instead of
defaulting to some place in the root filesystem which could previously
be filled up (#39802)
- it no longer offers to configure some obscure advanced options
- it now allows for disabling backups
- it generates anacron-friendly cron files

This package update adds support for LZMA compression in rpm.
This will allow users of Mandriva Linux 2007.1 to upgrade to the
Mandriva Linux 2009.0 release.

Updated timezone packages are being provided for older Mandriva Linux
systems that do not contain new Daylight Savings Time information
and Time Zone information for some locations. These updated packages
contain the new information.

Stéphane Bertin discovered a flaw in the pam_krb5 existing_ticket
configuration option where, if enabled and using an existing credential
cache, it was possible for a local user to gain elevated privileges
by using a different, local user's credential cache (CVE-2008-3825).

The updated packages have been patched to prevent this issue.

Update:

An updated package for Mandriva Linux 2009.0 is now available.

CRLF injection vulnerability in Sys.Web in Mono 2.0 and earlier allows
remote attackers to inject arbitrary HTTP headers and conduct HTTP
response splitting attacks via CRLF sequences in the query string.

The updated packages have been patched to fix the issue.

Stéphane Bertin discovered a flaw in the pam_krb5 existing_ticket
configuration option where, if enabled and using an existing credential
cache, it was possible for a local user to gain elevated privileges
by using a different, local user's credential cache (CVE-2008-3825).

The updated packages have been patched to prevent this issue.

mandriva-release for Mandriva 2008 Spring should contain a
product_branch set to Official, and not devel, otherwise it could
lead to an error with the new mdkonline.

The updated package fixes it.

This update fixes several minor issues in rpmdrake:
- it fixes a crash due to bad timing with the X server (#41010)
- it fix empty per importance lists of updates in rpmdrake (list
of all updates was OK, MandrivaUpdate was OK) (#41331) (regression
introduced in 3.95 on 2007-09-14)
- it makes rpmdrake only warn once per session when media XML metadata
are newer than synthesis: in that case rpmdrake complained for every
unsyncrhonized package (#42737)
- it fixes a crash when selecting all packages (#40025)
- it fixes a rare crash when canceling (#41970)

This update fixes several minor issues in drakxtools:
- it fixes management of XEN kernels in bootloader-config, when adding
a new kernel, a xen entry should not replace an existing 'linux'
(#40865)
- it fixes a crash in rpmdrake when description begins by
Gtk2::.. (#43802)

It also really enable draksnapashot to use Gtk+-2's new
FileChooserDialog in future.

The rmtree function in lib/File/Path.pm in Perl 5.10 does not properly
check permissions before performing a chmod, which allows local users
to modify the permissions of arbitrary files via a symlink attack.

The updated packages have been patched to fix this.