mageia vulnerabilities and fixes

Recent CVEs affecting mageia, with upgrade or downgrade steps. 34 tracked.

mageia has 34 tracked vulnerabilities, 2 critical and 2 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 21. Most recent: 2017-08-25. Highest priority: CVE-2014-7169 (score 100/100).

• CVE-2015-2296 MEDIUM 6.8 MITIGATE DOWNGRADE The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to condu
• CVE-2015-2191 MEDIUM 5.0 MITIGATE MITIGATE Integer overflow in the dissect_tnef function in epan/dissectors/packet-tnef.c in the TNEF dissector in Wiresh
• CVE-2015-2189 MEDIUM 5.0 DOWNGRADE MITIGATE Off-by-one error in the pcapng_read function in wiretap/pcapng.c in the pcapng file parser in Wireshark 1.10.x
• CVE-2015-2188 MEDIUM 5.0 DOWNGRADE MITIGATE epan/dissectors/packet-wcp.c in the WCP dissector in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4
• CVE-2015-0236 LOW 3.5 MITIGATE UPGRADE libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_
• CVE-2014-9637 MEDIUM 5.5 MITIGATE MITIGATE GNU patch 2.7.2 and earlier allows remote attackers to cause a denial of service (memory consumption and segme
• CVE-2014-9274 HIGH 7.5 UPGRADE MITIGATE UnRTF allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code as demo
• CVE-2014-9253 MEDIUM 4.3 UPGRADE MITIGATE The default file type whitelist configuration in conf/mime.conf in the Media Manager in DokuWiki before 2014-0
• CVE-2014-9116 MEDIUM 5.0 MITIGATE MITIGATE The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a
• CVE-2014-9087 HIGH 7.5 MITIGATE MITIGATE Integer underflow in the ksba_oid_to_str function in Libksba before 1.3.2, as used in GnuPG, allows remote att
• CVE-2014-9039 MEDIUM 4.3 MITIGATE MITIGATE wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might all
• CVE-2014-9037 MEDIUM 6.8 MITIGATE UPGRADE WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attack
• CVE-2014-8764 MEDIUM 5.0 MITIGATE UPGRADE DokuWiki 2014-05-05a and earlier, when using Active Directory for LDAP authentication, allows remote attackers
• CVE-2014-8763 MEDIUM 5.0 UPGRADE MITIGATE DokuWiki before 2014-05-05b, when using Active Directory for LDAP authentication, allows remote attackers to b
• CVE-2014-8136 LOW 2.1 MITIGATE MITIGATE The (1) qemuDomainMigratePerform and (2) qemuDomainMigrateFinish2 functions in qemu/qemu_driver.c in libvirt d
• CVE-2014-8117 MEDIUM 5.0 UPGRADE MITIGATE softmagic.c in file before 5.21 does not properly limit recursion, which allows remote attackers to cause a de
• CVE-2014-8116 MEDIUM 5.0 DOWNGRADE MITIGATE The ELF parser (readelf.c) in file before 5.21 allows remote attackers to cause a denial of service (CPU consu
• CVE-2014-8104 MEDIUM 6.8 MITIGATE MITIGATE OpenVPN 2.x before 2.0.11, 2.1.x, 2.2.x before 2.2.3, and 2.3.x before 2.3.6 allows remote authenticated users
• CVE-2014-7824 LOW 2.1 MITIGATE MITIGATE D-Bus 1.3.0 through 1.6.x before 1.6.26, 1.8.x before 1.8.10, and 1.9.x before 1.9.2 allows local users to cau
• CVE-2014-7204 MEDIUM 5.0 MITIGATE MITIGATE jscript.c in Exuberant Ctags 5.8 allows remote attackers to cause a denial of service (infinite loop and CPU a
• CVE-2014-7169 CRITICAL 9.8 EXPLOITED UPGRADE UPGRADE GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
• CVE-2014-6271 CRITICAL 9.8 EXPLOITED UPGRADE UPGRADE GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
• CVE-2014-5461 MEDIUM 5.0 MITIGATE MITIGATE Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependen
• CVE-2014-4668 MEDIUM 6.8 MITIGATE MITIGATE The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and earlier, when LDAP is u
• CVE-2014-3533 LOW 2.1 MITIGATE MITIGATE dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6 allows local users to cause a denial of service (disconnect) v
• CVE-2014-3532 LOW 2.1 UPGRADE MITIGATE dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6, when running on Linux 2.6.37-rc4 or later, allows local users
• CVE-2014-3429 MEDIUM 6.8 MITIGATE DOWNGRADE IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows
• CVE-2014-3424 LOW 3.3 MITIGATE UPGRADE lisp/net/tramp-sh.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symli
• CVE-2014-3423 LOW 3.3 MITIGATE UPGRADE lisp/net/browse-url.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a sym
• CVE-2014-3422 LOW 3.3 UPGRADE MITIGATE lisp/emacs-lisp/find-gc.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a
• CVE-2014-3421 LOW 3.3 MITIGATE UPGRADE lisp/gnus/gnus-fun.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a syml
• CVE-2014-2524 LOW 3.3 MITIGATE UPGRADE The _rl_tropen function in util.c in GNU readline before 6.3 patch 3 allows local users to create or overwrite
• CVE-2014-1829 MEDIUM 5.0 MITIGATE UPGRADE Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading the Au
• CVE-2013-4159 HIGH 7.5 UPGRADE MITIGATE ctdb before 2.3 in OpenSUSE 12.3 and 13.1 does not create temporary files securely, which has unspecified impa

FAQ

How do I fix mageia vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is mageia being exploited right now?

Yes: 2 mageia CVEs are on the CISA Known Exploited Vulnerabilities list, so patch those first.

Which mageia CVE should I patch first?

CVE-2014-7169 currently ranks highest (100/100): GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability.

RSS feed for mageia · ← Back to latest CVEs