mandrakesoft vulnerabilities

Recent CVEs affecting mandrakesoft products. 116 tracked.

mandrakesoft has 116 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 15. Most recent: 2008-02-29. Highest priority: CVE-2002-0083 (score 73/100).

• CVE-2000-1042 HIGH 10.0 MITIGATE Buffer overflow in ypserv in Mandrake Linux 7.1 and earlier, and possibly other Linux operating systems, allow
• CVE-2008-0595 MEDIUM 4.6 MITIGATE MITIGATE dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow dire
• CVE-2007-6284 MEDIUM 5.0 MITIGATE MITIGATE The xmlCurrentChar function in libxml2 before 2.6.31 allows context-dependent attackers to cause a denial of s
• CVE-2007-5116 HIGH 7.5 DOWNGRADE DOWNGRADE Buffer overflow in the polymorphic opcode support in the Regular Expression Engine (regcomp.c) in Perl 5.8 all
• CVE-2007-1352 LOW 3.8 DOWNGRADE DOWNGRADE Integer overflow in the FontFileInitTable function in X.Org libXfont before 20070403 allows remote authenticat
• CVE-2007-0454 HIGH 7.5 DOWNGRADE MITIGATE Format string vulnerability in the afsacl.so VFS module in Samba 3.0.6 through 3.0.23d allows context-dependen
• CVE-2006-0745 HIGH 7.2 DOWNGRADE DOWNGRADE X.Org server (xorg-server) 1.0.0 and later, X11R6.9.0, and X11R7.0 inadvertently treats the address of the get
• CVE-2005-2377 MEDIUM 5.0 MITIGATE MITIGATE nss_ldap 181 to versions before 213, as used in Mandrake Corporate Server and Mandrake 10.0, and other operati
• CVE-2005-1379 MEDIUM 4.6 DOWNGRADE The LAM runtime environment package (lam-runtime-7.0.6-2mdk) on Mandrake Linux installs the mpi user without a
• CVE-2005-1267 MEDIUM 5.0 DOWNGRADE MITIGATE The bgp_update_print function in tcpdump 3.x does not properly handle a -1 return value from the decode_prefix
• CVE-2005-0605 HIGH 7.5 DOWNGRADE DOWNGRADE scan.c for LibXPM may allow attackers to execute arbitrary code via a negative bitmap_unit value that leads to
• CVE-2005-0503 MEDIUM 4.6 DOWNGRADE MITIGATE uim before 0.4.5.1 trusts certain environment variables when libUIM is used in setuid or setgid applications,
• CVE-2005-0473 MEDIUM 5.0 DOWNGRADE MITIGATE The HTML parsing functions in Gaim before 1.1.3 allow remote attackers to cause a denial of service (applicati
• CVE-2005-0472 MEDIUM 5.0 DOWNGRADE MITIGATE Gaim before 1.1.3 allows remote attackers to cause a denial of service (infinite loop) via malformed SNAC pack
• CVE-2005-0085 MEDIUM 6.8 DOWNGRADE MITIGATE Cross-site scripting (XSS) vulnerability in ht://dig (htdig) before 3.1.6-r7 allows remote attackers to execut
• CVE-2005-0020 HIGH 7.2 DOWNGRADE MITIGATE Buffer overflow in playmidi before 2.4 allows local users to execute arbitrary code.
• CVE-2004-2395 LOW 2.1 DOWNGRADE MITIGATE Memory leak in passwd 0.68 allows local users to cause a denial of service (memory consumption) via a large nu
• CVE-2004-2394 LOW 2.1 DOWNGRADE MITIGATE Off-by-one error in passwd 0.68 and earlier, when using the --stdin option, causes passwd to use the first 78
• CVE-2004-2392 MEDIUM 5.0 MITIGATE MITIGATE libuser 0.51.7 allows attackers to cause a denial of service (crash or disk consumption) via unknown attack ve
• CVE-2004-1188 HIGH 10.0 DOWNGRADE DOWNGRADE The pnm_get_chunk function in xine 0.99.2 and earlier, and other packages such as MPlayer that use the same co
• CVE-2004-1187 HIGH 10.0 DOWNGRADE DOWNGRADE Heap-based buffer overflow in the pnm_get_chunk function for xine 0.99.2, and other packages such as MPlayer t
• CVE-2004-1180 MEDIUM 5.0 MITIGATE MITIGATE Unknown vulnerability in the rwho daemon (rwhod) before 0.17, on little endian architectures, allows remote at
• CVE-2004-1171 LOW 2.1 MITIGATE MITIGATE KDE 3.2.x and 3.3.0 through 3.3.2, when saving credentials that are (1) manually entered by the user or (2) cr
• CVE-2004-1158 HIGH 7.5 DOWNGRADE MITIGATE Konqueror 3.x up to 3.2.2-6, and possibly other versions, allows remote attackers to spoof arbitrary web sites
• CVE-2004-1098 HIGH 7.5 DOWNGRADE MITIGATE MIMEDefang in MIME-tools 5.414 allows remote attackers to bypass virus scanning capabilities via an e-mail att
• CVE-2004-1051 HIGH 7.2 DOWNGRADE MITIGATE sudo before 1.6.8p2 allows local users to execute arbitrary commands by using "()" style environment variables
• CVE-2004-1014 MEDIUM 5.0 DOWNGRADE MITIGATE statd in nfs-utils 1.257 and earlier does not ignore the SIGPIPE signal, which allows remote attackers to caus
• CVE-2004-0983 MEDIUM 5.0 DOWNGRADE MITIGATE The CGI module in Ruby 1.6 before 1.6.8, and 1.8 before 1.8.2, allows remote attackers to cause a denial of se
• CVE-2004-0977 LOW 2.1 UPGRADE MITIGATE The make_oidjoins_check script in PostgreSQL 7.4.5 and earlier allows local users to overwrite files via a sym
• CVE-2004-0975 LOW 2.1 DOWNGRADE MITIGATE The der_chop script in the openssl package in Trustix Secure Linux 1.5 through 2.1 and other operating systems
• CVE-2004-0974 LOW 2.1 DOWNGRADE MITIGATE The netatalk package in Trustix Secure Linux 1.5 through 2.1, and possibly other operating systems, allows loc
• CVE-2004-0834 HIGH 7.2 DOWNGRADE DOWNGRADE Format string vulnerability in Speedtouch USB driver before 1.3.1 allows local users to execute arbitrary code
• CVE-2004-0827 HIGH 7.5 DOWNGRADE DOWNGRADE Multiple buffer overflows in the ImageMagick graphics library 5.x before 5.4.4, and 6.x before 6.0.6.2, allow
• CVE-2004-0817 HIGH 7.5 DOWNGRADE DOWNGRADE Multiple heap-based buffer overflows in the imlib BMP image handler allow remote attackers to execute arbitrar
• CVE-2004-0809 MEDIUM 5.0 UPGRADE DOWNGRADE The mod_dav module in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service (child pr
• CVE-2004-0807 MEDIUM 5.0 DOWNGRADE DOWNGRADE Samba 3.0.6 and earlier allows remote attackers to cause a denial of service (infinite loop and memory exhaust
• CVE-2004-0805 HIGH 7.5 DOWNGRADE MITIGATE Buffer overflow in layer2.c in mpg123 0.59r and possibly mpg123 0.59s allows remote attackers to execute arbit
• CVE-2004-0802 MEDIUM 5.1 DOWNGRADE DOWNGRADE Buffer overflow in the BMP loader in imlib2 before 1.1.2 allows remote attackers to execute arbitrary code via
• CVE-2004-0746 HIGH 7.5 DOWNGRADE MITIGATE Konqueror in KDE 3.2.3 and earlier allows web sites to set cookies for country-specific top-level domains, suc
• CVE-2004-0635 MEDIUM 5.0 DOWNGRADE MITIGATE The SNMP dissector in Ethereal 0.8.15 through 0.10.4 allows remote attackers to cause a denial of service (pro
• CVE-2004-0634 MEDIUM 5.0 DOWNGRADE MITIGATE The SMB SID snooping capability in Ethereal 0.9.15 to 0.10.4 allows remote attackers to cause a denial of serv
• CVE-2004-0633 MEDIUM 5.0 DOWNGRADE MITIGATE The iSNS dissector for Ethereal 0.10.3 through 0.10.4 allows remote attackers to cause a denial of service (pr
• CVE-2004-0587 LOW 2.1 MITIGATE MITIGATE Insecure permissions for the /proc/scsi/qla2300/HbaApiNode file in Linux allows local users to cause a denial
• CVE-2004-0581 MEDIUM 4.6 DOWNGRADE MITIGATE ksymoops-gznm script in Mandrake Linux 9.1 through 10.0, and Corporate Server 2.1, allows local users to delet
• CVE-2004-0565 LOW 2.1 DOWNGRADE MITIGATE Floating point information leak in the context switch code for Linux 2.4.x only checks the MFH bit but does no
• CVE-2004-0559 LOW 2.1 DOWNGRADE DOWNGRADE The maketemp.pl script in Usermin 1.070 and 1.080 allows local users to overwrite arbitrary files at install t
• CVE-2004-0535 LOW 2.1 DOWNGRADE DOWNGRADE The e1000 driver for Linux kernel 2.4.26 and earlier does not properly initialize memory before using it, whic
• CVE-2004-0500 HIGH 7.5 DOWNGRADE MITIGATE Buffer overflow in the MSN protocol plugins (1) object.c and (2) slp.c for Gaim before 0.82 allows remote atta
• CVE-2004-0497 LOW 2.1 DOWNGRADE MITIGATE Unknown vulnerability in Linux kernel 2.x may allow local users to modify the group ID of files, such as NFS e
• CVE-2004-0496 HIGH 7.2 DOWNGRADE DOWNGRADE Multiple unknown vulnerabilities in Linux kernel 2.6 allow local users to gain privileges or access kernel mem
• CVE-2004-0402 MEDIUM 4.6 DOWNGRADE MITIGATE Buffer overflow in xpcd-svga in xpcd before 2.08, and possibly other versions, may allow local users to execut
• CVE-2004-0386 HIGH 10.0 DOWNGRADE MITIGATE Buffer overflow in the HTTP parser for MPlayer 1.0pre3 and earlier, 0.90, and 0.91 allows remote attackers to
• CVE-2003-1020 MEDIUM 5.0 DOWNGRADE MITIGATE The format_send_to_gui function in formats.c for irssi before 0.8.9 allows remote IRC users to cause a denial
• CVE-2003-0462 LOW 1.2 DOWNGRADE MITIGATE A race condition in the way env_start and env_end pointers are initialized in the execve system call and used
• CVE-2003-0434 HIGH 7.5 DOWNGRADE DOWNGRADE Various PDF viewers including (1) Adobe Acrobat 5.06 and (2) Xpdf 1.01 allow remote attackers to execute arbit
• CVE-2003-0041 HIGH 10.0 MITIGATE MITIGATE Kerberos FTP client allows remote FTP sites to execute arbitrary code via a pipe (|) character in a filename t
• CVE-2002-2185 MEDIUM 4.9 MITIGATE MITIGATE The Internet Group Management Protocol (IGMP) allows local users to cause a denial of service via an IGMP memb
• CVE-2002-2001 LOW 1.2 DOWNGRADE MITIGATE jmcce 1.3.8 in Mandrake 8.1 creates log files in /tmp with predictable names, which allows local users to over
• CVE-2002-1814 MEDIUM 4.6 MITIGATE MITIGATE Buffer overflow in efstools in Bonobo, when installed setuid, allows local users to execute arbitrary code via
• CVE-2002-1713 MEDIUM 5.5 MITIGATE The Standard security setting for Mandrake-Security package (msec) in Mandrake 8.2 installs home directories w
• CVE-2002-0836 HIGH 7.5 MITIGATE MITIGATE dvips converter for Postscript files in the tetex package calls the system() function insecurely, which allows
• CVE-2002-0638 MEDIUM 6.2 DOWNGRADE MITIGATE setpwnam.c in the util-linux package, as included in Red Hat Linux 7.3 and earlier, and other operating system
• CVE-2002-0083 CRITICAL 9.8 DOWNGRADE DOWNGRADE Off-by-one error in the channel code of OpenSSH 2.0 through 3.0.2 allows local users or remote malicious serve
• CVE-2002-0004 HIGH 7.2 DOWNGRADE DOWNGRADE Heap corruption vulnerability in the "at" program allows local users to execute arbitrary code via a malformed
• CVE-2002-0002 HIGH 7.5 DOWNGRADE MITIGATE Format string vulnerability in stunnel before 3.22 when used in client mode for (1) smtp, (2) pop, or (3) nntp
• CVE-2001-1449 HIGH 7.5 DOWNGRADE DOWNGRADE The default installation of Apache before 1.3.19 on Mandrake Linux 7.1 through 8.0 and Linux Corporate Server
• CVE-2001-1385 MEDIUM 5.0 DOWNGRADE MITIGATE The Apache module for PHP 4.0.0 through PHP 4.0.4, when disabled with the 'engine = off' option for a virtual
• CVE-2001-1190 MEDIUM 4.6 MITIGATE The default PAM files included with passwd in Mandrake Linux 8.1 do not support MD5 passwords, which could res
• CVE-2001-1030 HIGH 7.5 DOWNGRADE DOWNGRADE Squid before 2.3STABLE5 in HTTP accelerator mode does not enable access control lists (ACLs) when the httpd_ac
• CVE-2001-0977 MEDIUM 5.0 DOWNGRADE DOWNGRADE slapd in OpenLDAP 1.x before 1.2.12, and 2.x before 2.0.8, allows remote attackers to cause a denial of servic
• CVE-2001-0912 HIGH 7.2 MITIGATE Packaging error for expect 8.3.3 in Mandrake Linux 8.1 causes expect to search for its libraries in the /home/
• CVE-2001-0736 LOW 2.1 DOWNGRADE UPGRADE Vulnerability in (1) pine before 4.33 and (2) the pico editor, included with pine, allows local users local us
• CVE-2001-0496 MEDIUM 4.6 MITIGATE MITIGATE kdesu in kdelibs package creates world readable temporary files containing authentication info, which can allo
• CVE-2001-0481 HIGH 7.2 MITIGATE Vulnerability in rpmdrake in Mandrake Linux 8.0 related to insecure temporary file handling.
• CVE-2001-0474 LOW 2.1 UPGRADE MITIGATE Utah-glx in Mesa before 3.3-14 on Mandrake Linux 7.2 allows local users to overwrite arbitrary files via a sym
• CVE-2001-0473 HIGH 7.5 DOWNGRADE UPGRADE Format string vulnerability in Mutt before 1.2.5 allows a remote malicious IMAP server to execute arbitrary co
• CVE-2001-0458 HIGH 7.5 DOWNGRADE MITIGATE Multiple buffer overflows in ePerl before 2.2.14-0.7 allow local and remote attackers to execute arbitrary com
• CVE-2001-0441 HIGH 7.5 UPGRADE MITIGATE Buffer overflow in (1) wrapping and (2) unwrapping functions of slrn news reader before 0.9.7.0 allows remote
• CVE-2001-0440 HIGH 7.5 UPGRADE MITIGATE Buffer overflow in logging functions of licq before 1.0.3 allows remote attackers to cause a denial of service
• CVE-2001-0439 HIGH 7.5 UPGRADE MITIGATE licq before 1.0.3 allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
• CVE-2001-0416 LOW 2.1 DOWNGRADE DOWNGRADE sgml-tools (aka sgmltools) before 1.0.9-15 creates temporary files with insecure permissions, which allows oth
• CVE-2001-0388 HIGH 10.0 UPGRADE MITIGATE time server daemon timed allows remote attackers to cause a denial of service via malformed packets.
• CVE-2001-0279 HIGH 7.2 MITIGATE MITIGATE Buffer overflow in sudo earlier than 1.6.3p6 allows local users to gain root privileges.
• CVE-2001-0178 LOW 2.1 MITIGATE MITIGATE kdesu program in KDE2 (KDE before 2.2.0-6) does not properly verify the owner of a UNIX socket that is used to
• CVE-2001-0169 LOW 2.1 MITIGATE MITIGATE When using the LD_PRELOAD environmental variable in SUID or SGID applications, glibc does not verify that prel
• CVE-2001-0142 LOW 1.2 DOWNGRADE DOWNGRADE squid 2.3 and earlier allows local users to overwrite arbitrary files via a symlink attack in some configurati
• CVE-2001-0140 LOW 1.2 DOWNGRADE MITIGATE arpwatch 2.1a4 allows local users to overwrite arbitrary files via a symlink attack in some configurations.
• CVE-2001-0139 LOW 1.2 DOWNGRADE DOWNGRADE inn 2.2.3 allows local users to overwrite arbitrary files via a symlink attack in some configurations.
• CVE-2001-0138 LOW 1.2 DOWNGRADE MITIGATE privatepw program in wu-ftpd before 2.6.1-6 allows local users to overwrite arbitrary files via a symlink atta
• CVE-2001-0136 MEDIUM 5.0 DOWNGRADE MITIGATE Memory leak in ProFTPd 1.2.0rc2 allows remote attackers to cause a denial of service via a series of USER comm
• CVE-2001-0128 HIGH 7.2 DOWNGRADE UPGRADE Zope before 2.2.4 does not properly compute local roles, which could allow users to bypass specified access re
• CVE-2001-0125 LOW 1.2 UPGRADE MITIGATE exmh 2.2 and earlier allows local users to overwrite arbitrary files via a symlink attack on the exmhErrorMsg
• CVE-2001-0120 LOW 1.2 DOWNGRADE MITIGATE useradd program in shadow-utils program may allow local users to overwrite arbitrary files via a symlink attac
• CVE-2001-0119 LOW 1.2 DOWNGRADE MITIGATE getty_ps 2.0.7j allows local users to overwrite arbitrary files via a symlink attack.
• CVE-2001-0118 LOW 1.2 DOWNGRADE MITIGATE rdist 6.1.5 allows local users to overwrite arbitrary files via a symlink attack.
• CVE-2001-0117 LOW 1.2 DOWNGRADE MITIGATE sdiff 2.7 in the diffutils package allows local users to overwrite files via a symlink attack.
• CVE-2001-0116 LOW 1.2 DOWNGRADE MITIGATE gpm 1.19.3 allows local users to overwrite arbitrary files via a symlink attack.
• CVE-2001-0108 MEDIUM 5.0 DOWNGRADE MITIGATE PHP Apache module 4.0.4 and earlier allows remote attackers to bypass .htaccess access restrictions via a malf
• CVE-2000-1095 HIGH 7.2 DOWNGRADE MITIGATE modprobe in the modutils 2.3.x package on Linux systems allows a local user to execute arbitrary commands via
• CVE-2000-1059 HIGH 7.2 MITIGATE The default configuration of the Xsession file in Mandrake Linux 7.1 and 7.0 bypasses the Xauthority access co
• CVE-2000-1043 HIGH 10.0 MITIGATE Format string vulnerability in ypserv in Mandrake Linux 7.1 and earlier, and possibly other Linux operating sy
• CVE-2000-0883 MEDIUM 5.0 MITIGATE The default configuration of mod_perl for Apache as installed on Mandrake Linux 6.1 through 7.1 sets the /perl
• CVE-2000-0867 HIGH 7.2 MITIGATE MITIGATE Kernel logging daemon (klogd) in Linux does not properly cleanse user-injected format strings, which allows lo
• CVE-2000-0718 LOW 1.2 MITIGATE A race condition in MandrakeUpdate allows local users to modify RPM files while they are in the /tmp directory
• CVE-2000-0633 LOW 2.1 MITIGATE MITIGATE Vulnerability in Mandrake Linux usermode package allows local users to to reboot or halt the system.
• CVE-2000-0607 HIGH 7.2 MITIGATE MITIGATE Buffer overflow in fld program in Kanji on Console (KON) package on Linux may allow local users to gain root p
• CVE-2000-0606 HIGH 7.2 MITIGATE MITIGATE Buffer overflow in kon program in Kanji on Console (KON) package on Linux may allow local users to gain root p
• CVE-2000-0594 MEDIUM 5.0 DOWNGRADE DOWNGRADE BitchX IRC client does not properly cleanse an untrusted format string, which allows remote attackers to cause
• CVE-2000-0566 HIGH 7.2 MITIGATE MITIGATE makewhatis in Linux man package allows local users to overwrite files via a symlink attack.
• CVE-2000-0454 HIGH 7.2 MITIGATE Buffer overflow in Linux cdrecord allows local users to gain privileges via the dev parameter.
• CVE-2000-0336 LOW 2.1 DOWNGRADE MITIGATE Linux OpenLDAP server allows local users to modify arbitrary files via a symlink attack.
• CVE-2000-0186 HIGH 7.2 MITIGATE MITIGATE Buffer overflow in the dump utility in the Linux ext2fs backup package allows local users to gain privileges v
• CVE-2000-0184 LOW 2.1 MITIGATE MITIGATE Linux printtool sets the permissions of printer configuration files to be world-readable, which allows local a
• CVE-2000-0052 HIGH 7.2 MITIGATE MITIGATE Red Hat userhelper program in the usermode package allows local users to gain root access via PAM and a .
• CVE-1999-1477 HIGH 7.2 DOWNGRADE MITIGATE Buffer overflow in GNOME libraries 1.0.8 allows local user to gain root access via a long --espeaker argument
• CVE-1999-1008 HIGH 7.2 MITIGATE MITIGATE xsoldier program allows local users to gain root access via a long argument.

FAQ

How do I fix mandrakesoft vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is mandrakesoft being exploited right now?

None of the tracked mandrakesoft CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which mandrakesoft CVE should I patch first?

CVE-2002-0083 currently ranks highest (73/100): Off-by-one error in the channel code of OpenSSH 2.0 through 3.0.2 allows local users or remote malicious serve.

Products

• mandrake lam-runtime
• mandrake linux
• mandrake linux corporate server
• mandrake linuxsoft 2007
• mandrake multi network firewall
• mandrake single network firewall

RSS feed for mandrakesoft · ← Back to latest CVEs