Updated drupal packages fix security vulnerabilities:

An information disclosure vulnerability was discovered in Drupal
before 7.27. When pages are cached for anonymous users, form state
may leak between anonymous users. Sensitive or private information
recorded for one anonymous user could thus be disclosed to other
users interacting with the same form at the same time (CVE-2014-2983).

Multiple security issues in Drupal before 7.29, including a denial
of service issue, an access bypass issue in the File module, and
multiple cross-site scripting issues (CVE-2014-5019, CVE-2014-5020,
CVE-2014-5021, CVE-2014-5022).

A denial of service issue exists in Drupal before 7.31, due to XML
entity expansion in a publicly accessible XML-RPC endpoint.

An SQL Injection issue exists in Drupal before 7.32 due to the way
the Drupal core handles prepared statements. A malicious user can
inject arbitrary SQL queries, and thereby completely control the
Drupal site. This vulnerability can be exploited by remote attackers
without any kind of authentication required (CVE-2014-3704).

Aaron Averill discovered that a specially crafted request can give a
user access to another user’s session, allowing an attacker to hijack
a random session (CVE-2014-9015).

Michael Cullum, Javier Nieto and Andres Rojas Guerrero discovered
that the password hashing API allows an attacker to send specially
crafted requests resulting in CPU and memory exhaustion. This may lead
to the site becoming unavailable or unresponsive (denial of service)
(CVE-2014-9016). anonymous users (CVE-2014-9016).

Password reset URLs can be forged under certain circumstances, allowing
an attacker to gain access to another user’s account without knowing
the account’s password (CVE-2015-2559).

Under certain circumstances, malicious users can construct a URL
that will trick users into being redirected to a 3rd party website,
thereby exposing the users to potential social engineering attacks. In
addition, several URL-related API functions in Drupal 6 and 7 can be
tricked into passing through external URLs when not intending to,
potentially leading to additional open redirect vulnerabilities
(CVE-2015-2749, CVE-2015-2750).

The drupal package has been updated to version 7.35 to fix this
issue and other bugs. See the upstream advisory and release notes
for more details.

Updated apache-mod_wsgi package fixes security vulnerabilities:

apache-mod_wsgi before 4.2.4 contained an off-by-one error in
applying a limit to the number of supplementary groups allowed for
a daemon process group. The result could be that if more groups
than the operating system allowed were specified to the option
supplementary-groups, then memory corruption or a process crash
could occur.

It was discovered that mod_wsgi incorrectly handled errors when
setting up the working directory and group access rights. A malicious
application could possibly use this issue to cause a local privilege
escalation when using daemon mode (CVE-2014-8583).

Multiple vulnerabilities has been found and corrected in binutils:

Multiple integer overflows in the (1) _objalloc_alloc function in
objalloc.c and (2) objalloc_alloc macro in include/objalloc.h in GNU
libiberty, as used by binutils 2.22, allow remote attackers to cause
a denial of service (crash) via vectors related to the addition of
CHUNK_HEADER_SIZE to the length, which triggers a heap-based buffer
overflow (CVE-2012-3509).

The srec_scan function in bfd/srec.c in libdbfd in GNU binutils
before 2.25 allows remote attackers to cause a denial of service
(out-of-bounds read) via a small S-record (CVE-2014-8484).

The setup_group function in bfd/elf.c in libbfd in GNU binutils 2.24
and earlier allows remote attackers to cause a denial of service
(crash) and possibly execute arbitrary code via crafted section group
headers in an ELF file (CVE-2014-8485).

The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU binutils
2.24 and earlier allows remote attackers to cause a denial of service
(out-of-bounds write) and possibly have other unspecified impact via a
crafted NumberOfRvaAndSizes field in the AOUT header in a PE executable
(CVE-2014-8501).

Heap-based buffer overflow in the pe_print_edata function in
bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote
attackers to cause a denial of service (crash) and possibly have
other unspecified impact via a truncated export table in a PE file
(CVE-2014-8502).

Stack-based buffer overflow in the ihex_scan function in bfd/ihex.c
in GNU binutils 2.24 and earlier allows remote attackers to cause a
denial of service (crash) and possibly have other unspecified impact
via a crafted ihex file (CVE-2014-8503).

Stack-based buffer overflow in the srec_scan function in bfd/srec.c
in GNU binutils 2.24 and earlier allows remote attackers to cause a
denial of service (crash) and possibly have other unspecified impact
via a crafted file (CVE-2014-8504).

Multiple directory traversal vulnerabilities in GNU binutils 2.24 and
earlier allow local users to delete arbitrary files via a .. (dot dot)
or full path name in an archive to (1) strip or (2) objcopy or create
arbitrary files via (3) a .. (dot dot) or full path name in an archive
to ar (CVE-2014-8737).

The _bfd_slurp_extended_name_table function in bfd/archive.c in GNU
binutils 2.24 and earlier allows remote attackers to cause a denial of
service (invalid write, segmentation fault, and crash) via a crafted
extended name table in an archive (CVE-2014-8738).

The updated packages provides a solution for these security issues.

Update:

Packages for Mandriva Business Server 2 are now being provided.

Updated coreutils packages fix security vulnerability:

Bertrand Jacquin and Fiedler Roman discovered date and touch
incorrectly handled user-supplied input. An attacker could possibly
use this to cause a denial of service or potentially execute code
(CVE-2014-9471).

Updated ctags package fixes security vulnerability:

A denial of service issue was discovered in ctags 5.8. A remote
attacker could cause excessive CPU usage and disk space consumption
via a crafted JavaScript file by triggering an infinite loop
(CVE-2014-7204).

Updated ctdb packages fix security vulnerability:

ctdb before 2.5 is vulnerable to symlink attacks to due the
use of predictable filenames in /tmp, such as /tmp/ctdb.socket
(CVE-2013-4159).

Updated dbus packages fix multiple vulnerabilities:

A denial of service vulnerability in D-Bus before 1.6.20 allows a
local attacker to cause a bus-activated service that is not currently
running to attempt to start, and fail, denying other users access to
this service Additionally, in highly unusual environments the same
flaw could lead to a side channel between processes that should not
be able to communicate (CVE-2014-3477).

A flaw was reported in D-Bus’s file descriptor passing feature. A
local attacker could use this flaw to cause a service or application
to disconnect from the bus, typically resulting in that service or
application exiting (CVE-2014-3532).

A flaw was reported in D-Bus’s file descriptor passing feature. A local
attacker could use this flaw to cause an invalid file descriptor to be
forwarded to a service or application, causing it to disconnect from
the bus, typically resulting in that service or application exiting
(CVE-2014-3533).

On 64-bit platforms, file descriptor passing could be abused by local
users to cause heap corruption in dbus-daemon, leading to a crash,
or potentially to arbitrary code execution (CVE-2014-3635).

A denial-of-service vulnerability in dbus-daemon allowed local
attackers to prevent new connections to dbus-daemon, or disconnect
existing clients, by exhausting descriptor limits (CVE-2014-3636).

Malicious local users could create D-Bus connections to dbus-daemon
which could not be terminated by killing the participating processes,
resulting in a denial-of-service vulnerability (CVE-2014-3637).

dbus-daemon suffered from a denial-of-service vulnerability in the
code which tracks which messages expect a reply, allowing local
attackers to reduce the performance of dbus-daemon (CVE-2014-3638).

dbus-daemon did not properly reject malicious connections from local
users, resulting in a denial-of-service vulnerability (CVE-2014-3639).

The patch issued by the D-Bus maintainers for CVE-2014-3636 was
based on incorrect reasoning, and does not fully prevent the attack
described as CVE-2014-3636 part A, which is repeated below. Preventing
that attack requires raising the system dbus-daemon’s RLIMIT_NOFILE
(ulimit -n) to a higher value.

By queuing up the maximum allowed number of fds, a malicious sender
could reach the system dbus-daemon’s RLIMIT_NOFILE (ulimit -n,
typically 1024 on Linux). This would act as a denial of service in
two ways:

* new clients would be unable to connect to the dbus-daemon

* when receiving a subsequent message from a non-malicious client
that contained a fd, dbus-daemon would receive the MSG_CTRUNC flag,
indicating that the list of fds was truncated; kernel fd-passing
APIs do not provide any way to recover from that, so dbus-daemon
responds to MSG_CTRUNC by disconnecting the sender, causing denial
of service to that sender.

This update resolves the issue (CVE-2014-7824).

non-systemd processes can make dbus-daemon think systemd failed to
activate a system service, resulting in an error reply back to the
requester, causing a local denial of service (CVE-2015-0245).

Updated ejabberd packages fix security vulnerability:

A flaw was discovered in ejabberd that allows clients to connect
with an unencrypted connection even if starttls_required is set
(CVE-2014-8760).

Updated erlang packages fixes security vulnerability:

An FTP command injection flaw was found in Erlang’s FTP module. Several
functions in the FTP module do not properly sanitize the input before
passing it into a control socket. A local attacker can use this flaw
to execute arbitrary FTP commands on a system that uses this module
(CVE-2014-1693).

This update also disables SSLv3 by default to mitigate the POODLE
issue.

Updated ffmpeg packages fix security vulnerabilities:

The tak_decode_frame function in libavcodec/takdec.c in FFmpeg before
2.0.4 does not properly validate a certain bits-per-sample value, which
allows remote attackers to cause a denial of service (out-of-bounds
array access) or possibly have unspecified other impact via crafted
TAK (aka Tom’s lossless Audio Kompressor) data (CVE-2014-2097).

libavcodec/wmalosslessdec.c in FFmpeg before 2.0.4 uses an incorrect
data-structure size for certain coefficients, which allows remote
attackers to cause a denial of service (memory corruption) or possibly
have unspecified other impact via crafted WMA data (CVE-2014-2098).

The msrle_decode_frame function in libavcodec/msrle.c in FFmpeg before
2.0.4 does not properly calculate line sizes, which allows remote
attackers to cause a denial of service (out-of-bounds array access)
or possibly have unspecified other impact via crafted Microsoft RLE
video data (CVE-2014-2099).

The mpegts_write_pmt function in the MPEG2 transport stream (aka DVB)
muxer (libavformat/mpegtsenc.c) in FFmpeg before 2.0.4 allows remote
attackers to have unspecified impact and vectors, which trigger an
out-of-bounds write (CVE-2014-2263).

An integer overflow in LZO decompression in FFmpeg before 2.0.5 allows
remote attackers to have an unspecified impact by embedding compressed
data in a video file (CVE-2014-4610).

A heap-based buffer overflow in the encode_slice function in
libavcodec/proresenc_kostya.c in FFmpeg before 2.0.6 can cause a
crash, allowing a malicious image file to cause a denial of service
(CVE-2014-5271).

libavcodec/iff.c in FFmpeg before 2.0.6 allows an attacker to have
an unspecified impact via a crafted iff image, which triggers an
out-of-bounds array access, related to the rgb8 and rgbn formats
(CVE-2014-5272).

libavcodec/mjpegdec.c in FFmpeg before 2.0.6 considers only dimension
differences, and not bits-per-pixel differences, when determining
whether an image size has changed, which allows remote attackers to
cause a denial of service (out-of-bounds access) or possibly have
unspecified other impact via crafted MJPEG data (CVE-2014-8541).

libavcodec/utils.c in FFmpeg before 2.0.6 omits a certain codec ID
during enforcement of alignment, which allows remote attackers to
cause a denial of service (out-of-bounds access) or possibly have
unspecified other impact via crafted JV data (CVE-2014-8542).

libavcodec/mmvideo.c in FFmpeg before 2.0.6 does not consider all lines
of HHV Intra blocks during validation of image height, which allows
remote attackers to cause a denial of service (out-of-bounds access)
or possibly have unspecified other impact via crafted MM video data
(CVE-2014-8543).

libavcodec/tiff.c in FFmpeg before 2.0.6 does not properly validate
bits-per-pixel fields, which allows remote attackers to cause a denial
of service (out-of-bounds access) or possibly have unspecified other
impact via crafted TIFF data (CVE-2014-8544).

libavcodec/pngdec.c in FFmpeg before 2.0.6 accepts the monochrome-black
format without verifying that the bits-per-pixel value is 1, which
allows remote attackers to cause a denial of service (out-of-bounds
access) or possibly have unspecified other impact via crafted PNG data
(CVE-2014-8545).

Integer underflow in libavcodec/cinepak.c in FFmpeg before 2.0.6 allows
remote attackers to cause a denial of service (out-of-bounds access)
or possibly have unspecified other impact via crafted Cinepak video
data (CVE-2014-8546).

libavcodec/gifdec.c in FFmpeg before 2.0.6 does not properly compute
image heights, which allows remote attackers to cause a denial of
service (out-of-bounds access) or possibly have unspecified other
impact via crafted GIF data (CVE-2014-8547).

Off-by-one error in libavcodec/smc.c in FFmpeg before 2.0.6 allows
remote attackers to cause a denial of service (out-of-bounds access) or
possibly have unspecified other impact via crafted Quicktime Graphics
(aka SMC) video data (CVE-2014-8548).

This updates provides ffmpeg version 2.0.6, which fixes these issues
and several other bugs which were corrected upstream.