Updated stunnel package fixes security vulnerability:

A flaw was found in the way stunnel, a socket wrapper which can provide
SSL support to ordinary applications, performed (re)initialization of
PRNG after fork. When accepting a new connection, the server forks and
the child process handles the request. The RAND_bytes() function of
openssl doesn’t reset its state after the fork, but seeds the PRNG
with the output of time(NULL). The most important consequence is
that servers using EC (ECDSA) or DSA certificates may under certain
conditions leak their private key (CVE-2014-0016).

The updated packages fix this issue by using threads instead of new
processes to handle connections.

Also an issue has been corrected where the directory for the pid file
was not being created when the package is installed.

An issue currently exists in Mageia 4 where it fails trying to use
FIPS SSL (mga#13124). This can be worked around by adding fips =
no into the config.

Updated openssh packages fix security vulnerabilities:

sshd in OpenSSH before 6.6 does not properly support wildcards
on AcceptEnv lines in sshd_config, which allows remote attackers to
bypass intended environment restrictions by using a substring located
before a wildcard character (CVE-2014-2532).

Matthew Vernon reported that if a SSH server offers a HostCertificate
that the ssh client doesn’t accept, then the client doesn’t check
the DNS for SSHFP records. As a consequence a malicious server can
disable SSHFP-checking by presenting a certificate (CVE-2014-2653).

Updated nginx package fixes security vulnerabilities:

A bug in the experimental SPDY implementation in nginx was found,
which might allow an attacker to cause a heap memory buffer overflow
in a worker process by using a specially crafted request, potentially
resulting in arbitrary code execution (CVE-2014-0133).

Antoine Delignat-Lavaud and Karthikeyan Bhargavan discovered that
it was possible to reuse cached SSL sessions in unrelated contexts,
allowing virtual host confusion attacks in some configurations by an
attacker in a privileged network position (CVE-2014-3616).

Updated apache packages fix security vulnerabilities:

Apache HTTPD before 2.4.9 was vulnerable to a denial of service in
mod_dav when handling DAV_WRITE requests (CVE-2013-6438).

Apache HTTPD before 2.4.9 was vulnerable to a denial of service when
logging cookies (CVE-2014-0098).

A race condition flaw, leading to heap-based buffer overflows,
was found in the mod_status httpd module. A remote attacker able to
access a status page served by mod_status on a server using a threaded
Multi-Processing Module (MPM) could send a specially crafted request
that would cause the httpd child process to crash or, possibly,
allow the attacker to execute arbitrary code with the privileges of
the apache user (CVE-2014-0226).

A denial of service flaw was found in the mod_proxy httpd module. A
remote attacker could send a specially crafted request to a server
configured as a reverse proxy using a threaded Multi-Processing
Modules (MPM) that would cause the httpd child process to crash
(CVE-2014-0117).

A denial of service flaw was found in the way httpd’s mod_deflate
module handled request body decompression (configured via the DEFLATE
input filter). A remote attacker able to send a request whose body
would be decompressed could use this flaw to consume an excessive
amount of system memory and CPU on the target system (CVE-2014-0118).

A denial of service flaw was found in the way httpd’s mod_cgid module
executed CGI scripts that did not read data from the standard input. A
remote attacker could submit a specially crafted request that would
cause the httpd child process to hang indefinitely (CVE-2014-0231).

A NULL pointer dereference flaw was found in the way the mod_cache
httpd module handled Content-Type headers. A malicious HTTP server
could cause the httpd child process to crash when the Apache HTTP
server was configured to proxy to a server with caching enabled
(CVE-2014-3581).

mod_lua.c in the mod_lua module in the Apache HTTP Server through
2.4.10 does not support an httpd configuration in which the same
Lua authorization provider is used with different arguments within
different contexts, which allows remote attackers to bypass intended
access restrictions in opportunistic circumstances by leveraging
multiple Require directives, as demonstrated by a configuration that
specifies authorization for one group to access a certain directory,
and authorization for a second group to access a second directory
(CVE-2014-8109).

In the mod_lua module in the Apache HTTP Server through 2.4.10, a
maliciously crafted websockets PING after a script calls r:wsupgrade()
can cause a child process crash (CVE-2015-0228).

A flaw was found in the way httpd handled HTTP Trailer headers when
processing requests using chunked encoding. A malicious client could
use Trailer headers to set additional HTTP headers after header
processing was performed by other modules. This could, for example,
lead to a bypass of header restrictions defined with mod_headers
(CVE-2013-5704).

Note: With this update, httpd has been modified to not merge HTTP
Trailer headers with other HTTP request headers. A newly introduced
configuration directive MergeTrailers can be used to re-enable the
old method of processing Trailer headers, which also re-introduces
the aforementioned flaw.

This update also fixes the following bug:

Prior to this update, the mod_proxy_wstunnel module failed to set
up an SSL connection when configured to use a back end server using
the wss: URL scheme, causing proxied connections to fail. In these
updated packages, SSL is used when proxying to wss: back end servers
(rhbz#1141950).

Updated net-snmp packages fix security vulnerabilities:

Remotely exploitable denial of service vulnerability in Net-SNMP,
in the Linux implementation of the ICMP-MIB, making the SNMP
agent vulnerable if it is making use of the ICMP-MIB table objects
(CVE-2014-2284).

Remotely exploitable denial of service vulnerability in Net-SNMP,
in snmptrapd, due to how it handles trap requests with an empty
community string when the perl handler is enabled (CVE-2014-2285).

A remote denial-of-service flaw was found in the way snmptrapd handled
certain SNMP traps when started with the -OQ option. If an attacker
sent an SNMP trap containing a variable with a NULL type where an
integer variable type was expected, it would cause snmptrapd to crash
(CVE-2014-3565).

This update provides MariaDB 5.5.42, which fixes several security
issues and other bugs. Please refer to the Oracle Critical Patch Update
Advisories and the Release Notes for MariaDB for further information
regarding the security vulnerabilities.

Additionally the jemalloc packages is being provided as it was
previousely provided with the mariadb source code, built and used
but removed from the mariadb source code since 5.5.40.

Updated libpng package fixes security vulnerabilities:

The png_push_read_chunk function in pngpread.c in the progressive
decoder in libpng 1.6.x through 1.6.9 allows remote attackers to cause
a denial of service (infinite loop and CPU consumption) via an IDAT
chunk with a length of zero (CVE-2014-0333).

libpng versions 1.6.9 through 1.6.15 have an integer-overflow
vulnerability in png_combine_row() when decoding very wide interlaced
images, which can allow an attacker to overwrite an arbitrary amount
of memory with arbitrary (attacker-controlled) data (CVE-2014-9495).

Updated freetype2 packages fix security vulnerabilities:

It was reported that Freetype before 2.5.3 suffers from an
out-of-bounds stack-based read/write flaw in cf2_hintmap_build()
in the CFF rasterizing code, which could lead to a buffer overflow
(CVE-2014-2240).

It was also reported that Freetype before 2.5.3 has a denial-of-service
vulnerability in the CFF rasterizing code, due to a reachable assertion
(CVE-2014-2241).

It was reported that Freetype before 2.5.4 suffers from an
out-of-bounds stack-based read/write flaw in cf2_hintmap_build()
in the CFF rasterizing code, which could lead to a buffer overflow.
This is due to an incomplete fix for CVE-2014-2240.

The tt_sbit_decoder_load_image function in sfnt/ttsbit.c in FreeType
before 2.5.4 does not properly check for an integer overflow, which
allows remote attackers to cause a denial of service (out-of-bounds
read) or possibly have unspecified other impact via a crafted OpenType
font (CVE-2014-9656).

The tt_face_load_hdmx function in truetype/ttpload.c in FreeType
before 2.5.4 does not establish a minimum record size, which allows
remote attackers to cause a denial of service (out-of-bounds read)
or possibly have unspecified other impact via a crafted TrueType font
(CVE-2014-9657).

The tt_face_load_kern function in sfnt/ttkern.c in FreeType before
2.5.4enforces an incorrect minimum table length, which allows
remote attackers to cause a denial of service (out-of-bounds read)
or possibly have unspecified other impact via a crafted TrueType font
(CVE-2014-9658).

The _bdf_parse_glyphs function in bdf/bdflib.c in FreeType before 2.5.4
does not properly handle a missing ENDCHAR record, which allows remote
attackers to cause a denial of service (NULL pointer dereference)
or possibly have unspecified other impact via a crafted BDF font
(CVE-2014-9660).

type42/t42parse.c in FreeType before 2.5.4 does not consider that
scanning can be incomplete without triggering an error, which allows
remote attackers to cause a denial of service (use-after-free) or
possibly have unspecified other impact via a crafted Type42 font
(CVE-2014-9661).

cff/cf2ft.c in FreeType before 2.5.4 does not validate the return
values of point-allocation functions, which allows remote attackers
to cause a denial of service (heap-based buffer overflow) or possibly
have unspecified other impact via a crafted OTF font (CVE-2014-9662).

The tt_cmap4_validate function in sfnt/ttcmap.c in FreeType before
2.5.4 validates a certain length field before that field’s value
is completely calculated, which allows remote attackers to cause a
denial of service (out-of-bounds read) or possibly have unspecified
other impact via a crafted cmap SFNT table (CVE-2014-9663).

FreeType before 2.5.4 does not check for the end of the data during
certain parsing actions, which allows remote attackers to cause a
denial of service (out-of-bounds read) or possibly have unspecified
other impact via a crafted Type42 font, related to type42/t42parse.c
and type1/t1load.c (CVE-2014-9664).

The tt_sbit_decoder_init function in sfnt/ttsbit.c in FreeType before
2.5.4 proceeds with a count-to-size association without restricting
the count value, which allows remote attackers to cause a denial of
service (integer overflow and out-of-bounds read) or possibly have
unspecified other impact via a crafted embedded bitmap (CVE-2014-9666).

sfnt/ttload.c in FreeType before 2.5.4 proceeds with offset+length
calculations without restricting the values, which allows remote
attackers to cause a denial of service (integer overflow and
out-of-bounds read) or possibly have unspecified other impact via a
crafted SFNT table (CVE-2014-9667).

Multiple integer overflows in sfnt/ttcmap.c in FreeType before 2.5.4
allow remote attackers to cause a denial of service (out-of-bounds
read or memory corruption) or possibly have unspecified other impact
via a crafted cmap SFNT table (CVE-2014-9669).

Multiple integer signedness errors in the pcf_get_encodings function
in pcf/pcfread.c in FreeType before 2.5.4 allow remote attackers to
cause a denial of service (integer overflow, NULL pointer dereference,
and application crash) via a crafted PCF file that specifies negative
values for the first column and first row (CVE-2014-9670).

Off-by-one error in the pcf_get_properties function in pcf/pcfread.c
in FreeType before 2.5.4 allows remote attackers to cause a denial of
service (NULL pointer dereference and application crash) via a crafted
PCF file with a 0xffffffff size value that is improperly incremented
(CVE-2014-9671).

Array index error in the parse_fond function in base/ftmac.c in
FreeType before 2.5.4 allows remote attackers to cause a denial
of service (out-of-bounds read) or obtain sensitive information
from process memory via a crafted FOND resource in a Mac font file
(CVE-2014-9672).

Integer signedness error in the Mac_Read_POST_Resource function in
base/ftobjs.c in FreeType before 2.5.4 allows remote attackers to
cause a denial of service (heap-based buffer overflow) or possibly
have unspecified other impact via a crafted Mac font (CVE-2014-9673).

The Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before
2.5.4 proceeds with adding to length values without validating the
original values, which allows remote attackers to cause a denial of
service (integer overflow and heap-based buffer overflow) or possibly
have unspecified other impact via a crafted Mac font (CVE-2014-9674).

bdf/bdflib.c in FreeType before 2.5.4 identifies property names by
only verifying that an initial substring is present, which allows
remote attackers to discover heap pointer values and bypass the ASLR
protection mechanism via a crafted BDF font (CVE-2014-9675).

Updated udisks2 packages fixes security vulnerability:

A flaw was found in the way udisks and udisks2 handled long path
names. A malicious, local user could use this flaw to create a
specially-crafted directory structure that could lead to arbitrary
code execution with the privileges of the udisks daemon (root)
(CVE-2014-0004).

Updated egroupware packages fix security vulnerabilities:

eGroupware prior to 1.8.006.20140217 is vulnerable to remote file
deletion and possible remote code execution due to user input being
passed to PHP’s unserialize() method (CVE-2014-2027).

eGroupWare before 1.8.007 allows logged in users with administrative
priviledges to remotely execute arbitrary commands on the server.
It is also vulnerable to a cross site request forgery vulnerability
that allows creating new administrative users.