-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2015:202
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : ntp
 Date    : April 10, 2015
 Affected: Business Server 1.0, Business Server 2.0
 _______________________________________________________________________

 Problem Description:

 Multiple vulnerabilities has been found and corrected in ntp:
 
 The symmetric-key feature in the receive function in ntp_proto.c
 in ntpd in NTP before 4.2.8p2 requires a correct MAC only if the MAC
 field has a nonzero length, which makes it easier for man-in-the-middle
 attackers to spoof packets by omitting the MAC (CVE-2015-1798).
 
 The symmetric-key feature in the receive function in ntp_proto.c
 in ntpd in NTP before 4.2.8p2 performs state-variable updates
 upon receiving certain invalid packets, which ma

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2015:201
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : arj
 Date    : April 10, 2015
 Affected: Business Server 1.0
 _______________________________________________________________________

 Problem Description:

 Multiple vulnerabilities has been found and corrected in arj:
 
 Jakub Wilk discovered that arj follows symlinks created during
 unpacking of an arj archive. A remote attacker could use this flaw
 to perform a directory traversal attack if a user or automated
 system were tricked into processing a specially crafted arj archive
 (CVE-2015-0556).
 
 Jakub Wilk discovered that arj does not sufficiently protect from
 directory traversal while unpacking an arj archive containing
 file paths with multiple leading slashes. A remote attacker

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2015:200
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : mediawiki
 Date    : April 10, 2015
 Affected: Business Server 1.0
 _______________________________________________________________________

 Problem Description:

 Updated mediawiki packages fix security vulnerabilities:
 
 In MediaWiki before 1.23.9, one could circumvent the SVG MIME blacklist
 for embedded resources. This allowed an attacker to embed JavaScript
 in the SVG (CVE-2015-2931).
 
 In MediaWiki before 1.23.9, the SVG filter to prevent injecting
 JavaScript using animate elements was incorrect (CVE-2015-2932).
 
 In MediaWiki before 1.23.9, a stored XSS vulnerability exists due
 to the way attributes were expanded in MediaWiki's Html class, in
 combination with LanguageCo

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2015:199
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : less
 Date    : April 10, 2015
 Affected: Business Server 1.0, Business Server 2.0
 _______________________________________________________________________

 Problem Description:

 Updated less package fixes security vulnerability:
 
 Malformed UTF-8 data could have caused an out of bounds read
 in the UTF-8 decoding routines, causing an invalid read access
 (CVE-2014-9488).
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9488
 http://advisories.mageia.org/MGASA-2015-0139.html
 _______________________________________________________________________

 Updated Packages:

 Mandriva Business Server