-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2015:170
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : gcc
 Date    : March 30, 2015
 Affected: Business Server 2.0
 _______________________________________________________________________

 Problem Description:

 Updated gcc packages fix the following security issue:
 
 Multiple integer overflow issues were found in libgfortran, the
 run-time support library for the Fortran compiler. These could possibly
 be used to crash a Fortran application or cause it to execute arbitrary
 code CVE-2014-5044).
 
 They also fix the following bugs:
 
 The gcc rtl-optimization sched2 miscompiles syscall sequence wich
 can cause random panic in glibc and kernel (gcc/PR61801)
 
 clang++ fails to find cxxabi.h and cxxabi_tweaks.h during build
 (mga#13543)
 ____

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2015:169
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : git
 Date    : March 30, 2015
 Affected: Business Server 2.0
 _______________________________________________________________________

 Problem Description:

 Updated git packages fix security vulnerability:
 
 It was reported that git, when used as a client on a case-insensitive
 filesystem, could allow the overwrite of the .git/config file when
 the client performed a git pull.  Because git permitted committing
 .Git/config (or any case variation), on the pull this would replace the
 user's .git/config.  If this malicious config file contained defined
 external commands (such as for invoking and editor or an external diff
 utility) it could allow for the execution of arbitrary code 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2015:168
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : glibc
 Date    : March 30, 2015
 Affected: Business Server 2.0
 _______________________________________________________________________

 Problem Description:

 Updated glibc packages fix security vulnerabilities:
 
 Stephane Chazelas discovered that directory traversal issue in locale
 handling in glibc.  glibc accepts relative paths with .. components
 in the LC_* and LANG variables.  Together with typical OpenSSH
 configurations (with suitable AcceptEnv settings in sshd_config),
 this could conceivably be used to bypass ForceCommand restrictions
 (or restricted shells), assuming the attacker has sufficient level
 of access to a file system location on the host to create crafted
 locale 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2015:167
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : glpi
 Date    : March 30, 2015
 Affected: Business Server 2.0
 _______________________________________________________________________

 Problem Description:

 Updated glpi package fixes security vulnerabilities:
 
 Due to a bug in GLPI before 0.84.7, a user without access to cost
 information can in fact see the information when selecting cost as
 a search criteria (CVE-2014-5032).
 
 An issue in GLPI before 0.84.8 may allow arbitrary local files to be
 included by PHP through an autoload function (CVE-2014-8360).
 
 SQL injection vulnerability in ajax/getDropdownValue.php in GLPI
 before 0.85.1 allows remote authenticated users to execute arbitrary
 SQL commands via the condition paramet

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2015:160
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : ipython
 Date    : March 29, 2015
 Affected: Business Server 2.0
 _______________________________________________________________________

 Problem Description:

 Updated ipython package fixes security vulnerability:
 
 In IPython before 1.2, the origin of websocket requests was not
 verified within the IPython notebook server. If an attacker has
 knowledge of an IPython kernel id they can run arbitrary code on
 a user's machine when the client visits a crafted malicious page
 (CVE-2014-3429).
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3429
 http://advisories.mageia.org/MGASA-2014-0320

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2015:159
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : jasper
 Date    : March 29, 2015
 Affected: Business Server 2.0
 _______________________________________________________________________

 Problem Description:

 Updated jasper packages fix security vulnerabilities:
 
 Josh Duart of the Google Security Team discovered heap-based buffer
 overflow flaws in JasPer, which could lead to denial of service
 (application crash) or the execution of arbitrary code (CVE-2014-9029).
 
 A double free flaw was found in the way JasPer parsed ICC color
 profiles in JPEG 2000 image files. A specially crafted file could
 cause an application using JasPer to crash or, possibly, execute
 arbitrary code (CVE-2014-8137).
 
 A heap-based buffer overflow flaw was

Updated emacs packages fix security vulnerabilities:

Steve Kemp discovered multiple temporary file handling issues in
Emacs. A local attacker could use these flaws to perform symbolic link
attacks against users running Emacs (CVE-2014-3421, CVE-2014-3422,
CVE-2014-3423, CVE-2014-3424).

Updated xlockmore packages fix security vulnerability:

xlockmore before 5.45 contains a security flaw related to a bad value
of fnt for pyro2 which could cause an X error. This update backports
the fix for version 5.43.

Updated x11-server packages fix security vulnerabilities:

Ilja van Sprundel of IOActive discovered several security issues in the
X.org X server, which may lead to privilege escalation or denial of
service (CVE-2014-8091, CVE-2014-8092, CVE-2014-8093, CVE-2014-8094,
CVE-2014-8095, CVE-2014-8096, CVE-2014-8097, CVE-2014-8098,
CVE-2014-8099, CVE-2014-8100, CVE-2014-8101, CVE-2014-8102).

Olivier Fourdan from Red Hat has discovered a protocol handling
issue in the way the X server code base handles the XkbSetGeometry
request, where the server trusts the client to send valid string
lengths. A malicious client with string lengths exceeding the
request length can cause the server to copy adjacent memory data
into the XKB structs. This data is then available to the client via
the XkbGetGeometry request. This can lead to information disclosure
issues, as well as possibly a denial of service if a similar request
can cause the server to crash (CVE-2015-0255).

Updated python-lxml packages fix security vulnerability:

The clean_html() function, provided by the lxml.html.clean module,
did not properly clean HTML input if it included non-printed characters
(x01-x08). A remote attacker could use this flaw to serve malicious
content to an application using the clean_html() function to process
HTML, possibly allowing the attacker to inject malicious code into
a website generated by this application (CVE-2014-3146).