Updated openssh packages fix security vulnerabilities:

sshd in OpenSSH before 6.6 does not properly support wildcards
on AcceptEnv lines in sshd_config, which allows remote attackers to
bypass intended environment restrictions by using a substring located
before a wildcard character (CVE-2014-2532).

Matthew Vernon reported that if a SSH server offers a HostCertificate
that the ssh client doesn’t accept, then the client doesn’t check
the DNS for SSHFP records. As a consequence a malicious server can
disable SSHFP-checking by presenting a certificate (CVE-2014-2653).

Updated udisks2 packages fixes security vulnerability:

A flaw was found in the way udisks and udisks2 handled long path
names. A malicious, local user could use this flaw to create a
specially-crafted directory structure that could lead to arbitrary
code execution with the privileges of the udisks daemon (root)
(CVE-2014-0004).

Updated freetype2 packages fix security vulnerabilities:

It was reported that Freetype before 2.5.3 suffers from an
out-of-bounds stack-based read/write flaw in cf2_hintmap_build()
in the CFF rasterizing code, which could lead to a buffer overflow
(CVE-2014-2240).

It was also reported that Freetype before 2.5.3 has a denial-of-service
vulnerability in the CFF rasterizing code, due to a reachable assertion
(CVE-2014-2241).

It was reported that Freetype before 2.5.4 suffers from an
out-of-bounds stack-based read/write flaw in cf2_hintmap_build()
in the CFF rasterizing code, which could lead to a buffer overflow.
This is due to an incomplete fix for CVE-2014-2240.

The tt_sbit_decoder_load_image function in sfnt/ttsbit.c in FreeType
before 2.5.4 does not properly check for an integer overflow, which
allows remote attackers to cause a denial of service (out-of-bounds
read) or possibly have unspecified other impact via a crafted OpenType
font (CVE-2014-9656).

The tt_face_load_hdmx function in truetype/ttpload.c in FreeType
before 2.5.4 does not establish a minimum record size, which allows
remote attackers to cause a denial of service (out-of-bounds read)
or possibly have unspecified other impact via a crafted TrueType font
(CVE-2014-9657).

The tt_face_load_kern function in sfnt/ttkern.c in FreeType before
2.5.4enforces an incorrect minimum table length, which allows
remote attackers to cause a denial of service (out-of-bounds read)
or possibly have unspecified other impact via a crafted TrueType font
(CVE-2014-9658).

The _bdf_parse_glyphs function in bdf/bdflib.c in FreeType before 2.5.4
does not properly handle a missing ENDCHAR record, which allows remote
attackers to cause a denial of service (NULL pointer dereference)
or possibly have unspecified other impact via a crafted BDF font
(CVE-2014-9660).

type42/t42parse.c in FreeType before 2.5.4 does not consider that
scanning can be incomplete without triggering an error, which allows
remote attackers to cause a denial of service (use-after-free) or
possibly have unspecified other impact via a crafted Type42 font
(CVE-2014-9661).

cff/cf2ft.c in FreeType before 2.5.4 does not validate the return
values of point-allocation functions, which allows remote attackers
to cause a denial of service (heap-based buffer overflow) or possibly
have unspecified other impact via a crafted OTF font (CVE-2014-9662).

The tt_cmap4_validate function in sfnt/ttcmap.c in FreeType before
2.5.4 validates a certain length field before that field’s value
is completely calculated, which allows remote attackers to cause a
denial of service (out-of-bounds read) or possibly have unspecified
other impact via a crafted cmap SFNT table (CVE-2014-9663).

FreeType before 2.5.4 does not check for the end of the data during
certain parsing actions, which allows remote attackers to cause a
denial of service (out-of-bounds read) or possibly have unspecified
other impact via a crafted Type42 font, related to type42/t42parse.c
and type1/t1load.c (CVE-2014-9664).

The tt_sbit_decoder_init function in sfnt/ttsbit.c in FreeType before
2.5.4 proceeds with a count-to-size association without restricting
the count value, which allows remote attackers to cause a denial of
service (integer overflow and out-of-bounds read) or possibly have
unspecified other impact via a crafted embedded bitmap (CVE-2014-9666).

sfnt/ttload.c in FreeType before 2.5.4 proceeds with offset+length
calculations without restricting the values, which allows remote
attackers to cause a denial of service (integer overflow and
out-of-bounds read) or possibly have unspecified other impact via a
crafted SFNT table (CVE-2014-9667).

Multiple integer overflows in sfnt/ttcmap.c in FreeType before 2.5.4
allow remote attackers to cause a denial of service (out-of-bounds
read or memory corruption) or possibly have unspecified other impact
via a crafted cmap SFNT table (CVE-2014-9669).

Multiple integer signedness errors in the pcf_get_encodings function
in pcf/pcfread.c in FreeType before 2.5.4 allow remote attackers to
cause a denial of service (integer overflow, NULL pointer dereference,
and application crash) via a crafted PCF file that specifies negative
values for the first column and first row (CVE-2014-9670).

Off-by-one error in the pcf_get_properties function in pcf/pcfread.c
in FreeType before 2.5.4 allows remote attackers to cause a denial of
service (NULL pointer dereference and application crash) via a crafted
PCF file with a 0xffffffff size value that is improperly incremented
(CVE-2014-9671).

Array index error in the parse_fond function in base/ftmac.c in
FreeType before 2.5.4 allows remote attackers to cause a denial
of service (out-of-bounds read) or obtain sensitive information
from process memory via a crafted FOND resource in a Mac font file
(CVE-2014-9672).

Integer signedness error in the Mac_Read_POST_Resource function in
base/ftobjs.c in FreeType before 2.5.4 allows remote attackers to
cause a denial of service (heap-based buffer overflow) or possibly
have unspecified other impact via a crafted Mac font (CVE-2014-9673).

The Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before
2.5.4 proceeds with adding to length values without validating the
original values, which allows remote attackers to cause a denial of
service (integer overflow and heap-based buffer overflow) or possibly
have unspecified other impact via a crafted Mac font (CVE-2014-9674).

bdf/bdflib.c in FreeType before 2.5.4 identifies property names by
only verifying that an initial substring is present, which allows
remote attackers to discover heap pointer values and bypass the ASLR
protection mechanism via a crafted BDF font (CVE-2014-9675).

Updated libpng package fixes security vulnerabilities:

The png_push_read_chunk function in pngpread.c in the progressive
decoder in libpng 1.6.x through 1.6.9 allows remote attackers to cause
a denial of service (infinite loop and CPU consumption) via an IDAT
chunk with a length of zero (CVE-2014-0333).

libpng versions 1.6.9 through 1.6.15 have an integer-overflow
vulnerability in png_combine_row() when decoding very wide interlaced
images, which can allow an attacker to overwrite an arbitrary amount
of memory with arbitrary (attacker-controlled) data (CVE-2014-9495).

This update provides MariaDB 5.5.42, which fixes several security
issues and other bugs. Please refer to the Oracle Critical Patch Update
Advisories and the Release Notes for MariaDB for further information
regarding the security vulnerabilities.

Additionally the jemalloc packages is being provided as it was
previousely provided with the mariadb source code, built and used
but removed from the mariadb source code since 5.5.40.

Multiple vulnerabilities has been discovered and corrected in samba4:

Samba 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before
4.2rc4, when an Active Directory Domain Controller (AD DC)
is configured, allows remote authenticated users to set the LDB
userAccountControl UF_SERVER_TRUST_ACCOUNT bit, and consequently gain
privileges, by leveraging delegation of authority for user-account
or computer-account creation (CVE-2014-8143).

An uninitialized pointer use flaw was found in the Samba daemon
(smbd). A malicious Samba client could send specially crafted netlogon
packets that, when processed by smbd, could potentially lead to
arbitrary code execution with the privileges of the user running smbd
(by default, the root user) (CVE-2015-0240).

The updated packages provides a solution for these security issues.

Updated tomcat package fixes security vulnerabilities:

It was discovered that the Apache Commons FileUpload package for Java
could enter an infinite loop while processing a multipart request with
a crafted Content-Type, resulting in a denial-of-service condition
(CVE-2014-0050).

Apache Tomcat 7.x before 7.0.50 processes chunked transfer coding
without properly handling (1) a large total amount of chunked data or
(2) whitespace characters in an HTTP header value within a trailer
field, which allows remote attackers to cause a denial of service by
streaming data (CVE-2013-4322).

Apache Tomcat 7.x before 7.0.50 allows attackers to obtain Tomcat
internals information by leveraging the presence of an untrusted web
application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML
document containing an external entity declaration in conjunction
with an entity reference, related to an XML External Entity (XXE)
issue (CVE-2013-4590).

Integer overflow in the parseChunkHeader function in
java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in
Apache Tomcat before 6.0.40 and 7.x before 7.0.53 allows remote
attackers to cause a denial of service (resource consumption) via a
malformed chunk size in chunked transfer coding of a request during
the streaming of data (CVE-2014-0075).

java/org/apache/catalina/servlets/DefaultServlet.java in the default
servlet in Apache Tomcat before 6.0.40 and 7.x before 7.0.53 does not
properly restrict XSLT stylesheets, which allows remote attackers
to bypass security-manager restrictions and read arbitrary files
via a crafted web application that provides an XML external entity
declaration in conjunction with an entity reference, related to an
XML External Entity (XXE) issue (CVE-2014-0096).

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in
Apache Tomcat before 6.0.40 and 7.x before 7.0.53, when operated
behind a reverse proxy, allows remote attackers to conduct HTTP
request smuggling attacks via a crafted Content-Length HTTP header
(CVE-2014-0099).

Apache Tomcat before 6.0.40 and 7.x before 7.0.54 does not properly
constrain the class loader that accesses the XML parser used with
an XSLT stylesheet, which allows remote attackers to read arbitrary
files via a crafted web application that provides an XML external
entity declaration in conjunction with an entity reference, related
to an XML External Entity (XXE) issue, or read files associated with
different web applications on a single Tomcat instance via a crafted
web application (CVE-2014-0119).

In Apache Tomcat 7.x before 7.0.55, it was possible to craft a
malformed chunk as part of a chunked request that caused Tomcat to
read part of the request body as a new request (CVE-2014-0227).

Updated subversion packages fix security vulnerabilities:

The mod_dav_svn module in Apache Subversion before 1.8.8, when
SVNListParentPath is enabled, allows remote attackers to cause a
denial of service (crash) via an OPTIONS request (CVE-2014-0032).

Ben Reser discovered that Subversion did not correctly validate SSL
certificates containing wildcards. A remote attacker could exploit this
to perform a man in the middle attack to view sensitive information
or alter encrypted communications (CVE-2014-3522).

Bert Huijben discovered that Subversion did not properly handle
cached credentials. A malicious server could possibly use this issue
to obtain credentials cached for a different server (CVE-2014-3528).

A NULL pointer dereference flaw was found in the way mod_dav_svn
handled REPORT requests. A remote, unauthenticated attacker could
use a crafted REPORT request to crash mod_dav_svn (CVE-2014-3580).

A NULL pointer dereference flaw was found in the way mod_dav_svn
handled URIs for virtual transaction names. A remote, unauthenticated
attacker could send a request for a virtual transaction name that
does not exist, causing mod_dav_svn to crash (CVE-2014-8108).

Updated libssh packages fix security vulnerabilities:

When using libssh before 0.6.3, a libssh-based server, when accepting
a new connection, forks and the child process handles the request. The
RAND_bytes() function of openssl doesn’t reset its state after the
fork, but simply adds the current process id (getpid) to the PRNG
state, which is not guaranteed to be unique. The most important
consequence is that servers using EC (ECDSA) or DSA certificates may
under certain conditions leak their private key (CVE-2014-0017).

Double free vulnerability in the ssh_packet_kexinit function in kex.c
in libssh 0.5.x and 0.6.x before 0.6.4 allows remote attackers to
cause a denial of service via a crafted kexinit packet (CVE-2014-8132).

Updated egroupware packages fix security vulnerabilities:

eGroupware prior to 1.8.006.20140217 is vulnerable to remote file
deletion and possible remote code execution due to user input being
passed to PHP’s unserialize() method (CVE-2014-2027).

eGroupWare before 1.8.007 allows logged in users with administrative
priviledges to remotely execute arbitrary commands on the server.
It is also vulnerable to a cross site request forgery vulnerability
that allows creating new administrative users.