-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                       MDVSA-2015:161-1
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : icu
 Date    : April 2, 2015
 Affected: Business Server 1.0
 _______________________________________________________________________

 Problem Description:

 Updated icu packages fix security vulnerabilities:
 
 The Regular Expressions package in International Components for Unicode
 (ICU) 52 before SVN revision 292944 allows remote attackers to cause
 a denial of service (memory corruption) or possibly have unspecified
 other impact via vectors related to a zero-length quantifier or
 look-behind expression (CVE-2014-7923, CVE-2014-7926).
 
 The collator implementation in i18n/ucol.cpp in International
 Components for Unicode (ICU) 52 through SVN revision 293126 does not
 initialize memory

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2015:191
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : owncloud
 Date    : April 1, 2015
 Affected: Business Server 2.0
 _______________________________________________________________________

 Problem Description:

 Multiple vulnerabilities has been discovered and corrected in owncloud:
 
 * Multiple stored XSS in contacts application (oC-SA-2015-001)
 
 * Multiple stored XSS in documents application (oC-SA-2015-002)
 
 * Bypass of file blacklist (oC-SA-2015-004)
 
 The updated packages have been upgraded to the 7.0.5 version where
 these security flaws has been fixed.
 _______________________________________________________________________

 References:

 https://owncloud.org/changelog/
 https://owncloud.org/security/advisory/?id=oc-sa-2015

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2015:190
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : owncloud
 Date    : April 1, 2015
 Affected: Business Server 1.0
 _______________________________________________________________________

 Problem Description:

 Multiple vulnerabilities has been discovered and corrected in owncloud:
 
 * Login bypass when using user_ldap due to unauthenticated binds
 (oC-SA-2014-020)
 
 * Login bypass when using the external FTP user backend
 (oC-SA-2014-022)
 
 * CSRF in bookmarks application (oC-SA-2014-027)
 
 * Stored XSS in bookmarks application (oC-SA-2014-028)
 
 * Multiple stored XSS in contacts application (oC-SA-2015-001)
 
 * Multiple stored XSS in documents application (oC-SA-2015-002)
 
 * Bypass of file blacklist (oC-SA-2015-004)
 
 The upd

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Advisory                                   MDVA-2015:004
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : openldap
 Date    : April 1, 2015
 Affected: Business Server 2.0
 _______________________________________________________________________

 Problem Description:

 The slapd service is stopped during the package upgrade to perform
 upgrade on the OpenLDAP DB. The service wasn't restarted after the
 upgrade if the service was running before. This update fixes this
 issue.
 _______________________________________________________________________

 Updated Packages:

 Mandriva Business Server 2/X86_64:
 d873f95de0118fc37153a0567ea2b7c6  mbs2/x86_64/lib64ldap2.4_2-2.4.40-1.1.mbs2.x86_64.rpm
 2a1d58a3edd8c0607feca91ce3cf842a  mbs2/x86_64/lib64ldap2.4_2-devel-2.4.40-1.1.mbs2.x86_64.rpm
 6cb9f

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2015:189
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : tor
 Date    : April 1, 2015
 Affected: Business Server 1.0
 _______________________________________________________________________

 Problem Description:

 Updated tor packages fix security vulnerabilities:
 
 The tor package has been updated to version 0.2.4.26, which fixes
 possible crashes that may be remotely trigger-able, which would
 result in a denial of service, and also fixes a few other bugs.
 See the release announcement for details.
 _______________________________________________________________________

 References:

 http://advisories.mageia.org/MGASA-2015-0124.html
 _______________________________________________________________________

 Updated Packages:

 Mandriva Busi

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2015:188
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : flac
 Date    : April 1, 2015
 Affected: Business Server 2.0
 _______________________________________________________________________

 Problem Description:

 Multiple vulnerabilities has been discovered and corrected in flac:
 
 Heap-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1
 allows remote attackers to execute arbitrary code via a crafted .flac
 file (CVE-2014-9028).
 
 Stack-based buffer overflow in stream_decoder.c in libFLAC before
 1.3.1 allows remote attackers to execute arbitrary code via a crafted
 .flac file (CVE-2014-8962).
 
 The updated packages provides a solution for these security issues.
 ______________________________________________________________

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2015:187
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : graphviz
 Date    : April 1, 2015
 Affected: Business Server 2.0
 _______________________________________________________________________

 Problem Description:

 Updated graphviz packages fix security vulnerability:
 
 Format string vulnerability in the yyerror function in
 lib/cgraph/scan.l in Graphviz allows remote attackers to have
 unspecified impact via format string specifiers in unknown vector,
 which are not properly handled in an error string (CVE-2014-9157).
 
 Additionally the gtkglarea2 and gtkglext packages were missing and
 was required for graphviz to build, these packages are also being
 provided with this advisory.
 ________________________________________________________

A regression was found with the MDVSA-2015:093 advisory that made
the apache server fail to start due to faulty linking. This problem
has now been fixed.

Updated dokuwiki packages fix security vulnerabilities:

inc/template.php in DokuWiki before 2014-05-05a only checks for
access to the root namespace, which allows remote attackers to access
arbitrary images via a media file details ajax call (CVE-2014-8761).

The ajax_mediadiff function in DokuWiki before 2014-05-05a allows
remote attackers to access arbitrary images via a crafted namespace
in the ns parameter (CVE-2014-8762).

DokuWiki before 2014-05-05b, when using Active Directory for LDAP
authentication, allows remote attackers to bypass authentication via
a password starting with a null () character and a valid user name,
which triggers an unauthenticated bind (CVE-2014-8763).

DokuWiki 2014-05-05a and earlier, when using Active Directory for
LDAP authentication, allows remote attackers to bypass authentication
via a user name and password starting with a null () character,
which triggers an anonymous bind (CVE-2014-8764).

dokuwiki-2014-09-29a allows swf (application/x-shockwave-flash)
uploads by default. This may be used for Cross-site scripting (XSS)
attack which enables attackers to inject client-side script into Web
pages viewed by other users. (CVE-2014-9253).

The dokuwiki-2014-09-29b hotfix source disables swf uploads by default
and fixes the CVE-2014-9253 issue.

DokuWiki before 20140929c has a security issue in the ACL plugins
remote API component. The plugin failed to check for superuser
permissions before executing ACL addition or deletion. This means
everybody with permissions to call the XMLRPC API also had permissions
to set up their own ACL rules and thus circumventing any existing rules
(CVE-2015-2172).

DokuWiki before 20140929d is vulnerable to a cross-site scripting
(XSS) issue in the user manager. The user’s details were not properly
escaped in the user manager’s edit form. This allows a registered user
to edit her own name (using the change profile option) to include
malicious JavaScript code. The code is executed when a super user
tries to edit the user via the user manager.

A vulnerability has been discovered and corrected in phpmyadmin:

libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9,
4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid
language values in unknown-language error responses that contain
a CSRF token and may be sent with HTTP compression, which makes it
easier for remote attackers to conduct a BREACH attack and determine
this token via a series of crafted requests (CVE-2015-2206).

This upgrade provides the latest phpmyadmin version (4.2.13.2) to
address this vulnerability.

Additionally, the phpseclib package has been upgraded to the 0.3.10
version.