Updated rsyslog packages fix security vulnerability:

Rainer Gerhards, the rsyslog project leader, reported a vulnerability
in Rsyslog. As a consequence of this vulnerability an attacker can send
malformed messages to a server, if this one accepts data from untrusted
sources, and trigger a denial of service attack (CVE-2014-3634).

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2014:201
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : kernel
 Date    : October 21, 2014
 Affected: Business Server 1.0
 _______________________________________________________________________

 Problem Description:

 Multiple vulnerabilities has been found and corrected in the Linux
 kernel:
 
 The try_to_unmap_cluster function in mm/rmap.c in the Linux kernel
 before 3.14.3 does not properly consider which pages must be locked,
 which allows local users to cause a denial of service (system crash) by
 triggering a memory-usage pattern that requires removal of page-table
 mappings (CVE-2014-3122).
 
 Multiple stack-based buffer overflows in the magicmouse_raw_event
 function in drivers/hid/hid-magicmouse.c in the Magic Mouse HID driver
 in th

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2014:200
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : bugzilla
 Date    : October 21, 2014
 Affected: Business Server 1.0
 _______________________________________________________________________

 Problem Description:

 Updated bugzilla packages fix security vulnerabilities:
 
 If a new comment was marked private to the insider group, and a flag
 was set in the same transaction, the comment would be visible to flag
 recipients even if they were not in the insider group (CVE-2014-1571).
 
 An attacker creating a new Bugzilla account can override certain
 parameters when finalizing the account creation that can lead to the
 user being created with a different email address than originally
 requested. The overridden login name could be automatic

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2014:199
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : perl
 Date    : October 21, 2014
 Affected: Business Server 1.0
 _______________________________________________________________________

 Problem Description:

 Updated perl and perl-Data-Dumper packages fixes security
 vulnerability:
 
 The Dumper method in Data::Dumper before 2.154, allows
 context-dependent attackers to cause a denial of service (stack
 consumption and crash) via an Array-Reference with many nested
 Array-References, which triggers a large number of recursive calls
 to the DD_dump function (CVE-2014-4330).
 
 The Data::Dumper module bundled with perl and the perl-Data-Dumper
 packages has been updated to fix this issue.
 ________________________________________________

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2014:198
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : mediawiki
 Date    : October 21, 2014
 Affected: Business Server 1.0
 _______________________________________________________________________

 Problem Description:

 Updated mediawiki packages fix security vulnerability:
 
 MediaWiki before 1.23.4 is vulnerable to cross-site scripting due to
 JavaScript injection via CSS in uploaded SVG files (CVE-2014-7199).
 
 MediaWiki before 1.23.5 is vulnerable to cross-site scripting due to
 JavaScript injection via user-specificed CSS in certain special pages
 (CVE-2014-7295).
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7199
 http://cve.mitre.org/cgi

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2014:197
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : python
 Date    : October 21, 2014
 Affected: Business Server 1.0
 _______________________________________________________________________

 Problem Description:

 Updated python packages fix security vulnerability:
 
 Python before 2.7.8 is vulnerable to an integer overflow in the buffer
 type (CVE-2014-7185).
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7185
 http://advisories.mageia.org/MGASA-2014-0399.html
 _______________________________________________________________________

 Updated Packages:

 Mandriva Business Server 1/X86_64:
 dcefcf76c1a242a7f6f1b6db782df456  mbs1/x86_64/lib64pyt

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2014:196
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : rsyslog
 Date    : October 21, 2014
 Affected: Business Server 1.0
 _______________________________________________________________________

 Problem Description:

 Updated rsyslog packages fix security vulnerability:
 
 Rainer Gerhards, the rsyslog project leader, reported a vulnerability
 in Rsyslog. As a consequence of this vulnerability an attacker can send
 malformed messages to a server, if this one accepts data from untrusted
 sources, and trigger a denial of service attack (CVE-2014-3634).
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3634
 http://cve.mitre.org/cgi-bin/cvename.cgi?name

Updated wireshark packages fix security vulnerabilities:

RTP dissector crash (CVE-2014-6421, CVE-2014-6422).

MEGACO dissector infinite loop (CVE-2014-6423).

Netflow dissector crash (CVE-2014-6424).

RTSP dissector crash (CVE-2014-6427).

SES dissector crash (CVE-2014-6428).

Sniffer file parser crash (CVE-2014-6429, CVE-2014-6430, CVE-2014-6431,
CVE-2014-6432).

A vulnerability has been discovered and corrected in Mozilla NSS:

Antoine Delignat-Lavaud, security researcher at Inria Paris in
team Prosecco, reported an issue in Network Security Services (NSS)
libraries affecting all versions. He discovered that NSS is vulnerable
to a variant of a signature forgery attack previously published
by Daniel Bleichenbacher. This is due to lenient parsing of ASN.1
values involved in a signature and could lead to the forging of RSA
certificates (CVE-2014-1568).

The updated NSPR packages have been upgraded to the latest 4.10.7
version.

The updated NSS packages have been upgraded to the latest 3.17.1
version which is not vulnerable to this issue.

Additionally the rootcerts package has also been updated to the latest
version as of 2014-08-05.

This is a maintenance and bugfix release that upgrades php to the
latest 5.5.17 version which resolves various upstream bugs in php.

Additionally, the php-timezonedb packages has been upgraded to the
latest 2014.7 version, the php-suhosin packages has been upgraded to
the latest 0.9.36 version which has better support for php-5.5 and
the PECL packages which requires so has been rebuilt for php-5.5.17.