Scientific Linux Security Update : lftp on SL5.x i386/x86_64

CVE-2007-2348 lftp mirror --script does not escape names and targets of symbolic links It was discovered that lftp did not properly escape shell metacharacters when generating shell scripts using the 'mirror --script' command. A mirroring script generated to download files from a malicious FTP...

Scientific Linux Security Update : postgresql on SL3.x, SL4.x, SL5.x i386/x86_64

CVE-2009-0922 postgresql: potential DoS due to conversion functions CVE-2009-3230 postgresql: SQL privilege escalation, incomplete fix for CVE-2007-6600 It was discovered that the upstream patch for CVE-2007-6600 included in the Scientific Linux did not include protection against misuse of the...

Scientific Linux Security Update : iscsi-initiator-utils on SL5.x i386/x86_64

Olaf Kirch discovered two flaws in open-iscsi. A local attacker could use these flaws to cause the server daemon to stop responding, leading to a denial of service. CVE-2007-3099, CVE-2007-3100. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

Scientific Linux Security Update : spamassassin on SL5.x, SL4.x i386/x86_64 (fwd)

Martin Krafft discovered a symlink issue in SpamAssassin that affects certain non-default configurations. A local user could use this flaw to create or overwrite files writable by the spamd process CVE-2007-2873. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C...

Scientific Linux Security Update : perl-Net-DNS on SL3.0.x, SL4.x, SL5.x i386/x86_64

A flaw was found in the way Net::DNS generated the ID field in a DNS query. This predictable ID field could be used by a remote attacker to return invalid DNS data. CVE-2007-3377 A denial of service flaw was found in the way Net::DNS parsed certain DNS requests. A malformed response to a DNS...

Scientific Linux Security Update : elinks on SL5.x, SL4.x i386/x86_64

Details : An information disclosure flaw was found in the way ELinks passes https POST data to a proxy server. POST data sent via a proxy to an https site is not properly encrypted by ELinks, possibly allowing the disclosure of sensitive information. CVE-2007-5034 %NASLMINLEVEL 70300 C Tenable...

Scientific Linux Security Update : httpd on SL4.x, SL3.x i386/x86_64

The Apache HTTP Server did not verify that a process was an Apache child process before sending it signals. A local attacker with the ability to run scripts on the Apache HTTP Server could manipulate the scoreboard and cause arbitrary processes to be terminated which could lead to a denial of...

Scientific Linux Security Update : vixie-cron on SL5.x, SL4.x, SL3.x i386/x86_64

Raphael Marichez discovered a denial of service bug in the way vixie-cron verifies crontab file integrity. A local user with the ability to create a hardlink to /etc/crontab can prevent vixie-cron from executing certain system cron jobs. CVE-2007-1856 %NASLMINLEVEL 70300 C Tenable Network Securit...

Scientific Linux Security Update : util-linux on SL5.x, SL4.x, SL3.x i386/x86_64

A flaw was discovered in the way that the mount and umount utilities used the setuid and setgid functions, which could lead to privileges being dropped improperly. A local user could use this flaw to run mount helper applications such as, mount.nfs, with additional privileges CVE-2007-5191...

Scientific Linux Security Update : ImageMagick on SL3.x, SL4.x, SL5.x i386/x86_64

Several heap-based buffer overflow flaws were found in ImageMagick. If a victim opened a specially crafted DCM or XWD file, an attacker could potentially execute arbitrary code on the victim's machine. CVE-2007-1797 Several denial of service flaws were found in ImageMagick's parsing of XCF and DC...

Scientific Linux Security Update : mutt on SL5.x, SL4.x, SL3.x i386/x86_64

A flaw was found in the way Mutt used temporary files on NFS file systems. Due to an implementation issue in the NFS protocol, Mutt was not able to exclusively open a new file. A local attacker could conduct a time-dependent attack and possibly gain access to e-mail attachments opened by a victim...

Scientific Linux Security Update : postgresql on on SL3.0.x i386/x86_64

A flaw was found in the way PostgreSQL allows authenticated users to execute security-definer functions. It was possible for an unprivileged user to execute arbitrary code with the privileges of the security-definer function. CVE-2007-2138 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Scientific Linux Security Update : xscreensaver on SL3.0.x i386/x86_64

Alex Yamauchi discovered a flaw in the way XScreenSaver verifies user passwords. When a system is using a remote directory service for login credentials, a local attacker may be able to cause a network outage causing XScreenSaver to crash, unlocking the screen. CVE-2007-1859 %NASLMINLEVEL 70300 C...

Scientific Linux Security Update : openldap on SL4.x i386/x86_64

A flaw was found in the way OpenLDAP's slapd daemon handled malformed objectClasses LDAP attributes. An authenticated local or remote attacker could create an LDAP request which could cause a denial of service by crashing slapd. CVE-2007-5707 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. T...

Scientific Linux Security Update : perl-Archive-Tar on SL4.x, SL5.x i386/x86_64

Multiple directory traversal flaws were discovered in the Archive::Tar module. A specially crafted tar file could cause a Perl script, using the Archive::Tar module to extract the archive, to overwrite an arbitrary file writable by the user running the script. CVE-2007-4829 This package upgrades...

Scientific Linux Security Update : tomcat on SL5.x i386/x86_64

Some JSPs within the 'examples' web application did not escape user provided data. If the JSP examples were accessible, this flaw could allow a remote attacker to perform cross-site scripting attacks CVE-2007-2449. Note: it is recommended the 'examples' web application not be installed on a...

Scientific Linux Security Update : cups on SL5.x, SL4.x, SL3.x i386/x86_64

Maurycy Prodeus discovered an integer overflow flaw in the way CUPS processes PDF files. An attacker could create a malicious PDF file that could potentially execute arbitrary code when printed. CVE-2007-3387 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C Scientifi...

Scientific Linux Security Update : pwlib on SL5.x i386/x86_64

In Scientific Linux 5, the Ekiga teleconferencing application uses PWLib. A memory management flaw was discovered in PWLib. An attacker could use this flaw to crash an application, such as Ekiga, which is linked with pwlib CVE-2007-4897. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Scientific Linux Security Update : seamonkey on SL4.x, SL3.x i386/x86_64

Several flaws were found in the way SeaMonkey processed certain malformed JavaScript code. A web page containing malicious JavaScript code could cause SeaMonkey to crash or potentially execute arbitrary code as the user running SeaMonkey. CVE-2007-3734, CVE-2007-3735, CVE-2007-3737, CVE-2007-3738...

Scientific Linux Security Update : krb5 on SL3.x i386/x86_64

David Coffey discovered an uninitialized pointer free flaw in the RPC library used by kadmind. A remote unauthenticated attacker who can access kadmind could trigger this flaw and cause kadmind to crash or potentially execute arbitrary code as root. CVE-2007-2442 David Coffey also discovered an...