Scientific Linux Security Update : seamonkey on SL3.x, SL4.x i386/x86_64

Several flaws were found in the way SeaMonkey processed certain malformed web content. A webpage containing malicious content could cause SeaMonkey to crash, or potentially execute arbitrary code as the user running SeaMonkey. CVE-2008-0412, CVE-2008-0413, CVE-2008-0415, CVE-2008-0419 Several fla...

Scientific Linux Security Update : lynx on SL3.x, SL4.x, SL5.x i386/x86_64

An arbitrary command execution flaw was found in the Lynx 'lynxcgi:' URI handler. An attacker could create a web page redirecting to a malicious URL that could execute arbitrary code as the user running Lynx in the non-default 'Advanced' user mode. CVE-2008-4690 Note: In these updated lynx...

Scientific Linux Security Update : ruby on SL4.x, SL5.x i386/x86_64

Vincent Danen reported, that Red Hat Security Advisory RHSA-2008:0897 did not properly address a denial of service flaw in the WEBrick Ruby HTTP server toolkit, known as CVE-2008-3656. This flaw allowed a remote attacker to send a specially crafted HTTP request to a WEBrick server that would caus...

Scientific Linux Security Update : freetype on SL3.x, SL4.x, SL5.x i386/x86_64

Tavis Ormandy of the Google Security Team discovered several integer overflow flaws in the FreeType 2 font engine. If a user loaded a carefully-crafted font file with an application linked against FreeType 2, it could cause the application to crash or, possibly, execute arbitrary code with the...

Scientific Linux Security Update : libtiff on SL3.x, SL4.x, SL5.x i386/x86_64

Multiple uses of uninitialized values were discovered in libtiff's Lempel-Ziv-Welch LZW compression algorithm decoder. An attacker could create a carefully crafted LZW-encoded TIFF file that would cause an application linked with libtiff to crash or, possibly, execute arbitrary code. CVE-2008-232...

Scientific Linux Security Update : postfix on SL4.x, SL5.x i386/x86_64

It was discovered that Postfix did not flush the received SMTP commands buffer after switching to TLS encryption for an SMTP session. A man-in-the-middle attacker could use this flaw to inject SMTP commands into a victim's session during the plain text phase. This would lead to those commands bei...

Scientific Linux Security Update : thunderbird on SL4.x, SL5.x i386/x86_64

Multiple flaws were found in the processing of malformed JavaScript content. An HTML mail containing such malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. CVE-2008-2801, CVE-2008-2802, CVE-2008-2803 Several flaws were foun...

Scientific Linux Security Update : XFree86 on SL3.x i386/x86_64

An input validation flaw was discovered in X.org's Security and Record extensions. A malicious authorized client could exploit this issue to cause a denial of service crash or, potentially, execute arbitrary code with root privileges on the X.Org server. CVE-2008-1377 Multiple integer overflow...

Scientific Linux Security Update : evolution on SL3.x, SL4.x i386/x86_64

A flaw was found in the way Evolution parsed iCalendar timezone attachment data. If mail which included a carefully crafted iCalendar attachment was opened, arbitrary code could be executed as the user running Evolution. CVE-2008-1108 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Scientific Linux Security Update : pam_krb5/krb5 on SL5.x i386/x86_64

pamkrb5 address the following security issue : A flaw was found in the pamkrb5 'existingticket' configuration option. If a system is configured to use an existing credential cache via the 'existingticket' option, it may be possible for a local user to gain elevated privileges by using a different...

Scientific Linux Security Update : python for SL 3.0.x on i386/x86_64

When the assert system call was disabled, an input sanitization flaw was revealed in the Python string object implementation that led to a buffer overflow. The missing check for negative size values meant the Python memory allocator could allocate less memory than expected. This could result in...

Scientific Linux Security Update : openoffice.org on SL3.x, SL4.x i386/x86_64

Sean Larsson found a heap overflow flaw in the OpenOffice memory allocator. If a carefully crafted file was opened by a victim, an attacker could use the flaw to crash OpenOffice.org or, possibly, execute arbitrary code. CVE-2008-2152 It was discovered that certain libraries in the Scientific Lin...

Scientific Linux Security Update : dbus on SL5.x i386/x86_64

A denial-of-service flaw was discovered in the system for sending messages between applications. A local user could send a message with a malformed signature to the bus causing the bus and, consequently, any process using libdbus to receive messages to abort. CVE-2008-3834 %NASLMINLEVEL 70300 C...

Scientific Linux Security Update : firefox on SL4.x, SL5.x i386/x86_64

A flaw was found in the processing of malformed JavaScript content. A web page containing such malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox. CVE-2008-1380 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive tex...

Scientific Linux Security Update : elinks on SL4.x, SL5.x i386/x86_64

CVE-2007-2027 elinks tries to load .po files from a non-absolute path CVE-2008-7224 elinks: entitycache static array buffer overflow off-by-one An off-by-one buffer overflow flaw was discovered in the way ELinks handled its internal cache of string representations for HTML special entities. A...

Scientific Linux Security Update : bind on SL 3.0.x , SL 4.x, SL 5.x

The DNS protocol protects against spoofing attacks by requiring an attacker to predict both the DNS transaction ID and UDP source port of a request. In recent years, a number of papers have found problems with DNS implementations which make it easier for an attacker to perform DNS cache-poisoning...

Scientific Linux Security Update : freetype on SL3.x, SL4.x, SL5.x i386/x86_64

Multiple flaws were discovered in FreeType's Printer Font Binary PFB and TrueType Font TTF font-file format parsers. If a user loaded a carefully crafted font-file with a program linked against FreeType, it could cause the application to crash, or possibly execute arbitrary code. CVE-2008-1806,...

Fedora Update for bacula FEDORA-2012-10929

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

CentOS Update for postfix CESA-2011:0422 centos5 x86_64

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

CentOS Update for postfix CESA-2011:0422 centos5 x86_64

Check for the Version of postfix OpenVAS Vulnerability Test CentOS Update for postfix CESA-2011:0422 centos5 x8664 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...