Scientific Linux Security Update : boost on SL5.x i386/x86_64 (20120221)

The boost packages provide free, peer-reviewed, portable C++ source libraries with emphasis on libraries which work well with the C++ Standard Library. Invalid pointer dereference flaws were found in the way the Boost regular expression library processed certain, invalid expressions. An attacker...

Scientific Linux Security Update : ecryptfs-utils on SL5.x i386/x86_64

These updated ecryptfs-utils packages have been upgraded to upstream version 75, which provides a number of bug fixes and enhancements over the previous version. In addition, these packages provide a graphical program to help configure and use eCryptfs. To start this program, run the command :...

Scientific Linux Security Update : yum on SL5.x i386/x86_64

This updated yum package fixes the following bugs : - The kernel module plugin has been updated to deal with the situation where both a package that has a kernel module such as openafs is being updated at the same time that a kernel is being updated, while an old kernel is being removed. - string...

Scientific Linux Security Update : nfs-utils on SL5.x i386/x86_64 (20120221)

The nfs-utils package provides a daemon for the kernel Network File System NFS server, and related tools such as the mount.nfs, umount.nfs, and showmount programs. It was found that the mount.nfs tool did not handle certain errors correctly when updating the mtab mounted file systems table file. ...

Scientific Linux Security Update : kernel on SL4.x i386/x86_64

These updated kernel packages fix the following security issue : A buffer overflow flaw was found in the CIFS virtual file system. A remote authenticated user could issue a request that could lead to a denial of service. CVE-2007-5904, Moderate As well, these updated packages fix the following bu...

Scientific Linux Security Update : pam_krb5 on SL5.x i386/x86_64

A flaw was found in pamkrb5. In some non-default configurations specifically, those where pamkrb5 would be the first module to prompt for a password, the text of the password prompt varied based on whether or not the username provided was a username known to the system. A remote attacker could us...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64 (20120209)

The kernel packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issues : - Using the SGIO ioctl to issue SCSI requests to partitions or LVM volumes resulted in the requests being passed to the underlying block device. If a privileged...

Scientific Linux Security Update : kernel on SL3.x i386/x86_64

There were no new features introduced by this update. The only changes that have been included address critical customer needs or security issues elaborated below. Key areas affected by fixes in this update include the networking subsystem, dcache handling, the ext2 and ext3 file systems, the USB...

Scientific Linux Security Update : kernel on SL4.x i386/x86_64

CVE-2005-4881 kernel: netlink: fix numerous padding memleaks CVE-2009-3228 kernel: tc: uninitialised kernel memory leak This update fixes the following security issues : - multiple, missing initialization flaws were found in the Linux kernel. Padding data in several core network structures was no...

CVE-2012-2665

Multiple heap-based buffer overflows in the XML manifest encryption tag parsing functionality in OpenOffice.org and LibreOffice before 3.5.5 allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted Open Document Text .odt file with 1 a child tag within...

Scientific Linux Security Update : rhn-client-tools on SL5.x i386/x86_64

It was discovered that rhn-client-tools set insecure permissions on the loginAuth.pkl file, used to store session credentials for authenticating connections to servers. A local, unprivileged user could use these credentials to download packages they wouldn't normally have permission to download...

Scientific Linux Security Update : bind on SL5.x i386/x86_64

It was discovered that the bind packages created the 'rndc.key' file with insecure file permissions. This allowed any local user to read the content of this file. A local user could use this flaw to control some aspects of the named daemon by using the rndc utility, for example, stopping the name...

Scientific Linux Security Update : glibc on SL6.x i386/x86_64 (20120124)

The glibc packages contain the standard C libraries used by multiple programs on the system. These packages contain the standard C and the standard math libraries. Without these two libraries, a Linux system cannot function properly. An integer overflow flaw, leading to a heap-based buffer...

Scientific Linux Security Update : vsftpd on SL4.x i386/x86_64

The version of vsftpd as shipped in Red Hat Enterprise Linux 4 when used in combination with Pluggable Authentication Modules PAM had a memory leak on an invalid authentication attempt. Since vsftpd prior to version 2.0.5 allows any number of invalid attempts on the same connection this memory le...

Scientific Linux Security Update : openafs on SL4.x i386/x86_64

Updated openafs that fixes several bugs. This is the same openafs that is in Scientific Linux 4.5. Please remember that openafs is not autoyumed by default. You will have to manually do a 'yum update' to get the openafs update. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64

This update fixes the following security issues : - A NULL pointer dereference flaw was found in the iosubmitone function in the Linux kernel asynchronous I/O implementation. A local, unprivileged user could use this flaw to cause a denial of service. CVE-2010-3066, Moderate - A flaw was found in...

Scientific Linux Security Update : kvm on SL5.x x86_64

A data structure field in kvmvcpuioctlx86getvcpuevents in QEMU-KVM was not initialized properly before being copied to user-space. A privileged host user with access to '/dev/kvm' could use this flaw to leak kernel stack memory to user-space. CVE-2010-4525 These updated packages also fix several...

Scientific Linux Security Update : mailman on SL4.x i386/x86_64

A flaw was found in Mailman. A remote attacker could spoof messages in the error log, and possibly trick the administrator into visiting malicious URLs via a carriage return/line feed sequence in the URI. CVE-2006-4624 As well, these updated packages fix the following bugs : - canceling a...

Scientific Linux Security Update : gcc on SL5.x i386/x86_64

Two directory traversal flaws were found in the way fastjar extracted JAR archive files. If a local, unsuspecting user extracted a specially crafted JAR file, it could cause fastjar to overwrite arbitrary files writable by the user running fastjar. CVE-2010-0831, CVE-2010-2322 This update also...

CVE-2012-3443

The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a denial of service memory consumption by uploading an image file...