Scientific Linux Security Update : spice-xpi on SL5.x i386/x86_64

The spice-xpi package provides a plug-in that allows the SPICE client to run from within Mozilla Firefox. A race condition was found in the way the SPICE Firefox plug-in and the SPICE client communicated. A local attacker could use this flaw to trick the plug-in and the SPICE client into...

Scientific Linux Security Update : firefox on SL4.x, SL5.x i386/x86_64

A flaw was found in the way Firefox handles form history. A malicious web page could steal saved form data by synthesizing input events, causing the browser to auto-fill form fields which could then be read by an attacker. CVE-2009-3370 A flaw was found in the way Firefox creates temporary file...

Scientific Linux Security Update : seamonkey on SL3.x, SL4.x i386/x86_64

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey. CVE-2009-1303, CVE-2009-1305 Several flaws were found in the way malformed web content...

Scientific Linux Security Update : perl on SL5.x i386/x86_64

Perl is a high-level programming language commonly used for system administration utilities and web programming. The Safe extension module allows users to compile and execute Perl code in restricted compartments. The File::Path module allows users to create and remove directory trees. The Safe...

Scientific Linux Security Update : firefox on SL4.x, SL5.x i386/x86_64

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox. CVE-2009-0352, CVE-2009-0353, CVE-2009-0356 Several flaws were found in the way malformed...

Scientific Linux Security Update : openoffice.org2 on SL4.x i386/x86_64

A flaw was found in the way OpenOffice.org enforced a macro security setting for macros, written in the Python scripting language, that were embedded in OpenOffice.org documents. If a user were tricked into opening a specially crafted OpenOffice.org document and previewed the macro directory...

Scientific Linux Security Update : krb5 on SL3.x, SL4.x, SL5.x i386/x86_64

CVE-2009-4212 krb: KDC integer overflows in AES and RC4 decryption routines MITKRB5-SA-2009-004 Multiple integer underflow flaws, leading to heap-based corruption, were found in the way the MIT Kerberos Key Distribution Center KDC decrypted ciphertexts encrypted with the Advanced Encryption...

Scientific Linux Security Update : tomcat5 on SL5.x i386/x86_64

A flaw was found in the way Tomcat handled the Transfer-Encoding header in HTTP requests. A specially crafted HTTP request could prevent Tomcat from sending replies, or cause Tomcat to return truncated replies, or replies containing data related to the requests of other users, for all subsequent...

Scientific Linux Security Update : perl on SL4.x, SL5.x i386/x86_64

Perl is a high-level programming language commonly used for system administration utilities and web programming. It was found that the 'new' constructor of the Digest module used its argument as part of the string expression passed to the eval function. An attacker could possibly use this flaw to...

Scientific Linux Security Update : gnutls on SL4.x, SL5.x i386/x86_64

CVE-2009-3555 TLS: MITM attacks via session renegotiation CVE-2010-0731 gnutls: gnutlsx509crtgetserial incorrect serial decoding from ASN1 BE64 GNUTLS-SA-2010-1 A flaw was found in the way the TLS/SSL Transport Layer Security/Secure Sockets Layer protocols handled session renegotiation. A...

Scientific Linux Security Update : java-1.6.0-openjdk on SL5.x i386/x86_64

A flaw was found in the Swing library. Forged TimerEvents could be used to bypass SecurityManager checks, allowing access to otherwise blocked files and directories. CVE-2010-4465 A flaw was found in the HotSpot component in OpenJDK. Certain bytecode instructions confused the memory management...

Scientific Linux Security Update : curl on SL5.x i386/x86_64

Scott Cantor reported that cURL is affected by the previously published 'null prefix attack', caused by incorrect handling of NULL characters in X.509 certificates. If an attacker is able to get a carefully-crafted certificate signed by a trusted Certificate Authority, the attacker could use the...

Scientific Linux Security Update : thunderbird on SL4.x, SL5.x i386/x86_64

Several flaws were found in the processing of malformed HTML mail content. An HTML mail message containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. CVE-2010-3169 A buffer overflow flaw was found...

Scientific Linux Security Update : icedtea-web on SL6.x i386/x86_64

The IcedTea-Web project provides a Java web browser plug-in and an implementation of Java Web Start, which is based on the Netx project. It also contains a configuration tool for managing deployment settings for the plug-in and Web Start implementations. A flaw was found in the same-origin policy...

Scientific Linux Security Update : seamonkey on SL4.x i386/x86_64

SeaMonkey is an open source web browser, email and newsgroup client, IRC chat client, and HTML editor. A flaw was found in the way SeaMonkey handled malformed JPEG images. A website containing a malicious JPEG image could cause SeaMonkey to crash or, potentially, execute arbitrary code with the...

Scientific Linux Security Update : tomcat5 on SL5.x i386/x86_64

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. It was found that web applications could modify the location of the Tomcat host's work directory. As web applications deployed on Tomcat have read and write access to this directory, a malicious web...

Scientific Linux Security Update : openssl on SL3.x, SL4.x i386/x86_64

A flaw was found in the way the TLS/SSL Transport Layer Security/Secure Sockets Layer protocols handled session renegotiation. A man-in-the-middle attacker could use this flaw to prefix arbitrary plain text to a client's session for example, an HTTPS connection to a website. This could force the...

Scientific Linux Security Update : thunderbird on SL5.x, SL6.x i386/x86_64 (20120606)

Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed content. Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. CVE-2011-3101,...

Scientific Linux Security Update : libvorbis on SL3.x, SL4.x, SL5.x i386/x86_64

CVE-2009-2663 libvorbis: Improper codec headers processing DoS, ACE An insufficient input validation flaw was found in the way libvorbis processes the codec file headers static mode headers and encoding books of the Ogg Vorbis audio file format Ogg. A remote attacker could provide a specially...

CentOS Update for finch CESA-2012:1102 centos5

Check for the Version of finch OpenVAS Vulnerability Test CentOS Update for finch CESA-2012:1102 centos5 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...