Scientific Linux Security Update : httpd on SL5.x i386/x86_64

A flaw was discovered in the way the modproxy module of the Apache HTTP Server handled the timeouts of requests forwarded by a reverse proxy to the back-end server. If the proxy was configured to reuse existing back-end connections, it could return a response intended for another user under certa...

Scientific Linux Security Update : php on SL5.x, SL6.x i386/x86_64 (20120507)

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. A flaw was found in the way the php-cgi executable processed command line arguments when running in CGI mode. A remote attacker could send a specially crafted request to a PHP script that would result in the que...

Scientific Linux Security Update : device-mapper-multipath on SL4.x, SL5.x i386/x86_64

It was discovered that the multipathd daemon set incorrect permissions on the socket used to communicate with command line clients. An unprivileged, local user could use this flaw to send commands to multipathd, resulting in access disruptions to storage devices accessible via multiple paths and,...

Scientific Linux Security Update : seamonkey on SL3.x, SL4.x i386/x86_64

A race condition flaw was found in the way SeaMonkey handled Document Object Model DOM element properties. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. CVE-2010-3765 After installi...

Scientific Linux Security Update : libsndfile on SL6.x i386/x86_64

The libsndfile packages provide a library for reading and writing sound files. An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way the libsndfile library processed certain Ensoniq PARIS Audio Format PAF audio files. An attacker could create a specially crafted...

Scientific Linux Security Update : kdelibs on SL6.x i386/x86_64

The kdelibs packages provide libraries for the K Desktop Environment KDE. An input sanitization flaw was found in the KSSL KDE SSL Wrapper API. An attacker could supply a specially crafted SSL certificate for example, via a web page to an application using KSSL, such as the Konqueror web browser,...

Scientific Linux Security Update : curl on SL3.x i386/x86_64

Wesley Miaw discovered that when deflate compression was used, libcurl could call the registered write callback function with data exceeding the documented limit. A malicious server could use this flaw to crash an application using libcurl or, potentially, execute arbitrary code. Note: This issue...

Scientific Linux Security Update : quagga on SL6.x i386/x86_64

A denial of service flaw was found in the way the Quagga bgpd daemon processed certain route metrics information. A BGP message with a specially crafted path limit attribute would cause the bgpd daemon to reset its session with the peer through which this message was received. CVE-2010-1675 A NUL...

Scientific Linux Security Update : bind on SL6.x i386/x86_64

"The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'deprecatednasllevel.inc'; include'compat.inc'; if...

Scientific Linux Security Update : postgresql84 on SL5.x i386/x86_64

A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Perl. If the PL/Perl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Perl script could use this flaw to bypass intended PL/Perl...

Scientific Linux Security Update : frysk on SL4.x i386/x86_64

frysk is an execution-analysis technology implemented using native Java and C++. It provides developers and system administrators with the ability to examine and analyze multi-host, multi-process, and multithreaded systems while they are running. frysk is released as a Technology Preview for...

Scientific Linux Security Update : libXfont on SL5.x, SL6.x i386/x86_64

The libXfont packages provide the X.Org libXfont runtime library. X.Org is an open source implementation of the X Window System. A buffer overflow flaw was found in the way the libXfont library, used by the X.Org server, handled malformed font files compressed using UNIX compress. A malicious,...

Scientific Linux Security Update : sendmail on SL4.x i386/x86_64

A flaw was found in the way sendmail handled NUL characters in the CommonName field of X.509 certificates. An attacker able to get a carefully-crafted certificate signed by a trusted Certificate Authority could trick sendmail into accepting it by mistake, allowing the attacker to perform a...

Scientific Linux Security Update : firefox on SL4.x, SL5.x i386/x86_64

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox. CVE-2009-1302, CVE-2009-1303, CVE-2009-1304, CVE-2009-1305 Several flaws were found in the...

Scientific Linux Security Update : pango on SL5.x i386/x86_64

Pango is a library used for the layout and rendering of internationalized text. A buffer overflow flaw was found in HarfBuzz, an OpenType text shaping engine used in Pango. If a user loaded a specially crafted font file with an application that uses Pango, it could cause the application to crash...

Scientific Linux Security Update : cups on SL5.x i386/x86_64 (20120221)

The Common UNIX Printing System CUPS provides a portable printing layer for Linux, UNIX, and similar operating systems. A heap-based buffer overflow flaw was found in the Lempel-Ziv-Welch LZW decompression algorithm implementation used by the CUPS GIF image format reader. An attacker could create...

Scientific Linux Security Update : java (jdk 1.6.0) on SL4.x, SL5.x i386/x86_64

This update fixes several vulnerabilities in the Sun Java 6 Software Development Kit. Further information about these flaws can be found on the 'Oracle Java SE and Java for Business Critical Patch Update Advisory' page. CVE-2010-4422, CVE-2010-4447, CVE-2010-4448, CVE-2010-4450, CVE-2010-4451,...

Scientific Linux Security Update : dhcp on SL6.x i386/x86_64

The Dynamic Host Configuration Protocol DHCP is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. A denial of service flaw was found in the way the dhcpd daemon handled DH...

Scientific Linux Security Update : expat on SL3.x, SL4.x, SL5.x i386/x86_64

CVE-2009-3720 expat: buffer over-read and crash on XML with malformed UTF-8 sequences CVE-2009-3560 expat: buffer over-read and crash in big2toUtf8 on XML with malformed UTF-8 sequences Two buffer over-read flaws were found in the way Expat handled malformed UTF-8 sequences when processing XML...

Scientific Linux Security Update : seamonkey on SL3.x, SL4.x i386/x86_64

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. CVE-2009-3979 A flaw was found in the SeaMonkey NT Lan Manager NTL...