Scientific Linux Security Update : gstreamer-plugins-good on SL5.x i386/x86_64

Multiple heap buffer overflows and an array indexing error were found in the GStreamer's QuickTime media file format decoding plugin. An attacker could create a carefully-crafted QuickTime media .mov file that would cause an application using GStreamer to crash or, potentially, execute arbitrary...

Scientific Linux Security Update : gnutls on SL4.x, SL5.x i386/x86_64

CVE-2009-3555 TLS: MITM attacks via session renegotiation CVE-2010-0731 gnutls: gnutlsx509crtgetserial incorrect serial decoding from ASN1 BE64 GNUTLS-SA-2010-1 A flaw was found in the way the TLS/SSL Transport Layer Security/Secure Sockets Layer protocols handled session renegotiation. A...

Scientific Linux Security Update : perl-DBD-Pg on SL5.x, SL6.x i386/x86_64 (20120725)

Perl DBI is a database access Application Programming Interface API for the Perl language. perl-DBD-Pg allows Perl applications to access PostgreSQL database servers. Two format string flaws were found in perl-DBD-Pg. A specially crafted database warning or error message from a server could cause...

Scientific Linux Security Update : pcsc-lite on SL5.x i386/x86_64

Multiple buffer overflow flaws were discovered in the way the pcscd daemon, a resource manager that coordinates communications with smart card readers and smart cards connected to the system, handled client requests. A local user could create a specially crafted request that would cause the pcscd...

Scientific Linux Security Update : apr on SL4.x, SL5.x, SL6.x i386/x86_64

It was discovered that the aprfnmatch function used an unconstrained recursion when processing patterns with the '' wildcard. An attacker could use this flaw to cause an application using this function, which also accepted untrusted input as a pattern for matching such as an httpd server using th...

Scientific Linux Security Update : thunderbird on SL6.x i386/x86_64

Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed HTML content. Malicious HTML content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. CVE-2011-2982 A...

Scientific Linux Security Update : openoffice.org on SL5.x i386/x86_64 (20120322)

OpenOffice.org is an office productivity suite that includes desktop applications, such as a word processor, spreadsheet application, presentation manager, formula editor, and a drawing program. OpenOffice.org embeds a copy of Raptor, which provides parsers for Resource Description Framework RDF...

Scientific Linux Security Update : firefox on SL4.x, SL5.x i386/x86_64

A flaw was found in the way Firefox handles form history. A malicious web page could steal saved form data by synthesizing input events, causing the browser to auto-fill form fields which could then be read by an attacker. CVE-2009-3370 A flaw was found in the way Firefox creates temporary file...

Scientific Linux Security Update : krb5 on SL3.x, SL4.x, SL5.x i386/x86_64

CVE-2009-4212 krb: KDC integer overflows in AES and RC4 decryption routines MITKRB5-SA-2009-004 Multiple integer underflow flaws, leading to heap-based corruption, were found in the way the MIT Kerberos Key Distribution Center KDC decrypted ciphertexts encrypted with the Advanced Encryption...

Scientific Linux Security Update : xorg-x11 on SL4.x i386/x86_64

X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Multiple input sanitization flaws were found in the X.Org GLX OpenGL extension to the X Window System extension. A malicious,...

Scientific Linux Security Update : xorg-x11-server on SL5.x, SL6.x i386/x86_64

X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Multiple input sanitization flaws were found in the X.Org GLX OpenGL extension to the X Window System extension. A malicious,...

Scientific Linux Security Update : libxml2 on SL6.x i386/x86_64

The libxml2 library is a development toolbox providing the implementation of various XML standards. One of those standards is the XML Path Language XPath, which is a language for addressing parts of an XML document. An off-by-one error, leading to a heap-based buffer overflow, was found in the wa...

Scientific Linux Security Update : bind on SL3.x, SL4.x, SL5.x i386/x86_64

A flaw was discovered in the way BIND checked the return value of the OpenSSL DSAdoverify function. On systems using DNSSEC, a malicious zone could present a malformed DSA certificate and bypass proper certificate validation, allowing spoofing attacks. CVE-2009-0025 For users of Red Hat Enterpris...

Scientific Linux Security Update : squid on SL6.x i386/x86_64

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. An input validation flaw was found in the way Squid calculated the total number of resource records in the answer section of multiple name server responses. An attacker could use this...

Scientific Linux Security Update : ipsec-tools on SL5.x i386/x86_64

A denial of service flaw was found in the ipsec-tools racoon daemon. An unauthenticated, remote attacker could trigger a NULL pointer dereference that could cause the racoon daemon to crash. CVE-2009-1574 Multiple memory leak flaws were found in the ipsec-tools racoon daemon. If a remote attacker...

Scientific Linux Security Update : libvpx on SL6.x i386/x86_64

An integer overflow flaw, leading to arbitrary memory writes, was found in libvpx. An attacker could create a specially crafted video encoded using the VP8 codec that, when played by a victim with an application using libvpx such as Totem, would cause the application to crash or, potentially,...

Scientific Linux Security Update : thunderbird on SL5.x, SL6.x i386/x86_64 (20120606)

Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed content. Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. CVE-2011-3101,...

Scientific Linux Security Update : dnsmasq on SL5.x i386/x86_64

CVE-2009-2957, CVE-2009-2958 dnsmasq: multiple vulnerabilities in TFTP server Core Security Technologies discovered a heap overflow flaw in dnsmasq when the TFTP service is enabled the '--enable-tftp' command line option, or by enabling 'enable-tftp' in '/etc/dnsmasq.conf'. If the configured...

Scientific Linux Security Update : openoffice.org2 on SL4.x i386/x86_64

A flaw was found in the way OpenOffice.org enforced a macro security setting for macros, written in the Python scripting language, that were embedded in OpenOffice.org documents. If a user were tricked into opening a specially crafted OpenOffice.org document and previewed the macro directory...

Scientific Linux Security Update : kdelibs on SL6.x i386/x86_64

A cross-site scripting XSS flaw was found in the way KHTML, the HTML layout engine used by KDE applications such as the Konqueror web browser, displayed certain error pages. A remote attacker could use this flaw to perform a cross-site scripting attack against victims by tricking them into visiti...