Scientific Linux Security Update : xorg-x11-server on SL7.x i686/x86_64 (2022:0003)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:0003-1 advisory. - xorg-x11-server: SProcRenderCompositeGlyphs out-of-bounds access CVE-2021-4008 - xorg-x11-server: SProcXFixesCreatePointerBarrier out-of-bounds...

Scientific Linux Security Update : thunderbird on SL7.x x86_64 (2021:5046)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2021:5046-1 advisory. - Mozilla: Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4 Mozilla: URL leakage when navigating while executing asynchronous function...

Scientific Linux Security Update : mailman on SL7.x x86_64 (2021:4913)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2021:4913-1 advisory. - mailman: CSRF token bypass allows to perform CSRF attacks and account takeover CVE-2021-42097 - mailman: CSRF token bypass allows to perform CS...

Scientific Linux Security Update : java-11-openjdk on SL7.x i686/x86_64 (2021:3892)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2021:3892-1 advisory. - OpenJDK: Loop in HttpsServer triggered during TLS session close JSSE, 8254967 CVE-2021-35565 - OpenJDK: Incorrect principal selection when usin...

Scientific Linux Security Update : libxml2 on SL7.x i686/x86_64 (2021:3810)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2021:3810-1 advisory. - libxml2: Use after free via namespace node in XPointer ranges CVE-2016-4658 Note that Nessus has not tested for this issue but has instead relied only o...

Scientific Linux Security Update : kernel on SL7.x x86_64 (2021:3801)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2021:3801-1 advisory. - kernel: Improper handling of VMIO|VMPFNMAP vmas in KVM can bypass RO checks CVE-2021-22543 - kernel: powerpc: KVM guest OS users can cause host...

Scientific Linux Security Update : 389-ds-base on SL7.x x86_64 (2021:3807)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2021:3807-1 advisory. - 389-ds-base: CRYPT password hash with asterisk allows any bind attempt to succeed CVE-2021-3652 Note that Nessus has not tested for this issue but has...

Scientific Linux Security Update : thunderbird on SL7.x x86_64 (2021:3494)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2021:3494-1 advisory. - Mozilla: Memory safety bugs fixed in Firefox 92, Firefox ESR 78.14 and Firefox ESR 91.1 CVE-2021-38493 Note that Nessus has not tested for this issue bu...

Scientific Linux Security Update : libsndfile on SL7.x i686/x86_64 (2021:3295)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2021:3295-1 advisory. - libsndfile: Heap buffer overflow via crafted WAV file allows arbitrary code execution CVE-2021-3246 Note that Nessus has not tested for this issue but h...

Scientific Linux Security Update : sssd on SL7.x i686/x86_64 (2021:3336)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2021:3336-1 advisory. - sssd: shell command injection in sssctl CVE-2021-3621 Note that Nessus has not tested for this issue but has instead relied only on the application's...

SLSA - Supply-chain Levels For Software Artifacts

SLSA pronounced "salsa" is security framework from source to service, giving anyone working with software a common language for increasing levels of software security and supply chain integrity. The best way to read about SLSA is to visitslsa.dev. What's in this repo? The primary content of this...

Scientific Linux Security Update : microcode_ctl on SL7.x x86_64 (2021:3028)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2021:3028-1 advisory. - hw: Special Register Buffer Data Sampling SRBDS CVE-2020-0543 - hw: Vector Register Data Sampling CVE-2020-0548 - hw: L1D Cache Eviction Sampli...

Scientific Linux Security Update : lasso on SL7.x i686/x86_64 (2021:2989)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2021:2989-1 advisory. - lasso: XML signature wrapping vulnerability when parsing SAML responses CVE-2021-28091 Note that Nessus has not tested for this issue but has instead...

Scientific Linux Security Update : java-11-openjdk on SL7.x i686/x86_64 (2021:2784)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2021:2784-1 advisory. - OpenJDK: Incorrect comparison during range check elimination Hotspot, 8264066 CVE-2021-2388 - OpenJDK: FTP PASV command response can cause...

Scientific Linux Security Update : kernel on SL7.x x86_64 (2021:2725)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2021:2725-1 advisory. - kernel: sizet-to-int conversion vulnerability in the filesystem layer CVE-2021-33909 - kernel: use-after-free in net/bluetooth/hcievent.c when...

Scientific Linux Security Update : java-1.8.0-openjdk on SL7.x i686/x86_64 (2021:2845)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2021:2845-1 advisory. - OpenJDK: Incorrect comparison during range check elimination Hotspot, 8264066 CVE-2021-2388 - OpenJDK: FTP PASV command response can cause...

Scientific Linux Security Update : linuxptp on SL7.x x86_64 (2021:2658)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2021:2658-1 advisory. - linuxptp: missing length check of forwarded messages CVE-2021-3570 Note that Nessus has not tested for this issue but has instead relied only on the...

New Google Scorecards Tool Scans Open-Source Software for More Security Risks

Google has launched an updated version of Scorecards, its automated security tool that produces a "risk score" for open source initiatives, with improved checks and capabilities to make the data generated by the utility accessible for analysis. "With so much software today relying on open-source...

Two Google plans that could make open source code more secure

Recently Google announced that it will fund the further development of Rust. Rust is a low-level programming language that is designed to be more memory secure than other popular programming languages, such as C. Google has also proposed an end-to-end framework for supply chain integrity which it...

Google Releases New Framework to Prevent Software Supply Chain Attacks

As software supply chain attacks emerge as a point of concern in the wake of SolarWinds and Codecov security incidents, Google is proposing a solution to ensure the integrity of software packages and prevent unauthorized modifications. Called "Supply chain Levels for Software Artifacts" SLSA, and...