Scientific Linux Security Update : firefox on SL4.x, SL5.x, SL6.x i386/x86_64

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. It was found that a Certificate Authority CA issued a fraudulent HTTPS certificate. This update renders any HTTPS certificates signed by that CA as untrusted, except for a select few...

Scientific Linux Security Update : kvm on SL5.x x86_64 (20120221)

KVM Kernel-based Virtual Machine is a full virtualization solution for Linux on AMD64 and Intel 64 systems. KVM is a Linux kernel module built for the standard Scientific Linux kernel. It was found that the kvmvmioctlassigndevice function in the KVM subsystem of a Linux kernel did not check if th...

Scientific Linux Security Update : system-config-firewall on SL6.x i386/x86_64

system-config-firewall is a graphical user interface for basic firewall setup. It was found that system-config-firewall used the Python pickle module in an insecure way when sending data via D-Bus to the privileged back-end mechanism. A local user authorized to configure firewall rules using...

Scientific Linux Security Update : squirrelmail on SL4.x, SL5.x (20120208)

SquirrelMail is a standards-based webmail package written in PHP. A cross-site scripting XSS flaw was found in the way SquirrelMail performed the sanitization of HTML style tag content. A remote attacker could use this flaw to send a specially crafted Multipurpose Internet Mail Extensions MIME...

Scientific Linux Security Update : openssl on SL4.x i386/x86_64 (20120201)

OpenSSL is a toolkit that implements the Secure Sockets Layer SSL v2/v3 and Transport Layer Security TLS v1 protocols, as well as a full-strength, general purpose cryptography library. An information leak flaw was found in the SSL 3.0 protocol implementation in OpenSSL. Incorrect initialization o...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64

The kernel packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issues : - A NULL pointer dereference flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. A remote attacker could send a...

Scientific Linux Security Update : tomcat6 on SL6.x i386/x86_64

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. It was found that web applications could modify the location of the Tomcat host's work directory. As web applications deployed on Tomcat have read and write access to this directory, a malicious web...

Scientific Linux Security Update : qemu-kvm on SL6.x x86_64

KVM Kernel-based Virtual Machine is a full virtualization solution for Linux on AMD64 and Intel 64 systems. qemu-kvm is the user-space component for running virtual machines using KVM. It was found that the virtio-blk driver in qemu-kvm did not properly validate read and write requests from guest...

Scientific Linux Security Update : sysstat on SL5.x i386/x86_64

The sysstat package contains a set of utilities which enable system monitoring of disks, network, and other I/O activity. It was found that the sysstat initscript created a temporary file in an insecure way. A local attacker could use this flaw to create arbitrary files via a symbolic link attack...

Scientific Linux Security Update : samba on SL5.x i386/x86_64 (20120223)

Samba is a suite of programs used by machines to share files, printers, and other information. An input validation flaw was found in the way Samba handled Any Batched AndX requests. A remote, unauthenticated attacker could send a specially crafted SMB packet to the Samba server, possibly resultin...

Scientific Linux Security Update : squid on SL6.x i386/x86_64

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. An input validation flaw was found in the way Squid calculated the total number of resource records in the answer section of multiple name server responses. An attacker could use this...

Scientific Linux Security Update : ecryptfs-utils on SL5.x, SL6.x i386/x86_64

eCryptfs is a stacked, cryptographic file system. It is transparent to the underlying file system and provides per-file granularity. The setuid mount.ecryptfsprivate utility allows users to mount an eCryptfs file system. This utility can only be run by users in the 'ecryptfs' group. A race...

Scientific Linux Security Update : conga on SL4.x i386/x86_64

The conga packages provide a web-based administration tool for remote cluster and storage management. A privilege escalation flaw was found in luci, the Conga web-based administration application. A remote attacker could possibly use this flaw to obtain administrative access, allowing them to rea...

Scientific Linux Security Update : gnutls on SL5.x i386/x86_64 (20120327)

The GnuTLS library provides support for cryptographic algorithms and for protocols such as Transport Layer Security TLS. GnuTLS includes libtasn1, a library developed for ASN.1 Abstract Syntax Notation One structures management that includes DER Distinguished Encoding Rules encoding and decoding....

Scientific Linux Security Update : samba on SL4.x, SL5.x i386/x86_64

Samba is a suite of programs used by machines to share files, printers, and other information. A cross-site scripting XSS flaw was found in the password change page of the Samba Web Administration Tool SWAT. If a remote attacker could trick a user, who was logged into the SWAT interface, into...

Scientific Linux Security Update : jasper on SL6.x i386/x86_64

JasPer is an implementation of Part 1 of the JPEG 2000 image compression standard. Two heap-based buffer overflow flaws were found in the way JasPer decoded JPEG 2000 compressed image files. An attacker could create a malicious JPEG 2000 compressed image file that, when opened, would cause...

Scientific Linux Security Update : postgresql on SL4.x, SL5.x, SL6.x i386/x86_64

PostgreSQL is an advanced object-relational database management system DBMS. A signedness issue was found in the way the crypt function in the PostgreSQL pgcrypto module handled 8-bit characters in passwords when using Blowfish hashing. Up to three characters immediately preceding a non-ASCII...

Scientific Linux Security Update : glibc on SL5.x i386/x86_64 (20120718)

The glibc packages provide the standard C and standard math libraries used by multiple programs on the system. Without these libraries, the Linux system cannot function properly. It was discovered that the formatted printing functionality in glibc did not properly restrict the use of alloca. This...

Scientific Linux Security Update : kernel on SL6.x i386/x86_64

The kernel packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issues : - It was found that the receive hook in the ipipinit function in the ipip module, and in the ipgreinit function in the ipgre module, could be called before netwo...

Scientific Linux Security Update : tigervnc on SL6.x i386/x86_64

Virtual Network Computing VNC is a remote display system which allows you to view a computer's desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients. It wa...