Scientific Linux Security Update : libsndfile on SL6.x i386/x86_64

The libsndfile packages provide a library for reading and writing sound files. An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way the libsndfile library processed certain Ensoniq PARIS Audio Format PAF audio files. An attacker could create a specially crafted...

Scientific Linux Security Update : php on SL5.x, SL6.x i386/x86_64 (20120507)

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. A flaw was found in the way the php-cgi executable processed command line arguments when running in CGI mode. A remote attacker could send a specially crafted request to a PHP script that would result in the que...

Scientific Linux Security Update : openssl on SL4.x i386/x86_64 (20120201)

OpenSSL is a toolkit that implements the Secure Sockets Layer SSL v2/v3 and Transport Layer Security TLS v1 protocols, as well as a full-strength, general purpose cryptography library. An information leak flaw was found in the SSL 3.0 protocol implementation in OpenSSL. Incorrect initialization o...

Scientific Linux Security Update : conga on SL4.x i386/x86_64

The conga packages provide a web-based administration tool for remote cluster and storage management. A privilege escalation flaw was found in luci, the Conga web-based administration application. A remote attacker could possibly use this flaw to obtain administrative access, allowing them to rea...

Scientific Linux Security Update : openssl on SL5.x, SL6.x i386/x86_64 (20120424)

OpenSSL is a toolkit that implements the Secure Sockets Layer SSL v2/v3 and Transport Layer Security TLS v1 protocols, as well as a full-strength, general purpose cryptography library. Multiple numeric conversion errors, leading to a buffer overflow, were found in the way OpenSSL parsed ASN.1...

Scientific Linux Security Update : kernel on SL6.x i386/x86_64

The kernel packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issues : - Flaws in the AGPGART driver implementation when handling certain IOCTL commands could allow a local user to cause a denial of service or escalate their...

Scientific Linux Security Update : perl on SL6.x i386/x86_64

Perl is a high-level programming language commonly used for system administration utilities and web programming. A heap-based buffer overflow flaw was found in the way Perl decoded Unicode strings. An attacker could create a malicious Unicode string that, when decoded by a Perl program, would cau...

Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20120710)

The kernel packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issues : - A NULL pointer dereference flaw was found in the nfctfrag6reasm function in the Linux kernel's netfilter IPv6 connection tracking implementation. A remote...

Scientific Linux Security Update : samba on SL5.x i386/x86_64 (20120223)

Samba is a suite of programs used by machines to share files, printers, and other information. An input validation flaw was found in the way Samba handled Any Batched AndX requests. A remote, unauthenticated attacker could send a specially crafted SMB packet to the Samba server, possibly resultin...

Scientific Linux Security Update : cups on SL6.x i386/x86_64

The Common UNIX Printing System CUPS provides a portable printing layer for UNIX operating systems. A heap-based buffer overflow flaw was found in the Lempel-Ziv-Welch LZW decompression algorithm implementation used by the CUPS GIF image format reader. An attacker could create a malicious GIF ima...

Scientific Linux Security Update : kdelibs on SL6.x i386/x86_64

The kdelibs packages provide libraries for the K Desktop Environment KDE. An input sanitization flaw was found in the KSSL KDE SSL Wrapper API. An attacker could supply a specially crafted SSL certificate for example, via a web page to an application using KSSL, such as the Konqueror web browser,...

Scientific Linux Security Update : cups on SL5.x i386/x86_64 (20120221)

The Common UNIX Printing System CUPS provides a portable printing layer for Linux, UNIX, and similar operating systems. A heap-based buffer overflow flaw was found in the Lempel-Ziv-Welch LZW decompression algorithm implementation used by the CUPS GIF image format reader. An attacker could create...

Scientific Linux Security Update : sudo on SL5.x, SL6.x i386/x86_64 (20120716)

The sudo superuser do utility allows system administrators to give certain users the ability to run commands as root. A flaw was found in the way the network matching code in sudo handled multiple IP networks listed in user specification configuration directives. A user, who is authorized to run...

Scientific Linux Security Update : libxml2 on SL4.x i386/x86_64 (20120111)

The libxml2 library is a development toolbox providing the implementation of various XML standards. One of those standards is the XML Path Language XPath, which is a language for addressing parts of an XML document. A heap-based buffer overflow flaw was found in the way libxml2 decoded entity...

Scientific Linux Security Update : sos on SL6.x (20120620)

The sos package contains a set of tools that gather information from system hardware, logs and configuration files. The information can then be used for diagnostic purposes and debugging. The sosreport utility collected the Kickstart configuration file '/root/anaconda-ks.cfg', but did not remove...

Scientific Linux Security Update : ruby on SL5.x i386/x86_64

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to do system management tasks. A flaw was found in the way large amounts of memory were allocated on 64-bit systems when using the BigDecimal class. A context-dependent attacker coul...

Scientific Linux Security Update : squirrelmail on SL4.x, SL5.x (20120208)

SquirrelMail is a standards-based webmail package written in PHP. A cross-site scripting XSS flaw was found in the way SquirrelMail performed the sanitization of HTML style tag content. A remote attacker could use this flaw to send a specially crafted Multipurpose Internet Mail Extensions MIME...

Scientific Linux Security Update : tigervnc on SL6.x i386/x86_64

Virtual Network Computing VNC is a remote display system which allows you to view a computer's desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients. It wa...

Scientific Linux Security Update : dhcp on SL6.x i386/x86_64

The Dynamic Host Configuration Protocol DHCP is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. A denial of service flaw was found in the way the dhcpd daemon handled DH...

Scientific Linux Security Update : ghostscript on SL4.x i386/x86_64 (20120202)

Ghostscript is a set of software that provides a PostScript interpreter, a set of C procedures the Ghostscript library, which implements the graphics capabilities in the PostScript language and an interpreter for Portable Document Format PDF files. Ghostscript included the current working directo...