Scientific Linux Security Update : perl on SL6.x i386/x86_64

Perl is a high-level programming language commonly used for system administration utilities and web programming. A heap-based buffer overflow flaw was found in the way Perl decoded Unicode strings. An attacker could create a malicious Unicode string that, when decoded by a Perl program, would cau...

Scientific Linux Security Update : dhcp on SL6.x i386/x86_64

The Dynamic Host Configuration Protocol DHCP is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. A denial of service flaw was found in the way the dhcpd daemon handled DH...

Scientific Linux Security Update : php on SL5.x, SL6.x i386/x86_64 (20120507)

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. A flaw was found in the way the php-cgi executable processed command line arguments when running in CGI mode. A remote attacker could send a specially crafted request to a PHP script that would result in the que...

Scientific Linux Security Update : php on SL4.x, SL5.x, SL6.x i386/x86_64 (20120202)

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the fix for CVE-2011-4885 released via previous php packages introduced an uninitialized memory use flaw. A remote attacker could send a specially crafted HTTP request to cause the PHP...

Scientific Linux Security Update : squirrelmail on SL4.x, SL5.x (20120208)

SquirrelMail is a standards-based webmail package written in PHP. A cross-site scripting XSS flaw was found in the way SquirrelMail performed the sanitization of HTML style tag content. A remote attacker could use this flaw to send a specially crafted Multipurpose Internet Mail Extensions MIME...

Scientific Linux Security Update : samba on SL4.x, SL5.x i386/x86_64

Samba is a suite of programs used by machines to share files, printers, and other information. A cross-site scripting XSS flaw was found in the password change page of the Samba Web Administration Tool SWAT. If a remote attacker could trick a user, who was logged into the SWAT interface, into...

Scientific Linux Security Update : php53 and php on SL5.x, SL6.x i386/x86_64

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. A signedness issue was found in the way the PHP crypt function handled 8-bit characters in passwords when using Blowfish hashing. Up to three characters immediately preceding a non-ASCII character one with the...

Scientific Linux Security Update : cups on SL6.x i386/x86_64

The Common UNIX Printing System CUPS provides a portable printing layer for UNIX operating systems. A heap-based buffer overflow flaw was found in the Lempel-Ziv-Welch LZW decompression algorithm implementation used by the CUPS GIF image format reader. An attacker could create a malicious GIF ima...

Scientific Linux Security Update : cups on SL5.x i386/x86_64 (20120221)

The Common UNIX Printing System CUPS provides a portable printing layer for Linux, UNIX, and similar operating systems. A heap-based buffer overflow flaw was found in the Lempel-Ziv-Welch LZW decompression algorithm implementation used by the CUPS GIF image format reader. An attacker could create...

Scientific Linux Security Update : libsndfile on SL6.x i386/x86_64

The libsndfile packages provide a library for reading and writing sound files. An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way the libsndfile library processed certain Ensoniq PARIS Audio Format PAF audio files. An attacker could create a specially crafted...

Scientific Linux Security Update : openssl on SL3.x i386/x86_64

A flaw was found in the SSLgetsharedciphers utility function. An attacker could send a list of ciphers to an application that used this function and overrun a buffer with a single byte CVE-2007-5135. Few applications make use of this vulnerable function and generally it is used only when...

Scientific Linux Security Update : systemtap on SL6.x i386/x86_64

SystemTap is an instrumentation system for systems running the Linux kernel, version 2.6. Developers can write scripts to collect data on the operation of the system. Two divide-by-zero flaws were found in the way SystemTap handled malformed debugging information in DWARF format. When SystemTap...

Scientific Linux Security Update : util-linux on SL5.x i386/x86_64 (20120221)

The util-linux package contains a large variety of low-level system utilities that are necessary for a Linux system to function. Among others, util-linux contains the fdisk configuration tool and the login program. Multiple flaws were found in the way the mount and umount commands performed mtab...

Scientific Linux Security Update : postgresql on SL4.x, SL5.x, SL6.x i386/x86_64

PostgreSQL is an advanced object-relational database management system DBMS. A signedness issue was found in the way the crypt function in the PostgreSQL pgcrypto module handled 8-bit characters in passwords when using Blowfish hashing. Up to three characters immediately preceding a non-ASCII...

Scientific Linux Security Update : openoffice.org on SL5.x i386/x86_64 (20120322)

OpenOffice.org is an office productivity suite that includes desktop applications, such as a word processor, spreadsheet application, presentation manager, formula editor, and a drawing program. OpenOffice.org embeds a copy of Raptor, which provides parsers for Resource Description Framework RDF...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64

These new kernel packages contain fixes for the following security issues : - A flaw was found in the backported stack unwinder fixes in Red Hat Enterprise Linux 5. On AMD64 and Intel 64 platforms, a local user could trigger this flaw and cause a denial of service. CVE-2007-4574, Important - A fl...

Scientific Linux Security Update : openssl on SL5.x i386/x86_64

OpenSSL is a toolkit that implements Secure Sockets Layer SSL v2/v3 and Transport Layer Security TLS v1 protocols as well as a full-strength general purpose cryptography library. Datagram TLS DTLS is a protocol based on TLS that is capable of securing datagram transport UDP for instance. The...

Scientific Linux Security Update : systemtap on SL5.x i386/x86_64

SystemTap is an instrumentation system for systems running the Linux kernel, version 2.6. Developers can write scripts to collect data on the operation of the system. A divide-by-zero flaw was found in the way SystemTap handled malformed debugging information in DWARF format. When SystemTap...

Scientific Linux Security Update : rgmanager on SL5.x i386/x86_64

The rgmanager package contains the Resource Group Manager, which provides the ability to create and manage high-availability server applications in the event of system downtime. It was discovered that certain resource agent scripts set the LDLIBRARYPATH environment variable to an insecure value...

Scientific Linux Security Update : system-config-firewall on SL6.x i386/x86_64

system-config-firewall is a graphical user interface for basic firewall setup. It was found that system-config-firewall used the Python pickle module in an insecure way when sending data via D-Bus to the privileged back-end mechanism. A local user authorized to configure firewall rules using...