Scientific Linux Security Update : sos on SL5.x (20120221)

Sos is a set of tools that gather information about system hardware and configuration. The sosreport utility incorrectly included Certificate-based private entitlement keys for upstream updates in the resulting archive of debugging information. An attacker able to access the archive could use the...

Scientific Linux Security Update : sssd on SL6.x i386/x86_64

The System Security Services Daemon SSSD provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back-end system to connect to multiple different account sources. It is also the basis to...

Scientific Linux Security Update : libguestfs on SL6.x x86_64

libguestfs is a library for accessing and modifying guest disk images. libguestfs relied on the format auto-detection in QEMU rather than allowing the guest image file format to be specified. A privileged guest user could potentially use this flaw to read arbitrary files on the host that were...

Scientific Linux Security Update : kernel on SL3.x i386/x86_64

These updated packages fix the following security issues : - the absence of a protection mechanism when attempting to access a critical section of code has been found in the Linux kernel open file descriptors control mechanism, fcntl. This could allow a local unprivileged user to simultaneously...

Scientific Linux Security Update : xen on SL5.x i386/x86_64

The xen packages contain administration tools and the xend service for managing the kernel-xen kernel for virtualization on Scientific Linux. A buffer overflow flaw was found in the Xen hypervisor SCSI subsystem emulation. An unprivileged, local guest user could provide a large number of bytes th...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64

These new kernel packages contain fixes for the following security issues : A memory leak was found in the Red Hat Content Accelerator kernel patch. A local user could use this flaw to cause a denial of service memory exhaustion. CVE-2007-5494, Important A flaw was found in the handling of IEEE...

Scientific Linux Security Update : kvm on SL5.4 i386/x86_64

The x86 emulator implementation was missing a check for the Current Privilege Level CPL and I/O Privilege Level IOPL. A user in a guest could leverage these flaws to cause a denial of service guest crash or possibly escalate their privileges within that guest. CVE-2010-0298, CVE-2010-0306 A flaw...

Scientific Linux Security Update : yum on SL5.x i386/x86_64

This updated yum package fixes the following bugs : - The nightly yum.cron will spew out alot of information during the add-ons section. The logging level for these information messages was turned up so that it doesn't happen during yum.cron - The kernel-module plugin now detects when yum has...

Scientific Linux Security Update : mysql on SL5.x i386/x86_64

"MySQL did not require privileges such as 'SELECT' for the source table in a 'CREATE TABLE LIKE' statement. An authenticated user could obtain sensitive information, such as the table structure. CVE-2007-3781 A flaw was discovered in MySQL that allowed an authenticated user to gain update...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64

Security fixes : - a missing capability check was found in the Linux kernel dochangetype routine. This could allow a local unprivileged user to gain privileged access or cause a denial of service. CVE-2008-2931, Important - a flaw was found in the Linux kernel Direct-IO implementation. This could...

Scientific Linux Security Update : libvirt on SL5.x i386/x86_64

It was found that libvirt did not set the user-defined backing store format when creating a new image, possibly resulting in applications having to probe the backing store to discover the format. A privileged guest user could use this flaw to read arbitrary files on the host. CVE-2010-2239 It was...

Scientific Linux Security Update : rsync on SL5.x i386/x86_64

rsync is a program for synchronizing files over a network. A flaw was found in the way the rsync daemon handled the 'filter', 'exclude', and 'exclude from' options, used for hiding files and preventing access to them from rsync clients. A remote attacker could use this flaw to bypass those...

Scientific Linux Security Update : eclipse on SL6.x i386/x86_64

The Eclipse software development environment provides a set of tools for C/C++ and Java development. A cross-site scripting XSS flaw was found in the Eclipse Help Contents web application. An attacker could use this flaw to perform a cross-site scripting attack against victims by tricking them in...

Scientific Linux Security Update : kernel on SL4.x i386/x86_64

Security fixes : - a NULL pointer dereference flaw was found in the Linux kernel NFSv4 implementation. Several of the NFSv4 file locking functions failed to check whether a file had been opened on the server before performing locking operations on it. A local, unprivileged user on a system with a...

Scientific Linux Security Update : ImageMagick on SL5.x i386/x86_64 (20120221)

ImageMagick is an image display and manipulation tool for the X Window System that can read and write multiple image formats. It was found that ImageMagick utilities tried to load ImageMagick configuration files from the current working directory. If a user ran an ImageMagick utility in an...

Scientific Linux Security Update : net-snmp on SL6.x i386/x86_64 (20120620)

The net-snmp packages provide various libraries and tools for the Simple Network Management Protocol SNMP, including an SNMP library, an extensible agent, tools for requesting or setting information from SNMP agents, tools for generating and handling SNMP traps, a version of the netstat command...

Scientific Linux Security Update : abrt, libreport, btparser, and python-meh on SL6.x i386/x86_64 (20120620)

ABRT Automatic Bug Reporting Tool is a tool to help users to detect defects in applications and to create a bug report with all the information needed by a maintainer to fix it. It uses a plug-in system to extend its functionality. libreport provides an API for reporting different problems in...

Scientific Linux Security Update : pidgin on SL6.x i386/x86_64

Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously. Multiple NULL pointer dereference flaws were found in the way the Pidgin Yahoo! Messenger Protocol plug-in handled malformed YMSG packets. A remote attacker could us...

Scientific Linux Security Update : ecryptfs-utils on SL5.x i386/x86_64

These updated ecryptfs-utils packages have been upgraded to upstream version 75, which provides a number of bug fixes and enhancements over the previous version. In addition, these packages provide a graphical program to help configure and use eCryptfs. To start this program, run the command :...

Scientific Linux Security Update : conga on SL5.x i386/x86_64 (20120221)

The conga packages provide a web-based administration tool for remote cluster and storage management. Multiple cross-site scripting XSS flaws were found in luci, the conga web-based administration application. If a remote attacker could trick a user, who was logged into the luci interface, into...