Scientific Linux Security Update : libvirt on SL6.x i386/x86_64 (20120620)

The libvirt library is a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. Bus and device IDs were ignored when attempting to attach multiple USB devices...

Scientific Linux Security Update : krb5 on SL5.x i386/x86_64 (20120221)

Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third party, the Key Distribution Center KDC. It was found that ftpd, a Kerberos-aware FTP server, did not properly drop privileges. On Scientific...

Scientific Linux Security Update : ipa on SL6.x i386/x86_64

This Identity Management Application is a centralized authentication, identity management and authorization solution for both traditional and cloud based enterprise environments. It integrates components of the Upstream Directory Server, MIT Kerberos, the Upstream Certificate System, NTP, and DNS...

Scientific Linux Security Update : cups on SL5.x i386/x86_64 (20120221)

The Common UNIX Printing System CUPS provides a portable printing layer for Linux, UNIX, and similar operating systems. A heap-based buffer overflow flaw was found in the Lempel-Ziv-Welch LZW decompression algorithm implementation used by the CUPS GIF image format reader. An attacker could create...

Scientific Linux Security Update : cups on SL6.x i386/x86_64

The Common UNIX Printing System CUPS provides a portable printing layer for UNIX operating systems. A heap-based buffer overflow flaw was found in the Lempel-Ziv-Welch LZW decompression algorithm implementation used by the CUPS GIF image format reader. An attacker could create a malicious GIF ima...

Scientific Linux Security Update : rsyslog on SL6.x i386/x86_64 (20120620)

The rsyslog packages provide an enhanced, multi-threaded syslog daemon. A numeric truncation error, leading to a heap-based buffer overflow, was found in the way the rsyslog imfile module processed text files containing long lines. An attacker could use this flaw to crash the rsyslogd daemon or,...

Scientific Linux Security Update : python on SL4.x i386/x86_64

Multiple flaws were found in the Python rgbimg module. If an application written in Python was using the rgbimg module and loaded a specially crafted SGI image file, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the applicatio...

Scientific Linux Security Update : kernel on SL4.x i386/x86_64

Security fixes : - a NULL pointer dereference flaw was found in the Linux kernel NFSv4 implementation. Several of the NFSv4 file locking functions failed to check whether a file had been opened on the server before performing locking operations on it. A local, unprivileged user on a system with a...

Scientific Linux Security Update : abrt, libreport, btparser, and python-meh on SL6.x i386/x86_64 (20120620)

ABRT Automatic Bug Reporting Tool is a tool to help users to detect defects in applications and to create a bug report with all the information needed by a maintainer to fix it. It uses a plug-in system to extend its functionality. libreport provides an API for reporting different problems in...

Scientific Linux Security Update : mysql on SL5.x i386/x86_64

"MySQL did not require privileges such as 'SELECT' for the source table in a 'CREATE TABLE LIKE' statement. An authenticated user could obtain sensitive information, such as the table structure. CVE-2007-3781 A flaw was discovered in MySQL that allowed an authenticated user to gain update...

Scientific Linux Security Update : yum on SL5.x i386/x86_64

This updated yum package fixes the following bugs : - The nightly yum.cron will spew out alot of information during the add-ons section. The logging level for these information messages was turned up so that it doesn't happen during yum.cron - The kernel-module plugin now detects when yum has...

Scientific Linux Security Update : kexec-tools on SL5.x i386/x86_64 (20120221)

The kexec-tools package contains the /sbin/kexec binary and utilities that together form the user-space component of the kernel's kexec feature. The /sbin/kexec binary facilitates a new kernel to boot using the kernel's kexec feature either on a normal or a panic reboot. The kexec fastboot...

Scientific Linux Security Update : kvm on SL5.4 i386/x86_64

The x86 emulator implementation was missing a check for the Current Privilege Level CPL and I/O Privilege Level IOPL. A user in a guest could leverage these flaws to cause a denial of service guest crash or possibly escalate their privileges within that guest. CVE-2010-0298, CVE-2010-0306 A flaw...

Scientific Linux Security Update : eclipse on SL6.x i386/x86_64

The Eclipse software development environment provides a set of tools for C/C++ and Java development. A cross-site scripting XSS flaw was found in the Eclipse Help Contents web application. An attacker could use this flaw to perform a cross-site scripting attack against victims by tricking them in...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64

Security fixes : - a missing capability check was found in the Linux kernel dochangetype routine. This could allow a local unprivileged user to gain privileged access or cause a denial of service. CVE-2008-2931, Important - a flaw was found in the Linux kernel Direct-IO implementation. This could...

Scientific Linux Security Update : libguestfs on SL6.x x86_64 (20120620)

libguestfs is a library for accessing and modifying guest disk images. It was found that editing files with virt-edit left said files in a world-readable state and did not preserve the file owner or Security-Enhanced Linux context. If an administrator on the host used virt-edit to edit a file...

Scientific Linux Security Update : ypbind on SL3.x i386/x86_64

This updated package fixes the following bugs : - after a NIS server change, for example, after a server failure, ypbind corrupted files in the '/var/yp/binding/' directory. As well, these files were not updated, possibly causing old information to be retained. In these situations, glibc attempte...

Scientific Linux Security Update : sos on SL6.x (20120620)

The sos package contains a set of tools that gather information from system hardware, logs and configuration files. The information can then be used for diagnostic purposes and debugging. The sosreport utility collected the Kickstart configuration file '/root/anaconda-ks.cfg', but did not remove...

Scientific Linux Security Update : lftp on SL5.x i386/x86_64

CVE-2007-2348 lftp mirror --script does not escape names and targets of symbolic links It was discovered that lftp did not properly escape shell metacharacters when generating shell scripts using the 'mirror --script' command. A mirroring script generated to download files from a malicious FTP...

Scientific Linux Security Update : coolkey on SL5.x i386/x86_64

Steve Grubb discovered a flaw in the way coolkey created a temporary directory. A local attacker could perform a symlink attack and cause arbitrary files to be overwritten. CVE-2007-4129 In addition, the updated packages contain fixes for the following bugs in the CAC Smart Card support : - CAC...