Scientific Linux Security Update : cups on SL6.x i386/x86_64

The Common UNIX Printing System CUPS provides a portable printing layer for UNIX operating systems. A heap-based buffer overflow flaw was found in the Lempel-Ziv-Welch LZW decompression algorithm implementation used by the CUPS GIF image format reader. An attacker could create a malicious GIF ima...

Scientific Linux Security Update : krb5 on SL5.x i386/x86_64 (20120221)

Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third party, the Key Distribution Center KDC. It was found that ftpd, a Kerberos-aware FTP server, did not properly drop privileges. On Scientific...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64

Security fixes : - a missing capability check was found in the Linux kernel dochangetype routine. This could allow a local unprivileged user to gain privileged access or cause a denial of service. CVE-2008-2931, Important - a flaw was found in the Linux kernel Direct-IO implementation. This could...

Scientific Linux Security Update : yum on SL5.x i386/x86_64

This updated yum package fixes the following bugs : - The nightly yum.cron will spew out alot of information during the add-ons section. The logging level for these information messages was turned up so that it doesn't happen during yum.cron - The kernel-module plugin now detects when yum has...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64

This update addresses the following security issues : - a memory leak in keyctl handling. A local user could use this flaw to deplete kernel memory, eventually leading to a denial of service. CVE-2009-0031, Important - a buffer overflow in the Linux kernel Partial Reliable Stream Control...

Scientific Linux Security Update : python on SL6.x i386/x86_64

Python is an interpreted, interactive, object-oriented programming language. A flaw was found in the Python urllib and urllib2 libraries where they would not differentiate between different target URLs when handling automatic redirects. This caused Python applications using these modules to follo...

Scientific Linux Security Update : php-pear on SL6.x

The php-pear package contains the PHP Extension and Application Repository PEAR, a framework and distribution system for reusable PHP components. It was found that the 'pear' command created temporary files in an insecure way when installing packages. A malicious, local user could use this flaw t...

Scientific Linux Security Update : xen on SL5.x i386/x86_64 (20120307)

The xen packages contain administration tools and the xend service for managing the kernel-xen kernel for virtualization on Scientific Linux. A heap overflow flaw was found in the way QEMU emulated the e1000 network interface card. A privileged guest user in a virtual machine whose network...

Scientific Linux Security Update : nss, nss-util, and nspr on SL6.x i386/x86_64 (20120620)

Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime NSPR provides platform independence for non-GUI operating system facilities. It was found that a Certificate Authori...

Scientific Linux Security Update : nss_ldap on SL4.x i386/x86_64

A race condition was discovered in nssldap, which affected certain applications that make LDAP connections, such as Dovecot. This could cause nssldap to answer a request for information about one user with the information about a different user. CVE-2007-5794 As well, this updated package fixes t...

Scientific Linux Security Update : java-1.6.0-openjdk on SL5.x i386/x86_64

defaultReadObject of the Serialization API could be tricked into setting a volatile field multiple times, which could allow a remote attacker to execute arbitrary code with the privileges of the user running the applet or application. CVE-2010-3569 Race condition in the way objects were...

Scientific Linux Security Update : xen on SL5.x i386/x86_64

The xen packages contain administration tools and the xend service for managing the kernel-xen kernel for virtualization on Scientific Linux. A buffer overflow flaw was found in the Xen hypervisor SCSI subsystem emulation. An unprivileged, local guest user could provide a large number of bytes th...

Scientific Linux Security Update : libguestfs on SL6.x x86_64

libguestfs is a library for accessing and modifying guest disk images. libguestfs relied on the format auto-detection in QEMU rather than allowing the guest image file format to be specified. A privileged guest user could potentially use this flaw to read arbitrary files on the host that were...

Scientific Linux Security Update : virt-v2v on SL6.x x86_64

virt-v2v is a tool for converting and importing virtual machines to libvirt-managed KVM Kernel-based Virtual Machine. Using virt-v2v to convert a guest that has a password-protected VNC console to a KVM guest removed that password protection from the converted guest: after conversion, a password...

Scientific Linux Security Update : kernel on SL3.x i386/x86_64

These updated packages fix the following security issues : - the absence of a protection mechanism when attempting to access a critical section of code has been found in the Linux kernel open file descriptors control mechanism, fcntl. This could allow a local unprivileged user to simultaneously...

Scientific Linux Security Update : python on SL4.x i386/x86_64

Multiple flaws were found in the Python rgbimg module. If an application written in Python was using the rgbimg module and loaded a specially crafted SGI image file, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the applicatio...

Scientific Linux Security Update : abrt, libreport, btparser, and python-meh on SL6.x i386/x86_64 (20120620)

ABRT Automatic Bug Reporting Tool is a tool to help users to detect defects in applications and to create a bug report with all the information needed by a maintainer to fix it. It uses a plug-in system to extend its functionality. libreport provides an API for reporting different problems in...

Scientific Linux Security Update : ImageMagick on SL5.x i386/x86_64 (20120221)

ImageMagick is an image display and manipulation tool for the X Window System that can read and write multiple image formats. It was found that ImageMagick utilities tried to load ImageMagick configuration files from the current working directory. If a user ran an ImageMagick utility in an...

Scientific Linux Security Update : kexec-tools on SL5.x i386/x86_64 (20120221)

The kexec-tools package contains the /sbin/kexec binary and utilities that together form the user-space component of the kernel's kexec feature. The /sbin/kexec binary facilitates a new kernel to boot using the kernel's kexec feature either on a normal or a panic reboot. The kexec fastboot...

Scientific Linux Security Update : kernel on SL4.x i386/x86_64

Security fixes : - a NULL pointer dereference flaw was found in the Linux kernel NFSv4 implementation. Several of the NFSv4 file locking functions failed to check whether a file had been opened on the server before performing locking operations on it. A local, unprivileged user on a system with a...