Scientific Linux Security Update : php-pecl-apc on SL6.x i386/x86_64 (20120620)

The php-pecl-apc packages contain APC Alternative PHP Cache, the framework for caching and optimization of intermediate PHP code. A cross-site scripting XSS flaw was found in the 'apc.php' script, which provides a detailed analysis of the internal workings of APC and is shipped as part of the APC...

Scientific Linux Security Update : httpd on SL5.x

Problem description : A flaw was found in the Apache HTTP Server modproxy module. On sites where a reverse proxy is configured, a remote attacker could send a carefully crafted request that would cause the Apache child process handling that request to crash. On sites where a forward proxy is...

Scientific Linux Security Update : ecryptfs-utils on SL5.x i386/x86_64

These updated ecryptfs-utils packages have been upgraded to upstream version 75, which provides a number of bug fixes and enhancements over the previous version. In addition, these packages provide a graphical program to help configure and use eCryptfs. To start this program, run the command :...

Scientific Linux Security Update : conga on SL5.x i386/x86_64 (20120221)

The conga packages provide a web-based administration tool for remote cluster and storage management. Multiple cross-site scripting XSS flaws were found in luci, the conga web-based administration application. If a remote attacker could trick a user, who was logged into the luci interface, into...

Scientific Linux Security Update : kvm on SL5.4 i386/x86_64

The x86 emulator implementation was missing a check for the Current Privilege Level CPL and I/O Privilege Level IOPL. A user in a guest could leverage these flaws to cause a denial of service guest crash or possibly escalate their privileges within that guest. CVE-2010-0298, CVE-2010-0306 A flaw...

Scientific Linux Security Update : pidgin on SL6.x i386/x86_64

Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously. Multiple NULL pointer dereference flaws were found in the way the Pidgin Yahoo! Messenger Protocol plug-in handled malformed YMSG packets. A remote attacker could us...

Scientific Linux Security Update : net-snmp on SL6.x i386/x86_64 (20120620)

The net-snmp packages provide various libraries and tools for the Simple Network Management Protocol SNMP, including an SNMP library, an extensible agent, tools for requesting or setting information from SNMP agents, tools for generating and handling SNMP traps, a version of the netstat command...

Scientific Linux Security Update : rsync on SL5.x i386/x86_64

rsync is a program for synchronizing files over a network. A flaw was found in the way the rsync daemon handled the 'filter', 'exclude', and 'exclude from' options, used for hiding files and preventing access to them from rsync clients. A remote attacker could use this flaw to bypass those...

Scientific Linux Security Update : nspr and nss for SL 5.x on i386/x86_64

CVE-2009-2409 deprecate MD2 in SSL cert validation Kaminsky CVE-2009-2408 firefox/nss: doesn't handle NULL in Common Name properly CVE-2009-2404 nss regexp heap overflow The packages with this update are identical to the packages released on the 20th of July 2009. They are being reissued as a...

Scientific Linux Security Update : fence on SL4.x i386/x86_64

Insecure temporary file use flaws were found in fenceegenera, fenceapc, and fenceapcsnmp. A local attacker could use these flaws to overwrite an arbitrary file writable by the victim running those utilities via a symbolic link attack. CVE-2008-4192, CVE-2008-4579 This update also fixes the...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64

This update addresses the following security issues : - a memory leak in keyctl handling. A local user could use this flaw to deplete kernel memory, eventually leading to a denial of service. CVE-2009-0031, Important - a buffer overflow in the Linux kernel Partial Reliable Stream Control...

Scientific Linux Security Update : xen on SL5.x i386/x86_64 (20120307)

The xen packages contain administration tools and the xend service for managing the kernel-xen kernel for virtualization on Scientific Linux. A heap overflow flaw was found in the way QEMU emulated the e1000 network interface card. A privileged guest user in a virtual machine whose network...

Scientific Linux Security Update : squid on SL5.x i386/x86_64

A flaw was found in the way Squid processed certain external ACL helper HTTP header fields that contained a delimiter that was not a comma. A remote attacker could issue a crafted request to the Squid server, causing excessive CPU use up to 100%. CVE-2009-2855 Note: The CVE-2009-2855 issue only...

Scientific Linux Security Update : nss, nss-util, and nspr on SL6.x i386/x86_64 (20120620)

Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime NSPR provides platform independence for non-GUI operating system facilities. It was found that a Certificate Authori...

Scientific Linux Security Update : cups on SL6.x i386/x86_64

The Common UNIX Printing System CUPS provides a portable printing layer for UNIX operating systems. A heap-based buffer overflow flaw was found in the Lempel-Ziv-Welch LZW decompression algorithm implementation used by the CUPS GIF image format reader. An attacker could create a malicious GIF ima...

Scientific Linux Security Update : cups on SL5.x i386/x86_64 (20120221)

The Common UNIX Printing System CUPS provides a portable printing layer for Linux, UNIX, and similar operating systems. A heap-based buffer overflow flaw was found in the Lempel-Ziv-Welch LZW decompression algorithm implementation used by the CUPS GIF image format reader. An attacker could create...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64 (20120710)

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security fix : - The fix for CVE-2011-1083 introduced a flaw in the way the Linux kernel's Event Poll epoll subsystem handled resource clean up when an ELOOP error code was returned. A local, unprivileged user...

Scientific Linux Security Update : php-pear on SL6.x

The php-pear package contains the PHP Extension and Application Repository PEAR, a framework and distribution system for reusable PHP components. It was found that the 'pear' command created temporary files in an insecure way when installing packages. A malicious, local user could use this flaw t...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64

These new kernel packages contain fixes for the following security issues : A memory leak was found in the Red Hat Content Accelerator kernel patch. A local user could use this flaw to cause a denial of service memory exhaustion. CVE-2007-5494, Important A flaw was found in the handling of IEEE...

Scientific Linux Security Update : sos on SL5.x (20120221)

Sos is a set of tools that gather information about system hardware and configuration. The sosreport utility incorrectly included Certificate-based private entitlement keys for upstream updates in the resulting archive of debugging information. An attacker able to access the archive could use the...