Scientific Linux Security Update : krb5 on SL5.x i386/x86_64 (20120221)

Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third party, the Key Distribution Center KDC. It was found that ftpd, a Kerberos-aware FTP server, did not properly drop privileges. On Scientific...

Scientific Linux Security Update : mysql on SL5.x i386/x86_64

"MySQL did not require privileges such as 'SELECT' for the source table in a 'CREATE TABLE LIKE' statement. An authenticated user could obtain sensitive information, such as the table structure. CVE-2007-3781 A flaw was discovered in MySQL that allowed an authenticated user to gain update...

Scientific Linux Security Update : ipa on SL6.x i386/x86_64

This Identity Management Application is a centralized authentication, identity management and authorization solution for both traditional and cloud based enterprise environments. It integrates components of the Upstream Directory Server, MIT Kerberos, the Upstream Certificate System, NTP, and DNS...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64

Security fixes : - a NULL pointer dereference flaw was found in the sctprcvootb function in the Linux kernel Stream Control Transmission Protocol SCTP implementation. A remote attacker could send a specially crafted SCTP packet to a target system, resulting in a denial of service. CVE-2010-0008,...

Scientific Linux Security Update : libguestfs on SL6.x x86_64 (20120620)

libguestfs is a library for accessing and modifying guest disk images. It was found that editing files with virt-edit left said files in a world-readable state and did not preserve the file owner or Security-Enhanced Linux context. If an administrator on the host used virt-edit to edit a file...

Scientific Linux Security Update : python on SL4.x i386/x86_64

Multiple flaws were found in the Python rgbimg module. If an application written in Python was using the rgbimg module and loaded a specially crafted SGI image file, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the applicatio...

Scientific Linux Security Update : java-1.6.0-openjdk on SL6.x i386/x86_64

defaultReadObject of the Serialization API could be tricked into setting a volatile field multiple times, which could allow a remote attacker to execute arbitrary code with the privileges of the user running the applet or application. CVE-2010-3569 Race condition in the way objects were...

Scientific Linux Security Update : sssd on SL5.x i386/x86_64

The System Security Services Daemon SSSD provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back-end system to connect to multiple different account sources. It is also the basis to...

Scientific Linux Security Update : gdm on SL5.x i386/x86_64

CVE-2009-2697 gdm not built with tcpwrappers A flaw was found in the way the gdm package was built. The gdm package was missing TCP wrappers support, which could result in an administrator believing they had access restrictions enabled when they did not. CVE-2009-2697 This update also fixes the...

Scientific Linux Security Update : httpd on SL5.x

Problem description : A flaw was found in the Apache HTTP Server modproxy module. On sites where a reverse proxy is configured, a remote attacker could send a carefully crafted request that would cause the Apache child process handling that request to crash. On sites where a forward proxy is...

Scientific Linux Security Update : sos on SL6.x (20120620)

The sos package contains a set of tools that gather information from system hardware, logs and configuration files. The information can then be used for diagnostic purposes and debugging. The sosreport utility collected the Kickstart configuration file '/root/anaconda-ks.cfg', but did not remove...

Scientific Linux Security Update : mysql on SL4.x i386/x86_64

MySQL did not correctly check directories used as arguments for the DATA DIRECTORY and INDEX DIRECTORY directives. Using this flaw, an authenticated attacker could elevate their access privileges to tables created by other database users. Note: this attack does not work on existing tables. An...

Scientific Linux Security Update : nfs-utils on SL6.x i386/x86_64

The nfs-utils packages provide a daemon for the kernel Network File System NFS server, and related tools such as the mount.nfs, umount.nfs, and showmount programs. A flaw was found in the way nfs-utils performed IP based authentication of mount requests. In configurations where a directory was...

Scientific Linux Security Update : nss_ldap on SL4.x i386/x86_64

A race condition was discovered in nssldap, which affected certain applications that make LDAP connections, such as Dovecot. This could cause nssldap to answer a request for information about one user with the information about a different user. CVE-2007-5794 As well, this updated package fixes t...

Scientific Linux Security Update : coolkey on SL5.x i386/x86_64

Steve Grubb discovered a flaw in the way coolkey created a temporary directory. A local attacker could perform a symlink attack and cause arbitrary files to be overwritten. CVE-2007-4129 In addition, the updated packages contain fixes for the following bugs in the CAC Smart Card support : - CAC...

Scientific Linux Security Update : 389-ds-base on SL6.x i386/x86_64 (20120620)

The 389 Directory Server is an LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP server and command-line utilities for server administration. A flaw was found in the way the 389 Directory Server daemon ns-slapd handled access control instructions AC...

Scientific Linux Security Update : conga on SL5.x i386/x86_64 (20120221)

The conga packages provide a web-based administration tool for remote cluster and storage management. Multiple cross-site scripting XSS flaws were found in luci, the conga web-based administration application. If a remote attacker could trick a user, who was logged into the luci interface, into...

Scientific Linux Security Update : dovecot on SL5.x i386/x86_64

A flaw was discovered in the way Dovecot handled the 'mailextragroups' option. An authenticated attacker with local shell access could leverage this flaw to read, modify, or delete other users mail that is stored on the mail server. CVE-2008-1199 This issue did not affect the default Red Hat...

Scientific Linux Security Update : lftp on SL5.x i386/x86_64

CVE-2007-2348 lftp mirror --script does not escape names and targets of symbolic links It was discovered that lftp did not properly escape shell metacharacters when generating shell scripts using the 'mirror --script' command. A mirroring script generated to download files from a malicious FTP...

Scientific Linux Security Update : php-pear on SL6.x

The php-pear package contains the PHP Extension and Application Repository PEAR, a framework and distribution system for reusable PHP components. It was found that the 'pear' command created temporary files in an insecure way when installing packages. A malicious, local user could use this flaw t...