Scientific Linux Security Update : php-pear on SL6.x

The php-pear package contains the PHP Extension and Application Repository PEAR, a framework and distribution system for reusable PHP components. It was found that the 'pear' command created temporary files in an insecure way when installing packages. A malicious, local user could use this flaw t...

Scientific Linux Security Update : ecryptfs-utils on SL5.x i386/x86_64

These updated ecryptfs-utils packages have been upgraded to upstream version 75, which provides a number of bug fixes and enhancements over the previous version. In addition, these packages provide a graphical program to help configure and use eCryptfs. To start this program, run the command :...

Scientific Linux Security Update : xen on SL5.x i386/x86_64 (20120307)

The xen packages contain administration tools and the xend service for managing the kernel-xen kernel for virtualization on Scientific Linux. A heap overflow flaw was found in the way QEMU emulated the e1000 network interface card. A privileged guest user in a virtual machine whose network...

Scientific Linux Security Update : squid on SL5.x i386/x86_64

A flaw was found in the way Squid processed certain external ACL helper HTTP header fields that contained a delimiter that was not a comma. A remote attacker could issue a crafted request to the Squid server, causing excessive CPU use up to 100%. CVE-2009-2855 Note: The CVE-2009-2855 issue only...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64

This update addresses the following security issues : - a memory leak in keyctl handling. A local user could use this flaw to deplete kernel memory, eventually leading to a denial of service. CVE-2009-0031, Important - a buffer overflow in the Linux kernel Partial Reliable Stream Control...

Scientific Linux Security Update : openldap on SL5.x i386/x86_64

A flaw was found in the way OpenLDAP handled NUL characters in the CommonName field of X.509 certificates. An attacker able to get a carefully-crafted certificate signed by a trusted Certificate Authority could trick applications using OpenLDAP libraries into accepting it by mistake, allowing the...

Scientific Linux Security Update : fence on SL4.x i386/x86_64

Insecure temporary file use flaws were found in fenceegenera, fenceapc, and fenceapcsnmp. A local attacker could use these flaws to overwrite an arbitrary file writable by the victim running those utilities via a symbolic link attack. CVE-2008-4192, CVE-2008-4579 This update also fixes the...

Scientific Linux Security Update : java-1.6.0-openjdk on SL5.x i386/x86_64

defaultReadObject of the Serialization API could be tricked into setting a volatile field multiple times, which could allow a remote attacker to execute arbitrary code with the privileges of the user running the applet or application. CVE-2010-3569 Race condition in the way objects were...

Scientific Linux Security Update : python on SL6.x i386/x86_64

Python is an interpreted, interactive, object-oriented programming language. A flaw was found in the Python urllib and urllib2 libraries where they would not differentiate between different target URLs when handling automatic redirects. This caused Python applications using these modules to follo...

Scientific Linux Security Update : kernel on SL 5.0-5.4 i386/x86_64

This kernel is already in SL 5.5 This updated contains all the security and bug fixes from the 2.6.18-194.el5 kernel. In additions this update fixes the following security issues : - a flaw was found in the Unidirectional Lightweight Encapsulation ULE implementation. A remote attacker could send ...

Scientific Linux Security Update : libvirt on SL5.x i386/x86_64

It was found that libvirt did not set the user-defined backing store format when creating a new image, possibly resulting in applications having to probe the backing store to discover the format. A privileged guest user could use this flaw to read arbitrary files on the host. CVE-2010-2239 It was...

Scientific Linux Security Update : nss, nss-util, and nspr on SL6.x i386/x86_64 (20120620)

Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime NSPR provides platform independence for non-GUI operating system facilities. It was found that a Certificate Authori...

Scientific Linux Security Update : conga on SL5.x i386/x86_64 (20120221)

The conga packages provide a web-based administration tool for remote cluster and storage management. Multiple cross-site scripting XSS flaws were found in luci, the conga web-based administration application. If a remote attacker could trick a user, who was logged into the luci interface, into...

Scientific Linux Security Update : libguestfs on SL6.x x86_64

libguestfs is a library for accessing and modifying guest disk images. libguestfs relied on the format auto-detection in QEMU rather than allowing the guest image file format to be specified. A privileged guest user could potentially use this flaw to read arbitrary files on the host that were...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64

These new kernel packages contain fixes for the following security issues : A memory leak was found in the Red Hat Content Accelerator kernel patch. A local user could use this flaw to cause a denial of service memory exhaustion. CVE-2007-5494, Important A flaw was found in the handling of IEEE...

Scientific Linux Security Update : sos on SL5.x (20120221)

Sos is a set of tools that gather information about system hardware and configuration. The sosreport utility incorrectly included Certificate-based private entitlement keys for upstream updates in the resulting archive of debugging information. An attacker able to access the archive could use the...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64 (20120710)

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security fix : - The fix for CVE-2011-1083 introduced a flaw in the way the Linux kernel's Event Poll epoll subsystem handled resource clean up when an ELOOP error code was returned. A local, unprivileged user...

Scientific Linux Security Update : rsync on SL5.x i386/x86_64

rsync is a program for synchronizing files over a network. A flaw was found in the way the rsync daemon handled the 'filter', 'exclude', and 'exclude from' options, used for hiding files and preventing access to them from rsync clients. A remote attacker could use this flaw to bypass those...

Scientific Linux Security Update : nspr and nss for SL 5.x on i386/x86_64

CVE-2009-2409 deprecate MD2 in SSL cert validation Kaminsky CVE-2009-2408 firefox/nss: doesn't handle NULL in Common Name properly CVE-2009-2404 nss regexp heap overflow The packages with this update are identical to the packages released on the 20th of July 2009. They are being reissued as a...

Scientific Linux Security Update : xen on SL5.x i386/x86_64

The xen packages contain administration tools and the xend service for managing the kernel-xen kernel for virtualization on Scientific Linux. A buffer overflow flaw was found in the Xen hypervisor SCSI subsystem emulation. An unprivileged, local guest user could provide a large number of bytes th...