Scientific Linux Security Update : bind on SL6.x i386/x86_64 (20200603)

Security Fixes : - bind: BIND does not sufficiently limit the number of fetches performed when processing referrals CVE-2020-8616 - bind: A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c CVE-2020-8617 C Tenable Network Security, Inc. The...

Scientific Linux Security Update : thunderbird on SL6.x i386/x86_64 (20200416)

Security Fixes : - Mozilla: Use-after-free while running the nsDocShell destructor CVE-2020-6819 - Mozilla: Use-after-free when handling a ReadableStream CVE-2020-6820 - Mozilla: Uninitialized memory could be read when using the WebGL copyTexSubImage method CVE-2020-6821 - Mozilla: Memory safety...

Information Leakage

The kernel packages is vulnerable to an information leakage. A flaw was found in the printfatalsignal implementation in the Linux kernel. When "/proc/sys/kernel/print-fatal-signals" is set to 1 the default value is 0, memory that is reachable by the kernel could be leaked to user-space. This issu...

CVE-2017-18269

An SSE2-optimized memmove implementation for i386 in sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S in the GNU C Library aka glibc or libc6 2.21 through 2.27 does not correctly perform the overlapping memory check if the source memory range spans the middle of the address space, resulting in...

Scientific Linux Security Update : ipmitool on SL6.x i386/x86_64 (20200406)

Security Fixes : - ipmitool: Buffer overflow in readfruareasection function in lib/ipmifru.c CVE-2020-5208 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid135261; scriptversion"1.4";...

CVE-2018-6551

The malloc implementation in the GNU C Library aka glibc or libc6, from version 2.24 to 2.26 on powerpc, and only in version 2.26 on i386, did not properly handle malloc calls with arguments close to SIZEMAX and could return a pointer to a heap region that is smaller than requested, eventually...

Scientific Linux Security Update : zsh on SL6.x i386/x86_64 (20200318)

Security Fixes : - zsh: insecure dropping of privileges when unsetting PRIVILEGED option CVE-2019-20044 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid134695; scriptversion"1.3";...

musl: x87 floating-point stack adjustment imbalance

Background musl is an implementation of the C standard library built on top of the Linux system call API, including interfaces defined in the base language standard, POSIX, and widely agreed-upon extensions. Description A flaw in musl libc’s arch-specific math assembly code for i386 was found whi...

Scientific Linux Security Update : qemu-kvm on SL6.x i386/x86_64 (20200310)

Security Fixes : - QEMU: slirp: heap buffer overflow during packet reassembly CVE-2019-14378 - QEMU: slirp: OOB buffer access while emulating tcp protocols in tcpemu CVE-2020-7039 - QEMU: Slirp: use-after-free during packet reassembly CVE-2019-15890 C Tenable Network Security, Inc. The descriptiv...

Scientific Linux Security Update : sudo on SL6.x i386/x86_64 (20200305)

Security Fixes : - sudo: Stack based buffer overflow when pwfeedback is enabled CVE-2019-18634 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid134346; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

Scientific Linux Security Update : xerces-c on SL6.x i386/x86_64 (20200304)

Security Fixes : - xerces-c: XML parser contains a use-after-free error triggered during the scanning of external DTDs CVE-2018-1311 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid134274; scriptversion"1.3";...

Scientific Linux Security Update : thunderbird on SL6.x i386/x86_64 (20200224)

Security Fixes : Mozilla: Memory safety bugs fixed in Firefox 73 and Firefox ESR 68.5 CVE-2020-6800 Mozilla: Out-of-bounds read when processing certain email messages CVE-2020-6793 Mozilla: Setting a master password post-Thunderbird 52 does not delete unencrypted previously stored passwords...

Scientific Linux Security Update : ksh on SL6.x i386/x86_64 (20200217)

Security Fixes : - ksh: certain environment variables interpreted as arithmetic expressions on startup, leading to code injection CVE-2019-14868 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid133756; scriptversion"1.5";...

Scientific Linux Security Update : firefox on SL6.x i386/x86_64 (20200217)

Security Fixes : - Mozilla: Missing bounds check on shared memory read in the parent process CVE-2020-6796 - Mozilla: Memory safety bugs fixed in Firefox 73 and Firefox ESR 68.5 CVE-2020-6800 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include"compat.inc"; if...

Scientific Linux Security Update : git on SL6.x i386/x86_64 (20200203)

Security Fixes : - git: arbitrary code execution via .gitmodules CVE-2018-17456 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid133447; scriptversion"1.4"; scriptsetattributeattribute:"pluginmodificationdate",...

Huawei EulerOS: Security Advisory for qemu-kvm (EulerOS-SA-2018-1313)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Scientific Linux Security Update : python-reportlab on SL6.x i386/x86_64 (20200121)

Security Fixes : - python-reportlab: code injection in colors.py allows attacker to execute code CVE-2019-17626 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid133193; scriptversion"1.4";...

Scientific Linux Security Update : openslp on SL6.x i386/x86_64 (20200122)

Security Fixes : - openslp: Heap-based buffer overflow in ProcessSrvRqst in slpdprocess.c leading to remote code execution CVE-2019-5544 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid133196; scriptversion"1.7";...

OpenBSD 6.x - Dynamic Loader Privilege Escalation Exploit

Local Privilege Escalation in OpenBSD's dynamic loader CVE-2019-19726 ============================================================================== Contents ============================================================================== Summary Analysis Demonstration Acknowledgments...

OpenBSD 6.x - Dynamic Loader Privilege Escalation

Qualys Security Advisory Local Privilege Escalation in OpenBSD's dynamic loader CVE-2019-19726 ============================================================================== Contents ============================================================================== Summary Analysis Demonstration...