Scientific Linux Security Update : libxml2 on SL3.x, SL4.x, SL5.x i386/x86_64

An integer overflow flaw causing a heap-based buffer overflow was found in the libxml2 XML parser. If an application linked against libxml2 processed untrusted, malformed XML content, it could cause the application to crash or, possibly, execute arbitrary code. CVE-2008-4226 A denial of service...

Scientific Linux Security Update : newt on SL3.x, SL4.x, SL5.x i386/x86_64

CVE-2009-2905 newt: heap-overflow in textbox when text reflowing A heap-based buffer overflow flaw was found in the way newt processes content that is to be displayed in a text dialog box. A local attacker could issue a specially crafted text dialog box display request direct or via a custom...

Scientific Linux Security Update : seamonkey on SL4.x i386/x86_64

An integer overflow flaw was found in the way SeaMonkey displayed certain web content. A malicious website could cause SeaMonkey to crash or execute arbitrary code with the permissions of the user running SeaMonkey. CVE-2008-2785 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptiv...

Scientific Linux Security Update : cyrus-imapd on SL4.x, SL5.x i386/x86_64

It was discovered that the Cyrus SASL library cyrus-sasl does not always reliably terminate output from the saslencode64 function used by programs using this library. The Cyrus IMAP server cyrus-imapd relied on this function's output being properly terminated. Under certain conditions, improperly...

Scientific Linux Security Update : openssl on SL5.x i386/x86_64

CVE-2009-2409 deprecate MD2 in SSL cert validation Kaminsky CVE-2009-4355 openssl significant memory leak in certain SSLv3 requests DoS It was found that the OpenSSL library did not properly re-initialize its internal state in the SSLlibraryinit function after previous calls to the...

Scientific Linux Security Update : thunderbird on SL5.x i386/x86_64

A stability bug was found in the Scientific Linux 5 Thunderbird packages released in RHSA-2008:0105. These packages were linked against an incorrect version of a library which would cause Thunderbird to randomly crash while the browser was in use. This issue did not affect the Thunderbird package...

Scientific Linux Security Update : bind on SL5.x, SL4.x, SL3.x i386/x86_64

A flaw was found in the way BIND generates outbound DNS query ids. If an attacker is able to acquire a finite set of query IDs, it becomes possible to accurately predict future query IDs. Future query ID prediction may allow an attacker to conduct a DNS cache poisoning attack, which can result in...

Scientific Linux Security Update : systemtap on SL5.x, SL6.x i386/x86_64 (20120308)

SystemTap is an instrumentation system for systems running the Linux kernel. The system allows developers to write scripts to collect data on the operation of the system. An invalid pointer read flaw was found in the way SystemTap handled malformed debugging information in DWARF format. When...

Scientific Linux Security Update : lcms on SL5.x i386/x86_64

Multiple insufficient input validation flaws were discovered in LittleCMS. An attacker could use these flaws to create a specially crafted image file which could cause an application using LittleCMS to crash, or, possibly, execute arbitrary code when opened. CVE-2008-5316, CVE-2008-5317...

Scientific Linux Security Update : qt on SL6.x i386/x86_64

Qt is a software toolkit that simplifies the task of writing and maintaining GUI Graphical User Interface applications for the X Window System. HarfBuzz is an OpenType text shaping engine. A buffer overflow flaw was found in the harfbuzz module in Qt. If a user loaded a specially crafted font fil...

Scientific Linux Security Update : perl on SL4.x, SL3.x i386/x86_64

A flaw was found in Perl's regular expression engine. Specially crafted input to a regular expression can cause Perl to improperly allocate memory, possibly resulting in arbitrary code running with the permissions of the user running Perl. CVE-2007-5116 %NASLMINLEVEL 70300 C Tenable Network...

Scientific Linux Security Update : tzdata on SL3.x, SL4.x, SL5.x i386/x86_64

This updated package addresses the following changes to Daylight Savings Time DST observations : - as of June 24, 2008, for Brazil, all of Acre and parts of Amazonas that used UTC+5, now use UTC+4. Previously, only parts of Para used UTC+3. Now, all of Para use UTC+3. - Mauritius is introducing D...

Scientific Linux Security Update : bind for SL 3.0.x on i386/x86_64

CVE-2009-0696 bind: DoS assertion failure via nsupdate packets A flaw was found in the way BIND handles dynamic update message packets containing the 'ANY' record type. A remote attacker could use this flaw to send a specially crafted dynamic update packet that could cause named to exit with an...

Scientific Linux Security Update : subversion on SL4.x, SL5.x i386/x86_64

CVE-2009-2411 subversion: multiple heap overflow issues Matt Lewis, of Google, reported multiple heap overflow flaws in Subversion server and client when parsing binary deltas. A malicious user with commit access to a server could use these flaws to cause a heap overflow on that server. A malicio...

Scientific Linux Security Update : firefox on SL3.x i386/x86_64

There were problems with positioning the cursor in text input boxes, like the one for the URL, the search engine, and also widgets embeeded in web pages: This problem has been fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

Scientific Linux Security Update : mysql on SL5.x i386/x86_64

It was found that the MySQL PolyFromWKB function did not sanity check Well-Known Binary WKB data. A remote, authenticated attacker could use specially crafted WKB data to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash...

Scientific Linux Security Update : pidgin on SL6.x i386/x86_64

Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously. Multiple NULL pointer dereference flaws were found in the way the Pidgin Yahoo! Messenger Protocol plug-in handled malformed YMSG packets. A remote attacker could us...

Scientific Linux Security Update : kdebase on SL5.x, SL4.x, SL3.x i386/x86_64

A problem with the interaction between the Flash Player and the Konqueror web browser was found. The problem could lead to key presses leaking to the Flash Player applet instead of the browser. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

Scientific Linux Security Update : mysql on SL5.x i386/x86_64

A buffer overflow flaw was found in the way MySQL handled the parameters of the MySQL COMFIELDLIST network protocol command this command is sent when a client uses the MySQL mysqllistfields client library function. An authenticated database user could send a request with an excessively long table...

Scientific Linux Security Update : icu on SL5.x i386/x86_64

A flaw was found in the way ICU processed certain, invalid byte sequences during Unicode conversion. If an application used ICU to decode malformed, multibyte character data, it may have been possible to bypass certain content protection mechanisms, or display information in a manner misleading t...