Scientific Linux Security Update : java (jdk 1.6.0) on SL4.x, SL5.x i386/x86_64

This update fixes two vulnerabilities in the Sun Java 6 Runtime Environment and the Sun Java 6 Software Development Kit. Further information about these flaws can be found on the Oracle Security Alert page listed in the References section. CVE-2010-0886, CVE-2010-0887 All running instances of Sun...

Scientific Linux Security Update : systemtap on SL4.x i386/x86_64

It was discovered that staprun did not properly sanitize the environment before executing the modprobe command to load an additional kernel module. A local, unprivileged user could use this flaw to escalate their privileges. CVE-2010-4170 Note: On Scientific Linux 4, an attacker must be a member ...

Scientific Linux Security Update : seamonkey on SL4.x i386/x86_64

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. CVE-2010-3767, CVE-2010-3772, CVE-2010-3776 A flaw was found in th...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64

This update fixes the following security issues : - instances of unsafe sprintf use were found in the Linux kernel Bluetooth implementation. Creating a large number of Bluetooth L2CAP, SCO, or RFCOMM sockets could result in arbitrary memory pages being overwritten. A local, unprivileged user coul...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64

This update fixes the following security issue : - The rdspagecopyuser function in the Linux kernel Reliable Datagram Sockets RDS protocol implementation was missing sanity checks. A local, unprivileged user could use this flaw to escalate their privileges. CVE-2010-3904, Important The system mus...

Scientific Linux Security Update : avahi on SL5.x i386/x86_64

Hugo Dias discovered a denial of service flaw in avahi-daemon. A remote attacker on the same local area network LAN could send a specially crafted mDNS Multicast DNS packet that would cause avahi-daemon to exit unexpectedly due to a failed assertion check. CVE-2008-5081 After installing the updat...

Scientific Linux Security Update : perl on SL3.x, SL4.x, SL5.x i386/x86_64

A flaw was found in Perl's regular expression engine. A specially crafted regular expression with Unicode characters could trigger a buffer overflow, causing Perl to crash, or possibly execute arbitrary code with the privileges of the user running Perl. CVE-2008-1927 %NASLMINLEVEL 70300 C Tenable...

Scientific Linux Security Update : seamonkey on SL3.x, SL4.x i386/x86_64

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey. CVE-2009-1392, CVE-2009-1833, CVE-2009-1838, CVE-2009-1841 A flaw was found in the...

Scientific Linux Security Update : bind on SL5.x i386/x86_64

It was discovered that named did not invalidate previously cached RRSIG records when adding an NCACHE record for the same entry to the cache. A remote attacker allowed to send recursive DNS queries to named could use this flaw to crash named. CVE-2010-3613 A flaw was found in the DNSSEC validatio...

Scientific Linux Security Update : php on SL6.x i386/x86_64

A flaw was found in the way PHP converted certain floating point values from string representation to a number. If a PHP script evaluated an attacker's input in a numeric context, the PHP interpreter could cause high CPU usage until the script execution time limit is reached. This issue only...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64

This update fixes the following security issues : - multiple flaws were found in the mmap and mremap implementations. A local user could use these flaws to cause a local denial of service or escalate their privileges. CVE-2010-0291, Important - a NULL pointer dereference flaw was found in the Fas...

Scientific Linux Security Update : openoffice.org on SL3.x, SL4.x, SL5.x i386/x86_64

SureRun Security Team discovered an integer overflow flaw leading to a heap buffer overflow in the Windows Metafile WMF image format parser. An attacker could create a carefully crafted document containing a malicious WMF file that could cause OpenOffice.org to crash, or, possibly, execute...

Scientific Linux Security Update : tar on SL3.x, SL4.x, SL5.x i386/x86_64

CVE-2007-4476 tar/cpio stack crashing in safernamesuffix CVE-2010-0624 tar, cpio: Heap-based buffer overflow by expanding a specially crafted archive A heap-based buffer overflow flaw was found in the way tar expanded archive files. If a user were tricked into expanding a specially crafted archiv...

Scientific Linux Security Update : openldap on SL5.x i386/x86_64

Multiple flaws were discovered in the way the slapd daemon handled modify relative distinguished name modrdn requests. An authenticated user with privileges to perform modrdn operations could use these flaws to crash the slapd daemon via specially crafted modrdn requests. CVE-2010-0211,...

Scientific Linux Security Update : poppler on SL6.x i386/x86_64

Two uninitialized pointer use flaws were discovered in poppler. An attacker could create a malicious PDF file that, when opened, would cause applications that use poppler such as Evince to crash or, potentially, execute arbitrary code. CVE-2010-3702, CVE-2010-3703 An array index error was found i...

Scientific Linux Security Update : seamonkey on SL3.x, SL4.x i386/x86_64

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. CVE-2010-3169 A buffer overflow flaw was found in SeaMonkey. A web...

Scientific Linux Security Update : openssl on SL5.x i386/x86_64 (20120124)

OpenSSL is a toolkit that implements the Secure Sockets Layer SSL v2/v3 and Transport Layer Security TLS v1 protocols, as well as a full-strength, general purpose cryptography library. It was discovered that the Datagram Transport Layer Security DTLS protocol implementation in OpenSSL leaked timi...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64 (20120209)

The kernel packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issues : - Using the SGIO ioctl to issue SCSI requests to partitions or LVM volumes resulted in the requests being passed to the underlying block device. If a privileged...

Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20120710)

The kernel packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issues : - A NULL pointer dereference flaw was found in the nfctfrag6reasm function in the Linux kernel's netfilter IPv6 connection tracking implementation. A remote...

Scientific Linux Security Update : unzip on SL3.x i386/x86_64

An invalid pointer flaw was found in unzip. If a user ran unzip on a specially crafted file, an attacker could execute arbitrary code with that user's privileges. CVE-2008-0888 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...