Scientific Linux Security Update : dhcp on SL6.x i386/x86_64

The Dynamic Host Configuration Protocol DHCP is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. A denial of service flaw was found in the way the dhcpd daemon handled DH...

Scientific Linux Security Update : bind on SL5.x i386/x86_64

It was discovered that named did not invalidate previously cached RRSIG records when adding an NCACHE record for the same entry to the cache. A remote attacker allowed to send recursive DNS queries to named could use this flaw to crash named. CVE-2010-3613 A flaw was found in the DNSSEC validatio...

Scientific Linux Security Update : seamonkey on SL3.x, SL4.x i386/x86_64

Several use-after-free flaws were found in SeaMonkey. Visiting a web page containing malicious content could result in SeaMonkey executing arbitrary code with the privileges of the user running SeaMonkey. CVE-2010-0175, CVE-2010-0176, CVE-2010-0177 Several flaws were found in the processing of...

Scientific Linux Security Update : qt on SL5.x, SL4.x, SL3.x i386/x86_64

A flaw was found in the way Qt expanded certain UTF8 characters. It was possible to prevent a Qt-based application from properly sanitizing user supplied input. This could, for example, result in a cross-site scripting attack against the Konqueror web browser. CVE-2007-0242 A buffer overflow flaw...

Scientific Linux Security Update : gstreamer-plugins on SL3.x, SL4.x i386/x86_64

An array indexing error was found in the GStreamer's QuickTime media file format decoding plug-in. An attacker could create a carefully-crafted QuickTime media .mov file that would cause an application using GStreamer to crash or, potentially, execute arbitrary code if played by a victim...

Scientific Linux Security Update : openoffice.org on SL4.x, i386/x86_64

A heap overflow flaw was found in the RTF import filer. An attacker could create a carefully crafted RTF file that could cause OpenOffice.org to crash or possibly execute arbitrary code if the file was opened by a victim. CVE-2007-0245 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Scientific Linux Security Update : libpng on SL3.x, SL4.x, SL5.x i386/x86_64

A flaw was discovered in libpng that could result in libpng trying to free random memory if certain, unlikely error conditions occurred. If a carefully-crafted PNG file was loaded by an application linked against libpng, it could cause the application to crash or, potentially, execute arbitrary...

Scientific Linux Security Update : xen/libvirt on SL5.0 i386/x86_64

NOTE1: The xen update needs to be applied with the new kernel kernel-2.6.18-53.1.4.el5. Because a kernel does not automatically get updated, but the xen libraries do by default it is best to upgrade them both at the same time, and then reboot into the new kernel. Updating both the kernel and xen ...

Scientific Linux Security Update : kdegraphics on SL4.x, SL5.x i386/x86_64

CVE-2009-0791 xpdf: multiple integer overflows CVE-2009-1188 xpdf/poppler: SplashBitmap integer overflow CVE-2009-3608 xpdf/poppler: integer overflow in ObjectStream::ObjectStream oCERT-2009-016 CVE-2009-3609 xpdf/poppler: ImageStream::ImageStream integer overflow CVE-2009-3604 xpdf/poppler:...

Scientific Linux Security Update : ndiswrapper on SL5.x i386/x86_64

This release is corresponding with the first kernel security update with the new 2.6.18-92 kernel. We have built new kernel modules for all the kernels we have released. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

Scientific Linux Security Update : selinux-policy on SL6.x i386/x86_64 (20120709)

This update adds the following enhancements : - When the system produces a new SELinux denial, the setroubleshootd daemon executes the rpm tool to check information about the relevant packages. Previously, setroubleshootd was unable to execute the rpm tool, and AVC denials were logged in the...

Scientific Linux Security Update : kernel on SL4.x i386/x86_64

CVE-2009-3547 kernel: fs: pipe.c NULL pointer dereference This update fixes the following security issues : - a NULL pointer dereference flaw was found in each of the following functions in the Linux kernel: pipereadopen, pipewriteopen, and piperdwropen. When the mutex lock is not held, the ipipe...

Scientific Linux Security Update : thunderbird on SL6.x i386/x86_64

Mozilla Thunderbird is a standalone mail and newsgroup client. A flaw was found in the way Thunderbird handled malformed JPEG images. An HTML mail message containing a malicious JPEG image could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user...

Scientific Linux Security Update : krb5 on SL6.x i386/x86_64

Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third party, the Key Distribution Center KDC. A NULL pointer dereference flaw was found in the way the MIT Kerberos KDC processed certain TGS...

Scientific Linux Security Update : tetex on SL5.x, SL4.x, SL3.x i386/x86_64

Maurycy Prodeus discovered an integer overflow flaw in the processing of PDF files. An attacker could create a malicious PDF file that would cause TeTeX to crash or potentially execute arbitrary code when opened. CVE-2007-3387 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Scientific Linux Security Update : ruby on SL6.x i386/x86_64

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to do system management tasks. A flaw was found in the way large amounts of memory were allocated on 64-bit systems when using the BigDecimal class. A context-dependent attacker coul...

Scientific Linux Security Update : openoffice.org on SL3.x, SL4.x i386/x86_64

A heap overflow flaw was found in the EMF parser. An attacker could create a carefully crafted EMF file that could cause OpenOffice.org to crash or possibly execute arbitrary code if the malicious EMF image was added to a document or if a document containing the malicious EMF file was opened by a...

Scientific Linux Security Update : openoffice.org on SL3.x i386/x86_64

A heap overflow flaw was found in the RTF import filer. An attacker could create a carefully crafted RTF file that could cause OpenOffice.org to crash or possibly execute arbitrary code if the file was opened by a victim. CVE-2007-0245 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Scientific Linux Security Update : cups on SL5.x i386/x86_64

CVE-2010-0302 cups Incomplete fix for CVE-2009-3553 It was discovered that the cups 1.3.7-11.el54.4 security update did not fully correct the use-after-free flaw in the way CUPS handled references in its file descriptors-handling interface. A remote attacker could send specially crafted queries t...

Scientific Linux Security Update : evolution on SL3.x, SL4.x i386/x86_64

A flaw was found in the way Evolution parsed iCalendar timezone attachment data. If mail which included a carefully crafted iCalendar attachment was opened, arbitrary code could be executed as the user running Evolution. CVE-2008-1108 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...