Scientific Linux Security Update : openafs on SL5.0 i386/x86_64

In pthread-aware fileservers, the 'hostglock' pthread lock, accessed via the HLOCK and HUNLOCK macros, is used to provide safe access to host structures. This lock is required to be held when updating information pertaining to a host. The RPC handler for the GiveUpAllCallBacks RPC did not hold th...

Scientific Linux Security Update : openldap on SL5.x i386/x86_64

A flaw was found in the way OpenLDAP handled authentication failures being passed from an OpenLDAP slave to the master. If OpenLDAP was configured with a chain overlay and it forwarded authentication failures, OpenLDAP would bind to the directory as an anonymous user and return success, rather th...

Scientific Linux Security Update : libxml2 on SL3.x, SL4.x, SL5.x i386/x86_64

An integer overflow flaw causing a heap-based buffer overflow was found in the libxml2 XML parser. If an application linked against libxml2 processed untrusted, malformed XML content, it could cause the application to crash or, possibly, execute arbitrary code. CVE-2008-4226 A denial of service...

Scientific Linux Security Update : mysql on SL5.x i386/x86_64

It was found that the MySQL PolyFromWKB function did not sanity check Well-Known Binary WKB data. A remote, authenticated attacker could use specially crafted WKB data to crash mysqld. This issue only caused a temporary denial of service, as mysqld was automatically restarted after the crash...

Scientific Linux Security Update : krb5 on SL3.x, SL4.x, SL5.x i386/x86_64

A NULL pointer dereference flaw was discovered in the MIT Kerberos Generic Security Service Application Program Interface GSS-API library. A remote, authenticated attacker could use this flaw to crash any server application using the GSS-API authentication mechanism, by sending a specially crafte...

Scientific Linux Security Update : bind for SL 3.0.x on i386/x86_64

CVE-2009-0696 bind: DoS assertion failure via nsupdate packets A flaw was found in the way BIND handles dynamic update message packets containing the 'ANY' record type. A remote attacker could use this flaw to send a specially crafted dynamic update packet that could cause named to exit with an...

Scientific Linux Security Update : icu on SL5.x i386/x86_64

A flaw was found in the way ICU processed certain, invalid byte sequences during Unicode conversion. If an application used ICU to decode malformed, multibyte character data, it may have been possible to bypass certain content protection mechanisms, or display information in a manner misleading t...

Scientific Linux Security Update : icu on SL5.x i386/x86_64

Will Drewry reported multiple flaws in the way libicu processed certain malformed regular expressions. If an application linked against ICU, such as OpenOffice.org, processed a carefully crafted regular expression, it may be possible to execute arbitrary code as the user running the application...

Scientific Linux Security Update : kernel on SL4.x i386/x86_64

This update fixes the following security issues : - Information leak flaws were found in the Linux kernel Traffic Control Unit implementation. A local attacker could use these flaws to cause the kernel to leak kernel memory to user-space, possibly leading to the disclosure of sensitive informatio...

Scientific Linux Security Update : flac on SL5.x, SL4.x i386/x86_64

A security flaw was found in the way flac processed audio data. An attacker could create a carefully crafted FLAC audio file in such a way that it could cause an application linked with flac libraries to crash or execute arbitrary code when it was opened. CVE-2007-4619 This update actually went o...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64 (20120529)

The kernel packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issue : - It was found that the datalen parameter of the sockallocsendpskb function in the Linux kernel's networking implementation was not validated before use. A local...

Scientific Linux Security Update : curl on SL5.x i386/x86_64

Wesley Miaw discovered that when deflate compression was used, libcurl could call the registered write callback function with data exceeding the documented limit. A malicious server could use this flaw to crash an application using libcurl or, potentially, execute arbitrary code. Note: This issue...

Scientific Linux Security Update : tzdata on SL3.x, SL4.x, SL5.x i386/x86_64

This updated package addresses the following changes to Daylight Savings Time DST observations : - as of June 24, 2008, for Brazil, all of Acre and parts of Amazonas that used UTC+5, now use UTC+4. Previously, only parts of Para used UTC+3. Now, all of Para use UTC+3. - Mauritius is introducing D...

Scientific Linux Security Update : xerces-j2 on SL5.x i386/x86_64

CVE-2009-2625 OpenJDK: XML parsing Denial-Of-Service 6845701 A flaw was found in the way the Apache Xerces2 Java Parser processed the SYSTEM identifier in DTDs. A remote attacker could provide a specially crafted XML file, which once parsed by an application using the Apache Xerces2 Java Parser,...

Scientific Linux Security Update : sudo on SL5.x i386/x86_64

A flaw was discovered in a way sudo handled group specifications in 'run as' lists in the sudoers configuration file. If sudo configuration allowed a user to run commands as any user of some group and the user was also a member of that group, sudo incorrectly allowed them to run defined commands...

Scientific Linux Security Update : seamonkey on SL3.x, SL4.x i386/x86_64

CVE-2009-2409 deprecate MD2 in SSL cert validation Kaminsky CVE-2009-2408 firefox/nss: doesn't handle NULL in Common Name properly CVE-2009-2654 firefox: URL bar spoofing vulnerability CVE-2009-3072 Firefox 3.5.3 3.0.14 browser engine crashes CVE-2009-3075 Firefox 3.5.2 3.0.14 JavaScript engine...

Scientific Linux Security Update : gdm on SL6.x i386/x86_64

The GNOME Display Manager GDM provides the graphical login screen, shown shortly after boot up, log out, and when user-switching. A race condition flaw was found in the way GDM handled the cache directories used to store users' dmrc and face icon files. A local attacker could use this flaw to tri...

Scientific Linux Security Update : thunderbird on SL4.x i386/x86_64

Several flaws were found in the processing of malformed HTML mail content. An HTML mail message containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. CVE-2010-0174, CVE-2010-1200, CVE-2010-1211,...

Scientific Linux Security Update : cpuspeed on SL5.x i386/x86_64

cpuspeed was moved to the security errata from the fastbugs errata because the latest kernel security update depends on it. This package adds the following enhancements : - Userspace needed to support the loading of the new Powernow-k8 module that has changed from being built in. By rectifying th...

Scientific Linux Security Update : tcpdump on SL5.x i386/x86_64

Problem description : Moritz Jodeit discovered a denial of service bug in the tcpdump IEEE 802.11 processing code. If a certain link type was explicitly specified, an attacker could inject a carefully crafted frame onto the IEEE 802.11 network that could crash a running tcpdump session...