Scientific Linux Security Update : tzdata on SL3.x, SL4.x, SL5.x i386/x86_64

This updated package addresses the following changes to Daylight Savings Time DST observations : - as of June 24, 2008, for Brazil, all of Acre and parts of Amazonas that used UTC+5, now use UTC+4. Previously, only parts of Para used UTC+3. Now, all of Para use UTC+3. - Mauritius is introducing D...

Scientific Linux Security Update : subversion on SL4.x, SL5.x i386/x86_64

CVE-2009-2411 subversion: multiple heap overflow issues Matt Lewis, of Google, reported multiple heap overflow flaws in Subversion server and client when parsing binary deltas. A malicious user with commit access to a server could use these flaws to cause a heap overflow on that server. A malicio...

Scientific Linux Security Update : firefox on SL3.x i386/x86_64

There were problems with positioning the cursor in text input boxes, like the one for the URL, the search engine, and also widgets embeeded in web pages: This problem has been fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

Scientific Linux Security Update : icu on SL5.x i386/x86_64

A flaw was found in the way ICU processed certain, invalid byte sequences during Unicode conversion. If an application used ICU to decode malformed, multibyte character data, it may have been possible to bypass certain content protection mechanisms, or display information in a manner misleading t...

Scientific Linux Security Update : cups on SL3.x, SL4.x, SL5.x i386/x86_64

A buffer overflow flaw was discovered in the SGI image format decoding routines used by the CUPS image converting filter 'imagetops'. An attacker could create a malicious SGI image file that could, possibly, execute arbitrary code as the 'lp' user if the file was printed. CVE-2008-3639 An integer...

Scientific Linux Security Update : pam on SL4.x i386/x86_64

A flaw was found in the way pamconsole set console device permissions. It was possible for various console devices to retain ownership of the console user after logging out, possibly leaking information to another local user. CVE-2007-1716 A flaw was found in the way the PAM library wrote account...

Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20120710)

The kernel packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issues : - A NULL pointer dereference flaw was found in the nfctfrag6reasm function in the Linux kernel's netfilter IPv6 connection tracking implementation. A remote...

Scientific Linux Security Update : unzip on SL3.x i386/x86_64

An invalid pointer flaw was found in unzip. If a user ran unzip on a specially crafted file, an attacker could execute arbitrary code with that user's privileges. CVE-2008-0888 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

Scientific Linux Security Update : pam_krb5 on SL5.x i386/x86_64

A flaw was found in pamkrb5. In some non-default configurations specifically, those where pamkrb5 would be the first module to prompt for a password, the text of the password prompt varied based on whether or not the username provided was a username known to the system. A remote attacker could us...

Scientific Linux Security Update : seamonkey on SL3.x, SL4.x i386/x86_64

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey. CVE-2009-1392, CVE-2009-1833, CVE-2009-1838, CVE-2009-1841 A flaw was found in the...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64

This update fixes the following security issue : - The rdspagecopyuser function in the Linux kernel Reliable Datagram Sockets RDS protocol implementation was missing sanity checks. A local, unprivileged user could use this flaw to escalate their privileges. CVE-2010-3904, Important The system mus...

Scientific Linux Security Update : fence on SL4.x i386/x86_64

Insecure temporary file use flaws were found in fenceegenera, fenceapc, and fenceapcsnmp. A local attacker could use these flaws to overwrite an arbitrary file writable by the victim running those utilities via a symbolic link attack. CVE-2008-4192, CVE-2008-4579 This update also fixes the...

Scientific Linux Security Update : krb5-appl on SL6.x i386/x86_64

The krb5-appl packages provide Kerberos-aware telnet, ftp, rcp, rsh, and rlogin clients and servers. While these have been replaced by tools such as OpenSSH in most environments, they remain in use in others. It was found that gssftp, a Kerberos-aware FTP server, did not properly drop privileges....

Scientific Linux Security Update : kernel on SL5.x i386/x86_64

CVE-2007-4567 kernel: ipv6hopjumbo remote system crash CVE-2009-4537 kernel: r8169 issue reported at 26c3 CVE-2009-4538 kernel: e1000e frame fragment issue CVE-2009-4536 kernel: e1000 issue reported at 26c3 This update fixes the following security issues : - a flaw was found in the IPv6 Extension...

Scientific Linux Security Update : ntp on SL4.x i386/x86_64

A buffer overflow flaw was discovered in the ntpd daemon's NTPv4 authentication code. If ntpd was configured to use public key cryptography for NTP packet authentication, a remote attacker could use this flaw to send a specially crafted request packet that could crash ntpd or, potentially, execut...

Scientific Linux Security Update : bind97 on SL5.x i386/x86_64

"The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'deprecatednasllevel.inc'; include'compat.inc'; if...

Scientific Linux Security Update : dhcp on SL6.x i386/x86_64

The Dynamic Host Configuration Protocol DHCP is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. A denial of service flaw was found in the way the dhcpd daemon handled DH...

Scientific Linux Security Update : gd on SL4.x, SL5.x i386/x86_64

Multiple issues were discovered in the gd GIF image-handling code. A carefully-crafted GIF file could cause a crash or possibly execute code with the privileges of the application using the gd library. CVE-2006-4484, CVE-2007-3475, CVE-2007-3476 An integer overflow was discovered in the...

Scientific Linux Security Update : bind on SL5.x, SL6.x i386/x86_64

"The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'deprecatednasllevel.inc'; include'compat.inc'; if...

Scientific Linux Security Update : openssl096b on SL3.x, SL4.x i386/x86_64

CVE-2009-3245 openssl: missing bnwexpand return value checks It was discovered that OpenSSL did not always check the return value of the bnwexpand function. An attacker able to trigger a memory allocation failure in that function could cause an application using the OpenSSL library to crash or,...