Scientific Linux Security Update : openssl on SL6.x, SL7.x i386/x86_64 (20170220)

Security Fixes : - An integer underflow leading to an out of bounds read flaw was found in OpenSSL. A remote attacker could possibly use this flaw to crash a 32-bit TLS/SSL server or client using OpenSSL if it used the RC4-MD5 cipher suite. CVE-2017-3731 - A denial of service flaw was found in th...

Scientific Linux Security Update : bind on SL7.x x86_64 (20170215)

Security Fixes : - A denial of service flaw was found in the way BIND handled query responses when both DNS64 and RPZ were used. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure or a NULL pointer dereference via a specially crafted DNS response...

Scientific Linux Security Update : spice on SL7.x x86_64 (20170205)

Security Fixes : - A vulnerability was discovered in spice in the server's protocol handling. An authenticated attacker could send crafted messages to the spice server causing a heap overflow leading to a crash or possible code execution. CVE-2016-9577 - A vulnerability was discovered in spice in...

Scientific Linux Security Update : spice-server on SL6.x x86_64 (20170205)

Security Fixes : - A vulnerability was discovered in spice in the server's protocol handling. An authenticated attacker could send crafted messages to the spice server causing a heap overflow leading to a crash or possible code execution. CVE-2016-9577 - A vulnerability was discovered in spice in...

Scientific Linux Security Update : ntp on SL6.x, SL7.x i386/x86_64 (20170206)

Security Fixes : - It was found that when ntp is configured with rate limiting for all associations the limits are also applied to responses received from its configured sources. A remote attacker who knows the sources can cause a denial of service by preventing ntpd from accepting valid response...

Scientific Linux Security Update : thunderbird on SL5.x, SL6.x, SL7.x i386/x86_64 (20170202)

This update upgrades Thunderbird to version 45.7.0. Security Fixes : - Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running...

Scientific Linux Security Update : libtiff on SL6.x, SL7.x i386/x86_64 (20170201)

Security Fixes : - Multiple flaws have been discovered in libtiff. A remote attacker could exploit these flaws to cause a crash or memory corruption and, possibly, execute arbitrary code by tricking an application linked against libtiff into processing specially crafted files. CVE-2016-9533,...

Scientific Linux Security Update : firefox on SL5.x, SL6.x, SL7.x i386/x86_64 (20170125)

This update upgrades Firefox to version 45.7.0 ESR. Security Fixes : - Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox...

Scientific Linux Security Update : mysql on SL6.x i386/x86_64 (20170124)

Security Fixes : - It was discovered that the MySQL logging functionality allowed writing to MySQL configuration files. An administrative database user, or a database user with FILE privileges, could possibly use this flaw to run arbitrary commands with root privileges on the system running the...

Scientific Linux Security Update : squid on SL7.x x86_64 (20170124)

Security Fixes : - It was found that squid did not properly remove connection specific headers when answering conditional requests using a cached request. A remote attacker could send a specially crafted request to an HTTP server via the squid proxy and steal private data from other connections...

Scientific Linux Security Update : java-1.8.0-openjdk on SL6.x, SL7.x i386/x86_64 (20170120)

Security Fixes : - It was discovered that the RMI registry and DCG implementations in the RMI component of OpenJDK performed deserialization of untrusted inputs. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of RMI registry or a Java RMI application...

Scientific Linux Security Update : squid34 on SL6.x i386/x86_64 (20170124)

Security Fixes : - It was found that squid did not properly remove connection specific headers when answering conditional requests using a cached request. A remote attacker could send a specially crafted request to an HTTP server via the squid proxy and steal private data from other connections...

Scientific Linux Security Update : qemu-kvm on SL7.x x86_64 (20170117)

Security Fixes : - An out-of-bounds read-access flaw was found in the QEMU emulator built with IP checksum routines. The flaw could occur when computing a TCP/UDP packet's checksum, because a QEMU function used the packet's payload length without checking against the data buffer's size. A user...

Scientific Linux Security Update : kernel on SL7.x x86_64 (20170117)

To see the complete list of bug fixes, users are directed to the related Knowledge Article : Security Fixes : - A use-after-free vulnerability was found in the kernel's socket recvmmsg subsystem. This may allow remote attackers to corrupt memory and may allow execution of arbitrary code. This...

Scientific Linux Security Update : bind on SL5.x, SL6.x i386/x86_64 (20170116)

Security Fixes : - A denial of service flaw was found in the way BIND handled a query response containing inconsistent DNSSEC information. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. CVE-2016-9147...

Scientific Linux Security Update : bind97 on SL5.x i386/x86_64 (20170116)

Security Fixes : - A denial of service flaw was found in the way BIND handled a query response containing inconsistent DNSSEC information. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. CVE-2016-9147...

Scientific Linux Security Update : bind on SL7.x x86_64 (20170116)

Security Fixes : - A denial of service flaw was found in the way BIND processed a response to an ANY query. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. CVE-2016-9131 - A denial of service flaw was found in t...

Scientific Linux Security Update : gstreamer-plugins-good on SL7.x x86_64 (20170105)

Security Fixes : - Multiple flaws were discovered in GStreamer's FLC/FLI/FLX media file format decoding plug-in. A remote attacker could use these flaws to cause an application using GStreamer to crash or, potentially, execute arbitrary code with the privileges of the user running the application...

Scientific Linux Security Update : gstreamer-plugins-bad-free on SL7.x x86_64 (20170105)

Security Fixes : - An integer overflow flaw, leading to a heap-based buffer overflow, was found in GStreamer's VMware VMnc video file format decoding plug-in. A remote attacker could use this flaw to cause an application using GStreamer to crash or, potentially, execute arbitrary code with the...

Scientific Linux Security Update : gstreamer1-plugins-bad-free on SL7.x x86_64 (20170105)

Security Fixes : - An integer overflow flaw, leading to a heap-based buffer overflow, was found in GStreamer's VMware VMnc video file format decoding plug-in. A remote attacker could use this flaw to cause an application using GStreamer to crash or, potentially, execute arbitrary code with the...