Scientific Linux Security Update : ghostscript on SL6.x i386/x86_64 (20170104)

Security Fixes : - It was found that the ghostscript functions getenv, filenameforall and .libfile did not honor the -dSAFER option, usually used when processing untrusted documents, leading to information disclosure. A specially crafted postscript document could read environment variable, list...

Scientific Linux Security Update : ipa on SL7.x x86_64 (20170102)

Security Fixes : - It was discovered that the default IdM password policies that lock out accounts after a certain number of failed login attempts were also applied to host and service accounts. A remote unauthenticated user could use this flaw to cause a denial of service attack against kerberiz...

Scientific Linux Security Update : gstreamer-plugins-bad-free on SL6.x i386/x86_64 (20161221)

Security Fixes : - An integer overflow flaw, leading to a heap-based buffer overflow, was found in GStreamer's VMware VMnc video file format decoding plug-in. A remote attacker could use this flaw to cause an application using GStreamer to crash or, potentially, execute arbitrary code with the...

Scientific Linux Security Update : xen on SL5.x i386/x86_64 (20161220)

Security Fixes : - An out of bounds array access issue was found in the Xen virtual machine monitor, built with the QEMU ioport support. It could occur while doing ioport read/write operations, if guest was to supply a 32bit address parameter. A privileged guest user/process could use this flaw t...

Scientific Linux Security Update : vim on SL6.x, SL7.x i386/x86_64 (20161221)

Security Fixes : - A vulnerability was found in vim in how certain modeline options were treated. An attacker could craft a file that, when opened in vim with modelines enabled, could execute arbitrary commands with privileges of the user running vim. CVE-2016-1248 %NASLMINLEVEL 70300 C Tenable...

Scientific Linux Security Update : thunderbird on SL5.x, SL6.x, SL7.x i386/x86_64 (20161221)

This update upgrades Thunderbird to version 45.6.0. Security Fixes : - Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64 (20161220)

Security Fixes : - A use-after-free vulnerability was found in the kernels socket recvmmsg subsystem. This may allows remote attackers to corrupt memory and may allow execution of arbitrary code. This corruption takes place during the error handling routines within sysrecvmmsg function...

Scientific Linux Security Update : gstreamer-plugins-good on SL6.x i386/x86_64 (20161221)

Security Fixes : - Multiple flaws were discovered in GStreamer's FLC/FLI/FLX media file format decoding plug-in. A remote attacker could use these flaws to cause an application using GStreamer to crash or, potentially, execute arbitrary code with the privileges of the user running the application...

Scientific Linux Security Update : pacemaker on SL7.x x86_64 (20161104)

The following packages have been upgraded to a newer upstream version: pacemaker 1.1.15. Security Fixes : - It was found that the connection between a pacemaker cluster and a pacemakerremote node could be shut down using a new unauthenticated connection. A remote attacker could use this flaw to...

Scientific Linux Security Update : nettle on SL7.x x86_64 (20161103)

Security Fixes : - Multiple flaws were found in the way nettle implemented elliptic curve scalar multiplication. These flaws could potentially introduce cryptographic weaknesses into nettle's functionality. CVE-2015-8803, CVE-2015-8804, CVE-2015-8805 - It was found that nettle's RSA and DSA...

Scientific Linux Security Update : libreswan on SL7.x x86_64 (20161103)

Security Fixes : - A traffic amplification flaw was found in the Internet Key Exchange version 1 IKEv1 protocol. A remote attacker could use a libreswan server with IKEv1 enabled in a network traffic amplification denial of service attack against other hosts on the network by sending UDP packets...

Scientific Linux Security Update : memcached on SL7.x x86_64 (20161123)

Security Fixes : - Two integer overflow flaws, leading to heap-based buffer overflows, were found in the memcached binary protocol. An attacker could create a specially crafted message that would cause the memcached server to crash or, potentially, execute arbitrary code. CVE-2016-8704,...

Scientific Linux Security Update : tomcat on SL7.x (noarch) (20161103)

The following packages have been upgraded to a newer upstream version: tomcat 7.0.69. Security Fixes : - A CSRF flaw was found in Tomcat's the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an...

Scientific Linux Security Update : gimp on SL7.x x86_64 (20161103)

The following packages have been upgraded to a newer upstream version: gimp 2.8.16, gimp-help 2.8.2. Security Fixes : - Multiple use-after-free vulnerabilities were found in GIMP in the channel and layer properties parsing process when loading XCF files. An attacker could create a specially craft...

Scientific Linux Security Update : squid on SL7.x x86_64 (20161103)

The following packages have been upgraded to a newer upstream version: squid 3.5.20. Security Fixes : - Incorrect boundary checks were found in the way squid handled headers in HTTP responses, which could lead to an assertion failure. A malicious HTTP server could use this flaw to crash squid usi...

Scientific Linux Security Update : util-linux on SL7.x x86_64 (20161103)

Security Fixes : - It was found that util-linux's libblkid library did not properly handle Extended Boot Record EBR partitions when reading MS-DOS partition tables. An attacker with physical USB access to a protected machine could insert a storage device with a specially crafted partition table...

Scientific Linux Security Update : sudo on SL7.x x86_64 (20161103)

Security Fixes : - It was discovered that the default sudo configuration preserved the value of INPUTRC from the user's environment, which could lead to information disclosure. A local user with sudo access to a restricted program that uses readline could use this flaw to read content from...

Scientific Linux Security Update : python on SL7.x x86_64 (20161103)

Security Fixes : - A vulnerability was discovered in Python, in the built-in zipimporter. A specially crafted zip file placed in a module path such that it would be loaded by a later 'import' statement could cause a heap overflow, leading to arbitrary code execution. CVE-2016-5636 Additional...

Scientific Linux Security Update : pcs on SL7.x x86_64 (20161103)

The following packages have been upgraded to a newer upstream version: pcs 0.9.152. Security Fixes : - A Cross-Site Request Forgery CSRF flaw was found in the pcsd web UI. A remote attacker could provide a specially crafted web page that, when visited by a user with a valid pcsd session, would...

Scientific Linux Security Update : 389-ds-base on SL7.x x86_64 (20161103)

"The following packages have been upgraded to a newer upstream version: 389 -ds-base 1.3.5.10. Security Fixes : - It was found that 389 Directory Server was vulnerable to a flaw in which the default ACI Access Control Instructions could be read by an anonymous user. This could lead to leakage of...