Scientific Linux Security Update : libguestfs and virt-p2v on SL7.x x86_64 (20161103)

Virt-p2v is a tool for conversion of a physical server to a virtual guest. The following packages have been upgraded to a newer upstream version: libguestfs 1.32.7, virt-p2v 1.32.7. Security Fixes : - An integer conversion flaw was found in the way OCaml's String handled its length. Certain...

Scientific Linux Security Update : bind on SL7.x x86_64 (20161103)

Security Fixes : - A denial of service flaw was found in the way BIND handled responses containing a DNAME answer. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. CVE-2016-8864 %NASLMINLEVEL 70300 C Tenable...

Scientific Linux Security Update : firewalld on SL7.x (noarch) (20161103)

The following packages have been upgraded to a newer upstream version: firewalld 0.4.3.2. Security Fixes : - A flaw was found in the way firewalld allowed certain firewall configurations to be modified by unauthenticated users. Any locally logged in user could use this flaw to tamper or change...

Scientific Linux Security Update : php on SL7.x x86_64 (20161103)

Security Fixes : - A flaw was found in the way certain error conditions were handled by bzread function in PHP. An attacker could use this flaw to upload a specially crafted bz2 archive which, when parsed via the vulnerable function, could cause the application to crash or execute arbitrary code...

Scientific Linux Security Update : squid on SL7.x x86_64 (20161103)

The following packages have been upgraded to a newer upstream version: squid 3.5.20. Security Fixes : - Incorrect boundary checks were found in the way squid handled headers in HTTP responses, which could lead to an assertion failure. A malicious HTTP server could use this flaw to crash squid usi...

Scientific Linux Security Update : nettle on SL7.x x86_64 (20161103)

Security Fixes : - Multiple flaws were found in the way nettle implemented elliptic curve scalar multiplication. These flaws could potentially introduce cryptographic weaknesses into nettle's functionality. CVE-2015-8803, CVE-2015-8804, CVE-2015-8805 - It was found that nettle's RSA and DSA...

Scientific Linux Security Update : gimp on SL7.x x86_64 (20161103)

The following packages have been upgraded to a newer upstream version: gimp 2.8.16, gimp-help 2.8.2. Security Fixes : - Multiple use-after-free vulnerabilities were found in GIMP in the channel and layer properties parsing process when loading XCF files. An attacker could create a specially craft...

Scientific Linux Security Update : dhcp on SL7.x x86_64 (20161103)

Security Fixes : - A resource-consumption flaw was discovered in the DHCP server. dhcpd did not restrict the number of open connections to OMAPI and failover ports. A remote attacker able to establish TCP connections to one of these ports could use this flaw to cause dhcpd to exit unexpectedly,...

Scientific Linux Security Update : libvirt on SL7.x x86_64 (20161103)

The following packages have been upgraded to a newer upstream version: libvirt 2.0.0. Security Fixes : - It was found that the libvirt daemon, when using RBD RADOS Block Device, leaked private credentials to the process list. A local attacker could use this flaw to perform certain privileged...

Scientific Linux Security Update : mariadb on SL7.x x86_64 (20161103)

The following packages have been upgraded to a newer upstream version: mariadb 5.5.52. Security Fixes : - It was discovered that the MariaDB logging functionality allowed writing to MariaDB configuration files. An administrative database user, or a database user with FILE privileges, could possib...

Scientific Linux Security Update : openssh on SL7.x x86_64 (20161103)

Security Fixes : - It was discovered that the OpenSSH sshd daemon fetched PAM environment settings before running the login program. In configurations with UseLogin=yes and the pamenv PAM module configured to read user environment settings, a local user could use this flaw to execute arbitrary co...

Scientific Linux Security Update : util-linux on SL7.x x86_64 (20161103)

Security Fixes : - It was found that util-linux's libblkid library did not properly handle Extended Boot Record EBR partitions when reading MS-DOS partition tables. An attacker with physical USB access to a protected machine could insert a storage device with a specially crafted partition table...

Scientific Linux Security Update : NetworkManager on SL7.x x86_64 (20161103)

The following packages have been upgraded to a newer upstream version: NetworkManager 1.4.0, NetworkManager-libreswan 1.2.4, network-manager- applet 1.4.0, libnl3 3.2.28. Security Fixes : - A race condition vulnerability was discovered in NetworkManager. Temporary files were created insecurely wh...

Scientific Linux Security Update : sudo on SL6.x, SL7.x i386/x86_64 (20161206)

Security Fixes : - It was discovered that the sudo noexec restriction could have been bypassed if application run via sudo executed system, popen, or wordexp C library functions with a user-supplied argument. A local user permitted to run such application via sudo with noexec restriction could us...

Scientific Linux Security Update : python on SL7.x x86_64 (20161103)

Security Fixes : - A vulnerability was discovered in Python, in the built-in zipimporter. A specially crafted zip file placed in a module path such that it would be loaded by a later 'import' statement could cause a heap overflow, leading to arbitrary code execution. CVE-2016-5636 Additional...

Scientific Linux Security Update : fontconfig on SL7.x x86_64 (20161103)

Security Fixes : - It was found that cache files were insufficiently validated in fontconfig. A local attacker could create a specially crafted cache file to trigger arbitrary free calls, which in turn could lead to arbitrary code execution. CVE-2016-5384 Additional Changes : %NASLMINLEVEL 70300 ...

Scientific Linux Security Update : mod_nss on SL7.x x86_64 (20161103)

The following packages have been upgraded to a newer upstream version: modnss 1.0.14. Security Fixes : - A flaw was found in the way modnss parsed certain OpenSSL-style cipher strings. As a result, modnss could potentially use ciphers that were not intended to be enabled. CVE-2016-3099 This issue...

Scientific Linux Security Update : resteasy-base on SL7.x (noarch) (20161103)

Security Fixes : - It was discovered that under certain conditions RESTEasy could be forced to parse a request with SerializableProvider, resulting in deserialization of potentially untrusted data. An attacker could possibly use this flaw to execute arbitrary code with the permissions of the...

Scientific Linux Security Update : kernel on SL7.x x86_64 (20161103)

Security Fixes : - It was found that the Linux kernel's IPv6 implementation mishandled socket options. A local attacker could abuse concurrent access to the socket options to escalate their privileges, or cause a denial of service use-after-free and system crash via a crafted sendmsg system call...

Scientific Linux Security Update : poppler on SL7.x x86_64 (20161103)

Security Fixes : - A heap-buffer overflow was found in the poppler library. An attacker could create a malicious PDF file that would cause applications that use poppler such as Evince to crash or, potentially, execute arbitrary code when opened. CVE-2015-8868 Additional Changes : %NASLMINLEVEL...