Scientific Linux Security Update : squid on SL7.x x86_64 (20161103)

The following packages have been upgraded to a newer upstream version: squid 3.5.20. Security Fixes : - Incorrect boundary checks were found in the way squid handled headers in HTTP responses, which could lead to an assertion failure. A malicious HTTP server could use this flaw to crash squid usi...

Scientific Linux Security Update : thunderbird on SL5.x, SL6.x, SL7.x i386/x86_64 (20161205)

This update upgrades Thunderbird to version 45.5.1. Security Fixes : - A flaw was found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird...

Scientific Linux Security Update : libguestfs and virt-p2v on SL7.x x86_64 (20161103)

Virt-p2v is a tool for conversion of a physical server to a virtual guest. The following packages have been upgraded to a newer upstream version: libguestfs 1.32.7, virt-p2v 1.32.7. Security Fixes : - An integer conversion flaw was found in the way OCaml's String handled its length. Certain...

Scientific Linux Security Update : qemu-kvm on SL7.x x86_64 (20161103)

Security Fixes : - An integer overflow flaw and an out-of-bounds read flaw were found in the way QEMU's VGA emulator set certain VGA registers while in VBE mode. A privileged guest user could use this flaw to crash the QEMU process instance. CVE-2016-3712 - An infinite loop flaw was found in the...

Scientific Linux Security Update : firefox on SL5.x, SL6.x, SL7.x i386/x86_64 (20161201)

This update upgrades Firefox to version 45.5.1 ESR. Security Fixes : - A flaw was found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox...

Scientific Linux Security Update : php on SL7.x x86_64 (20161103)

Security Fixes : - A flaw was found in the way certain error conditions were handled by bzread function in PHP. An attacker could use this flaw to upload a specially crafted bz2 archive which, when parsed via the vulnerable function, could cause the application to crash or execute arbitrary code...

Scientific Linux Security Update : bind on SL7.x x86_64 (20161103)

Security Fixes : - A denial of service flaw was found in the way BIND handled responses containing a DNAME answer. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. CVE-2016-8864 %NASLMINLEVEL 70300 C Tenable...

Scientific Linux Security Update : libreoffice on SL7.x x86_64 (20161103)

The following packages have been upgraded to a newer upstream version: libreoffice 5.0.6.2. Security Fixes : - Multiple flaws were found in the Lotus Word Pro LWP document format parser in LibreOffice. By tricking a user into opening a specially crafted LWP document, an attacker could possibly us...

Scientific Linux Security Update : mariadb on SL7.x x86_64 (20161103)

The following packages have been upgraded to a newer upstream version: mariadb 5.5.52. Security Fixes : - It was discovered that the MariaDB logging functionality allowed writing to MariaDB configuration files. An administrative database user, or a database user with FILE privileges, could possib...

Scientific Linux Security Update : dhcp on SL7.x x86_64 (20161103)

Security Fixes : - A resource-consumption flaw was discovered in the DHCP server. dhcpd did not restrict the number of open connections to OMAPI and failover ports. A remote attacker able to establish TCP connections to one of these ports could use this flaw to cause dhcpd to exit unexpectedly,...

Scientific Linux Security Update : wget on SL7.x x86_64 (20161103)

Security Fixes : - It was found that wget used a file name provided by the server for the downloaded file when following an HTTP redirect to a FTP server resource. This could cause wget to create a file with a different name than expected, possibly allowing the server to execute arbitrary code on...

Scientific Linux Security Update : mod_nss on SL7.x x86_64 (20161103)

The following packages have been upgraded to a newer upstream version: modnss 1.0.14. Security Fixes : - A flaw was found in the way modnss parsed certain OpenSSL-style cipher strings. As a result, modnss could potentially use ciphers that were not intended to be enabled. CVE-2016-3099 This issue...

Scientific Linux Security Update : postgresql on SL7.x x86_64 (20161103)

The following packages have been upgraded to a newer upstream version: postgresql 9.2.18. Security Fixes : - A flaw was found in the way PostgreSQL server handled certain SQL statements containing CASE/WHEN commands. A remote, authenticated attacker could use a specially crafted SQL statement to...

Scientific Linux Security Update : firefox on SL5.x, SL6.x, SL7.x i386/x86_64 (20161214)

This update upgrades Firefox to version 45.6.0 ESR. Security Fixes : - Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox...

Scientific Linux Security Update : curl on SL7.x x86_64 (20161103)

Security Fixes : - It was found that the libcurl library did not prevent TLS session resumption when the client certificate had changed. An attacker could potentially use this flaw to hijack the authentication of the connection by leveraging a previously created connection with a different client...

Scientific Linux Security Update : firewalld on SL7.x (noarch) (20161103)

The following packages have been upgraded to a newer upstream version: firewalld 0.4.3.2. Security Fixes : - A flaw was found in the way firewalld allowed certain firewall configurations to be modified by unauthenticated users. Any locally logged in user could use this flaw to tamper or change...

Scientific Linux Security Update : systemd on SL7.x x86_64 (20161103)

Security Fixes : - A flaw was found in the way systemd handled empty notification messages. A local attacker could use this flaw to make systemd freeze its execution, preventing further management of system services, system shutdown, or zombie process collection via systemd. CVE-2016-7795 Bug Fix...

Scientific Linux Security Update : sudo on SL6.x, SL7.x i386/x86_64 (20161206)

Security Fixes : - It was discovered that the sudo noexec restriction could have been bypassed if application run via sudo executed system, popen, or wordexp C library functions with a user-supplied argument. A local user permitted to run such application via sudo with noexec restriction could us...

Scientific Linux Security Update : poppler on SL7.x x86_64 (20161103)

Security Fixes : - A heap-buffer overflow was found in the poppler library. An attacker could create a malicious PDF file that would cause applications that use poppler such as Evince to crash or, potentially, execute arbitrary code when opened. CVE-2015-8868 Additional Changes : %NASLMINLEVEL...

Scientific Linux Security Update : kernel on SL7.x x86_64 (20161103)

Security Fixes : - It was found that the Linux kernel's IPv6 implementation mishandled socket options. A local attacker could abuse concurrent access to the socket options to escalate their privileges, or cause a denial of service use-after-free and system crash via a crafted sendmsg system call...