Scientific Linux Security Update : bind on SL7.x x86_64 (20161103)

Security Fixes : - A denial of service flaw was found in the way BIND handled responses containing a DNAME answer. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. CVE-2016-8864 %NASLMINLEVEL 70300 C Tenable...

Scientific Linux Security Update : firefox on SL5.x, SL6.x, SL7.x i386/x86_64 (20161214)

This update upgrades Firefox to version 45.6.0 ESR. Security Fixes : - Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox...

Scientific Linux Security Update : expat on SL6.x, SL7.x i386/x86_64 (20161128)

Security Fixes : - An out-of-bounds read flaw was found in the way Expat processed certain input. A remote attacker could send specially crafted XML that, when parsed by an application using the Expat library, would cause that application to crash or, possibly, execute arbitrary code with the...

Scientific Linux Security Update : libreswan on SL7.x x86_64 (20161103)

Security Fixes : - A traffic amplification flaw was found in the Internet Key Exchange version 1 IKEv1 protocol. A remote attacker could use a libreswan server with IKEv1 enabled in a network traffic amplification denial of service attack against other hosts on the network by sending UDP packets...

Scientific Linux Security Update : memcached on SL7.x x86_64 (20161123)

Security Fixes : - Two integer overflow flaws, leading to heap-based buffer overflows, were found in the memcached binary protocol. An attacker could create a specially crafted message that would cause the memcached server to crash or, potentially, execute arbitrary code. CVE-2016-8704,...

Scientific Linux Security Update : pcs on SL7.x x86_64 (20161103)

The following packages have been upgraded to a newer upstream version: pcs 0.9.152. Security Fixes : - A Cross-Site Request Forgery CSRF flaw was found in the pcsd web UI. A remote attacker could provide a specially crafted web page that, when visited by a user with a valid pcsd session, would...

Scientific Linux Security Update : qemu-kvm on SL7.x x86_64 (20161103)

Security Fixes : - An integer overflow flaw and an out-of-bounds read flaw were found in the way QEMU's VGA emulator set certain VGA registers while in VBE mode. A privileged guest user could use this flaw to crash the QEMU process instance. CVE-2016-3712 - An infinite loop flaw was found in the...

Scientific Linux Security Update : tomcat on SL7.x (noarch) (20161103)

The following packages have been upgraded to a newer upstream version: tomcat 7.0.69. Security Fixes : - A CSRF flaw was found in Tomcat's the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an...

Scientific Linux Security Update : libguestfs and virt-p2v on SL7.x x86_64 (20161103)

Virt-p2v is a tool for conversion of a physical server to a virtual guest. The following packages have been upgraded to a newer upstream version: libguestfs 1.32.7, virt-p2v 1.32.7. Security Fixes : - An integer conversion flaw was found in the way OCaml's String handled its length. Certain...

Scientific Linux Security Update : memcached on SL6.x i386/x86_64 (20161123)

Security Fixes : - Two integer overflow flaws, leading to heap-based buffer overflows, were found in the memcached binary protocol. An attacker could create a specially crafted message that would cause the memcached server to crash or, potentially, execute arbitrary code. CVE-2016-8704,...

Scientific Linux Security Update : firefox on SL5.x, SL6.x, SL7.x i386/x86_64 (20161116)

This update upgrades Firefox to version 45.5.0 ESR. Security Fixes : - Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox...

Scientific Linux Security Update : 389-ds-base on SL6.x i386/x86_64 (20161115)

Security Fixes : - It was found that 389 Directory Server was vulnerable to a flaw in which the default ACI Access Control Instructions could be read by an anonymous user. This could lead to leakage of sensitive information. CVE-2016-5416 - An information disclosure flaw was found in 389 Director...

Scientific Linux Security Update : nss and nss-util on SL5.x, SL6.x, SL7.x i386/x86_64 (20161116)

The nss-util packages provide utilities for use with the Network Security Services NSS libraries. The following packages have been upgraded to a newer upstream version: nss 3.12.3, nss-util 3.12.3. Security Fixes : - Multiple buffer handling flaws were found in the way NSS handled cryptographic...

Scientific Linux Security Update : policycoreutils on SL6.x, SL7.x i386/x86_64

Security Fixes : - It was found that the sandbox tool provided in policycoreutils was vulnerable to a TIOCSTI ioctl attack. A specially crafted program executed via the sandbox command could use this flaw to execute arbitrary commands in the context of the parent shell, escaping the sandbox...

Scientific Linux Security Update : pacemaker on SL6.x i386/x86_64 (20161108)

Security Fixes : - An authorization flaw was found in Pacemaker, where it did not properly guard its IPC interface. An attacker with an unprivileged account on a Pacemaker node could use this flaw to, for example, force the Local Resource Manager daemon to execute a script as root and thereby gai...

Scientific Linux Security Update : libgcrypt on SL6.x i386/x86_64 (20161108)

Security Fixes : - A design flaw was found in the libgcrypt PRNG Pseudo-Random Number Generator. An attacker able to obtain the first 580 bytes of the PRNG output could predict the following 20 bytes. CVE-2016-6313 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C...

Scientific Linux Security Update : bind on SL5.x, SL6.x i386/x86_64 (20161102)

Security Fixes : - A denial of service flaw was found in the way BIND handled responses containing a DNAME answer. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. CVE-2016-8864 %NASLMINLEVEL 70300 C Tenable...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64 (20161028) (Dirty COW)

Security Fixes : - A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write COW breakage of private read-only memory mappings. An unprivileged, local user could use this flaw to gain write access to otherwise read-only memory mappings and thus increase...

Scientific Linux Security Update : Important: kernel on SL6.x i386/x86_64 (20161025) (Dirty COW)

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes : - A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write COW breakage of private read-only memory mappings. An unprivileged, local user could use thi...

Scientific Linux Security Update : kernel on SL7.x x86_64 (20161024) (Dirty COW)

Security Fixes : - A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write COW breakage of private read-only memory mappings. An unprivileged, local user could use this flaw to gain write access to otherwise read-only memory mappings and thus increase...