Scientific Linux Security Update : thunderbird on SL5.x, SL6.x i386/x86_64 (20140319)

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. CVE-2014-1493, CVE-2014-1510, CVE-2014-1511, CVE-2014-1512,...

Scientific Linux Security Update : mutt on SL6.x i386/x86_64 (20140317)

A heap-based buffer overflow flaw was found in the way mutt processed certain email headers. A remote attacker could use this flaw to send an email with specially crafted headers that, when processed, could cause mutt to crash or, potentially, execute arbitrary code with the permissions of the us...

Scientific Linux Security Update : samba on SL5.x i386/x86_64 (20140317)

It was discovered that the Samba Web Administration Tool SWAT did not protect against being opened in a web page frame. A remote attacker could possibly use this flaw to conduct a clickjacking attack against SWAT users or users with an active SWAT session. CVE-2013-0213 A flaw was found in the...

Scientific Linux Security Update : udisks on SL6.x i386/x86_64 (20140313)

A stack-based buffer overflow flaw was found in the way udisks handled files with long path names. A malicious, local user could use this flaw to create a specially crafted directory structure that, when processed by the udisks daemon, could lead to arbitrary code execution with the privileges of...

Scientific Linux Security Update : 389-ds-base on SL6.x i386/x86_64 (20140313)

It was discovered that the 389 Directory Server did not properly handle certain SASL-based authentication mechanisms. A user able to authenticate to the directory using these SASL mechanisms could connect as any other directory user, including the administrative Directory Manager account. This...

Scientific Linux Security Update : sudo on SL5.x i386/x86_64 (20140310)

A flaw was found in the way sudo handled its blacklist of environment variables. When the 'envreset' option was disabled, a user permitted to run certain commands via sudo could use this flaw to run such a command with one of the blacklisted environment variables set, allowing them to run an...

Scientific Linux Security Update : subversion on SL5.x, SL6.x i386/x86_64 (20140305)

A flaw was found in the way the moddavsvn module handled OPTIONS requests. A remote attacker with read access to an SVN repository served via HTTP could use this flaw to cause the httpd process that handled such a request to crash. CVE-2014-0032 A flaw was found in the way Subversion handled file...

Scientific Linux Version Detection

Binary data 8148.prm...

Scientific Linux Security Update : gnutls on SL6.x i386/x86_64 (20140303)

It was discovered that GnuTLS did not correctly handle certain errors that could occur during the verification of an X.509 certificate, causing it to incorrectly report a successful verification. An attacker could use this flaw to create a specially crafted certificate that could be accepted by...

Scientific Linux Security Update : gnutls on SL5.x i386/x86_64 (20140303)

It was discovered that GnuTLS did not correctly handle certain errors that could occur during the verification of an X.509 certificate, causing it to incorrectly report a successful verification. An attacker could use this flaw to create a specially crafted certificate that could be accepted by...

Scientific Linux Security Update : libtiff on SL5.x i386/x86_64 (20140227)

A heap-based buffer overflow and a use-after-free flaw were found in the tiff2pdf tool. An attacker could use these flaws to create a specially crafted TIFF file that would cause tiff2pdf to crash or, possibly, execute arbitrary code. CVE-2013-1960, CVE-2013-4232 Multiple buffer overflow flaws we...

Scientific Linux Security Update : libtiff on SL6.x i386/x86_64 (20140227)

A heap-based buffer overflow and a use-after-free flaw were found in the tiff2pdf tool. An attacker could use these flaws to create a specially crafted TIFF file that would cause tiff2pdf to crash or, possibly, execute arbitrary code. CVE-2013-1960, CVE-2013-4232 Multiple buffer overflow flaws we...

Scientific Linux Security Update : postgresql84 and postgresql on SL5.x, SL6.x i386/x86_64 (20140225)

Multiple stack-based buffer overflow flaws were found in the date/time implementation of PostgreSQL. An authenticated database user could provide a specially crafted date/time value that, when processed, could cause PostgreSQL to crash or, potentially, execute arbitrary code with the permissions ...

Scientific Linux Security Update : openldap on SL5.x i386/x86_64 (20140224)

A denial of service flaw was found in the way the OpenLDAP server daemon slapd performed reference counting when using the rwm rewrite/remap overlay. A remote attacker able to query the OpenLDAP server could use this flaw to crash the server by immediately unbinding from the server after sending ...

Scientific Linux Security Update : openswan on SL5.x, SL6.x i386/x86_64 (20140218)

A NULL pointer dereference flaw was discovered in the way Openswan's IKE daemon processed IKEv2 payloads. A remote attacker could send specially crafted IKEv2 payloads that, when processed, would lead to a denial of service daemon crash, possibly causing existing VPN connections to be dropped...

Scientific Linux Security Update : mysql55-mysql on SL5.x i386/x86_64 (20140218)

A buffer overflow flaw was found in the way the MySQL command line client tool mysql processed excessively long version strings. If a user connected to a malicious MySQL server via the mysql client, the server could use this flaw to crash the mysql client or, potentially, execute arbitrary code a...

Scientific Linux Security Update : piranha on SL5.x i386/x86_64 (20140213)

It was discovered that the Piranha Configuration Tool did not properly restrict access to its web pages. A remote attacker able to connect to the Piranha Configuration Tool web server port could use this flaw to read or modify the LVS configuration without providing valid administrative...

Scientific Linux Security Update : piranha on SL6.x i386/x86_64 (20140213)

It was discovered that the Piranha Configuration Tool did not properly restrict access to its web pages. A remote attacker able to connect to the Piranha Configuration Tool web server port could use this flaw to read or modify the LVS configuration without providing valid administrative...

Scientific Linux Security Update : kvm on SL5.x x86_64 (20140212)

A divide-by-zero flaw was found in the apicgettmcct function in KVM's Local Advanced Programmable Interrupt Controller LAPIC implementation. A privileged guest user could use this flaw to crash the host. CVE-2013-6367 A memory corruption flaw was discovered in the way KVM handled virtual APIC...

Scientific Linux Security Update : mysql on SL6.x i386/x86_64 (20140212)

CVE-2014-0386, CVE-2014-0393, CVE-2014-0401, CVE-2014-0402, CVE-2014-0412, CVE-2014-0437, CVE-2013-5908 A buffer overflow flaw was found in the way the MySQL command line client tool mysql processed excessively long version strings. If a user connected to a malicious MySQL server via the mysql...