Scientific Linux Security Update : libproxy on SL6.x i386/x86_64 (20121114)

A buffer overflow flaw was found in the way libproxy handled the downloading of proxy auto-configuration PAC files. A malicious server hosting a PAC file or a man-in-the-middle attacker could use this flaw to cause an application using libproxy to crash or, possibly, execute arbitrary code, if th...

Scientific Linux Security Update : mysql on SL6.x i386/x86_64 (20121114)

This update fixes several vulnerabilities in the MySQL database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory pages. CVE-2012-1688, CVE-2012-1690, CVE-2012-1703, CVE-2012-2749, CVE-2012-0540, CVE-2012-1689, CVE-2012-1734, CVE-2012-3163,...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64 (20121113)

The kernel packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issue : - It was found that a previous update did not correctly fix the CVE-2009-4307 issue, a divide-by-zero flaw in the ext4 file system code. A local, unprivileged use...

Scientific Linux Security Update : selinux-policy enhancement update on SL6.x i386/x86_64 (20121112)

This update adds the following enhancements : - Previously, SELinux was blocking the /usr/libexec/qemu-kvm utility during a migration of a virtual machine from Red Hat Enterprise Virtualization Manager. Consequently, such a migration attempt failed and AVC messages were returned. This update fixe...

Scientific Linux Security Update : gegl on SL6.x i386/x86_64 (20121112)

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way the gegl utility processed .ppm Portable Pixel Map image files. An attacker could create a specially crafted .ppm file that, when opened in gegl, would cause gegl to crash or, potentially, execute arbitrary...

Scientific Linux Security Update : icedtea-web on SL6.x i386/x86_64 (20121107)

This erratum also upgrades IcedTea-Web to version 1.2.2. Web browsers using the IcedTea-Web browser plug-in must be restarted for this update to take effect. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'deprecatednasllevel.inc';...

Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20121106)

A use-after-free flaw was found in the Linux kernel's memory management subsystem in the way quota handling for huge pages was performed. A local, unprivileged user could use this flaw to cause a denial of service or, potentially, escalate their privileges. CVE-2012-2133, Moderate A use-after-fre...

Scientific Linux Security Update : firefox on SL4.x i386/x86_64

Mozilla Firefox is an open source Web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as t...

Scientific Linux Security Update : seamonkey on SL4.x i386/x86_64 (fwd)

CVE-2009-2462 Mozilla Browser engine crashes CVE-2009-2463 Mozilla Base64 decoding crash CVE-2009-2466 Mozilla JavaScript engine crashes Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially,...

Scientific Linux Security Update : thunderbird on SL5.x, SL6.x i386/x86_64 (20121029)

Note: None of the issues in this advisory can be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed. After installing the...

Scientific Linux Security Update : kdelibs on SL6.x i386/x86_64 (20121030)

A heap-based buffer over-read flaw was found in the way kdelibs calculated canvas dimensions for large images. A web page containing malicious content could cause an application using kdelibs to crash or disclose portions of its memory. CVE-2012-4513 The desktop must be restarted log out, then lo...

Scientific Linux Security Update : java-1.6.0-sun on SL5.x i386/x86_64 (20121018) (ROBOT)

As a reminder, the openjdk Java environment is available in Scientific Linux 5. Updates for openjdk are released in a similar manner to other security updates. Scientific Linux 6 does not bundle the closed source Java environment. All running instances of Sun/Oracle Java must be restarted for the...

Scientific Linux Security Update : java-1.7.0-openjdk on SL6.x i386/x86_64 (20121017) (ROBOT)

Multiple improper permission check issues were discovered in the Beans, Libraries, Swing, and JMX components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. CVE-2012-5086, CVE-2012-5087, CVE-2012-5088, CVE-2012-5084, CVE-2012-5089 The...

Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20121016)

This update fixes the following security issue : - A flaw was found in the way socket buffers skb requiring TSO TCP segment offloading were handled by the sfc driver. If the skb did not fit within the minimum-size of the transmission queue, the network card could repeatedly reset itself. A remote...

Scientific Linux Security Update : bind97 on SL5.x i386/x86_64 (20121012)

A flaw was found in the way BIND handled certain combinations of resource records. A remote attacker could use this flaw to cause a recursive resolver, or an authoritative server in certain configurations, to lockup. CVE-2012-5166 After installing the update, the BIND daemon named will be restart...

Scientific Linux Security Update : xulrunner on SL5.x, SL6.x i386/x86_64 (20121012)

A flaw was found in the way XULRunner handled security wrappers. A web page containing malicious content could possibly cause an application linked against XULRunner such as Mozilla Firefox to execute arbitrary code with the privileges of the user running the application. CVE-2012-4193 After...

Scientific Linux Security Update : bind on SL5.x, SL6.x i386/x86_64 (20121012)

A flaw was found in the way BIND handled certain combinations of resource records. A remote attacker could use this flaw to cause a recursive resolver, or an authoritative server in certain configurations, to lockup. CVE-2012-5166 After installing the update, the BIND daemon named will be restart...

Scientific Linux Security Update : firefox on SL5.x, SL6.x i386/x86_64 (20121009)

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with...

Scientific Linux Security Update : tzdata enhancement update on SL5.x, SL6.x i386/x86_64 (20121004)

This update adds the following enhancements : - Daylight saving time in Fiji will start at 2:00 a.m. on Sunday, 21st October 2012, and end at 3 am on Sunday, 20th January 2013. - Tokelau was listed in an incorrect time zone for as long as the Zoneinfo project was in existence. The actual zone was...

Scientific Linux Security Update : freeradius2 on SL5.x i386/x86_64 (20121002)

FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service RADIUS server, designed to allow centralized authentication and authorization for a network. A buffer overflow flaw was discovered in the way radiusd handled the expiration date field in X.509...