Scientific Linux Security Update : xpdf on SL3.x, SL4.x i386/x86_64

An uninitialized pointer use flaw was discovered in Xpdf. An attacker could create a malicious PDF file that, when opened, would cause Xpdf to crash or, potentially, execute arbitrary code. CVE-2010-3702 An array index error was found in the way Xpdf parsed PostScript Type 1 fonts embedded in PDF...

Scientific Linux Security Update : libtiff on SL3.x, SL4.x, SL5.x i386/x86_64

Multiple integer overflow flaws, leading to a buffer overflow, were discovered in libtiff. An attacker could use these flaws to create a specially crafted TIFF file that, when opened, would cause an application linked against libtiff to crash or, possibly, execute arbitrary code. CVE-2010-1411...

Scientific Linux Security Update : seamonkey on SL4.x, SL3.x i386/x86_64

Several flaws were found in the way SeaMonkey processed certain malformed JavaScript code. A web page containing malicious JavaScript code could cause SeaMonkey to crash or potentially execute arbitrary code as the user running SeaMonkey. CVE-2007-2867, CVE-2007-2868 A flaw was found in the way...

Scientific Linux Security Update : NetworkManager on SL6.x i386/x86_64

NetworkManager is a network link manager that attempts to keep a wired or wireless network connection active at all times. It was found that NetworkManager did not properly enforce PolicyKit settings controlling the permissions to configure wireless network sharing. A local, unprivileged user cou...

Scientific Linux Security Update : tzdata on SL3.x, SL4.x, SL5.x i386/x86_64

This updated package addresses the following changes to Daylight Saving Time DST observations : - Morocco will observe DST from 2009-06-01 00:00 to 2009-08-21 00:00. - Tunisia will not observe DST this year. - Syria started DST on 2009-03-27 00:00 this year. - Cuba started DST at midnight between...

Scientific Linux Security Update : java (jdk 1.6.0) on SL4.x, SL5.x i386/x86_64

This update fixes several vulnerabilities in the Sun Java 6 Runtime Environment and the Sun Java 6 Software Development Kit. These vulnerabilities are summarized on the 'Advance notification of Security Updates for Java SE' page from Sun Microsystems, listed in the References section. All running...

Scientific Linux Security Update : freetype on SL4.x, SL5.x, SL6.x i386/x86_64

FreeType is a free, high-quality, portable font engine that can open and manage font files. It also loads, hints, and renders individual glyphs efficiently. The freetype packages for Scientific Linux 4 provide both the FreeType 1 and FreeType 2 font engines. The freetype packages for Scientific...

Scientific Linux Security Update : libxslt on SL3.x, SL4.x, SL5.x i386/x86_64

Anthony de Almeida Lopes reported the libxslt library did not properly process long 'transformation match' conditions in the XSL stylesheet files. An attacker could create a malicious XSL file that would cause a crash, or, possibly, execute and arbitrary code with the privileges of the applicatio...

Scientific Linux Security Update : qt on SL6.x i386/x86_64

Qt is a software toolkit that simplifies the task of writing and maintaining GUI Graphical User Interface applications for the X Window System. HarfBuzz is an OpenType text shaping engine. A buffer overflow flaw was found in the harfbuzz module in Qt. If a user loaded a specially crafted font fil...

Scientific Linux Security Update : openoffice.org2 on SL4.x i386/x86_64

An integer truncation error, leading to a heap-based buffer overflow, was found in the way the OpenOffice.org Impress presentation application sanitized a file's dictionary property items. An attacker could use this flaw to create a specially crafted Microsoft Office PowerPoint file that, when...

Scientific Linux Security Update : lcms on SL5.x i386/x86_64

Multiple insufficient input validation flaws were discovered in LittleCMS. An attacker could use these flaws to create a specially crafted image file which could cause an application using LittleCMS to crash, or, possibly, execute arbitrary code when opened. CVE-2008-5316, CVE-2008-5317...

Scientific Linux Security Update : cyrus-imapd on SL4.x, SL5.x i386/x86_64

CVE-2009-2632 cyrus-imapd: buffer overflow in cyrus sieve CVE-2009-3235 cyrus-impad: CMU sieve buffer overflows Multiple buffer overflow flaws were found in the Cyrus IMAP Sieve implementation. An authenticated user able to create Sieve mail filtering rules could use these flaws to execute...

Scientific Linux Security Update : python for SL5.x i386/x86_64

When the assert system call was disabled, an input sanitization flaw was revealed in the Python string object implementation that led to a buffer overflow. The missing check for negative size values meant the Python memory allocator could allocate less memory than expected. This could result in...

Scientific Linux Security Update : selinux-policy on SL5.x i386/x86_64

These updated packages resolve several bugs in Security-Enhanced Linux SELinux policy as shipped with Scientific Linux 5. The majority of these bugs resulted in SELinux denying legitimate access. The most prominent error came when tzdata was updated. %NASLMINLEVEL 70300 C Tenable Network Security...

Scientific Linux Security Update : kvm on SL5.x x86_64

It was found that QEMU-KVM on the host did not validate all pointers provided from a guest system's QXL graphics card driver. A privileged guest user could use this flaw to cause the host to dereference an invalid pointer, causing the guest to crash denial of service or, possibly, resulting in th...

Scientific Linux Security Update : yum on SL5.x i386/x86_64

This updated yum package fixes the following bugs : - The kernel module plugin has been updated to deal with the situation where both a package that has a kernel module such as openafs is being updated at the same time that a kernel is being updated, while an old kernel is being removed. - string...

Scientific Linux Security Update : kernel on SL4.x i386/x86_64

This update fixes the following security issues : - Information leak flaws were found in the Linux kernel Traffic Control Unit implementation. A local attacker could use these flaws to cause the kernel to leak kernel memory to user-space, possibly leading to the disclosure of sensitive informatio...

Scientific Linux Security Update : gd on SL4.x, SL5.x i386/x86_64

A missing input sanitization flaw, leading to a buffer overflow, was discovered in the gd library. A specially crafted GD image file could cause an application using the gd library to crash or, possibly, execute arbitrary code when opened. CVE-2009-3546 %NASLMINLEVEL 70300 C Tenable Network...

Scientific Linux Security Update : glibc on SL6.x i386/x86_64 (20120718)

The glibc packages provide the standard C and standard math libraries used by multiple programs on the system. Without these libraries, the Linux system cannot function properly. Multiple errors in glibc's formatted printing functionality could allow an attacker to bypass FORTIFYSOURCE protection...

Scientific Linux Security Update : thunderbird on SL5.x, SL4.x i386/x86_64

A cross-site scripting flaw was found in the way Thunderbird handled the jar: URI scheme. It may be possible for a malicious HTML mail message to leverage this flaw, and conduct a cross-site scripting attack against a user running Thunderbird. CVE-2007-5947 Several flaws were found in the way...