Scientific Linux Security Update : firefox on SL4.x, SL5.x i386/x86_64

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. CVE-2010-1208, CVE-2010-1209, CVE-2010-1211, CVE-2010-1212,...

Scientific Linux Security Update : net-snmp on SL5.x, SL4.x, SL3.x i386/x86_64

A flaw was discovered in the way net-snmp handled certain requests. A remote attacker who can connect to the snmpd UDP port 161 by default could send a malicious packet causing snmpd to crash, resulting in a denial of service. CVE-2007-5846 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Scientific Linux Security Update : cyrus-imapd on SL4.x, SL5.x i386/x86_64

It was discovered that the Cyrus SASL library cyrus-sasl does not always reliably terminate output from the saslencode64 function used by programs using this library. The Cyrus IMAP server cyrus-imapd relied on this function's output being properly terminated. Under certain conditions, improperly...

Scientific Linux Security Update : seamonkey on SL4.x i386/x86_64

An integer overflow flaw was found in the way SeaMonkey displayed certain web content. A malicious website could cause SeaMonkey to crash or execute arbitrary code with the permissions of the user running SeaMonkey. CVE-2008-2785 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptiv...

Scientific Linux Security Update : xpdf on SL4.x i386/x86_64

Petr Gajdos and Christian Kornacker of SUSE reported a buffer overflow flaw in Xpdf's Type 1 font parser. A specially crafted PDF file with an embedded Type 1 font could cause Xpdf to crash or, possibly, execute arbitrary code when opened. CVE-2009-4035 %NASLMINLEVEL 70300 C Tenable Network...

Scientific Linux Security Update : libtiff on SL5.x, SL6.x i386/x86_64 (20120410)

The libtiff packages contain a library of functions for manipulating Tagged Image File Format TIFF files. Two integer overflow flaws, leading to heap-based buffer overflows, were found in the way libtiff attempted to allocate space for a tile in a TIFF image file. An attacker could use these flaw...

Scientific Linux Security Update : openoffice.org on SL5.x i386/x86_64

A flaw was found in the way OpenOffice.org enforced a macro security setting for macros, written in the Python scripting language, that were embedded in OpenOffice.org documents. If a user were tricked into opening a specially crafted OpenOffice.org document and previewed the macro directory...

Scientific Linux Security Update : w3m on SL5.x i386/x86_64

It was discovered that w3m is affected by the previously published 'null prefix attack', caused by incorrect handling of NULL characters in X.509 certificates. If an attacker is able to get a carefully-crafted certificate signed by a trusted Certificate Authority, the attacker could use the...

Scientific Linux Security Update : dovecot on SL5.x i386/x86_64

A flaw was discovered in the way Dovecot handled the 'mailextragroups' option. An authenticated attacker with local shell access could leverage this flaw to read, modify, or delete other users mail that is stored on the mail server. CVE-2008-1199 This issue did not affect the default Red Hat...

Scientific Linux Security Update : gnome-screensaver on SL5.x i386/x86_64

A flaw was found in the way gnome-screensaver verified user passwords. When a system used a remote directory service for login credentials, a local attacker able to cause a network outage could cause gnome-screensaver to crash, unlocking the screen. CVE-2008-0887 %NASLMINLEVEL 70300 C Tenable...

Scientific Linux Security Update : java-1.6.0-sun on SL4.x, SL5.x i386/x86_64 (20120216)

This update fixes several vulnerabilities in the Sun Java 6 Runtime Environment and the Sun Java 6 Software Development Kit. Further information about these flaws can be found on the Oracle Java SE Critical Patch page. CVE-2011-3563, CVE-2011-3571, CVE-2011-5035, CVE-2012-0498, CVE-2012-0499,...

Scientific Linux Security Update : firefox on SL4.x, SL5.x i386/x86_64

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. CVE-2009-3979, CVE-2009-3981, CVE-2009-3986 A flaw was found in the...

Scientific Linux Security Update : subversion on SL5.x i386/x86_64

A server-side memory leak was found in the Subversion server. If a malicious, remote user performed 'svn blame' or 'svn log' operations on certain repository files, it could cause the Subversion server to consume a large amount of system memory. CVE-2010-4644 A NULL pointer dereference flaw was...

Scientific Linux Security Update : dovecot on SL4.x, SL5.x, SL6.x i386/x86_64

Dovecot is an IMAP server for Linux, UNIX, and similar operating systems, primarily written with security in mind. A denial of service flaw was found in the way Dovecot handled NULL characters in certain header names. A mail message with specially crafted headers could cause the Dovecot child...

Scientific Linux Security Update : mysql on SL5.x i386/x86_64

CVE-2009-4019 mysql: DoS crash when comparing GIS items from subquery and when handling subqueires in WHERE and assigning a SELECT result to a @variable CVE-2009-4028 mysql: client SSL certificate verification flaw CVE-2009-4030 mysql: Incomplete fix for CVE-2008-2079 / CVE-2008-4098 It was...

Scientific Linux Security Update : rsyslog on SL6.x i386/x86_64

The rsyslog packages provide an enhanced, multi-threaded syslog daemon that supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine grained output format control. A two byte buffer overflow flaw was found in the rsyslog daemon's parseLegacySyslogMsg...

Scientific Linux Security Update : kvm on SL5.x x86_64 (20120521)

KVM Kernel-based Virtual Machine is a full virtualization solution for Linux on AMD64 and Intel 64 systems. KVM is a Linux kernel module built for the standard Scientific Linux kernel. A flaw was found in the way the KVMCREATEIRQCHIP ioctl was handled. Calling this ioctl when at least one virtual...

Scientific Linux Security Update : xpdf on SL4.x i386/x86_64

Problem description : Alin Rad Pop discovered several flaws in the handling of PDF files. An attacker could create a malicious PDF file that would cause Xpdf to crash, or potentially execute arbitrary code when opened. CVE-2007-4352, CVE-2007-5392, CVE-2007-5393 %NASLMINLEVEL 70300 C Tenable...

Scientific Linux Security Update : firefox on SL4.x i386/x86_64

A race condition flaw was found in the way Firefox handled Document Object Model DOM element properties. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. CVE-2010-3765 After installing the...

Scientific Linux Security Update : file on SL5.x, SL4.x i386/x86_64

The fix for CVE-2007-1536 introduced a new integer underflow flaw in the file utility. An attacker could create a carefully crafted file which, if examined by a victim using the file utility, could lead to arbitrary code execution. CVE-2007-2799 %NASLMINLEVEL 70300 C Tenable Network Security, Inc...