Scientific Linux Security Update : firefox on SL5.x i386/x86_64

An integer overflow flaw was found in the way Firefox displayed certain web content. A malicious website could cause Firefox to crash, or execute arbitrary code with the permissions of the user running Firefox. CVE-2008-2785 A flaw was found in the way Firefox handled certain command line URLs. I...

Scientific Linux Security Update : net-snmp on SL6.x i386/x86_64 (20120620)

The net-snmp packages provide various libraries and tools for the Simple Network Management Protocol SNMP, including an SNMP library, an extensible agent, tools for requesting or setting information from SNMP agents, tools for generating and handling SNMP traps, a version of the netstat command...

Scientific Linux Security Update : quagga on SL5.x, SL4.x, SL3.x i386/x86_64

An out of bounds memory read flaw was discovered in Quagga's bgpd. A configured peer of bgpd could cause Quagga to crash, leading to a denial of service CVE-2007-1995. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'deprecatednasllevel.inc'...

Scientific Linux Security Update : tzdata on SL3.x, SL4.x, SL5.x i386/x86_64

This updated package addresses the following change to Daylight Saving Time DST observations : - Argentina does not enter DST on October 18. BZ529427, BZ529497, BZ529677 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

Scientific Linux Security Update : rpm on SL5.x i386/x86_64

It was discovered that RPM did not remove setuid and setgid bits set on binaries when upgrading packages. A local attacker able to create hard links to binaries could use this flaw to keep those binaries on the system, at a specific version level and with the setuid or setgid bit set, even if the...

Scientific Linux Security Update : firefox on SL6.x i386/x86_64

A race condition flaw was found in the way Firefox handled Document Object Model DOM element properties. Malicious HTML content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. CVE-2010-3765 Several flaws were found in the...

Scientific Linux Security Update : libgcrypt on SL5.0 - 5.3 i386/x86_64

gnutls-1.4.1-3.el54.8 is a moderate security update that required /usr/libm/libgcrypt.so.11 to have the symbol gcryciphersetkey This is only available in the newer libgcrypt that was released with SL 5.4. This update updates libgcrypt in the older SL 5 releases so that the gnutls security update...

Scientific Linux Security Update : libvirt on SL5.x i386/x86_64

The libvirtd daemon was discovered to not properly check user connection permissions before performing certain privileged actions, such as requesting migration of an unprivileged guest domain to another system. A local user able to establish a read-only connection to libvirtd could use this flaw ...

Scientific Linux Security Update : sl-release on SL5.1 i386/x86_64

The configuration file /etc/sysconfig/rhn/sources had still been set to 5rolling instead of 51. 5rolling is the development area for Scientific Linux 5. If a user was using a program that used /etc/sysconfig/rhn/sources as a configuration file, they would be getting development updates in additio...

Scientific Linux Security Update : selinux-policy on SL5.x i386/x86_64

This update fixes the following bug : - Due to incorrect SELinux policy, cmirror was unable to start properly, and as a result, cluster mirrors could not be started at all. This error has been fixed, and SELinux no longer prevents cluster mirrors from being started. BZ644821 %NASLMINLEVEL 70300 C...

Scientific Linux Security Update : openoffice.org on SL4.x i386/x86_64

CVE-2009-2950 openoffice.org: GIF file parsing heap overflow CVE-2009-2949 openoffice.org: integer overflow in XPM processing CVE-2009-3301 OpenOffice.org Word sprmTDefTable Memory Corruption CVE-2009-3302 OpenOffice.org Word sprmTSetBrc Memory Corruption An integer overflow flaw, leading to a...

Scientific Linux Security Update : xulrunner on SL5.x, SL6.x i386/x86_64 (20120216)

XULRunner provides the XUL Runtime environment for applications using the Gecko layout engine. A heap-based buffer overflow flaw was found in the way XULRunner handled PNG Portable Network Graphics images. A web page containing a malicious PNG image could cause an application linked against...

Scientific Linux Security Update : java-1.6.0-openjdk on SL5.3 i386/x86_64

CVE-2009-0217 xmlsec1, mono, xml-security-c, xml-security-1.3.0-1jpp.ep1.: XMLDsig HMAC-based signatures spoofing and authentication bypass CVE-2009-2670 OpenJDK Untrusted applet System properties access 6738524 CVE-2009-2671 CVE-2009-2672 OpenJDK Proxy mechanism information leaks 6801071...

Scientific Linux Security Update : httpd on SL4.x, SL3.x i386/x86_64

The Apache HTTP Server did not verify that a process was an Apache child process before sending it signals. A local attacker with the ability to run scripts on the Apache HTTP Server could manipulate the scoreboard and cause arbitrary processes to be terminated which could lead to a denial of...

Scientific Linux Security Update : openldap on SL3.x i386/x86_64

A flaw was found in the way OpenLDAP handled selfwrite access. Users with selfwrite access were able to modify the distinguished name of any user. Users with selfwrite access should only be able to modify their own distinguished name. CVE-2006-4600 A memory leak bug was found in OpenLDAP's...

Scientific Linux Security Update : cups on SL3.x, SL4.x, SL5.x i386/x86_64

An integer overflow flaw leading to a heap buffer overflow was discovered in the Portable Network Graphics PNG decoding routines used by the CUPS image converting filters 'imagetops' and 'imagetoraster'. An attacker could create a malicious PNG file that could possibly execute arbitrary code as t...

Scientific Linux Security Update : aide on SL5.x i386/x86_64

A flaw was discovered in the way file checksums were stored in the AIDE database. A packaging flaw in the Red Hat AIDE rpm resulted in the file database not containing any file checksum information. This could prevent AIDE from detecting certain file modifications. CVE-2007-3849 This update also...

Scientific Linux Security Update : kernel on SL6.x i386/x86_64

This update fixes the following security issues : - A divide-by-zero flaw was found in the tcpselectinitialwindow function in the Linux kernel's TCP/IP protocol suite implementation. A local, unprivileged user could use this flaw to trigger a denial of service by calling setsockopt with certain...

Scientific Linux Security Update : perl-Net-DNS on SL3.0.x, SL4.x, SL5.x i386/x86_64

A flaw was found in the way Net::DNS generated the ID field in a DNS query. This predictable ID field could be used by a remote attacker to return invalid DNS data. CVE-2007-3377 A denial of service flaw was found in the way Net::DNS parsed certain DNS requests. A malformed response to a DNS...

Scientific Linux Security Update : qemu-kvm on SL6.x x86_64

KVM Kernel-based Virtual Machine is a full virtualization solution for Linux on AMD64 and Intel 64 systems. qemu-kvm is the user-space component for running virtual machines using KVM. It was found that the virtio-blk driver in qemu-kvm did not properly validate read and write requests from guest...