Scientific Linux Security Update : java (jdk 1.6.0) on SL4.x, SL5.x i386/x86_64

This update fixes several vulnerabilities in the Sun Java 6 Runtime Environment and the Sun Java 6 Software Development Kit. These vulnerabilities are summarized on the 'Advance notification of Security Updates for Java SE' page from Sun Microsystems, listed in the References section. All running...

Scientific Linux Security Update : xpdf on SL3.x, SL4.x i386/x86_64

An uninitialized pointer use flaw was discovered in Xpdf. An attacker could create a malicious PDF file that, when opened, would cause Xpdf to crash or, potentially, execute arbitrary code. CVE-2010-3702 An array index error was found in the way Xpdf parsed PostScript Type 1 fonts embedded in PDF...

Scientific Linux Security Update : subversion on SL5.x i386/x86_64

A NULL pointer dereference flaw was found in the way the moddavsvn module processed certain requests to lock working copy paths in a repository. A remote attacker could issue a lock request that could cause the httpd process serving the request to crash. CVE-2011-0715 This update also fixes the...

Scientific Linux Security Update : thunderbird on SL4.x, SL5.x i386/x86_64

Several flaws were found in the way Thunderbird processed certain malformed HTML mail content. A HTML mail message containing malicious content could cause Thunderbird to crash, or potentially execute arbitrary code as the user running Thunderbird. CVE-2008-0412, CVE-2008-0413, CVE-2008-0415,...

Scientific Linux Security Update : cups on SL5.x i386/x86_64

A use-after-free flaw was found in the way the CUPS server parsed Internet Printing Protocol IPP packets. A malicious user able to send IPP requests to the CUPS server could use this flaw to crash the CUPS server or, potentially, execute arbitrary code with the privileges of the CUPS server...

Scientific Linux Security Update : bind for SL 5.x on i386/x86_64

CVE-2009-0696 bind: DoS assertion failure via nsupdate packets A flaw was found in the way BIND handles dynamic update message packets containing the 'ANY' record type. A remote attacker could use this flaw to send a specially crafted dynamic update packet that could cause named to exit with an...

Scientific Linux Security Update : firefox on SL6.x i386/x86_64

A race condition flaw was found in the way Firefox handled Document Object Model DOM element properties. Malicious HTML content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. CVE-2010-3765 Several flaws were found in the...

Scientific Linux Security Update : tzdata on SL3.x, SL4.x, SL5.x i386/x86_64

This updated package addresses the following changes to Daylight Saving Time DST observations : - Morocco will observe DST from 2009-06-01 00:00 to 2009-08-21 00:00. - Tunisia will not observe DST this year. - Syria started DST on 2009-03-27 00:00 this year. - Cuba started DST at midnight between...

Scientific Linux Security Update : seamonkey on SL3.x i386/x86_64

An integer overflow flaw was found in the way SeaMonkey displayed certain web content. A malicious website could cause SeaMonkey to crash or execute arbitrary code with the permissions of the user running SeaMonkey. CVE-2008-2785 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptiv...

Scientific Linux Security Update : poppler on SL5.x i386/x86_64

CVE-2009-3608 xpdf/poppler: integer overflow in ObjectStream::ObjectStream oCERT-2009-016 CVE-2009-3609 xpdf/poppler: ImageStream::ImageStream integer overflow CVE-2009-3603 xpdf/poppler: SplashBitmap::SplashBitmap integer overflow Multiple integer overflow flaws were found in poppler. An attacke...

Scientific Linux Security Update : firefox on SL5.x i386/x86_64

An integer overflow flaw was found in the way Firefox displayed certain web content. A malicious website could cause Firefox to crash, or execute arbitrary code with the permissions of the user running Firefox. CVE-2008-2785 A flaw was found in the way Firefox handled certain command line URLs. I...

Scientific Linux Security Update : subversion on SL5.x, SL6.x i386/x86_64

Subversion SVN is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. The moddavsvn module is used with the Apache HTTP Server to allow access to Subversion...

Scientific Linux Security Update : cyrus-imapd on SL4.x, SL5.x i386/x86_64

CVE-2009-2632 cyrus-imapd: buffer overflow in cyrus sieve CVE-2009-3235 cyrus-impad: CMU sieve buffer overflows Multiple buffer overflow flaws were found in the Cyrus IMAP Sieve implementation. An authenticated user able to create Sieve mail filtering rules could use these flaws to execute...

Scientific Linux Security Update : seamonkey on SL4.x i386/x86_64

SeaMonkey is an open source web browser, email and newsgroup client, IRC chat client, and HTML editor. A flaw was found in the way SeaMonkey handled frame objects with certain names. An attacker could use this flaw to cause a plug-in to grant its content access to another site or the local file...

Scientific Linux Security Update : selinux-policy on SL6.x i386/x86_64 (20120307)

This update fixes the following bugs : - An incorrect SELinux policy prevented the qpidd service from connecting to the AMQP Advanced Message Queuing Protocol port when the qpidd daemon was configured with Corosync clustering. These selinux-policy packages contain updated SELinux rules, which all...

Scientific Linux Security Update : kernel on SL4.x i386/x86_64

A flaw was found in the handling of IEEE 802.11 frames, which affected several wireless LAN modules. In certain situations, a remote attacker could trigger this flaw by sending a malicious packet over a wireless network, causing a denial of service kernel crash. CVE-2007-4997, Important A memory...

Scientific Linux Security Update : mysql on SL6.x i386/x86_64 (20120620)

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon mysqld and many client programs and libraries. A flaw was found in the way MySQL processed HANDLER READ NEXT statements after deleting a record. A remote, authenticated attacker could use this flaw t...

Scientific Linux Security Update : bind on SL5.x i386/x86_64

CVE-2010-0097 BIND DNSSEC NSEC/NSEC3 validation code could cause bogus NXDOMAIN responses CVE-2010-0290 BIND upstream fix for CVE-2009-4022 is incomplete A flaw was found in the BIND DNSSEC NSEC/NSEC3 validation code. If BIND was running as a DNSSEC-validating resolver, it could incorrectly cache...

Scientific Linux Security Update : star on SL5.x, SL4.x, SL3.x i386/x86_64

A path traversal flaw was discovered in the way star extracted archives. A malicious user could create a tar archive that would cause star to write to arbitrary files to which the user running star had write access. CVE-2007-4134 As well, this update adds the command line argument '-..' to the Re...

Scientific Linux Security Update : seamonkey on SL3.x, SL4.x i386/x86_64

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey. CVE-2009-0352, CVE-2009-0353 A flaw was found in the way malformed content was...