Scientific Linux Security Update : firefox on SL4.x, SL5.x, SL6.x i386/x86_64

This erratum blacklists a small number of HTTPS certificates. BZ689430 These updated firefox packages also fixes the following bug : - Prior to this update, some Java applets would fail to load in the 3.6.14 version of Firefox. In this newly-released version Firefox 3.6.15, Java applets no longer...

Scientific Linux Security Update : systemtap on SL6.x i386/x86_64

SystemTap is an instrumentation system for systems running the Linux kernel. The system allows developers to write scripts to collect data on the operation of the system. It was found that SystemTap did not perform proper module path sanity checking if a user specified a custom path to the uprobe...

Scientific Linux Security Update : kernel on SL4.x i386/x86_64

This update fixes the following security issues : - A buffer overflow flaw was found in the loadmixervolumes function in the Linux kernel's Open Sound System OSS sound driver. On 64-bit PowerPC systems, a local, unprivileged user could use this flaw to cause a denial of service or escalate their...

Scientific Linux Security Update : thunderbird on SL4.x, SL5.x i386/x86_64

Several flaws were found in the processing of some malformed HTML mail content. An HTML mail message containing such malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. CVE-2008-1233, CVE-2008-1235, CVE-2008-1236, CVE-2008-12...

Scientific Linux Security Update : bind on SL5.x i386/x86_64

CVE-2009-4022 bind: cache poisoning using not validated DNSSEC responses Michael Sinatra discovered that BIND was incorrectly caching responses without performing proper DNSSEC validation, when those responses were received during the resolution of a recursive client query that requested DNSSEC...

Scientific Linux Security Update : openswan on SL6.x i386/x86_64

Openswan is a free implementation of Internet Protocol Security IPsec and Internet Key Exchange IKE. IPsec uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks. A NULL pointer dereference flaw...

Scientific Linux Security Update : busybox on SL4.x i386/x86_64

BusyBox did not use a salt when generating passwords. This made it easier for local users to guess passwords from a stolen password file. CVE-2006-1058 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'deprecatednasllevel.inc';...

Scientific Linux Security Update : krb5 on SL5.x i386/x86_64

A NULL pointer dereference flaw was found in the way the MIT Kerberos KDC processed principal names that were not null terminated, when the KDC was configured to use an LDAP back end. A remote attacker could use this flaw to crash the KDC via a specially crafted request. CVE-2011-0282 A denial of...

Scientific Linux Security Update : openafs on SL5.0 i386/x86_64

In pthread-aware fileservers, the 'hostglock' pthread lock, accessed via the HLOCK and HUNLOCK macros, is used to provide safe access to host structures. This lock is required to be held when updating information pertaining to a host. The RPC handler for the GiveUpAllCallBacks RPC did not hold th...

Scientific Linux Security Update : shadow-utils on SL3.x i386/x86_64

A flaw was found in the useradd tool in shadow-utils. A new user's mailbox, when created, could have random permissions for a short period. This could allow a local attacker to read or modify the mailbox. CVE-2006-1174 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C...

Scientific Linux Security Update : postgresql on on SL3.0.x i386/x86_64

A flaw was found in the way PostgreSQL allows authenticated users to execute security-definer functions. It was possible for an unprivileged user to execute arbitrary code with the privileges of the security-definer function. CVE-2007-2138 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Scientific Linux Security Update : firefox on SL4.x, SL5.x, SL6.x i386/x86_64

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. A flaw was found in the way Firefox handled malformed JPEG images. A website containing a malicious JPEG image could cause Firefox to crash or, potentially, execute arbitrary code wi...

Scientific Linux Security Update : gpdf on SL4.x i386/x86_64

Problem description : Alin Rad Pop discovered several flaws in the handling of PDF files. An attacker could create a malicious PDF file that would cause gpdf to crash, or potentially execute arbitrary code when opened. CVE-2007-4352, CVE-2007-5392, CVE-2007-5393 %NASLMINLEVEL 70300 C Tenable...

Scientific Linux Security Update : mutt on SL5.x, SL4.x, SL3.x i386/x86_64

A flaw was found in the way Mutt used temporary files on NFS file systems. Due to an implementation issue in the NFS protocol, Mutt was not able to exclusively open a new file. A local attacker could conduct a time-dependent attack and possibly gain access to e-mail attachments opened by a victim...

Scientific Linux Security Update : httpd on SL4.x, SL3.x i386/x86_64

The Apache HTTP Server did not verify that a process was an Apache child process before sending it signals. A local attacker with the ability to run scripts on the Apache HTTP Server could manipulate the scoreboard and cause arbitrary processes to be terminated which could lead to a denial of...

Scientific Linux Security Update : xulrunner on SL5.x, SL6.x i386/x86_64 (20120216)

XULRunner provides the XUL Runtime environment for applications using the Gecko layout engine. A heap-based buffer overflow flaw was found in the way XULRunner handled PNG Portable Network Graphics images. A web page containing a malicious PNG image could cause an application linked against...

Scientific Linux Security Update : java-1.6.0-openjdk on SL5.3 i386/x86_64

CVE-2009-0217 xmlsec1, mono, xml-security-c, xml-security-1.3.0-1jpp.ep1.: XMLDsig HMAC-based signatures spoofing and authentication bypass CVE-2009-2670 OpenJDK Untrusted applet System properties access 6738524 CVE-2009-2671 CVE-2009-2672 OpenJDK Proxy mechanism information leaks 6801071...

Scientific Linux Security Update : postgresql on SL4.x, SL5.x i386/x86_64

A stack-based buffer overflow flaw was found in the way PostgreSQL processed certain tokens from a SQL query when the intarray module was enabled on a particular database. An authenticated database user running a specially crafted SQL query could use this flaw to cause a temporary denial of servi...

Scientific Linux Security Update : httpd on SL3.x i386/x86_64

An off-by-one overflow flaw was found in the way apr-util processed a variable list of arguments. An attacker could provide a specially crafted string as input for the formatted output conversion routine, which could, on big-endian platforms, potentially lead to the disclosure of sensitive...

Scientific Linux Security Update : freetype on SL6.x i386/x86_64

It was found that the FreeType font rendering engine improperly validated certain position values when processing input streams. If a user loaded a specially crafted font file with an application linked against FreeType, it could cause the application to crash or, possibly, execute arbitrary code...