Scientific Linux Security Update : kernel on SL5.x i386/x86_64 (20120612)

The kernel packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issues : - It was found that the Xen hypervisor implementation as shipped with Scientific Linux 5 did not properly restrict the syscall return addresses in the sysret...

Scientific Linux Security Update : httpd on SL5.x i386/x86_64

A flaw was found in the handling of compression structures between modssl and OpenSSL. If too many connections were opened in a short period of time, all system memory and swap space would be consumed by httpd, negatively impacting other processes, or causing a system crash. CVE-2008-1678 A flaw...

Scientific Linux Security Update : libxml and libxml2 on SL3.x, SL4.x, SL5.x i386/x86_64

CVE-2009-2414 libxml, libxml2, mingw32-libxml2: Stack overflow by parsing root XML element DTD definition CVE-2009-2416 libxml, libxml2, mingw32-libxml2: Pointer use-after-free flaws by parsing Notation and Enumeration attribute types A stack overflow flaw was found in the way libxml processes th...

Scientific Linux Security Update : pidgin on SL3.x, SL4.x, SL5.x i386/x86_64

A buffer overflow flaw was found in the way Pidgin initiates file transfers when using the Extensible Messaging and Presence Protocol XMPP. If a Pidgin client initiates a file transfer, and the remote target sends a malformed response, it could cause Pidgin to crash or, potentially, execute...

Scientific Linux Security Update : postfix on SL6.x i386/x86_64

It was discovered that Postfix did not flush the received SMTP commands buffer after switching to TLS encryption for an SMTP session. A man-in-the-middle attacker could use this flaw to inject SMTP commands into a victim's session during the plain text phase. This would lead to those commands bei...

Scientific Linux Security Update : frysk on SL4.x i386/x86_64

frysk is an execution-analysis technology implemented using native Java and C++. It provides developers and system administrators with the ability to examine and analyze multi-host, multi-process, and multithreaded systems while they are running. frysk is released as a Technology Preview for...

Scientific Linux Security Update : pango on SL5.x i386/x86_64

Pango is a library used for the layout and rendering of internationalized text. A buffer overflow flaw was found in HarfBuzz, an OpenType text shaping engine used in Pango. If a user loaded a specially crafted font file with an application that uses Pango, it could cause the application to crash...

Scientific Linux Security Update : ndiswrapper on SL5.x i386/x86_64

This release is corresponding with the first kernel security update with the new 2.6.18-92 kernel. We have built new kernel modules for all the kernels we have released. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

Scientific Linux Security Update : kernel for SL 5.x on i386/x86_64

CVE-2007-5966 kernel: non-root can trigger cpuidle soft lockup CVE-2009-1385 kernel: e1000cleanrxirq denial of service CVE-2009-1388 kernel: docoredump vs ptracestart deadlock CVE-2009-1389 kernel: r8169: fix crash when large packets are received CVE-2009-1895 kernel: personality: fix...

Scientific Linux Security Update : selinux-policy on SL6.x i386/x86_64 (20120213)

The selinux-policy packages contain the rules that govern how confined processes run on the system. This update fixes the following bug : - An incorrect SELinux policy prevented the qpidd service from starting. These selinux-policy packages contain updated SELinux rules, which allow the qpidd...

Scientific Linux Security Update : libXfont on SL5.x, SL6.x i386/x86_64

The libXfont packages provide the X.Org libXfont runtime library. X.Org is an open source implementation of the X Window System. A buffer overflow flaw was found in the way the libXfont library, used by the X.Org server, handled malformed font files compressed using UNIX compress. A malicious,...

Scientific Linux Security Update : krb5 on SL4.x, SL5.x i386/x86_64

Multiple checksum validation flaws were discovered in the MIT Kerberos implementation. A remote attacker could use these flaws to tamper with certain Kerberos protocol packets and, possibly, bypass authentication mechanisms in certain configurations using Single-use Authentication Mechanisms...

Scientific Linux Security Update : pidgin on SL4.x, SL5.x i386/x86_64

A directory traversal flaw was discovered in Pidgin's MSN protocol implementation. A remote attacker could send a specially crafted emoticon image download request that would cause Pidgin to disclose an arbitrary file readable to the user running Pidgin. CVE-2010-0013 These packages upgrade Pidgi...

Scientific Linux Security Update : nspr and nss for SL 4.x on i386/x86_64

CVE-2009-2409 deprecate MD2 in SSL cert validation Kaminsky CVE-2009-2408 firefox/nss: doesn't handle NULL in Common Name properly CVE-2009-2404 nss regexp heap overflow Netscape Portable Runtime NSPR provides platform independence for non-GUI operating system facilities. These facilities include...

Scientific Linux Security Update : java-1.6.0-sun on SL5.x i386/x86_64 (20120613)

The Sun 1.6.0 Java release includes the Sun Java 6 Runtime Environment and the Sun Java 6 Software Development Kit. This update fixes several vulnerabilities in the Sun Java 6 Runtime Environment and the Sun Java 6 Software Development Kit. Further information about these flaws can be found on th...

Scientific Linux Security Update : openssl on SL5.x i386/x86_64

CVE-2009-3555 TLS: MITM attacks via session renegotiation CVE-2010-0433 openssl: crash caused by a missing krb5snametoprincipal return value check CVE-2009-3245 openssl: missing bnwexpand return value checks It was discovered that OpenSSL did not always check the return value of the bnwexpand...

Scientific Linux Security Update : java (jdk 1.6.0) on SL4.x, SL5.x i386/x86_64

CVE-2009-0217 xmlsec1, mono, xml-security-c, xml-security-1.3.0-1jpp.ep1.: XMLDsig HMAC-based signatures spoofing and authentication bypass CVE-2009-2670 OpenJDK Untrusted applet System properties access 6738524 CVE-2009-2671 CVE-2009-2672 OpenJDK Proxy mechanism information leaks 6801071...

Scientific Linux Security Update : firefox on SL4.x, SL5.x i386/x86_64

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox. CVE-2009-1302, CVE-2009-1303, CVE-2009-1304, CVE-2009-1305 Several flaws were found in the...

Scientific Linux Security Update : libXfont on SL5.x i386/x86_64

A heap based buffer overflow flaw was found in the way the X.Org server handled malformed font files. A malicious local user could exploit this issue to potentially execute arbitrary code with the privileges of the X.Org server. CVE-2008-0006 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. T...

Scientific Linux Security Update : openoffice.org on SL5.x, SL6.x i386/x86_64 (20120604)

OpenOffice.org is an office productivity suite that includes desktop applications, such as a word processor, spreadsheet application, presentation manager, formula editor, and a drawing program. An integer overflow flaw, leading to a buffer overflow, was found in the way OpenOffice.org processed ...