Scientific Linux Security Update : seamonkey on SL4.x i386/x86_64

A flaw was found in the way SeaMonkey handled dialog boxes. An attacker could use this flaw to create a malicious web page that would present a blank dialog box that has non-functioning buttons. If a user closes the dialog box window, it could unexpectedly grant the malicious web page elevated...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64

These updated packages fix the following security issues : - A security flaw was found in the Linux kernel memory copy routines, when running on certain AMD64 systems. If an unsuccessful attempt to copy kernel memory from source to destination memory locations occurred, the copy routines did not...

Scientific Linux Security Update : libXfont on SL5.x i386/x86_64

A heap based buffer overflow flaw was found in the way the X.Org server handled malformed font files. A malicious local user could exploit this issue to potentially execute arbitrary code with the privileges of the X.Org server. CVE-2008-0006 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. T...

Scientific Linux Security Update : sos on SL6.x (20120620)

The sos package contains a set of tools that gather information from system hardware, logs and configuration files. The information can then be used for diagnostic purposes and debugging. The sosreport utility collected the Kickstart configuration file '/root/anaconda-ks.cfg', but did not remove...

Scientific Linux Security Update : seamonkey on SL3.x, SL4.x i386/x86_64

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. CVE-2009-3979 A flaw was found in the SeaMonkey NT Lan Manager NTL...

Scientific Linux Security Update : kdebase on SL5.x, SL4.x i386/x86_64

Kees Huijgen found a flaw in the way KDM handled logins when autologin and 'shutdown with password' were enabled. A local user would have been able to login via KDM as any user without requiring a password. CVE-2007-4569 Two Konqueror address spoofing flaws were discovered. A malicious website...

Scientific Linux Security Update : kernel on SL4.x i386/x86_64

This update fixes the following security issues : - a flaw was found in the CIFSSMBWrite function in the Linux kernel Common Internet File System CIFS implementation. A remote attacker could send a specially crafted SMB response packet to a target CIFS client, resulting in a kernel panic denial o...

Scientific Linux Security Update : firefox on SL4.x, SL5.x i386/x86_64

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox. CVE-2009-1302, CVE-2009-1303, CVE-2009-1304, CVE-2009-1305 Several flaws were found in the...

Scientific Linux Security Update : postgresql84 on SL5.x i386/x86_64

A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Perl. If the PL/Perl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Perl script could use this flaw to bypass intended PL/Perl...

Scientific Linux Security Update : seamonkey on SL4.x i386/x86_64

This erratum blacklists a small number of HTTPS certificates. BZ689430 After installing the update, SeaMonkey must be restarted for the changes to take effect. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'deprecatednasllevel.inc';...

Scientific Linux Security Update : exim on SL4.x, SL5.x i386/x86_64

A privilege escalation flaw was discovered in Exim. If an attacker were able to gain access to the 'exim' user, they could cause Exim to execute arbitrary commands as the root user. CVE-2010-4345 This update adds a new configuration file, '/etc/exim/trusted-configs'. To prevent Exim from running...

Scientific Linux Security Update : tetex on SL5.x, SL4.x, SL3.x i386/x86_64

Alin Rad Pop discovered several flaws in the handling of PDF files. An attacker could create a malicious PDF file that would cause TeTeX to crash or potentially execute arbitrary code when opened. CVE-2007-4352, CVE-2007-5392, CVE-2007-5393 A flaw was found in the t1lib library, used in the...

Scientific Linux Security Update : postgresql on SL4 i386,x86_64, SL5 i386

Updated postgresql packages that fix several security issues are now available. A flaw was found in the way PostgreSQL allows authenticated users to execute security-definer functions. It was possible for an unprivileged user to execute arbitrary code with the privileges of the security-definer...

Scientific Linux Security Update : postfix on SL3.x, SL4.x, SL5.x i386/x86_64

A flaw was found in the way Postfix dereferences symbolic links. If a local user has write access to a mail spool directory with no root mailbox, it may be possible for them to append arbitrary data to files that root has write permission to. CVE-2008-2936 %NASLMINLEVEL 70300 C Tenable Network...

Scientific Linux Security Update : openoffice.org on SL5.x, SL6.x i386/x86_64 (20120604)

OpenOffice.org is an office productivity suite that includes desktop applications, such as a word processor, spreadsheet application, presentation manager, formula editor, and a drawing program. An integer overflow flaw, leading to a buffer overflow, was found in the way OpenOffice.org processed ...

Scientific Linux Security Update : openoffice.org on SL3.x, SL4.x, SL5.x i386/x86_64

CVE-2009-0200 OpenOffice.org Word document Integer Underflow CVE-2009-0201 OpenOffice.org Word document buffer overflow An integer underflow flaw and a boundary error flaw, both possibly leading to a heap-based buffer overflow, were found in the way OpenOffice.org parses certain records in...

Scientific Linux Security Update : kernel on SL5.x, SL4.x, SL3.x i386/x86_64

A flaw was found in the IA32 system call emulation provided on AMD64 and Intel 64 platforms. An improperly validated 64-bit value could be stored in the %RAX register, which could trigger an out-of-bounds system call table access. An untrusted local user could exploit this flaw to run code in the...

Scientific Linux Security Update : gnome-vfs2 on SL3.x, SL4.x i386/x86_64

A buffer overflow flaw was discovered in the GNOME virtual file system when handling data returned by CDDB servers. If a user connected to a malicious CDDB server, an attacker could use this flaw to execute arbitrary code on the victim's machine. CVE-2005-0706 All running GNOME sessions must be...

Scientific Linux Security Update : ypbind on SL3.x i386/x86_64

This updated package fixes the following bugs : - after a NIS server change, for example, after a server failure, ypbind corrupted files in the '/var/yp/binding/' directory. As well, these files were not updated, possibly causing old information to be retained. In these situations, glibc attempte...

Scientific Linux Security Update : bind on SL6.x i386/x86_64

"The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'deprecatednasllevel.inc'; include'compat.inc'; if...