Scientific Linux Security Update : libexif on SL7.x x86_64 (20201001)

Security Fixes : - libexif: out of bound write in exif-data.c CVE-2019-9278 - libexif: out of bounds read due to a missing bounds check in exifdatasavedataentry function in exif-data.c CVE-2020-0093 - libexif: use of uninitialized memory in EXIF Makernote handling can lead to crashes and...

Scientific Linux Security Update : unoconv on SL7.x (noarch) (20201001)

Security Fixes : - unoconv: mishandling of pathname leads to SSRF and local file inclusion CVE-2019-17400 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid141680; scriptversion"1.3";...

Scientific Linux Security Update : nss and nspr on SL7.x x86_64 (20201001)

Security Fixes : - nss: Out-of-bounds read when importing curve25519 private key CVE-2019-11719 - nss: Use-after-free in sftkFreeSession due to improper refcounting CVE-2019-11756 - nss: Check length of inputs for cryptographic primitives CVE-2019-17006 - nss: Side channel attack on ECDSA signatu...

Scientific Linux Security Update : libxml2 on SL7.x x86_64 (20201001)

Security Fixes : - libxml2: memory leak in xmlParseBalancedChunkMemoryRecover in parser.c CVE-2019-19956 - libxml2: memory leak in xmlSchemaPreRun in xmlschemas.c CVE-2019-20388 - libxml2: infinite loop in xmlStringLenDecodeEntities in some end-of-file situations CVE-2020-7595 C Tenable Network...

Scientific Linux Security Update : dbus on SL7.x x86_64 (20201001)

Security Fixes : - dbus: DBusServer DBUSCOOKIESHA1 authentication bypass CVE-2019-12749 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid141677; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

Scientific Linux Security Update : libsndfile on SL7.x x86_64 (20201001)

Security Fixes : - libsndfile: buffer over-read in the function i2alawarray in alaw.c CVE-2018-19662 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid141650; scriptversion"1.3";...

Scientific Linux Security Update : cloud-init on SL7.x x86_64 (20201001)

Security Fixes : - cloud-init: Use of random.choice when generating random password CVE-2020-8631 - cloud-init: Too short random password length in ccsetpassword in config/ccsetpasswords.py CVE-2020-8632 - cloud-init: default configuration disabled deletion of SSH host keys CVE-2018-10896 C Tenab...

Scientific Linux Security Update : python-pillow on SL7.x x86_64 (20201001)

Security Fixes : - python-pillow: out-of-bounds read in ImagingFliDecode when loading FLI images CVE-2020-5313 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid141709; scriptversion"1.3";...

Scientific Linux Security Update : webkitgtk4 on SL7.x x86_64 (20201001)

Security Fixes : - webkitgtk: Multiple security issues CVE-2019-6237, CVE-2019-6251, CVE-2019-8506, CVE-2019-8524, CVE-2019-8535, CVE-2019-8536, CVE-2019-8544, CVE-2019-8551, CVE-2019-8558, CVE-2019-8559, CVE-2019-8563, CVE-2019-8571, CVE-2019-8583, CVE-2019-8584, CVE-2019-8586, CVE-2019-8587,...

Scientific Linux Security Update : dnsmasq on SL7.x x86_64 (20201001)

Security Fixes : - dnsmasq: memory leak in the createhelper function in /src/helper.c CVE-2019-14834 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid141690; scriptversion"1.3";...

Scientific Linux Security Update : httpd on SL7.x x86_64 (20201001)

Security Fixes : - httpd: Improper handling of headers in modsession can allow a remote user to modify session data for CGI applications CVE-2018-1283 - httpd: Out of bounds read in modcachesocache can allow a remote attacker to cause DoS CVE-2018-1303 - httpd: modrewrite configurations vulnerabl...

Scientific Linux Security Update : libssh2 on SL7.x x86_64 (20201001)

Security Fixes : - libssh2: integer overflow in SSHMSGDISCONNECT logic in packet.c CVE-2019-17498 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid141667; scriptversion"1.3";...

Scientific Linux Security Update : libmspack on SL7.x x86_64 (20201001)

Security Fixes : - libmspack: buffer overflow in function chmdreadheaders CVE-2019-1010305 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid141694; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

Scientific Linux Security Update : libwmf on SL7.x x86_64 (20201001)

Security Fixes : - gd: double free in the gdImagePtr in gdgifout.c, gdjpeg.c, and gdwbmp.c CVE-2019-6978 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid141688; scriptversion"1.3";...

Scientific Linux Security Update : openldap on SL7.x x86_64 (20201001)

Security Fixes : - openldap: denial of service via nested boolean expressions in LDAP search filters CVE-2020-12243 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid141663; scriptversion"1.3";...

Scientific Linux Security Update : OpenEXR on SL7.x x86_64 (20201001)

Security Fixes : - OpenEXR: out-of-bounds read during Huffman uncompression CVE-2020-11761 - OpenEXR: std::vector out-of-bounds read and write in ImfTileOffsets.cpp CVE-2020-11763 - OpenEXR: out-of-bounds write in copyIntoFrameBuffer function in ImfMisc.cpp CVE-2020-11764 C Tenable Network...

Scientific Linux Security Update : libvirt on SL7.x x86_64 (20201001)

Security Fixes : - libvirt: Potential DoS by holding a monitor job while querying QEMU guest-agent CVE-2019-20485 - libvirt: Potential denial of service via active pool without target path CVE-2020-10703 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

Scientific Linux Security Update : cpio on SL7.x x86_64 (20201001)

Security Fixes : - cpio: improper input validation when writing tar header fields leads to unexpect tar generation CVE-2019-14866 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid141753; scriptversion"1.3";...

Scientific Linux Security Update : squid on SL7.x x86_64 (20201001)

Security Fixes : - squid: HTTP Request Smuggling could result in cache poisoning CVE-2020-15810 - squid: HTTP Request Splitting could result in cache poisoning CVE-2020-15811 - squid: Information Disclosure issue in FTP Gateway CVE-2019-12528 - squid: Improper input validation issues in HTTP...

Scientific Linux Security Update : expat on SL7.x x86_64 (20201001)

Security Fixes : - expat: large number of colons in input makes parser consume high amount of resources, leading to DoS CVE-2018-20843 - expat: heap-based buffer over-read via crafted XML input CVE-2019-15903 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...