Scientific Linux Security Update : icu on SL5.x i386/x86_64

A flaw was found in the way ICU processed certain, invalid, encoded data. If an application used ICU to decode malformed, multibyte, character data, it may have been possible to bypass certain content protection mechanisms, or display information in a manner misleading to the user. CVE-2008-1036...

Scientific Linux Security Update : mysql on SL6.x i386/x86_64 (20120208)

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon mysqld and many client programs and libraries. This update fixes several vulnerabilities in the MySQL database server. Information about these flaws can be found on the Oracle Critical Patch Update...

Scientific Linux Security Update : ipsec-tools on SL5.x i386/x86_64

A denial of service flaw was found in the ipsec-tools racoon daemon. It was possible for a remote attacker, with knowledge of an existing ipsec tunnel, to terminate the ipsec connection between two machines. CVE-2007-1841 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text i...

Scientific Linux Security Update : tzdata on SL3.x, SL4.x, SL5.x i386/x86_64

This updated package addresses the following change to Daylight Saving Time DST observations : - Pakistan was previously expected to switch back to standard time at 00:00 midnight, between October 31st and November 1st 2009. Pakistan is now set to leave Daylight Savings Time DST at midnight betwe...

Scientific Linux Security Update : bind on SL5.x, SL6.x i386/x86_64

"The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'deprecatednasllevel.inc'; include'compat.inc'; if...

Scientific Linux Security Update : seamonkey on SL3.x, SL4.x i386/x86_64

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey. CVE-2008-5500, CVE-2008-5501, CVE-2008-5502, CVE-2008-5504, CVE-2008-5511,...

Scientific Linux Security Update : polkit on SL6.x i386/x86_64

A race condition flaw was found in the PolicyKit pkexec utility and polkitd daemon. A local user could use this flaw to appear as a privileged user to pkexec, allowing them to execute arbitrary commands as root by running those commands with pkexec. CVE-2011-1485 The system must be rebooted for...

Scientific Linux Security Update : xorg-x11 on SL4.x i386/x86_64

A flaw was found in the way X.Org's composite extension handles 32 bit color depth windows while running in 16 bit color depth mode. If an X.org server has enabled the composite extension, it may be possible for a malicious authorized client to cause a denial of service crash or potentially execu...

Scientific Linux Security Update : NetworkManager on SL4.x, SL5.x i386/x86_64

An information disclosure flaw was found in NetworkManager's D-Bus interface. A local attacker could leverage this flaw to discover sensitive information, such as network connection passwords and pre-shared keys. CVE-2009-0365 A potential denial of service flaw was found in NetworkManager's D-Bus...

Scientific Linux Security Update : pango on SL6.x i386/x86_64

It was discovered that Pango did not check for memory reallocation failures in the hbbufferensure function. An attacker able to trigger a reallocation failure by passing sufficiently large input to an application using Pango could use this flaw to crash the application or, possibly, execute...

Scientific Linux Security Update : lvm2-cluster,lvm2 for SL5

It was discovered that the cluster logical volume manager daemon clvmd did not verify the credentials of clients connecting to its control UNIX abstract socket, allowing local, unprivileged users to send control commands that were intended to only be available to the privileged root user. This...

Scientific Linux Security Update : seamonkey on SL3.x, SL4.x i386/x86_64

A race condition flaw was found in the way SeaMonkey handled Document Object Model DOM element properties. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. CVE-2010-3765 After installi...

Scientific Linux Security Update : cvs on SL6.x i386/x86_64

An array index error, leading to a heap-based buffer overflow, was found in the way CVS applied certain delta fragment changes from input files in the RCS Revision Control System file format. If an attacker in control of a CVS repository stored a specially crafted RCS file in that repository, and...

Scientific Linux Security Update : hplip on SL5.x i386/x86_64

Kees Cook discovered a flaw in the way the hplip hpssd daemon handled user input. A local attacker could send a specially crafted request to the hpssd daemon, possibly allowing them to run arbitrary commands as the root user. CVE-2007-5208. On Scientific Linux 5, the SELinux targeted policy for...

Scientific Linux Security Update : bzip2 on SL3.x, SL4.x, SL5.x i386/x86_64

A buffer over-read flaw was discovered in the bzip2 decompression routine. This issue could cause an application linked against the libbz2 library to crash when decompressing malformed archives. CVE-2008-1372 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C Scientifi...

Scientific Linux Security Update : kernel on SL4.x i386/x86_64

CVE-2005-4881 kernel: netlink: fix numerous padding memleaks CVE-2009-3228 kernel: tc: uninitialised kernel memory leak This update fixes the following security issues : - multiple, missing initialization flaws were found in the Linux kernel. Padding data in several core network structures was no...

Scientific Linux Security Update : php on SL5.x, SL6.x i386/x86_64 (20120507)

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. A flaw was found in the way the php-cgi executable processed command line arguments when running in CGI mode. A remote attacker could send a specially crafted request to a PHP script that would result in the que...

Scientific Linux Security Update : nss and nspr on SL5.x i386/x86_64 (20120717)

Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime NSPR provides platform independence for non-GUI operating system facilities. A flaw was found in the way the ASN.1...

Scientific Linux Security Update : systemtap on SL4.x i386/x86_64

CVE-2010-0411 systemtap: Crash with systemtap script using getargv A buffer overflow flaw was found in SystemTap's tapset getargv function. If a privileged user ran a SystemTap script that called this function, a local, unprivileged user could, while that script is still running, trigger this fla...

Scientific Linux Security Update : mysql on SL5.x, SL4.x i386/x86_64

A flaw was found in a way MySQL handled symbolic links when database tables were created with explicit 'DATA' and 'INDEX DIRECTORY' options. An authenticated user could create a table that would overwrite tables in other databases, causing destruction of data or allowing the user to elevate...