Scientific Linux Security Update : freetype on SL4.x i386/x86_64

FreeType is a free, high-quality, portable font engine that can open and manage font files. It also loads, hints, and renders individual glyphs efficiently. These packages provide both the FreeType 1 and FreeType 2 font engines. A buffer overflow flaw was found in the way the FreeType library...

Scientific Linux Security Update : cvs on SL5.x, SL6.x i386/x86_64 (20120221)

Concurrent Version System CVS is a version control system that can record the history of your files. A heap-based buffer overflow flaw was found in the way the CVS client handled responses from HTTP proxies. A malicious HTTP proxy could use this flaw to cause the CVS client to crash or, possibly,...

Scientific Linux Security Update : seamonkey on SL4.x i386/x86_64

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. CVE-2010-3767, CVE-2010-3772, CVE-2010-3776 A flaw was found in th...

Scientific Linux Security Update : selinux-policy on SL6.x i386/x86_64

This update fixes the following bug : - Prior to this update, the SELinux policy package did not allow the RHEV agent to execute. This update adds the policy for RHEV agents, so that they can be executed as expected. - Previously, several labels were incorrect and rules for creating new 389-ds...

Scientific Linux Security Update : mod_auth_mysql on SL6.x i386/x86_64

A flaw was found in the way modauthmysql escaped certain multibyte-encoded strings. If modauthmysql was configured to use a multibyte character set that allowed a backslash '' as part of the character encodings, a remote attacker could inject arbitrary SQL commands into a login request...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64

This update fixes the following security issue : - A flaw was found in the sctpicmpprotounreachable function in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. A remote attacker could use this flaw to cause a denial of service. CVE-2010-4526, Important This update als...

Scientific Linux Security Update : firefox on SL4.x i386/x86_64

Several use-after-free flaws were found in Firefox. Visiting a web page containing malicious content could result in Firefox executing arbitrary code with the privileges of the user running Firefox. CVE-2010-0175, CVE-2010-0176, CVE-2010-0177 A flaw was found in Firefox that could allow an applet...

Scientific Linux Security Update : samba on SL6.x i386/x86_64

A flaw was found in the way Samba handled file descriptors. If an attacker were able to open a large number of file descriptors on the Samba server, they could flip certain stack bits to '1' values, resulting in the Samba server smbd crashing. CVE-2011-0719 After installing this update, the smb...

Scientific Linux Security Update : seamonkey on SL3.x, SL4.x i386/x86_64

A flaw was found in the way SeaMonkey creates temporary file names for downloaded files. If a local attacker knows the name of a file SeaMonkey is going to download, they can replace the contents of that file with arbitrary contents. CVE-2009-3274 A heap-based buffer overflow flaw was found in th...

Scientific Linux Security Update : openoffice.org, hsqldb on SL5.x i386/x86_64

It was discovered that HSQLDB could allow the execution of arbitrary public static Java methods. A carefully crafted odb file opened in OpenOffice.org Base could execute arbitrary commands with the permissions of the user running OpenOffice.org. CVE-2007-4575 It was discovered that HSQLDB did not...

Scientific Linux Security Update : gpdf on SL4.x i386/x86_64

A flaw was discovered in the way gpdf displayed malformed fonts embedded in PDF files. An attacker could create a malicious PDF file that would cause gpdf to crash, or, potentially, execute arbitrary code when opened. CVE-2008-1693 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Scientific Linux Security Update : tar on SL5.x, SL4.x i386/x86_64

A path traversal flaw was discovered in the way GNU tar extracted archives. A malicious user could create a tar archive that could write to arbitrary files to which the user running GNU tar had write access. CVE-2007-4131 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text i...

Scientific Linux Security Update : seamonkey on SL4.x i386/x86_64 (fwd)

CVE-2009-2462 Mozilla Browser engine crashes CVE-2009-2463 Mozilla Base64 decoding crash CVE-2009-2466 Mozilla JavaScript engine crashes Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially,...

Scientific Linux Security Update : thunderbird on SL5.x, SL4.x, SL3.x i386/x86_64

Several flaws were found in the way in which Thunderbird processed certain malformed HTML mail content. An HTML mail message containing malicious content could cause Thunderbird to crash or potentially execute arbitrary code as the user running Thunderbird. JavaScript support is disabled by defau...

Scientific Linux Security Update : NetworkManager on SL5.x i386/x86_64

CVE-2009-4145 NetworkManager: information disclosure by nm-connection-editor CVE-2009-4144 NetworkManager: WPA enterprise network not verified when certificate is removed A missing network certificate verification flaw was found in NetworkManager. If a user created a WPA Enterprise or 802.1x...

Scientific Linux Security Update : quagga on SL6.x i386/x86_64

A stack-based buffer overflow flaw was found in the way the Quagga bgpd daemon processed certain BGP Route Refresh RR messages. A configured BGP peer could send a specially crafted BGP message, causing bgpd on a target system to crash or, possibly, execute arbitrary code with the privileges of th...

Scientific Linux Security Update : libvorbis on SL3.x, SL4.x, SL5.x i386/x86_64

Will Drewry of the Google Security Team reported several flaws in the way libvorbis processed audio data. An attacker could create a carefully crafted OGG audio file in such a way that it could cause an application linked with libvorbis to crash, or execute arbitrary code when it was opened...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64

This update fixes the following security issues : - multiple flaws were found in the mmap and mremap implementations. A local user could use these flaws to cause a local denial of service or escalate their privileges. CVE-2010-0291, Important - a NULL pointer dereference flaw was found in the Fas...

Scientific Linux Security Update : dovecot on SL5.x i386/x86_64

A flaw was found in Dovecot's ACL plug-in. The ACL plug-in treated negative access rights as positive rights, which could allow an attacker to bypass intended access restrictions. CVE-2008-4577 A password disclosure flaw was found with Dovecot's configuration file. If a system had the...

Scientific Linux Security Update : cups on SL3.x, SL5.x i386/x86_64

A NULL pointer dereference flaw was found in the way CUPS handled subscriptions for printing job completion notifications. A local user could use this flaw to crash the CUPS daemon by submitting a large number of printing jobs requiring mail notification on completion, leading to a denial of...