Scientific Linux Security Update : lcms on SL5.x i386/x86_64

Multiple integer overflow flaws which could lead to heap-based buffer overflows, as well as multiple insufficient input validation flaws, were found in LittleCMS. An attacker could use these flaws to create a specially crafted image file which could cause an application using LittleCMS to crash,...

Scientific Linux Security Update : openssl on SL5.x i386/x86_64 (20120124)

OpenSSL is a toolkit that implements the Secure Sockets Layer SSL v2/v3 and Transport Layer Security TLS v1 protocols, as well as a full-strength, general purpose cryptography library. It was discovered that the Datagram Transport Layer Security DTLS protocol implementation in OpenSSL leaked timi...

Scientific Linux Security Update : php on SL4.x, SL5.x, SL6.x i386/x86_64 (20120202)

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the fix for CVE-2011-4885 released via previous php packages introduced an uninitialized memory use flaw. A remote attacker could send a specially crafted HTTP request to cause the PHP...

Scientific Linux Security Update : firefox on SL5.x, SL6.x i386/x86_64 (20120717)

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. CVE-2012-1948,...

Scientific Linux Security Update : tomcat6 on SL6.x

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. APR Apache Portable Runtime as mentioned in the CVE-2011-3190 and CVE-2011-2526 descriptions does not refer to APR provided by the apr packages. It refers to the implementation of APR provided by the...

Scientific Linux Security Update : dhcp on SL6.x i386/x86_64

The Dynamic Host Configuration Protocol DHCP is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. A denial of service flaw was found in the way the dhcpd daemon handled DH...

Scientific Linux Security Update : 389-ds-base on SL6.x i386/x86_64 (20120620)

The 389 Directory Server is an LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP server and command-line utilities for server administration. A flaw was found in the way 389 Directory Server handled password changes. If an LDAP user has changed thei...

Scientific Linux Security Update : mysql on SL5.x i386/x86_64

CVE-2008-2079 mysql: privilege escalation via DATA/INDEX DIRECTORY directives CVE-2008-3963 MySQL: Using an empty binary value leads to server crash CVE-2008-4456 mysql: mysql command line client XSS flaw CVE-2008-3963 MySQL: Using an empty binary value leads to server crash CVE-2009-2446 MySQL:...

Scientific Linux Security Update : kernel for SL 5.x on i386/x86_64

CVE-2007-5966 kernel: non-root can trigger cpuidle soft lockup CVE-2009-1385 kernel: e1000cleanrxirq denial of service CVE-2009-1388 kernel: docoredump vs ptracestart deadlock CVE-2009-1389 kernel: r8169: fix crash when large packets are received CVE-2009-1895 kernel: personality: fix...

Scientific Linux Security Update : texlive on SL6.x i386/x86_64 (20120215)

TeX Live is an implementation of TeX. TeX takes a text file and a set of formatting commands as input, and creates a typesetter-independent DeVice Independent DVI file as output. The texlive packages provide a number of utilities, including dvips. TeX Live embeds a copy of t1lib. The t1lib librar...

Scientific Linux Security Update : evolution on SL3.x, SL4.x i386/x86_64

A flaw was found in the way Evolution parsed iCalendar timezone attachment data. If mail which included a carefully crafted iCalendar attachment was opened, arbitrary code could be executed as the user running Evolution. CVE-2008-1108 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Scientific Linux Security Update : httpd on SL5.x i386/x86_64

CVE-2010-0408 httpd: modproxyajp remote temporary DoS CVE-2010-0434 httpd: request header information leak It was discovered that modproxyajp incorrectly returned an 'Internal Server Error' response when processing certain malformed requests, which caused the back-end server to be marked as faile...

Scientific Linux Security Update : httpd on SL3.x i386/x86_64

CVE-2009-1891 httpd: possible temporary DoS CPU consumption in moddeflate CVE-2009-2412 apr, apr-util: Integer overflows in memory pool apr and relocatable memory apr-util management Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way the Apache Portable...

Scientific Linux Security Update : glibc on SL6.x i386/x86_64 (20120124)

The glibc packages contain the standard C libraries used by multiple programs on the system. These packages contain the standard C and the standard math libraries. Without these two libraries, a Linux system cannot function properly. An integer overflow flaw, leading to a heap-based buffer...

Scientific Linux Security Update : pam_krb5/krb5 on SL5.x i386/x86_64

pamkrb5 address the following security issue : A flaw was found in the pamkrb5 'existingticket' configuration option. If a system is configured to use an existing credential cache via the 'existingticket' option, it may be possible for a local user to gain elevated privileges by using a different...

Scientific Linux Security Update : ipw3945 on SL5.x i386/x86_64

SL 5.x %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid60320; scriptversion"1.6"; scriptsetattributeattribute:"pluginmodificationdate", value:"2021/01/14";...

Scientific Linux Security Update : thunderbird on SL4.x, SL5.x, SL6.x i386/x86_64

This erratum blacklists a small number of HTTPS certificates. BZ689430 This update also fixes the following bug : - Previous security updates introduced a regression, preventing some Java content and plug-ins written in Java from loading. With this update, the Java content and plug-ins work as...

Scientific Linux Security Update : xpdf on SL4.x, SL3.x i386/x86_64

Maurycy Prodeus discovered an integer overflow flaw in the processing of PDF files. An attacker could create a malicious PDF file that would cause Xpdf to crash or potentially execute arbitrary code when opened. CVE-2007-3387 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive te...

Scientific Linux Security Update : neon on SL4.x, SL5.x i386/x86_64

CVE-2009-2473 neon, gnome-vfs2 embedded neon: billion laughs DoS attack CVE-2009-2474 neon: Improper verification of x509v3 certificate with NULL zero byte in certain fields It was discovered that neon is affected by the previously published 'null prefix attack', caused by incorrect handling of...

Scientific Linux Security Update : webkitgtk on SL6.x i386/x86_64

Multiple memory corruption flaws were found in WebKit. Malicious web content could cause an application using WebKitGTK+ to crash or, potentially, execute arbitrary code with the privileges of the user running the application. CVE-2010-1782, CVE-2010-1783, CVE-2010-1784, CVE-2010-1785,...