Scientific Linux Security Update : xorg-x11-server on SL5.x, SL6.x i386/x86_64

X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Multiple input sanitization flaws were found in the X.Org GLX OpenGL extension to the X Window System extension. A malicious,...

Scientific Linux Security Update : thunderbird on SL4.x, SL5.x i386/x86_64

Multiple flaws were found in the processing of malformed JavaScript content. An HTML mail containing such malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. CVE-2008-2801, CVE-2008-2802, CVE-2008-2803 Several flaws were foun...

Scientific Linux Security Update : tcltk on SL3.x i386/x86_64

An input validation flaw was discovered in Tk's GIF image handling. A code-size value read from a GIF image was not properly validated before being used, leading to a buffer overflow. A specially crafted GIF file could use this to cause a crash or, potentially, execute code with the privileges of...

Scientific Linux Security Update : SL_desktop_tweaks on SL5.x i386/x86_64

A %triggerun script triggering on kdebase had a bug. It would make your startkde file empty. This update fixes the script as well as fixes your startkde file if it was wiped out. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

Scientific Linux Security Update : netpbm on SL4.x, SL5.x i386/x86_64

An input validation flaw and multiple integer overflows were discovered in the JasPer library providing support for JPEG-2000 image format and used in the jpeg2ktopam and pamtojpeg2k converters. An attacker could create a carefully-crafted JPEG file which could cause jpeg2ktopam to crash or,...

Scientific Linux Security Update : thunderbird on SL5.x, SL6.x i386/x86_64 (20120606)

Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed content. Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. CVE-2011-3101,...

Scientific Linux Security Update : libtiff on SL3.x, SL4.x, SL5.x i386/x86_64

Multiple uses of uninitialized values were discovered in libtiff's Lempel-Ziv-Welch LZW compression algorithm decoder. An attacker could create a carefully crafted LZW-encoded TIFF file that would cause an application linked with libtiff to crash or, possibly, execute arbitrary code. CVE-2008-232...

Scientific Linux Security Update : postfix on SL4.x, SL5.x i386/x86_64

It was discovered that Postfix did not flush the received SMTP commands buffer after switching to TLS encryption for an SMTP session. A man-in-the-middle attacker could use this flaw to inject SMTP commands into a victim's session during the plain text phase. This would lead to those commands bei...

Scientific Linux Security Update : wireshark on SL5.x i386/x86_64

Several denial of service bugs were found in Wireshark's HTTP, iSeries, DCP ETSI, SSL, MMS, DHCP and BOOTP protocol dissectors. It was possible for Wireshark to crash or stop responding if it read a malformed packet off the network. CVE-2007-3389, CVE-2007-3390, CVE-2007-3391, CVE-2007-3392,...

Scientific Linux Security Update : sendmail on SL4.x i386/x86_64

The configuration of Sendmail was found to not reject the 'localhost.localdomain' domain name for e-mail messages that came from external hosts. This could have allowed remote attackers to disguise spoofed messages CVE-2006-7176. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptiv...

Scientific Linux Security Update : xen on SL5.x i386/x86_64

The xen packages contain administration tools and the xend service for managing the kernel-xen kernel for virtualization on Scientific Linux. A buffer overflow flaw was found in the Xen hypervisor SCSI subsystem emulation. An unprivileged, local guest user could provide a large number of bytes th...

Scientific Linux Security Update : firefox on SL5.x, SL4.x, SL3.x i386/x86_64

Several flaws were found in the way in which Firefox processed certain malformed web content. A web page containing malicious content could cause Firefox to crash or potentially execute arbitrary code as the user running Firefox. CVE-2007-5338, CVE-2007-5339, CVE-2007-5340 Several flaws were foun...

Scientific Linux Security Update : openafs on SL4.x i386/x86_64

Updated openafs that fixes several bugs. This is the same openafs that is in Scientific Linux 4.5. Please remember that openafs is not autoyumed by default. You will have to manually do a 'yum update' to get the openafs update. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Scientific Linux Security Update : shadow-utils on SL4.x i386/x86_64

A flaw was found in the useradd tool in shadow-utils. A new user's mailbox, when created, could have random permissions for a short period. This could allow a local attacker to read or modify the mailbox. CVE-2006-1174 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C...

Scientific Linux Security Update : xmlsec1 on SL4.x, SL5.x i386/x86_64

A flaw was found in the way xmlsec1 handled XML files that contain an XSLT transformation specification. A specially crafted XML file could cause xmlsec1 to create or overwrite an arbitrary file while performing the verification of a file's digital signature. CVE-2011-1425 After installing the...

Scientific Linux Security Update : ruby on SL4.x, SL5.x i386/x86_64 (20120130)

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to do system management tasks. A denial of service flaw was found in the implementation of associative arrays hashes in Ruby. An attacker able to supply a large number of inputs to a...

Scientific Linux Security Update : git on SL6.x i386/x86_64

A cross-site scripting XSS flaw was found in gitweb, a simple web interface for Git repositories. A remote attacker could perform an XSS attack against victims by tricking them into visiting a specially crafted gitweb URL. CVE-2010-3906 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Scientific Linux Security Update : postgresql on SL4.x, SL5.x, SL6.x i386/x86_64

PostgreSQL is an advanced object-relational database management system DBMS. A signedness issue was found in the way the crypt function in the PostgreSQL pgcrypto module handled 8-bit characters in passwords when using Blowfish hashing. Up to three characters immediately preceding a non-ASCII...

Scientific Linux Security Update : curl on SL3.x, SL4.x, SL5.x i386/x86_64

David Kierznowski discovered a flaw in libcurl where it would not differentiate between different target URLs when handling automatic redirects. This caused libcurl to follow any new URL that it understood, including the 'file://' URL type. This could allow a remote server to force a local...

Scientific Linux Security Update : tzdata on SL4.x, SL5.x, SL6.x i386/x86_64

This updated package addresses the following changes to Daylight Saving Time DST : - Chile was supposed to switch to the standard time April 2nd, 2011. With this update Daylight Saving Time is retained for additional five weeks and the system switches to standard time on May 7th, 2011. BZ691432,...