Scientific Linux Security Update : openssl on SL5.x i386/x86_64

OpenSSL is a toolkit that implements Secure Sockets Layer SSL v2/v3 and Transport Layer Security TLS v1 protocols as well as a full-strength general purpose cryptography library. Datagram TLS DTLS is a protocol based on TLS that is capable of securing datagram transport UDP for instance. The...

Scientific Linux Security Update : gimp on SL5.x, SL4.x, SL3.x i386/x86_64

Multiple integer overflow and input validation flaws were found in The GIMP's image loaders. An attacker could create a carefully crafted image file that could cause The GIMP to crash or possibly execute arbitrary code if the file was opened by a victim. CVE-2006-4519, CVE-2007-2949, CVE-2007-374...

Scientific Linux Security Update : abrt, libreport, btparser, and python-meh on SL6.x i386/x86_64 (20120620)

ABRT Automatic Bug Reporting Tool is a tool to help users to detect defects in applications and to create a bug report with all the information needed by a maintainer to fix it. It uses a plug-in system to extend its functionality. libreport provides an API for reporting different problems in...

Scientific Linux Security Update : systemtap on SL5.x i386/x86_64

SystemTap is an instrumentation system for systems running the Linux kernel, version 2.6. Developers can write scripts to collect data on the operation of the system. A divide-by-zero flaw was found in the way SystemTap handled malformed debugging information in DWARF format. When SystemTap...

Scientific Linux Security Update : cups on SL5.x i386/x86_64

Two integer overflow flaws were found in the CUPS 'pdftops' filter. An attacker could create a malicious PDF file that would cause 'pdftops' to crash or, potentially, execute arbitrary code as the 'lp' user if the file was printed. CVE-2009-3608, CVE-2009-3609 After installing the update, the cup...

Scientific Linux Security Update : caching-nameserver on SL3.x i386/x86_64

the IPv4 address of L.ROOT-SERVERS.NET one of the DNS root servers changed. It was 198.32.64.12. It is now 199.7.83.42 This update includes an edited named.ca file that reflects this change. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

Scientific Linux Security Update : dhcp on SL4.x,SL5.x,SL6.x i386/x86_64

It was discovered that the DHCP client daemon, dhclient, did not sufficiently sanitize certain options provided in DHCP server replies, such as the client hostname. A malicious DHCP server could send such an option with a specially crafted value to a DHCP client. If this option's value was saved ...

Scientific Linux Security Update : gnutls on SL4.x i386/x86_64

Flaws were found in the way GnuTLS handles malicious client connections. A malicious remote client could send a specially crafted request to a service using GnuTLS that could cause the service to crash. CVE-2008-1948, CVE-2008-1949, CVE-2008-1950 At this time we have not seen any code that is usi...

Scientific Linux Security Update : dbus on SL5.x, SL6.x i386/x86_64

D-Bus is a system for sending messages between applications. It is used for the system-wide message bus service and as a per-user-login-session messaging facility. A denial of service flaw was found in the way the D-Bus library handled endianness conversion when receiving messages. A local user...

Scientific Linux Security Update : evolution on SL4.x, SL3.x i386/x86_64

A flaw was found in the way Evolution processes certain IMAP server messages. If a user can be tricked into connecting to a malicious IMAP server it may be possible to execute arbitrary code as the user running evolution. CVE-2007-3257 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Scientific Linux Security Update : bind on SL5.x i386/x86_64

It was discovered that the bind packages created the 'rndc.key' file with insecure file permissions. This allowed any local user to read the content of this file. A local user could use this flaw to control some aspects of the named daemon by using the rndc utility, for example, stopping the name...

Scientific Linux Security Update : cpio on SL3.x, SL4.x, SL5.x i386/x86_64

CVE-2005-4268 cpio large filesize buffer overflow CVE-2007-4476 tar/cpio stack crashing in safernamesuffix CVE-2010-0624 tar, cpio: Heap-based buffer overflow by expanding a specially crafted archive A heap-based buffer overflow flaw was found in the way cpio expanded archive files. If a user wer...

Scientific Linux Security Update : freetype on SL5.x, SL6.x i386/x86_64 (20120410)

FreeType is a free, high-quality, portable font engine that can open and manage font files. It also loads, hints, and renders individual glyphs efficiently. Multiple flaws were found in the way FreeType handled TrueType Font TTF, Glyph Bitmap Distribution Format BDF, Windows .fnt and .fon, and...

Scientific Linux Security Update : kexec-tools on SL5.x i386/x86_64 (20120221)

The kexec-tools package contains the /sbin/kexec binary and utilities that together form the user-space component of the kernel's kexec feature. The /sbin/kexec binary facilitates a new kernel to boot using the kernel's kexec feature either on a normal or a panic reboot. The kexec fastboot...

Scientific Linux Security Update : tzdata on SL3.x, SL4.x, SL5.x i386/x86_64

This updated package addresses the following change to Daylight Saving Time DST observations : - during Ramadan, that is, during the period between 2010-08-11 and 2010-09-08, Egypt will suspend DST. The DST period will be officially restored on 2010-09-09. BZ618593, BZ618597, BZ618599 %NASLMINLEV...

Scientific Linux Security Update : gstreamer-plugins-good on SL5.x i386/x86_64

Multiple heap buffer overflows and an array indexing error were found in the GStreamer's QuickTime media file format decoding plugin. An attacker could create a carefully-crafted QuickTime media .mov file that would cause an application using GStreamer to crash or, potentially, execute arbitrary...

Scientific Linux Security Update : postgresql and postgresql84 on SL6.x i386/x86_64 (20120625)

PostgreSQL is an advanced object-relational database management system DBMS. A flaw was found in the way the crypt password hashing function from the optional PostgreSQL pgcrypto contrib module performed password transformation when used with the DES algorithm. If the password string to be hashed...

Scientific Linux Security Update : xen on SL5.x i386/x86_64

It was discovered that the hypervisor's para-virtualized framebuffer PVFB backend failed to validate the frontend's framebuffer description properly. This could allow a privileged user in the unprivileged domain DomU to cause a denial of service, or, possibly, elevate privileges to the privileged...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64

This update fixes the following security issues : - A NULL pointer dereference flaw was found in the iosubmitone function in the Linux kernel asynchronous I/O implementation. A local, unprivileged user could use this flaw to cause a denial of service. CVE-2010-3066, Moderate - A flaw was found in...

Scientific Linux Security Update : openssl on SL6.x i386/x86_64

A ciphersuite downgrade flaw was found in the OpenSSL SSL/TLS server code. A remote attacker could possibly use this flaw to change the ciphersuite associated with a cached session stored on the server, if the server enabled the SSLOPNETSCAPEREUSECIPHERCHANGEBUG option, possibly forcing the clien...