Scientific Linux Security Update : poppler on SL5.x i386/x86_64

An uninitialized pointer use flaw was discovered in poppler. An attacker could create a malicious PDF file that, when opened, would cause applications that use poppler such as Evince to crash or, potentially, execute arbitrary code. CVE-2010-3702 An array index error was found in the way poppler...

Scientific Linux Security Update : bind on SL4.x i386/x86_64

It was discovered that named did not invalidate previously cached SIG records when adding an NCACHE record for the same entry to the cache. A remote attacker allowed to send recursive DNS queries to named could use this flaw to crash named. CVE-2010-3613 After installing the update, the BIND daem...

Scientific Linux Security Update : postgresql and postgresql84 on SL5.x i386/x86_64 (20120625)

PostgreSQL is an advanced object-relational database management system DBMS. A flaw was found in the way the crypt password hashing function from the optional PostgreSQL pgcrypto contrib module performed password transformation when used with the DES algorithm. If the password string to be hashed...

Scientific Linux Security Update : firefox on SL5.x, SL6.x i386/x86_64 (20120605)

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with...

Scientific Linux Security Update : evolution-data-server on SL5.x i386/x86_64

Evolution Data Server did not properly check the Secure/Multipurpose Internet Mail Extensions S/MIME signatures used for public key encryption and signing of e-mail messages. An attacker could use this flaw to spoof a signature by modifying the text of the e-mail message displayed to the user...

Scientific Linux Security Update : libexif on SL5.x, SL4.x i386/x86_64

An integer overflow flaw was found in the way libexif parses EXIF image tags. If a victim opens a carefully crafted EXIF image file it could cause the application linked against libexif to execute arbitrary code or crash. CVE-2007-4168 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Scientific Linux Security Update : krb5 on SL5.x i386/x86_64

A use-after-free flaw was discovered in the MIT Kerberos administration daemon, kadmind. A remote, authenticated attacker could use this flaw to crash the kadmind daemon. Administrative privileges are not required to trigger this flaw, as any realm user can request information about their own...

Scientific Linux Security Update : seamonkey on SL3.x, SL4.x i386/x86_64

A flaw was found in the processing of malformed JavaScript content. A web page containing such malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey. CVE-2008-1380 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Scientific Linux Security Update : openssl on SL3.x i386/x86_64

A flaw was found in the SSLgetsharedciphers utility function. An attacker could send a list of ciphers to an application that used this function and overrun a buffer with a single byte CVE-2007-5135. Few applications make use of this vulnerable function and generally it is used only when...

Scientific Linux Security Update : kernel on SL4.x i386/x86_64

Security fixes : - Kernel update 2.6.9-89.EL introduced a flaw in the ptrace implementation on Itanium systems. ptracecheckattach was not called during certain ptrace requests. Under certain circumstances, a local, unprivileged user could use this flaw to call ptrace on a process they do not own,...

Scientific Linux Security Update : seamonkey on SL3.x, SL4.x i386/x86_64

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey. CVE-2009-1303, CVE-2009-1305 Several flaws were found in the way malformed web content...

Scientific Linux Security Update : ImageMagick on SL5.x i386/x86_64

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the ImageMagick routine responsible for creating X11 images. An attacker could create a specially crafted image file that, when opened by a victim, would cause ImageMagick to crash or, potentially, execute arbitrary...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64

This update fixes the following security issues : - A flaw was found in the Linux kernel's garbage collector for AFUNIX sockets. A local, unprivileged user could use this flaw to trigger a denial of service out-of-memory condition. CVE-2010-4249, Moderate - A flaw was found in the Linux kernel's...

Scientific Linux Security Update : openssh on SL4.x, SL5.x i386/x86_64

These packages fix a low severity flaw in the way ssh handles X11 cookies when creating X11 forwarding connections. When ssh was unable to create untrusted cookie, ssh used a trusted cookie instead, possibly allowing the administrative user of a untrusted remote server, or untrusted application r...

Scientific Linux Security Update : wireshark on SL4.x, SL5.x i386/x86_64

A heap-based buffer overflow flaw was found in Wireshark. If Wireshark opened a specially crafted capture file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. CVE-2011-0024 Several denial of service flaws were found in Wireshark. Wireshark could crash or stop...

Scientific Linux Security Update : postgresql and postgresql84 on SL5.x, SL6.x i386/x86_64 (20120521)

PostgreSQL is an advanced object-relational database management system DBMS. The pgdump utility inserted object names literally into comments in the SQL script it produces. An unprivileged database user could create an object whose name includes a newline followed by a SQL command. This SQL comma...

Scientific Linux Security Update : gpdf on SL4.x i386/x86_64

Multiple integer overflow flaws were found in GPdf's JBIG2 decoder. An attacker could create a malicious PDF file that would cause GPdf to crash or, potentially, execute arbitrary code when opened. CVE-2009-0147, CVE-2009-1179 Multiple buffer overflow flaws were found in GPdf's JBIG2 decoder. An...

Scientific Linux Security Update : nfs-utils on SL6.x i386/x86_64

The nfs-utils packages provide a daemon for the kernel Network File System NFS server, and related tools such as the mount.nfs, umount.nfs, and showmount programs. A flaw was found in the way nfs-utils performed IP based authentication of mount requests. In configurations where a directory was...

Scientific Linux Security Update : libtool on SL3.x, SL4.x, SL5.x i386/x86_64

CVE-2009-3736 libtool: libltdl may load and execute code from a library in the current directory A flaw was found in the way GNU Libtool's libltdl library looked for modules to load. It was possible for libltdl to load and run modules from an arbitrary library in the current working directory. If...

Scientific Linux Security Update : dbus-glib on SL5.x i386/x86_64

It was discovered that dbus-glib did not enforce the 'access' flag on exported GObject properties. If such a property were read/write internally but specified as read-only externally, a malicious, local user could use this flaw to modify that property of an application. Such a change could impact...