Scientific Linux Security Update : openldap on SL5.x i386/x86_64

A flaw was found in the way OpenLDAP's slapd daemon handled malformed objectClasses LDAP attributes. A local or remote attacker could create an LDAP request which could cause a denial of service by crashing slapd. CVE-2007-5707 In addition, the following feature was added : - OpenLDAP client tool...

Scientific Linux Security Update : vnc on SL3.x, SL4.x, SL5.x i386/x86_64

An insufficient input validation flaw was discovered in the VNC client application, vncviewer. If an attacker could convince a victim to connect to a malicious VNC server, or when an attacker was able to connect to vncviewer running in the 'listen' mode, the attacker could cause the victim's...

Scientific Linux Security Update : libexif on SL5.x, SL4.x i386/x86_64

An infinite recursion flaw was found in the way libexif parses Exif image tags. If a victim opens a carefully crafted Exif image file, it could cause the application linked against libexif to crash. CVE-2007-6351 An integer overflow flaw was found in the way libexif parses Exif image tags. If a...

Scientific Linux Security Update : squirrelmail on SL5.x, SL4.x, SL3.x i386/x86_64

Several HTML filtering bugs were discovered in SquirrelMail. An attacker could inject arbitrary JavaScript leading to cross-site scripting attacks by sending an e-mail viewed by a user within SquirrelMail. CVE-2007-1262 Squirrelmail did not sufficiently check arguments to IMG tags in HTML e-mail...

Scientific Linux Security Update : e2fsprogs on SL5.x, SL4.x, SL3.x i386/x86_64

Multiple integer overflow flaws were found in the way e2fsprogs processes file system content. If a victim opens a carefully crafted file system with a program using e2fsprogs, it may be possible to execute arbitrary code with the permissions of the victim. It may be possible to leverage this fla...

Scientific Linux Security Update : python on SL4.x i386/x86_64

Multiple flaws were found in the Python rgbimg module. If an application written in Python was using the rgbimg module and loaded a specially crafted SGI image file, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the applicatio...

Scientific Linux Security Update : rpm on SL4.x i386/x86_64

It was discovered that RPM did not remove setuid and setgid bits set on binaries when upgrading or removing packages. A local attacker able to create hard links to binaries could use this flaw to keep those binaries on the system, at a specific version level and with the setuid or setgid bit set,...

Scientific Linux Security Update : httpd on SL6.x i386/x86_64

The Apache HTTP Server is a popular web server. It was discovered that the Apache HTTP Server did not properly validate the request URI for proxied requests. In certain configurations, if a reverse proxy used the ProxyPassMatch directive, or if it used the RewriteRule directive with the proxy fla...

Scientific Linux Security Update : httpd on SL4.x, SL5.x i386/x86_64

The Apache HTTP Server is a popular web server. It was discovered that the Apache HTTP Server did not properly validate the request URI for proxied requests. In certain configurations, if a reverse proxy used the ProxyPassMatch directive, or if it used the RewriteRule directive with the proxy fla...

Scientific Linux Security Update : cups on SL5.x i386/x86_64

Two integer overflow flaws were found in the CUPS 'pdftops' filter. An attacker could create a malicious PDF file that would cause 'pdftops' to crash or, potentially, execute arbitrary code as the 'lp' user if the file was printed. CVE-2009-3608, CVE-2009-3609 After installing the update, the cup...

Scientific Linux Security Update : systemtap on SL5.x i386/x86_64

SystemTap is an instrumentation system for systems running the Linux kernel, version 2.6. Developers can write scripts to collect data on the operation of the system. A divide-by-zero flaw was found in the way SystemTap handled malformed debugging information in DWARF format. When SystemTap...

Scientific Linux Security Update : xen on SL5.x i386/x86_64

CVE-2009-3525 Xen: PyGrub missing support for password configuration command The pyGrub boot loader did not honor the 'password' option in the grub.conf file for para-virtualized guests. Users with access to a guest's console could use this flaw to bypass intended access restrictions and boot the...

Scientific Linux Security Update : httpd on SL3.x, SL4.x, SL5.x i386/x86_64

CVE-2009-1891 httpd: possible temporary DoS CPU consumption in moddeflate CVE-2009-3094 httpd: NULL pointer defer in modproxyftp caused by crafted EPSV and PASV reply CVE-2009-3095 httpd: modproxyftp FTP command injection via Authorization HTTP header CVE-2009-3555 TLS: MITM attacks via session...

Scientific Linux Security Update : w3c-libwww on SL4 i386/x86_64

Several buffer overflow flaws in w3c-libwww were found. If a client application that uses w3c-libwww connected to a malicious HTTP server, it could trigger an out of bounds memory access, causing the client application to crash CVE-2005-3183. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. T...

Scientific Linux Security Update : libguestfs on SL6.x x86_64

libguestfs is a library for accessing and modifying guest disk images. libguestfs relied on the format auto-detection in QEMU rather than allowing the guest image file format to be specified. A privileged guest user could potentially use this flaw to read arbitrary files on the host that were...

Scientific Linux Security Update : bind on SL 3.0.x , SL 4.x, SL 5.x

The DNS protocol protects against spoofing attacks by requiring an attacker to predict both the DNS transaction ID and UDP source port of a request. In recent years, a number of papers have found problems with DNS implementations which make it easier for an attacker to perform DNS cache-poisoning...

Scientific Linux Security Update : samba on SL5.x, SL4.x, SL3.x i386/x86_64

A buffer overflow flaw was found in the way Samba creates NetBIOS replies. If a Samba server is configured to run as a WINS server, a remote unauthenticated user could cause the Samba server to crash or execute arbitrary code. CVE-2007-5398 A heap based buffer overflow flaw was found in the way...

Scientific Linux Security Update : ruby on SL3.x i386/x86_64

Multiple integer overflows leading to a heap overflow were discovered in the array- and string-handling code used by Ruby. An attacker could use these flaws to crash a Ruby application or, possibly, execute arbitrary code with the privileges of the Ruby application using untrusted inputs in array...

Scientific Linux Security Update : tzdata on SL3.x, SL4.x, SL5.x i386/x86_64

The tzdata package contains data files with rules for various time zones around the world. This updated package addresses the following changes to Daylight Saving Time DST observations : - Future transition dates for Brazil were fixed. - Several Argentinian provinces decided not to observe Daylig...

Scientific Linux Security Update : GPG-RPM key on SL3.x, SL4.x, SL5.x i386/x86_64

Updating the GPG keys in the release to include a Scientific Linux RPM signing key to sign the rpm's with. We will start using this new key, and stop using Connie or Troy's personal GPG Keys for signing rpm's. This is labeled as Moderate because those machines that have gpg checking turned on wil...