Scientific Linux Security Update : gimp on SL6.x i386/x86_64

The GIMP GNU Image Manipulation Program is an image composition and editing program. A heap-based buffer overflow flaw was found in the GIMP's Paint Shop Pro PSP image file plug-in. An attacker could create a specially crafted PSP image file that, when opened, could cause the PSP plug-in to crash...

Scientific Linux Security Update : mysql on SL4.x i386/x86_64

CVE-2008-4098 mysql: incomplete upstream fix for CVE-2008-2079 CVE-2008-4456 mysql: mysql command line client XSS flaw CVE-2009-2446 MySQL: Format string vulnerability by manipulation with database instances crash CVE-2009-4030 mysql: Incomplete fix for CVE-2008-2079 / CVE-2008-4098 Multiple flaw...

Scientific Linux Security Update : wireshark on SL4.x i386/x86_64

Several denial of service bugs were found in Wireshark's HTTP, iSeries, DCP ETSI, SSL, MMS, DHCP and BOOTP protocol dissectors. It was possible for Wireshark to crash or stop responding if it read a malformed packet off the network. CVE-2007-3389, CVE-2007-3390, CVE-2007-3391, CVE-2007-3392,...

Scientific Linux Security Update : apr-util on SL4.x, SL5.x i386/x86_64

An off-by-one overflow flaw was found in the way apr-util processed a variable list of arguments. An attacker could provide a specially crafted string as input for the formatted output conversion routine, which could, on big-endian platforms, potentially lead to the disclosure of sensitive...

Scientific Linux Security Update : seamonkey on SL4.x, SL3.x i386/x86_64

A cross-site scripting flaw was found in the way SeaMonkey handled the jar: URI scheme. It was possible for a malicious website to leverage this flaw and conduct a cross-site scripting attack against a user running SeaMonkey. CVE-2007-5947 Several flaws were found in the way SeaMonkey processed...

Scientific Linux Security Update : openoffice.org on SL5.x, SL4.x, SL3.x i386/x86_64

A heap overflow flaw was found in the TIFF parser. An attacker could create a carefully crafted document containing a malicious TIFF file that could cause OpenOffice.org to crash or possibly execute arbitrary code if opened by a victim. CVE-2007-2834 %NASLMINLEVEL 70300 C Tenable Network Security...

Scientific Linux Security Update : evolution on SL4.x, SL3.x i386/x86_64

A flaw was found in the way Evolution processes certain IMAP server messages. If a user can be tricked into connecting to a malicious IMAP server it may be possible to execute arbitrary code as the user running evolution. CVE-2007-3257 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Scientific Linux Security Update : nss on SL6.x i386/x86_64

A flaw was found in the way NSS matched SSL certificates when the certificates had a Common Name containing a wildcard and a partial IP address. NSS incorrectly accepted connections to IP addresses that fell within the SSL certificate's wildcard range as valid SSL connections, possibly allowing a...

Scientific Linux Security Update : cups on SL3.x i386/x86_64

An integer overflow flaw, leading to a heap-based buffer overflow, was discovered in the Tagged Image File Format TIFF decoding routines used by the CUPS image-converting filters, 'imagetops' and 'imagetoraster'. An attacker could create a malicious TIFF file that could, potentially, execute...

Scientific Linux Security Update : xorg-x11-server on SL5.x i386/x86_64

Two integer overflow flaws were found in the X.Org server's EVI and MIT-SHM modules. A malicious authorized client could exploit these issues to cause a denial of service crash, or potentially execute arbitrary code with root privileges on the X.Org server. CVE-2007-6429 A memory corruption flaw...

Scientific Linux Security Update : cups on SL4.x i386/x86_64

Problem description : Alin Rad Pop discovered several flaws in the handling of PDF files. An attacker could create a malicious PDF file that would cause CUPS to crash or potentially execute arbitrary code when printed. CVE-2007-4352, CVE-2007-5392, CVE-2007-5393 Alin Rad Pop discovered a flaw in ...

Scientific Linux Security Update : thunderbird on SL4.x, SL5.x i386/x86_64

Several flaws were found in the processing of malformed HTML mail content. An HTML mail message containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. CVE-2010-3176, CVE-2010-3180 Note: JavaScript...

Scientific Linux Security Update : seamonkey on SL3.x, SL4.x i386/x86_64

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. CVE-2010-1200 A flaw was found in the way browser plug-ins interac...

Scientific Linux Security Update : scsi-target-utils on SL5.x i386/x86_64

Multiple buffer overflow flaws were found in scsi-target-utils' tgtd daemon. A remote attacker could trigger these flaws by sending a carefully-crafted Internet Storage Name Service iSNS request, causing the tgtd daemon to crash. CVE-2010-2221 All running scsi-target-utils services must be...

Scientific Linux Security Update : glibc on SL5.x,SL6.x i386/x86_64

The glibc packages contain the standard C libraries used by multiple programs on the system. These packages contain the standard C and the standard math libraries. Without these two libraries, a Linux system cannot function properly. The fix for CVE-2010-3847 introduced a regression in the way th...

Scientific Linux Security Update : thunderbird on SL3.x i386/x86_64

Thunderbird has had several important security updates. Thunderbird is no longer supported for Scientific Linux 3. This package essentually removes thunderbird from your system and replaces it with a script calling seamonkey -mail. This package will automatically pull in any seamonkey packages...

Scientific Linux Security Update : openssl on SL6.x i386/x86_64

A ciphersuite downgrade flaw was found in the OpenSSL SSL/TLS server code. A remote attacker could possibly use this flaw to change the ciphersuite associated with a cached session stored on the server, if the server enabled the SSLOPNETSCAPEREUSECIPHERCHANGEBUG option, possibly forcing the clien...

Scientific Linux Security Update : dhcp on SL4.x, SL5.x, SL6.x i386/x86_64

The Dynamic Host Configuration Protocol DHCP is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. Two denial of service flaws were found in the way the dhcpd daemon handle...

Scientific Linux Security Update : glibc on SL6.x i386/x86_64

The glibc packages contain the standard C libraries used by multiple programs on the system. These packages contain the standard C and the standard math libraries. Without these two libraries, a Linux system cannot function properly. A flaw was found in the way the ldd utility identified...

Scientific Linux Security Update : ghostscript on SL3.x, SL4.x, SL5.x i386/x86_64

Chris Evans from the Google Security Team reported a stack-based buffer overflow flaw in Ghostscript's zseticcspace function. An attacker could create a malicious PostScript file that would cause Ghostscript to execute arbitrary code when opened. CVE-2008-0411 These updated packages also fix a bu...