Scientific Linux Security Update : squid on SL7.x x86_64 (20200506)

Security Fixes : - squid: improper check for new member in ESIExpression::Evaluate allows for stack-based buffer overflow CVE-2019-12519 - squid: improper access restriction upon Digest Authentication nonce replay could lead to remote code execution CVE-2020-11945 - squid: parsing of header...

Scientific Linux Security Update : python-twisted-web on SL7.x x86_64 (20200423)

Security Fixes : - python-twisted: HTTP request smuggling when presented with two Content-Length headers CVE-2020-10108 - python-twisted: HTTP request smuggling when presented with a Content-Length and a chunked Transfer-Encoding header CVE-2020-10109 C Tenable Network Security, Inc. The...

Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20200422) (Stack Clash)

Security Fixes : - kernel: rtlp2pnoaie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel lacks a certain upper-bound check, leading to a buffer overflow CVE-2019-17666 - kernel: offset2lib allows for the stack guard page to be jumped over CVE-2017-1000371 C Tenable Network Security...

Scientific Linux Security Update : git on SL7.x x86_64 (20200421)

Security Fixes : - git: Crafted URL containing new lines can cause credential leak CVE-2020-5260 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include"compat.inc"; if description scriptid135886; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate...

Scientific Linux Security Update : cups on 7.x i686/x86_64 (2020:1050)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2020:1050-1 advisory. - In macOS High Sierra before 10.13.5, an issue existed in CUPS. This issue was addressed with improved access restrictions. CVE-2018-4180,...

Scientific Linux Security Update : zziplib on SL7.x x86_64 (20200407)

zziplib: directory traversal in unzzipcat in the bins/unzzipcat-mem.c C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid135843; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate", value:"2024/03/15";...

Scientific Linux Security Update : libqb on SL7.x x86_64 (20200407)

libqb: Insecure treatment of IPC temporary files C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid135816; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate", value:"2024/03/15";...

Scientific Linux Security Update : lftp on SL7.x x86_64 (20200407)

lftp: particular remote file names may lead to current working directory erased C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid135814; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

Scientific Linux Security Update : qemu-kvm on SL7.x x86_64 (20200407)

QEMU: Slirp: potential OOB access due to unsafe snprintf usages C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include"compat.inc"; if description scriptid135833; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate", value:"2020/09/29";...

Scientific Linux Security Update : bash on SL7.x x86_64 (20200407)

bash: BASHCMD is writable in restricted bash shells C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid135800; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate", value:"2024/03/15";...

Scientific Linux Security Update : dovecot on SL7.x x86_64 (20200407)

dovecot: Improper certificate validation dovecot: Buffer overflow in indexer-worker process results in privilege escalation C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid135805; scriptversion"1.3";...

Scientific Linux Security Update : qt on SL7.x x86_64 (20200407)

qt5-qtbase: Double free in QXmlStreamReader qt: Malformed PPM image causing division by zero and crash in qppmhandler.cpp qt5-qtsvg: Invalid parsing of malformed url reference resulting in a denial of service qt5-qtbase: QImage allocation failure in qgifhandler qt5-qtimageformats: QTgaFile CPU...

Scientific Linux Security Update : file on SL7.x x86_64 (20200407)

file: out-of-bounds read via a crafted ELF file C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid135809; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate", value:"2024/03/15"; scriptcveid"CVE-2018-10360...

Scientific Linux Security Update : mod_auth_mellon on SL7.x x86_64 (20200407)

modauthmellon: Open Redirect via the login?ReturnTo= substring which could facilitate information theft C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid135822; scriptversion"1.3";...

Scientific Linux Security Update : telnet on SL7.x x86_64 (20200407)

telnet-server: no bounds checks in nextitem function allows to remotely execute arbitrary code C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid135839; scriptversion"1.6"; scriptsetattributeattribute:"pluginmodificationdate",...

Scientific Linux Security Update : kernel on SL7.x x86_64 (20200407)

kernel: out of bound read in DVB connexant driver. kernel: Missing permissions check for requestkey destination allows local attackers to add keys to keyring without Write permission kernel: denial of service via ioctl call in network tun handling kernel: usb: missing size check in the...

Scientific Linux Security Update : curl on SL7.x x86_64 (20200407)

curl: TFTP receive heap buffer overflow in tftpreceivepacket function C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid135804; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate", value:"2024/03/15";...

Scientific Linux Security Update : bluez on SL7.x x86_64 (20200407)

bluez: failure in disabling Bluetooth discoverability in certain cases may lead to the unauthorized pairing of Bluetooth devices C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid135802; scriptversion"1.3";...

Scientific Linux Security Update : php on SL7.x x86_64 (20200407)

php: Reflected XSS on PHAR 404 page php: Stack-based buffer under-read in phpstreamurlwraphttpex in httpfopenwrapper.c when parsing HTTP response php: Reflected XSS vulnerability on PHAR 403 and 404 error pages php: Out-of-bounds read in base64decodexmlrpc in ext/xmlrpc/libxmlrpc/base64.c C Tenab...

Scientific Linux Security Update : samba on SL7.x x86_64 (20200407)

samba: Combination of parameters and permissions can allow user to escape from the share path definition samba: smb client vulnerable to filenames containing path separators C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description...