Scientific Linux Security Update : mailman on SL7.x x86_64 (20200407)

mailman: Cross-site scripting vulnerability allows malicious listowners to inject scripts into listinfo pages mailman: Mishandled URLs in Utils.py:GetPathPieces allows attackers to display arbitrary text on trusted sites C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

Scientific Linux Security Update : mod_auth_mellon on SL7.x x86_64 (20200407)

modauthmellon: Open Redirect via the login?ReturnTo= substring which could facilitate information theft C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid135822; scriptversion"1.3";...

Scientific Linux Security Update : texlive on SL7.x x86_64 (20200407)

texlive: Buffer overflow in t1checkunusualcharstring function in writet1.c C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid135840; scriptversion"1.4"; scriptsetattributeattribute:"pluginmodificationdate", value:"2024/03/15";...

Scientific Linux Security Update : libxml2 on SL7.x x86_64 (20200407)

libxml2: Use after free triggered by XPointer paths beginning with range-to libxml2: Use after free in xmlXPathCompOpEvalPositionalPredicate function in xpath.c libxml2: DoS caused by incorrect error detection during XZ decompression libxml2: NULL pointer dereference in xmlXPathCompOpEval functio...

Scientific Linux Security Update : bash on SL7.x x86_64 (20200407)

bash: BASHCMD is writable in restricted bash shells C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid135800; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate", value:"2024/03/15";...

Scientific Linux Security Update : bind on SL7.x x86_64 (20200407)

bind: TCP Pipelining doesn't limit TCP clients on a single connection bind: An assertion failure if a trust anchor rolls over to an unsupported key algorithm when using managed-keys bind: Controls for zone transfers may not be properly applied to DLZs if the zones are writable C Tenable Network...

Scientific Linux Security Update : kernel on SL7.x x86_64 (20200407)

kernel: out of bound read in DVB connexant driver. kernel: Missing permissions check for requestkey destination allows local attackers to add keys to keyring without Write permission kernel: denial of service via ioctl call in network tun handling kernel: usb: missing size check in the...

Scientific Linux Security Update : python3 on SL7.x x86_64 (20200407)

python: Cookie domain check returns incorrect results python: email.utils.parseaddr wrongly parses email addresses C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid135830; scriptversion"1.3";...

Scientific Linux Security Update : unzip on SL7.x x86_64 (20200407)

unzip: overlapping of files in ZIP container leads to denial of service C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include"compat.inc"; if description scriptid135841; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate", value:"2020/09/29";...

Scientific Linux Security Update : gettext on SL7.x x86_64 (20200407)

gettext: double free in defaultaddmessage in read-catalog.c C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid135811; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate", value:"2024/03/15";...

Scientific Linux Security Update : thunderbird on SL7.x x86_64 (20200416)

Security Fixes : - Mozilla: Use-after-free while running the nsDocShell destructor CVE-2020-6819 - Mozilla: Use-after-free when handling a ReadableStream CVE-2020-6820 - Mozilla: Uninitialized memory could be read when using the WebGL copyTexSubImage method CVE-2020-6821 - Mozilla: Memory safety...

Scientific Linux Security Update : lftp on SL7.x x86_64 (20200407)

lftp: particular remote file names may lead to current working directory erased C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid135814; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

Scientific Linux Security Update : avahi on SL7.x x86_64 (20200407)

avahi: Multicast DNS responds to unicast queries outside of local network C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid135799; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate", value:"2024/03/15";...

Scientific Linux Security Update : httpd on SL7.x x86_64 (20200407)

httpd: modsessioncookie does not respect expiry time httpd: Out of bounds write in modauthnzldap when using too small Accept-Language values httpd: Out of bounds access after failure in reading the HTTP request C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

Scientific Linux Security Update : thunderbird on SL6.x i386/x86_64 (20200416)

Security Fixes : - Mozilla: Use-after-free while running the nsDocShell destructor CVE-2020-6819 - Mozilla: Use-after-free when handling a ReadableStream CVE-2020-6820 - Mozilla: Uninitialized memory could be read when using the WebGL copyTexSubImage method CVE-2020-6821 - Mozilla: Memory safety...

Scientific Linux Security Update : firefox on SL6.x i386/x86_64 (20200414)

Security Fixes : - Mozilla: Uninitialized memory could be read when using the WebGL copyTexSubImage method CVE-2020-6821 - Mozilla: Memory safety bugs fixed in Firefox 75 and Firefox ESR 68.7 CVE-2020-6825 - Mozilla: Out of bounds write in GMPDecodeData when processing large images CVE-2020-6822 ...

Scientific Linux Security Update : qemu-kvm on SL6.x i386/x86_64 (20200408)

Security Fixes : - QEMU: Slirp: potential OOB access due to unsafe snprintf usages Bug Fixes : - QEMU: Slirp: disable emulation of tcp programs like ftp IRC etc. rhel-6 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include"compat.inc"; if description scriptid135382;...

Scientific Linux Security Update : krb5-appl on SL6.x i386/x86_64 (20200407)

Security Fixes : - telnet-server: no bounds checks in nextitem function allows to remotely execute arbitrary code CVE-2020-10188 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid135279; scriptversion"1.6";...

Scientific Linux Security Update : firefox on SL6.x i386/x86_64 (20200407)

Security Fixes : - Mozilla: Use-after-free while running the nsDocShell destructor CVE-2020-6819 - Mozilla: Use-after-free when handling a ReadableStream CVE-2020-6820 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include"compat.inc"; if description scriptid135278;...

Scientific Linux Security Update : ipmitool on SL6.x i386/x86_64 (20200406)

Security Fixes : - ipmitool: Buffer overflow in readfruareasection function in lib/ipmifru.c CVE-2020-5208 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid135261; scriptversion"1.4";...