Scientific Linux Security Update : java-11-openjdk on SL7.x x86_64 (20191016)

Security Fixes : - OpenJDK: Improper handling of Kerberos proxy credentials Kerberos, 8220302 CVE-2019-2949 - OpenJDK: Unexpected exception thrown during regular expression processing in Nashorn Scripting, 8223518 CVE-2019-2975 - OpenJDK: Out of bounds access in optimized String indexof...

Scientific Linux Security Update : jss on SL7.x x86_64 (20191016)

Security Fixes : - JSS: OCSP policy 'Leaf and Chain' implicitly trusts the root certificate CVE-2019-14823 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE pages listed in the References section. C...

Scientific Linux Security Update : patch on SL7.x x86_64 (20191003)

Security Fixes : - patch: doedscript in pch.c does not block strings beginning with a ! character CVE-2018-20969 - patch: OS shell command injection when processing crafted patch files CVE-2019-13638 For more details about the security issues, including the impact, a CVSS score, acknowledgments,...

Scientific Linux Security Update : qemu-kvm on SL6.x i386/x86_64 (20190924)

Security Fixes : - QEMU: slirp: heap buffer overflow while reassembling fragmented datagrams CVE-2018-11806 - QEMU: slirp: heap buffer overflow in tcpemu CVE-2019-6778 - QEMU: ne2000: integer overflow leads to buffer overflow issue CVE-2018-10839 - QEMU: pcnet: integer overflow leads to buffer...

Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20190923)

Security Fixes : - A buffer overflow flaw was found in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs, logged the buffer descriptors during migration. A privileged guest user able to pass descriptors with invalid length to the host when migration is underway,...

Scientific Linux Security Update : dovecot on SL6.x i386/x86_64 (20190923)

dovecot: improper NULL byte handling in IMAP and ManageSieve protocol parsers leads to out of bounds writes CVE-2019-11500 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid129277; scriptversion"1.4";...

Scientific Linux Security Update : kernel on SL7.x x86_64 (20190920)

Security Fixes : - A buffer overflow flaw was found in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs, logged the buffer descriptors during migration. A privileged guest user able to pass descriptors with invalid length to the host when migration is underway,...

Scientific Linux Security Update : dovecot on SL7.x x86_64 (20190920)

Security Fixes : - dovecot: improper NULL byte handling in IMAP and ManageSieve protocol parsers leads to out of bounds writes CVE-2019-11500 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE pages list...

Scientific Linux Security Update : thunderbird on SL6.x i386/x86_64 (20190919)

This update upgrades Thunderbird to version 60.9.0. Security Fixes : - Mozilla: Covert Content Attack on S/MIME encryption using a crafted multipart/alternative message CVE-2019-11739 - Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 CVE-2019-11740 - Mozill...

Scientific Linux Security Update : thunderbird on SL7.x x86_64 (20190918)

This update upgrades Thunderbird to version 60.9.0. Security Fixes : - Mozilla: Covert Content Attack on S/MIME encryption using a crafted multipart/alternative message CVE-2019-11739 - Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 CVE-2019-11740 - Mozill...

Scientific Linux Security Update : firefox on SL7.x x86_64 (20190911)

Security Fixes : - Mozilla: Sandbox escape through Firefox Sync CVE-2019-9812 - Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 CVE-2019-11740 - Mozilla: Same-origin policy violation with SVG filters and canvas to steal cross-origin images CVE-2019-11742 -...

Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20190912)

Security Fixes : - kernel: Memory corruption due to incorrect socket cloning CVE-2018-9568 - kernel: a NULL pointer dereference in drivers/scsi/megaraid/megaraidsasbase.c leading to DoS CVE-2019-11810 For more details about the security issues, including the impact, a CVSS score, acknowledgments,...

Scientific Linux Security Update : firefox on SL6.x i386/x86_64 (20190910)

This update upgrades Firefox to version 60.9.0 ESR. Security Fixes: - Mozilla: Sandbox escape through Firefox Sync CVE-2019-9812 - Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 CVE-2019-11740 - Mozilla: Same-origin policy violation with SVG filters and...

Scientific Linux Security Update : kdelibs and kde-settings on SL7.x x86_64 (20190903)

kdelibs: malicious desktop files and configuration files lead to code execution with minimal user interaction CVE-2019-14744 Bug Fixes: - kde.csh profile file contains bourne-shell code -- C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if...

Scientific Linux Security Update : qemu-kvm on SL7.x x86_64 (20190903)

Security Fixes: - QEMU: qxl: NULL pointer dereference while releasing spice resources CVE-2019-12155 -- C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128502; scriptversion"1.4";...

Scientific Linux Security Update : kernel on SL7.x x86_64 (20190903)

Security Fixes: - kernel: hw: Spectre SWAPGS gadget vulnerability CVE-2019-1125 - kernel: brcmfmac heap buffer overflow in brcmfwowlndresults CVE-2019-9500 Bug Fixes: - mlx4 VXLAN over VLAN TCP segmentation - Race condition in /dev/sg due to missing synchronization causes corruption in RHV - pani...

Scientific Linux Security Update : ghostscript on SL7.x x86_64 (20190903)

Security Fixes: - ghostscript: Safer mode bypass by .forceput exposure in .pdfhookDSCCreator 701445 CVE-2019-14811 - ghostscript: Safer mode bypass by .forceput exposure in setuserparams 701444 CVE-2019-14812 - ghostscript: Safer mode bypass by .forceput exposure in setsystemparams 701443...

Scientific Linux Security Update : pango on SL7.x x86_64 (20190828)

Security Fixes : - pango: pangolog2visgetembeddinglevels heap-based buffer overflow CVE-2019-1010238 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128311; scriptversion"1.4";...

Scientific Linux Security Update : libvirt on SL7.x x86_64 (20190806)

Security Fixes : - libvirt: NULL pointer dereference after running qemuAgentCommand in qemuAgentGetInterfaces function CVE-2019-3840 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128237; scriptversion"1.6";...

Scientific Linux Security Update : linux-firmware on SL7.x x86_64 (20190806)

Security Fixes : - kernel: Bluetooth implementations may not sufficiently validate elliptic curve parameters during Diffie-Hellman key exchange CVE-2018-5383 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128239;...