Scientific Linux Security Update : nss, nss-softokn, nss-util, and nspr on SL7.x x86_64 (20190806)

Netscape Portable Runtime NSPR provides platform independence for non- GUI operating system facilities. The following packages have been upgraded to a later upstream version: nss 3.44.0, nss-softokn 3.44.0, nss-util 3.44.0, nspr 4.21.0. Security Fixes : - ROHNP: Key Extraction Side Channel in...

Scientific Linux Security Update : libwpd on SL7.x x86_64 (20190806)

Security Fixes : - libwpd: NULL pointer dereference in the function WP6ContentListener::defineTable in WP6ContentListener.cpp CVE-2018-19208 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128238; scriptversion"1.4";...

Scientific Linux Security Update : libarchive on SL7.x x86_64 (20190806)

Security Fixes : - libarchive: Double free in RAR decoder resulting in a denial of service CVE-2018-1000877 - libarchive: Use after free in RAR decoder resulting in a denial of service CVE-2018-1000878 - libarchive: Out of bounds read in archivereadsupportformat7zip.c resulting in a denial of...

Scientific Linux Security Update : dhcp on SL7.x x86_64 (20190806)

Security Fixes : - dhcp: double-deletion of the released addresses in the dhcpv6 code leading to crash and possible DoS CVE-2019-6470 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128213; scriptversion"1.8";...

Scientific Linux Security Update : mod_auth_openidc on SL7.x x86_64 (20190806)

Security Fixes : - modauthopenidc: OIDCCLAIM and OIDCAuthNHeader not skipped in an 'AuthType oauth20' configuration CVE-2017-6413 - modauthopenidc: Shows user-supplied content on error pages CVE-2017-6059 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

Scientific Linux Security Update : kernel on SL7.x x86_64 (20190806)

Security Fixes : - Kernel: vhostnet: infinite loop while receiving packets leads to DoS CVE-2019-3900 - Kernel: page cache side channel attacks CVE-2019-5489 - kernel: Buffer overflow in hidpprocessreport CVE-2018-9363 - kernel: l2tp: Race condition between pppol2tpsessioncreate and l2tpethcreate...

Scientific Linux Security Update : mercurial on SL7.x x86_64 (20190806)

Security Fixes : - mercurial: Buffer underflow in mpatch.c:mpatchapply CVE-2018-13347 - mercurial: HTTP server permissions bypass CVE-2018-1000132 - mercurial: Missing check for fragment start position in mpatch.c:mpatchapply CVE-2018-13346 C Tenable Network Security, Inc. The descriptive text is...

Scientific Linux Security Update : python-urllib3 on SL7.x x86_64 (20190806)

Security Fixes : - python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure CVE-2018-20060 - python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service CVE-2019-11236 C Tenable Network Securit...

Scientific Linux Security Update : ntp on SL7.x x86_64 (20190806)

Security Fixes : - ntp: Stack-based buffer overflow in ntpq and ntpdc allows denial of service or code execution CVE-2018-12327 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128244; scriptversion"1.4";...

Scientific Linux Security Update : openssl on SL7.x x86_64 (20190806)

Security Fixes : - openssl: 0-byte record padding oracle CVE-2019-1559 - openssl: timing side channel attack in the DSA signature algorithm CVE-2018-0734 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128247;...

Scientific Linux Security Update : glibc on SL7.x x86_64 (20190806)

Security Fixes : - glibc: getaddrinfo should reject IP addresses with trailing characters CVE-2016-10739 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128220; scriptversion"1.4";...

Scientific Linux Security Update : httpd on SL7.x x86_64 (20190806)

Security Fixes : - httpd: modauthdigest: access control bypass due to race condition CVE-2019-0217 - httpd: URL normalization inconsistency CVE-2019-0220 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128223;...

Scientific Linux Security Update : ruby on SL7.x x86_64 (20190806)

Security Fixes : - ruby: HTTP response splitting in WEBrick CVE-2017-17742 - ruby: DoS by large request in WEBrick CVE-2018-8777 - ruby: Buffer under-read in Stringunpack CVE-2018-8778 - ruby: Unintentional directory traversal by poisoned NULL byte in Dir CVE-2018-8780 - ruby: Tainted flags are n...

Scientific Linux Security Update : exempi on SL7.x x86_64 (20190806)

Security Fixes : - exempi: Infinite Loop in Chunk class in XMPFiles/source/FormatSupport/RIFF.cpp CVE-2017-18233 - exempi: Use after free via a PDF file containing JPEG data CVE-2017-18234 - exempi: Infinite loop in ASFSupport::ReadHeaderObject function in...

Scientific Linux Security Update : qt5 on SL7.x x86_64 (20190806)

The following packages have been upgraded to a later upstream version: qt5-qt3d 5.9.7, qt5-qtbase 5.9.7, qt5-qtcanvas3d 5.9.7, qt5-qtconnectivity 5.9.7, qt5-qtdeclarative 5.9.7, qt5-qtdoc 5.9.7, qt5-qtgraphicaleffects 5.9.7, qt5-qtimageformats 5.9.7, qt5-qtlocation 5.9.7, qt5-qtmultimedia 5.9.7,...

Scientific Linux Security Update : fence-agents on SL7.x x86_64 (20190806)

fence-agents: mis-handling of non-ASCII characters in guest comment fields CVE-2019-10153 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128217; scriptversion"1.4"; scriptsetattributeattribute:"pluginmodificationdate",...

Scientific Linux Security Update : kde-workspace on SL7.x x86_64 (20190806)

Security Fixes : - kde-workspace: Missing sanitization of notifications allows to leak client IP address via IMG element CVE-2018-6790 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128224; scriptversion"1.4";...

Scientific Linux Security Update : spice-gtk on SL7.x x86_64 (20190806)

The libgovirt packages contain a library that allows applications to use the oVirt Representational State Transfer REST API to list virtual machines VMs managed by an oVirt instance. The library is also used to get the connection parameters needed to establish a connection to the VMs using Simple...

Scientific Linux Security Update : sox on SL7.x x86_64 (20190806)

Security Fixes : - sox: NULL pointer dereference in startread function in xa.c CVE-2017-18189 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128262; scriptversion"1.4"; scriptsetattributeattribute:"pluginmodificationdate",...

Scientific Linux Security Update : qemu-kvm on SL7.x x86_64 (20190806)

Security Fixes : - QEMU: Slirp: information leakage in tcpemu due to uninitialized stack variables CVE-2019-9824 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128257; scriptversion"1.4";...