Scientific Linux Security Update : libtiff on SL7.x x86_64 (20190806)

Security Fixes : - libtiff: buffer overflow in gif2tiff CVE-2016-3186 - libtiff: Heap-based buffer overflow in the cpSeparateBufToContigBuf function resulting in a denial of service or possibly code execution CVE-2018-12900 - libtiff: Out-of-bounds write in tifjbig.c CVE-2018-18557 - libtiff: NUL...

Scientific Linux Security Update : libwpd on SL7.x x86_64 (20190806)

Security Fixes : - libwpd: NULL pointer dereference in the function WP6ContentListener::defineTable in WP6ContentListener.cpp CVE-2018-19208 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128238; scriptversion"1.4";...

Scientific Linux Security Update : keycloak-httpd-client-install on SL7.x x86_64 (20190806)

Security Fixes : - keycloak-httpd-client-install: unsafe /tmp log file in --log-file option in keycloakcli.py CVE-2017-15111 - keycloak-httpd-client-install: unsafe use of -p/--admin-password on command line CVE-2017-15112 C Tenable Network Security, Inc. The descriptive text is C Scientific Linu...

Scientific Linux Security Update : binutils on SL7.x x86_64 (20190806)

Security Fixes : - binutils: integer overflow leads to heap-based buffer overflow in objdump CVE-2018-1000876 - binutils: Stack Exhaustion in the demangling functions provided by libiberty CVE-2018-12641 - binutils: NULL pointer dereference in workstuffcopytofrom in cplus- dem.c. CVE-2018-12697 C...

Scientific Linux Security Update : exempi on SL7.x x86_64 (20190806)

Security Fixes : - exempi: Infinite Loop in Chunk class in XMPFiles/source/FormatSupport/RIFF.cpp CVE-2017-18233 - exempi: Use after free via a PDF file containing JPEG data CVE-2017-18234 - exempi: Infinite loop in ASFSupport::ReadHeaderObject function in...

Scientific Linux Security Update : elfutils on SL7.x x86_64 (20190806)

The following packages have been upgraded to a later upstream version: elfutils 0.176. Security Fixes : - elfutils: Heap-based buffer over-read in libdw/dwarfgetaranges.c:dwarfgetaranges via crafted file CVE-2018-16062 - elfutils: Double-free due to double decompression of sections in crafted ELF...

Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20190813)

Security Fixes : - Kernel: page cache side channel attacks CVE-2019-5489 - kernel: Salsa20 encryption algorithm does not correctly handle zero-length inputs allowing local attackers to cause denial-of-service CVE-2017-17805 - kernel: Unprivileged users able to inspect kernel stacks of arbitrary...

Scientific Linux Security Update : openssl on SL6.x i386/x86_64 (20190813)

Security Fixes : - openssl: 0-byte record padding oracle CVE-2019-1559 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE pages listed in the References section. C Tenable Network Security, Inc. The...

Scientific Linux Security Update : httpd on SL7.x x86_64 (20190729)

Security Fixes : - httpd: Weak Digest auth nonce generation in modauthdigest CVE-2018-1312 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid127725; scriptversion"1.4"; scriptsetattributeattribute:"pluginmodificationdate",...

Scientific Linux Security Update : curl on SL7.x x86_64 (20190729)

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes : - curl: NTLM password overflow via integer overflow CVE-2018-14618 For more details about the security issues, including t...

Scientific Linux Security Update : 389-ds-base on SL7.x x86_64 (20190729)

Security Fixes : - 389-ds-base: DoS via hanging secured connections CVE-2019-3883 Bug Fixes : - Previously, if you were using the PAM plugin and attempted to bind as a dn that doesn't exist, the server would crash. This has now been fixed. C Tenable Network Security, Inc. The descriptive text is ...

Scientific Linux Security Update : kernel on SL7.x x86_64 (20190729)

Security Fixes : - kernel: nfs: use-after-free in svcprocesscommon CVE-2018-16884 - kernel: insufficient input validation in kernel mode driver in Intel i915 graphics leads to privilege escalation CVE-2019-11085 - kernel: nfs: NULL pointer dereference due to an anomalized NFS message sequence...

Scientific Linux Security Update : qemu-kvm on SL7.x x86_64 (20190729)

Kernel-based Virtual Machine KVM is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-ma packages provide the user-space component for running virtual machines that use KVM on the IBM z Systems, IBM Power, and 64-bit ARM architectures. Security Fixes : - QEMU:...

Scientific Linux Security Update : libssh2 on SL7.x x86_64 (20190729)

Security Fixes : - libssh2: Out-of-bounds memory comparison with specially crafted message channel request CVE-2019-3862 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid127727; scriptversion"1.4";...

Scientific Linux Security Update : java-1.7.0-openjdk on SL6.x i386/x86_64 (20190723)

Security Fixes : - OpenJDK: Side-channel attack risks in Elliptic Curve EC cryptography Security, 8208698 CVE-2019-2745 - OpenJDK: Insufficient checks of suppressed exceptions in deserialization Utilities, 8212328 CVE-2019-2762 - OpenJDK: Unbounded memory allocation during deserialization in...

Scientific Linux Security Update : java-1.8.0-openjdk on SL7.x x86_64 (20190722)

Security Fixes : - OpenJDK: Side-channel attack risks in Elliptic Curve EC cryptography Security, 8208698 CVE-2019-2745 - OpenJDK: Insufficient checks of suppressed exceptions in deserialization Utilities, 8212328 CVE-2019-2762 - OpenJDK: Unbounded memory allocation during deserialization in...

Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (SACK Panic) (SACK Slowness)

Based on the RPM metadata this appears to be a security kernel. The RPM changelog shows fixes related to Security Fixes : - An integer overflow flaw was found in the way the Linux kernel's networking subsystem processed TCP Selective Acknowledgment SACK segments. While processing SACK segments, t...

Scientific Linux Security Update : vim on SL6.x i386/x86_64 (20190715)

Security Fixes : - vim/neovim: ':source!' command allows arbitrary command execution via modelines CVE-2019-12735 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid126715; scriptversion"1.4";...

Scientific Linux Security Update : thunderbird on SL7.x x86_64 (20190715)

This update upgrades Thunderbird to version 60.8.0. Security Fixes : - Mozilla: Memory safety bugs fixed in Firefox 68 and Firefox ESR 60.8 CVE-2019-11709 - Mozilla: Sandbox escape via installation of malicious language pack CVE-2019-9811 - Mozilla: Script injection within domain through inner...

Scientific Linux Security Update : thunderbird on SL6.x i386/x86_64 (20190715)

This update upgrades Thunderbird to version 60.8.0. Security Fixes : - Mozilla: Memory safety bugs fixed in Firefox 68 and Firefox ESR 60.8 CVE-2019-11709 - Mozilla: Sandbox escape via installation of malicious language pack CVE-2019-9811 - Mozilla: Script injection within domain through inner...