Scientific Linux Security Update : ovmf on on SL7.x x86_64 (20181030)

Security Fixes : - openssl: Handling of crafted recursive ASN.1 structures can cause a stack overflow and resulting denial of service CVE-2018-0739 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid119195; scriptversion"1.5";...

Scientific Linux Security Update : wpa_supplicant on SL7.x x86_64 (20181030)

Security Fixes : - wpasupplicant: Unauthenticated EAPOL-Key decryption in wpasupplicant CVE-2018-14526 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid119202; scriptversion"1.5";...

Scientific Linux Security Update : openssl on SL7.x x86_64 (20181030)

Security Fixes : - openssl: ROHNP - Key Extraction Side Channel in Multiple Crypto Libraries CVE-2018-0495 - openssl: Malicious server can send large prime to client during DHE TLS handshake causing the client to hang CVE-2018-0732 - openssl: Handling of crafted recursive ASN.1 structures can cau...

Scientific Linux Security Update : java-11-openjdk on SL7.x x86_64 (20181107)

Security Fixes : - OpenJDK: Improper field access checks Hotspot, 8199226 CVE-2018-3169 - OpenJDK: Unrestricted access to scripting engine Scripting, 8202936 CVE-2018-3183 - OpenJDK: Incomplete enforcement of the trustURLCodebase restriction JNDI, 8199177 CVE-2018-3149 - OpenJDK: Incorrect handli...

Scientific Linux Security Update : setup on SL7.x (noarch) (20181030)

Security Fixes : - setup: nologin listed in /etc/shells violates security expectations CVE-2018-1113 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid119199; scriptversion"1.5";...

Scientific Linux Security Update : gnutls on SL7.x x86_64 (20181030)

Security Fixes : - gnutls: HMAC-SHA-256 vulnerable to Lucky thirteen attack due to not enough dummy function calls CVE-2018-10844 - gnutls: HMAC-SHA-384 vulnerable to Lucky thirteen attack due to use of wrong constant CVE-2018-10845 - gnutls: 'Just in Time' PRIME + PROBE cache-based side channel...

Scientific Linux Security Update : glusterfs on SL7.x x86_64 (20181030)

Security Fixes : - glusterfs: Improper deserialization in dict.c:dictunserialize can allow attackers to read arbitrary memory CVE-2018-10911 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid119183; scriptversion"1.5";...

Scientific Linux Security Update : sssd on SL7.x x86_64 (20181030)

Security Fixes : - sssd: information leak from the sssd-sudo responder CVE-2018-10852 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid119200; scriptversion"1.5"; scriptsetattributeattribute:"pluginmodificationdate",...

Scientific Linux Security Update : fuse on SL7.x x86_64 (20181030)

Security Fixes : - fuse: bypass of the 'userallowother' restriction when SELinux is active CVE-2018-10906 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid119181; scriptversion"1.5";...

Scientific Linux Security Update : python on SL7.x x86_64 (20181030)

Security Fixes : - python: DOS via regular expression backtracking in difflib.ISLINEJUNK method in difflib CVE-2018-1061 - python: DOS via regular expression catastrophic backtracking in apop method in pop3lib CVE-2018-1060 C Tenable Network Security, Inc. The descriptive text is C Scientific...

Scientific Linux Security Update : 389-ds-base on SL7.x x86_64 (20181030)

Security Fixes : - 389-ds-base: Mishandled search requests in servers/slapd/search.c:dosearch allows for denial of service CVE-2018-14648 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid119176; scriptversion"1.6";...

Scientific Linux Security Update : glibc on SL7.x x86_64 (20181030)

Security Fixes : - glibc: Incorrect handling of RPATH in elf/dl-load.c can be used to execute code loaded from arbitrary libraries CVE-2017-16997 - glibc: Integer overflow in posixmemalign in memalign functions CVE-2018-6485 - glibc: Integer overflow in stdlib/canonicalize.c on 32-bit architectur...

Scientific Linux Security Update : libkdcraw on SL7.x x86_64 (20181030)

LibRaw: Stack-based buffer overflow in quicktake100loadraw function in internal/dcrawcommon.cpp CVE-2018-5805 LibRaw: Heap-based buffer overflow in LibRaw::kodakycbcrloadraw function in internal/dcrawcommon.cpp CVE-2018-5800 LibRaw: NULL pointer dereference in LibRaw::unpack function...

Scientific Linux Security Update : git on SL7.x x86_64 (20181031)

Security Fixes : - git: arbitrary code execution via .gitmodules CVE-2018-17456 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid119206; scriptversion"1.6"; scriptsetattributeattribute:"pluginmodificationdate",...

Scientific Linux Security Update : python-paramiko on SL7.x (noarch) (20181030)

Security Fixes : - python-paramiko: Authentication bypass in authhandler.py CVE-2018-1000805 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid119197; scriptversion"1.6"; scriptsetattributeattribute:"pluginmodificationdate",...

Scientific Linux Security Update : X.org X11 on SL7.x x86_64 (20181030)

Security Fixes : - libxcursor: 1-byte heap-based overflow in XcursorThemeInherits function in library.c CVE-2015-9262 The SL Team added a fix for upstream bug 1650634 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid119178;...

Scientific Linux Security Update : zziplib on SL7.x x86_64 (20181030)

Security Fixes : - zziplib: out of bound read in mmapped.c:zzipdiskfread causes crash CVE-2018-7725 - zziplib: Bus error in zip.c:zzipparserootdirectory cause crash via crafted zip file CVE-2018-7726 - zziplib: Memory leak in memdisk.c:zzipmemdisknew can lead to denial of service via crafted zip...

Scientific Linux Security Update : krb5 on SL7.x x86_64 (20181030)

Security Fixes : - krb5: null dereference in kadmind or DN container check bypass by supplying special crafted data CVE-2018-5729 - krb5: DN container check bypass by supplying special crafted data CVE-2018-5730 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

Scientific Linux Security Update : java-1.7.0-openjdk on SL7.x x86_64 (20181030)

Security Fixes : - OpenJDK: Improper field access checks Hotspot, 8199226 CVE-2018-3169 - OpenJDK: Incomplete enforcement of the trustURLCodebase restriction JNDI, 8199177 CVE-2018-3149 - OpenJDK: Incorrect handling of unsigned attributes in signed Jar manifests Security, 8194534 CVE-2018-3136 -...

Scientific Linux Security Update : libcdio on SL7.x x86_64 (20181030)

Security Fixes : - libcdio: Heap-based buffer over-read in printiso9660recurse function in iso-info.c CVE-2017-18198 - libcdio: NULL pointer dereference in reallocsymlink in rock.c CVE-2017-18199 - libcdio: Double free in getcdtextgeneric in lib/driver/cdiogeneric.c CVE-2017-18201 C Tenable Netwo...