Scientific Linux Security Update : libkdcraw on SL7.x x86_64 (20181030)

LibRaw: Stack-based buffer overflow in quicktake100loadraw function in internal/dcrawcommon.cpp CVE-2018-5805 LibRaw: Heap-based buffer overflow in LibRaw::kodakycbcrloadraw function in internal/dcrawcommon.cpp CVE-2018-5800 LibRaw: NULL pointer dereference in LibRaw::unpack function...

Scientific Linux Security Update : python on SL7.x x86_64 (20181030)

Security Fixes : - python: DOS via regular expression backtracking in difflib.ISLINEJUNK method in difflib CVE-2018-1061 - python: DOS via regular expression catastrophic backtracking in apop method in pop3lib CVE-2018-1060 C Tenable Network Security, Inc. The descriptive text is C Scientific...

Scientific Linux Security Update : thunderbird on SL7.x x86_64 (20181109)

This update upgrades Thunderbird to version 60.3.0. Security Fixes : - Mozilla: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3 CVE-2018-12390 - Mozilla: Crash with nested event loops CVE-2018-12392 - Mozilla: Integer overflow during Unicode conversion while loading JavaScript...

Scientific Linux Security Update : zziplib on SL7.x x86_64 (20181030)

Security Fixes : - zziplib: out of bound read in mmapped.c:zzipdiskfread causes crash CVE-2018-7725 - zziplib: Bus error in zip.c:zzipparserootdirectory cause crash via crafted zip file CVE-2018-7726 - zziplib: Memory leak in memdisk.c:zzipmemdisknew can lead to denial of service via crafted zip...

Scientific Linux Security Update : krb5 on SL7.x x86_64 (20181030)

Security Fixes : - krb5: null dereference in kadmind or DN container check bypass by supplying special crafted data CVE-2018-5729 - krb5: DN container check bypass by supplying special crafted data CVE-2018-5730 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

Scientific Linux Security Update : jasper on SL7.x x86_64 (20181030)

Security Fixes : - jasper: reachable assertion in JPCNOMINALGAIN CVE-2016-9396 - jasper: NULL pointer exception in jp2encode CVE-2017-1000050 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid119185; scriptversion"1.5";...

Scientific Linux Security Update : glibc on SL7.x x86_64 (20181030)

Security Fixes : - glibc: Incorrect handling of RPATH in elf/dl-load.c can be used to execute code loaded from arbitrary libraries CVE-2017-16997 - glibc: Integer overflow in posixmemalign in memalign functions CVE-2018-6485 - glibc: Integer overflow in stdlib/canonicalize.c on 32-bit architectur...

Scientific Linux Security Update : curl and nss-pem on SL7.x x86_64 (20181030)

Security Fixes : - curl: HTTP authentication leak in redirects CVE-2018-1000007 - curl: FTP path trickery leads to NIL byte out of bounds write CVE-2018-1000120 - curl: RTSP RTP buffer over-read CVE-2018-1000122 - curl: Out-of-bounds heap read when missing RTSP headers allows information leak of...

Scientific Linux Security Update : libcdio on SL7.x x86_64 (20181030)

Security Fixes : - libcdio: Heap-based buffer over-read in printiso9660recurse function in iso-info.c CVE-2017-18198 - libcdio: NULL pointer dereference in reallocsymlink in rock.c CVE-2017-18199 - libcdio: Double free in getcdtextgeneric in lib/driver/cdiogeneric.c CVE-2017-18201 C Tenable Netwo...

Scientific Linux Security Update : xorg-x11-server on SL7.x x86_64 (20181031)

Security Fixes : - xorg-x11-server: Incorrect permission check in Xorg X server allows for privilege escalation CVE-2018-14665 The SL Team added a fix for upstream bug 1650634 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description...

Scientific Linux Security Update : openssl on SL7.x x86_64 (20181030)

Security Fixes : - openssl: ROHNP - Key Extraction Side Channel in Multiple Crypto Libraries CVE-2018-0495 - openssl: Malicious server can send large prime to client during DHE TLS handshake causing the client to hang CVE-2018-0732 - openssl: Handling of crafted recursive ASN.1 structures can cau...

Scientific Linux Security Update : samba on SL7.x x86_64 (20181030)

Security Fixes : - samba: Weak authentication protocol regression CVE-2018-1139 - samba: Insufficient input validation in libsmbclient CVE-2018-10858 - samba: NULL pointer dereference in printer server process CVE-2018-1050 C Tenable Network Security, Inc. The descriptive text is C Scientific...

Scientific Linux Security Update : libvirt on SL7.x x86_64 (20181030)

Security Fixes : - libvirt: guest could inject executable code via libnssdns.so loaded by libvirtlxc before init CVE-2018-6764 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid119193; scriptversion"1.5";...

Scientific Linux Security Update : wget on SL7.x x86_64 (20181030)

Security Fixes : - wget: Cookie injection allows malicious website to write arbitrary cookie entries into cookie jar CVE-2018-0494 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid119201; scriptversion"1.5";...

Scientific Linux Security Update : java-11-openjdk on SL7.x x86_64 (20181107)

Security Fixes : - OpenJDK: Improper field access checks Hotspot, 8199226 CVE-2018-3169 - OpenJDK: Unrestricted access to scripting engine Scripting, 8202936 CVE-2018-3183 - OpenJDK: Incomplete enforcement of the trustURLCodebase restriction JNDI, 8199177 CVE-2018-3149 - OpenJDK: Incorrect handli...

Scientific Linux Security Update : GNOME on SL7.x x86_64 (20181030)

Security Fixes : - libsoup: Crash in soupcookiejar.c:getcookies on empty hostnames CVE-2018-12910 - poppler: Infinite recursion in fofi/FoFiType1C.cc:FoFiType1C::cvtGlyph function allows denial of service CVE-2017-18267 - libgxps: heap based buffer over read in ftfontfacehash function of...

Scientific Linux Security Update : git on SL7.x x86_64 (20181031)

Security Fixes : - git: arbitrary code execution via .gitmodules CVE-2018-17456 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid119206; scriptversion"1.6"; scriptsetattributeattribute:"pluginmodificationdate",...

Scientific Linux Security Update : 389-ds-base on SL7.x x86_64 (20181030)

Security Fixes : - 389-ds-base: Mishandled search requests in servers/slapd/search.c:dosearch allows for denial of service CVE-2018-14648 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid119176; scriptversion"1.6";...

Scientific Linux Security Update : gnutls on SL7.x x86_64 (20181030)

Security Fixes : - gnutls: HMAC-SHA-256 vulnerable to Lucky thirteen attack due to not enough dummy function calls CVE-2018-10844 - gnutls: HMAC-SHA-384 vulnerable to Lucky thirteen attack due to use of wrong constant CVE-2018-10845 - gnutls: 'Just in Time' PRIME + PROBE cache-based side channel...

Scientific Linux Security Update : glusterfs on SL7.x x86_64 (20181030)

Security Fixes : - glusterfs: Improper deserialization in dict.c:dictunserialize can allow attackers to read arbitrary memory CVE-2018-10911 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid119183; scriptversion"1.5";...