Scientific Linux Security Update : libcdio on SL7.x x86_64 (20181030)

Security Fixes : - libcdio: Heap-based buffer over-read in printiso9660recurse function in iso-info.c CVE-2017-18198 - libcdio: NULL pointer dereference in reallocsymlink in rock.c CVE-2017-18199 - libcdio: Double free in getcdtextgeneric in lib/driver/cdiogeneric.c CVE-2017-18201 C Tenable Netwo...

Scientific Linux Security Update : jasper on SL7.x x86_64 (20181030)

Security Fixes : - jasper: reachable assertion in JPCNOMINALGAIN CVE-2016-9396 - jasper: NULL pointer exception in jp2encode CVE-2017-1000050 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid119185; scriptversion"1.5";...

Scientific Linux Security Update : xerces-c on SL7.x x86_64 (20181030)

Security Fixes : - xerces-c: Stack overflow when parsing deeply nested DTD CVE-2016-4463 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid119203; scriptversion"1.5"; scriptsetattributeattribute:"pluginmodificationdate",...

Scientific Linux Security Update : thunderbird on SL7.x x86_64 (20181109)

This update upgrades Thunderbird to version 60.3.0. Security Fixes : - Mozilla: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3 CVE-2018-12390 - Mozilla: Crash with nested event loops CVE-2018-12392 - Mozilla: Integer overflow during Unicode conversion while loading JavaScript...

Scientific Linux Security Update : libvirt on SL7.x x86_64 (20181030)

Security Fixes : - libvirt: guest could inject executable code via libnssdns.so loaded by libvirtlxc before init CVE-2018-6764 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid119193; scriptversion"1.5";...

Scientific Linux Security Update : xorg-x11-server on SL7.x x86_64 (20181031)

Security Fixes : - xorg-x11-server: Incorrect permission check in Xorg X server allows for privilege escalation CVE-2018-14665 The SL Team added a fix for upstream bug 1650634 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description...

Scientific Linux Security Update : GNOME on SL7.x x86_64 (20181030)

Security Fixes : - libsoup: Crash in soupcookiejar.c:getcookies on empty hostnames CVE-2018-12910 - poppler: Infinite recursion in fofi/FoFiType1C.cc:FoFiType1C::cvtGlyph function allows denial of service CVE-2017-18267 - libgxps: heap based buffer over read in ftfontfacehash function of...

Scientific Linux Security Update : zsh on SL7.x x86_64 (20181030)

Security Fixes : - zsh: Stack-based buffer overflow in genmatchesfiles at compctl.c CVE-2018-1083 - zsh: buffer overflow for very long fds in & fd syntax CVE-2014-10071 - zsh: buffer overflow when scanning very long directory paths for symbolic links CVE-2014-10072 - zsh: NULL dereference in cd i...

Scientific Linux Security Update : thunderbird on SL6.x i386/x86_64 (20181109)

This update upgrades Thunderbird to version 60.3.0. Security Fixes : - Mozilla: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3 CVE-2018-12390 - Mozilla: Crash with nested event loops CVE-2018-12392 - Mozilla: Integer overflow during Unicode conversion while loading JavaScript...

Scientific Linux Security Update : spice-server on SL6.x x86_64 (20181108)

Security Fixes : - spice: Possible buffer overflow via invalid monitor configurations CVE-2017-7506 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid118853; scriptversion"1.5";...

Scientific Linux Security Update : python-paramiko on SL6.x (noarch) (20181031)

Security Fixes : - python-paramiko: Authentication bypass in authhandler.py CVE-2018-1000805 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid118727; scriptversion"1.6"; scriptsetattributeattribute:"pluginmodificationdate",...

Scientific Linux Security Update : thunderbird on SL6.x i386/x86_64 (20181031)

This update upgrades Thunderbird to version 60.2.1. Security Fixes : - Mozilla: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2 CVE-2018-12376 - Mozilla: Use-after-free in driver timers CVE-2018-12377 - Mozilla: Use-after-free in IndexedDB CVE-2018-12378 - Mozilla: Proxy bypass using...

Scientific Linux Security Update : java-1.7.0-openjdk on SL6.x i386/x86_64 (20181031)

Security Fixes : - OpenJDK: Improper field access checks Hotspot, 8199226 CVE-2018-3169 - OpenJDK: Incomplete enforcement of the trustURLCodebase restriction JNDI, 8199177 CVE-2018-3149 - OpenJDK: Incorrect handling of unsigned attributes in signed Jar manifests Security, 8194534 CVE-2018-3136 -...

Scientific Linux Security Update : firefox on SL6.x i386/x86_64 (20181025)

This update upgrades Firefox to version 60.3.0 ESR. Security Fixes : - Mozilla: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3 CVE-2018-12390 - Mozilla: Crash with nested event loops CVE-2018-12392 - Mozilla: Integer overflow during Unicode conversion while loading JavaScript...

Scientific Linux Security Update : java-1.8.0-openjdk on SL6.x i386/x86_64 (20181018)

Security Fixes : - OpenJDK: Improper field access checks Hotspot, 8199226 CVE-2018-3169 - OpenJDK: Unrestricted access to scripting engine Scripting, 8202936 CVE-2018-3183 - OpenJDK: Incomplete enforcement of the trustURLCodebase restriction JNDI, 8199177 CVE-2018-3149 - OpenJDK: Incorrect handli...

Scientific Linux Security Update : java-1.8.0-openjdk on SL7.x x86_64 (20181018)

Security Fixes : - OpenJDK: Improper field access checks Hotspot, 8199226 CVE-2018-3169 - OpenJDK: Unrestricted access to scripting engine Scripting, 8202936 CVE-2018-3183 - OpenJDK: Incomplete enforcement of the trustURLCodebase restriction JNDI, 8199177 CVE-2018-3149 - OpenJDK: Incorrect handli...

Scientific Linux Security Update : ghostscript on SL7.x x86_64 (20181016)

Security Fixes : - It was discovered that the ghostscript /invalidaccess checks fail under certain conditions. An attacker could possibly exploit this to bypass the - -dSAFER protection and, for example, execute arbitrary shell commands via a specially crafted PostScript document. CVE-2018-16509 ...

Scientific Linux Security Update : tomcat on SL7.x (noarch) (20181016)

Security Fixes : - tomcat: A bug in the UTF-8 decoder can lead to DoS CVE-2018-1336 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include"compat.inc"; if description scriptid118167; scriptversion"1.4"; scriptsetattributeattribute:"pluginmodificationdate",...

Scientific Linux Security Update : spamassassin on SL7.x x86_64 (20181011)

Security Fixes : - spamassassin: Certain unclosed tags in crafted emails allow for scan timeouts and result in denial of service CVE-2017-15705 - spamassassin: Local user code injection in the meta rule syntax CVE-2018-11781 C Tenable Network Security, Inc. The descriptive text is C Scientific...

Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20181009)

Security Fixes : - A flaw named FragmentSmack was found in the way the Linux kernel handled reassembly of fragmented IPv4 and IPv6 packets. A remote attacker could use this flaw to trigger time and calculation expensive fragment reassembly algorithm by sending specially crafted packets which coul...