Scientific Linux Security Update : glusterfs on SL6.x x86_64 (20181009)

The glusterfs packages have been upgraded to upstream version 3.12.2, which provides a number of bug fixes over the previous version. Security Fixes : - glusterfs: Improper deserialization in dict.c:dictunserialize can allow attackers to read arbitrary memory CVE-2018-10911 C Tenable Network...

Scientific Linux Security Update : nss on SL6.x i386/x86_64 (20181009)

Security Fixes : - nss: ServerHello.random is all zeros when handling a v2-compatible ClientHello CVE-2018-12384 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid118058; scriptversion"1.7";...

Scientific Linux Security Update : firefox on SL7.x x86_64 (20181008)

This update upgrades Firefox to version 60.2.2 ESR. Security Fixes : - Mozilla: type confusion in JavaScript CVE-2018-12386 - Mozilla: stack out-of-bounds read in Array.prototype.push CVE-2018-12387 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; ...

Scientific Linux Security Update : firefox on SL6.x i386/x86_64 (20181008)

This update upgrades Firefox to version 60.2.2 ESR. Security Fixes : - Mozilla: type confusion in JavaScript CVE-2018-12386 - Mozilla: stack out-of-bounds read in Array.prototype.push CVE-2018-12387 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; ...

Scientific Linux Security Update : firefox on SL6.x i386/x86_64 (20180927)

This update upgrades Firefox to version 60.2.1 ESR. Security Fixes : - Mozilla: Crash in TransportSecurityInfo due to cached data CVE-2018-12385 - Mozilla: Setting a master password post-Firefox 58 does not delete unencrypted previously stored passwords CVE-2018-12383 C Tenable Network Security,...

Scientific Linux Security Update : firefox on SL7.x x86_64 (20180927)

This update upgrades Firefox to version 60.2.1 ESR. Security Fixes : - Mozilla: Crash in TransportSecurityInfo due to cached data CVE-2018-12385 - Mozilla: Setting a master password post-Firefox 58 does not delete unencrypted previously stored passwords CVE-2018-12383 C Tenable Network Security,...

Scientific Linux Security Update : 389-ds-base on SL7.x x86_64 (20180925)

Security Fixes : - 389-ds-base: race condition on reference counter leads to DoS using persistent search CVE-2018-10850 - 389-ds-base: ldapsearch with server side sort allows users to cause a crash CVE-2018-10935 - 389-ds-base: Server crash through modify command with large DN CVE-2018-14624 -...

Scientific Linux Security Update : kernel on SL7.x x86_64 (20180925)

Security Fixes : - kernel: Integer overflow in Linux's createelftables function CVE-2018-14634 Bug Fixes : See the descriptions in the related Knowledge Article : C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid117787;...

Scientific Linux Security Update : nss on SL7.x x86_64 (20180925)

Security Fixes : - nss: ServerHello.random is all zeros when handling a v2-compatible ClientHello CVE-2018-12384 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid117788; scriptversion"1.7";...

Scientific Linux Security Update : flatpak on SL7.x x86_64 (20180925)

Security Fixes : - flatpak: sandbox escape in D-Bus filtering by a crafted authentication handshake CVE-2018-6560 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include"compat.inc"; if description scriptid117786; scriptversion"1.4";...

Scientific Linux Security Update : mod_perl on SL6.x i386/x86_64 (20180924)

Security Fixes : - modperl: arbitrary Perl code execution in the context of the user account via a user-owned .htaccess CVE-2011-2767 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid117682; scriptversion"1.5";...

Scientific Linux Security Update : spice-gtk and spice-server on SL6.x i386/x86_64 (20180920)

The spice-gtk packages provide a GIMP Toolkit GTK+ widget for Simple Protocol for Independent Computing Environments SPICE clients. Both Virtual Machine Manager and Virtual Machine Viewer can make use of this widget to access virtual machines using the SPICE protocol. Security Fixes : - spice:...

Scientific Linux Security Update : spice and spice-gtk on SL7.x x86_64 (20180920)

The spice-gtk packages provide a GIMP Toolkit GTK+ widget for Simple Protocol for Independent Computing Environments SPICE clients. Both Virtual Machine Manager and Virtual Machine Viewer can make use of this widget to access virtual machines using the SPICE protocol. Security Fixes : - spice:...

Scientific Linux Security Update : firefox on SL6.x i386/x86_64 (20180912)

This update upgrades Firefox to version 60.2.0 ESR. Security Fixes : - Mozilla: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2 CVE-2018-12376 - Mozilla: Use-after-free in driver timers CVE-2018-12377 - Mozilla: Use-after-free in IndexedDB CVE-2018-12378 - Mozilla: Proxy bypass using...

Scientific Linux Security Update : Moderate: OpenAFS on SL6.x, SL7.x i386/x86_64 (20180911)

These releases include fixes for three security advisories, OPENAFS-SA-2018-001, OPENAFS-SA-2018-002, and OPENAFS-SA-2018-003. OPENAFS-SA-2018-001 only affects deployments that run the 'butc' utility as part of the in-tree backup system, but is of high severity for those sites which are affected ...

Scientific Linux Security Update : firefox on SL7.x x86_64 (20180912)

This update upgrades Firefox to version 60.2.0 ESR. Security Fixes : - Mozilla: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2 CVE-2018-12376 - Mozilla: Use-after-free in driver timers CVE-2018-12377 - Mozilla: Use-after-free in IndexedDB CVE-2018-12378 - Mozilla: Proxy bypass using...

Scientific Linux Security Update : bind on SL7.x x86_64 (20180827)

Security Fixes : - bind: processing of certain records when 'deny-answer-aliases' is in use may trigger an assert leading to a denial of service CVE-2018-5740 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid112136;...

Scientific Linux Security Update : bind on SL6.x i386/x86_64 (20180827)

Security Fixes : - bind: processing of certain records when 'deny-answer-aliases' is in use may trigger an assert leading to a denial of service CVE-2018-5740 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid112135;...

Scientific Linux Security Update : postgresql on SL7.x x86_64 (20180823)

The following packages have been upgraded to a later upstream version: postgresql 9.2.24. Security Fixes : - postgresql: Certain host connection parameters defeat client-side security defenses CVE-2018-10915 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

Scientific Linux Security Update : mutt on SL6.x, SL7.x i386/x86_64 (20180821)

Security Fixes : - mutt: Remote code injection vulnerability to an IMAP mailbox CVE-2018-14354 - mutt: Remote Code Execution via backquote characters CVE-2018-14357 - mutt: POP body caching path traversal vulnerability CVE-2018-14362 C Tenable Network Security, Inc. The descriptive text is C...