Scientific Linux Security Update : firefox on SL7.x x86_64 (20180410)

This update upgrades Firefox to version 52.7.3 ESR. Security Fixes : - firefox: Use-after-free in compositor potentially allows code execution CVE-2018-5148 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid109445;...

Scientific Linux Security Update : pcs on SL7.x x86_64 (20180410)

Security Fixes : - pcs: Privilege escalation via authorized user malicious REST call CVE-2018-1079 - pcs: Debug parameter removal bypass, allowing information disclosure CVE-2018-1086 - rack-protection: Timing attack in authenticitytoken.rb CVE-2018-1000119 C Tenable Network Security, Inc. The...

Scientific Linux Security Update : corosync on SL7.x x86_64 (20180417)

Security Fixes : - corosync: Integer overflow in exec/totemcrypto.c:authenticatenss23 function CVE-2018-1084 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid109460; scriptversion"1.9";...

Scientific Linux Security Update : glibc on SL7.x x86_64 (20180410)

Security Fixes : - glibc: realpath buffer underflow when getcwd returns relative path allows privilege escalation CVE-2018-1000001 - glibc: Buffer overflow in glob with GLOBTILDE CVE-2017-15670 - glibc: Buffer overflow during unescaping of user names with the operator CVE-2017-15804 - glibc: deni...

Scientific Linux Security Update : patch on SL7.x x86_64 (20180423)

Patch should be installed because it is a common way of upgrading applications. Security Fixes : - patch: Malicious patch files cause ed to execute arbitrary commands CVE-2018-1000156 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description...

Scientific Linux Security Update : golang on SL7.x (noarch) (20180410)

The following packages have been upgraded to a later upstream version: golang 1.9.4. Security Fixes : - golang: arbitrary code execution during 'go get' or 'go get -d' CVE-2017-15041 - golang: smtp.PlainAuth susceptible to man-in-the-middle password harvesting CVE-2017-15042 - golang: arbitrary...

Scientific Linux Security Update : PackageKit on SL7.x x86_64 (20180424)

Security Fixes : - PackageKit: authentication bypass allows to install signed packages without administrator privileges CVE-2018-1106 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid109463; scriptversion"1.6";...

Scientific Linux Security Update : librelp on SL7.x x86_64 (20180424)

Security Fixes : - librelp: Stack-based buffer overflow in relpTcpChkPeerName function in src/tcp.c CVE-2018-1000140 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid109464; scriptversion"1.6";...

Scientific Linux Security Update : libvncserver on SL7.x x86_64 (20180410)

Security Fixes : - libvncserver: Improper input sanitization in rfbProcessClientNormalMessage in rfbserver.c CVE-2018-7225 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid109451; scriptversion"1.4";...

Scientific Linux Security Update : java-1.7.0-openjdk on SL6.x i386/x86_64 (20180430)

Security Fixes : - OpenJDK: incorrect handling of Reference clones can lead to sandbox bypass Hotspot, 8192025 CVE-2018-2814 - OpenJDK: unrestricted deserialization of data from JCEKS key stores Security, 8189997 CVE-2018-2794 - OpenJDK: insufficient consistency checks in deserialization of...

Scientific Linux Security Update : ntp on SL7.x x86_64 (20180410)

Security Fixes : - ntp: Authenticated DoS via Malicious Config Option CVE-2017-6463 - ntp: Denial of Service via Malformed Config CVE-2017-6464 - ntp: Buffer Overflow in DPTS Clock CVE-2017-6462 Additional Changes : C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

Scientific Linux Security Update : gcc on SL7.x x86_64 (20180410)

Security Fixes : - gcc: GCC generates incorrect code for RDRAND/RDSEED intrinsics CVE-2017-11671 Additional Changes : C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid109446; scriptversion"1.4";...

Scientific Linux Security Update : openssl on SL7.x x86_64 (20180410)

Security Fixes : - openssl: bnsqrx8xinternal carry bug on x8664 CVE-2017-3736 - openssl: Read/write after SSL object in error state CVE-2017-3737 - openssl: rsaz1024mulavx2 overflow bug on x8664 CVE-2017-3738 Additional Changes : C Tenable Network Security, Inc. The descriptive text is C Scientif...

Scientific Linux Security Update : librelp on SL6.x i386/x86_64 (20180424)

Security Fixes : - librelp: Stack-based buffer overflow in relpTcpChkPeerName function in src/tcp.c CVE-2018-1000140 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid109340; scriptversion"1.6";...

Scientific Linux Security Update : patch on SL6.x i386/x86_64 (20180423)

Patch should be installed because it is a common way of upgrading applications. Security Fixes : - patch: Malicious patch files cause ed to execute arbitrary commands CVE-2018-1000156 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description...

Scientific Linux Security Update : java-1.8.0-openjdk on SL6.x i386/x86_64 (20180419)

Security Fixes : - OpenJDK: incorrect handling of Reference clones can lead to sandbox bypass Hotspot, 8192025 CVE-2018-2814 - OpenJDK: unrestricted deserialization of data from JCEKS key stores Security, 8189997 CVE-2018-2794 - OpenJDK: insufficient consistency checks in deserialization of...

Scientific Linux Security Update : python-paramiko on SL6.x (noarch) (20180412)

Security Fixes : - python-paramiko: Authentication bypass in transport.py CVE-2018-7750 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid109057; scriptversion"1.6"; scriptsetattributeattribute:"pluginmodificationdate",...

Scientific Linux Security Update : firefox on SL6.x i386/x86_64 (20180410)

This update upgrades Firefox to version 52.7.3 ESR. Security Fixes : - firefox: Use-after-free in compositor potentially allows code execution CVE-2018-5148 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid109010;...

Scientific Linux Security Update : thunderbird on SL6.x i386/x86_64 (20180405)

This update upgrades Thunderbird to version 52.7.0. Security Fixes : - Mozilla: Memory safety bugs fixed in Firefox 59 and Firefox ESR 52.7 MFSA 2018-07 CVE-2018-5125 - Mozilla: Memory safety bugs fixed in Firefox ESR 52.7 MFSA 2018-07 CVE-2018-5145 - Mozilla: Vorbis audio processing out of bound...

Scientific Linux Security Update : libvorbis on SL6.x i386/x86_64 (20180405)

Security Fixes : - Mozilla: Vorbis audio processing out of bounds write MFSA 2018-08 CVE-2018-5146 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid108870; scriptversion"1.8";...