Scientific Linux Security Update : poppler on SL6.x i386/x86_64 (20170830)

Security Fixes : - An integer overflow leading to heap-based buffer overflow was found in the poppler library. An attacker could create a malicious PDF file that would cause applications that use poppler such as Evince to crash, or potentially execute arbitrary code when opened. CVE-2017-9776...

Scientific Linux Security Update : poppler on SL7.x x86_64 (20170830)

Security Fixes : - A stack-based buffer overflow was found in the poppler library. An attacker could create a malicious PDF file that would cause applications that use poppler such as Evince to crash, or potentially execute arbitrary code when opened. CVE-2017-9775 - An integer overflow leading t...

Scientific Linux Security Update : thunderbird on SL6.x, SL7.x i386/x86_64 (20170824)

This update upgrades Thunderbird to version 52.3.0. Security Fixes : - Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running...

Scientific Linux Security Update : tigervnc and fltk on SL7.x x86_64 (20170801)

FLTK pronounced 'fulltick' is a cross-platform C++ GUI toolkit. It provides modern GUI functionality without the bloat, and supports 3D graphics via OpenGL and its built-in GLUT emulation. The following packages have been upgraded to a later upstream version: tigervnc 1.8.0, fltk 1.3.4. Security...

Scientific Linux Security Update : gdm and gnome-session on SL7.x x86_64 (20170802)

The following packages have been upgraded to a later upstream version: gdm 3.22.3, gnome-session 3.22.3. Security Fixes : - It was found that gdm could crash due to a signal handler dispatched to an invalid conversation. An attacker could crash gdm by holding the escape key when the screen is...

Scientific Linux Security Update : golang on (20170801)

The following packages have been upgraded to a later upstream version: golang 1.8.3. Security Fixes : - A carry propagation flaw was found in the implementation of the P-256 elliptic curve in golang. An attacker could possibly use this flaw to extract private keys when static ECDH was used...

Scientific Linux Security Update : firefox on SL6.x, SL7.x i386/x86_64 (20170815)

This update upgrades Firefox to version 52.3.0 ESR. Security Fixes : - Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox...

Scientific Linux Security Update : xmlsec1 on SL7.x x86_64 (20170821)

Security Fixes : - It was discovered xmlsec1's use of libxml2 inadvertently enabled external entity expansion XXE along with validation. An attacker could craft an XML file that would cause xmlsec1 to try and read local files or HTTP/FTP URLs, leading to information disclosure or denial of servic...

Scientific Linux Security Update : glibc on SL7.x x86_64 (20170801)

Security Fixes : - A stack overflow vulnerability was found in nan functions that could cause applications, which process long strings with the nan function, to crash or, potentially, execute arbitrary code. CVE-2014-9761 - It was found that out-of-range time values passed to the strftime functio...

Scientific Linux Security Update : openssh on SL7.x x86_64 (20170801)

The following packages have been upgraded to a later upstream version: openssh 7.4p1. Security Fixes : - A covert timing channel flaw was found in the way OpenSSH handled authentication of non-existent users. A remote unauthenticated attacker could possibly use this flaw to determine valid user...

Scientific Linux Security Update : gtk-vnc on SL7.x x86_64 (20170801)

The following packages have been upgraded to a later upstream version: gtk-vnc 0.7.0. Security Fixes : - It was found that gtk-vnc lacked proper bounds checking while processing messages using RRE, hextile, or copyrect encodings. A remote malicious VNC server could use this flaw to crash VNC...

Scientific Linux Security Update : spice on SL7.x x86_64 (20170815)

Security Fixes : - A vulnerability was discovered in spice server's protocol handling. An authenticated attacker could send specially crafted messages to the spice server, causing out-of-bounds memory accesses, leading to parts of server memory being leaked or a crash. CVE-2017-7506 This issue wa...

Scientific Linux Security Update : git on SL7.x x86_64 (20170801)

Security Fixes : - It was found that the git-prompt.sh script shipped with git failed to correctly handle branch names containing special characters. A specially crafted git repository could use this flaw to execute arbitrary commands if a user working with the repository configured their shell t...

Scientific Linux Security Update : ghostscript on SL7.x x86_64 (20170802)

Security Fixes : - A NULL pointer dereference flaw was found in ghostscript's memgetbitsrectangle function. A specially crafted postscript document could cause a crash in the context of the gs process. CVE-2017-7207 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C...

Scientific Linux Security Update : samba on SL7.x x86_64 (20170801)

The following packages have been upgraded to a later upstream version: samba 4.6.2. Security Fixes : - A flaw was found in the way Samba handled dangling symlinks. An authenticated malicious Samba client could use this flaw to cause the smbd daemon to enter an infinite loop and use an excessive...

Scientific Linux Security Update : kernel on SL7.x x86_64 (20170801)

Security Fixes : - An use-after-free flaw was found in the Linux kernel which enables a race condition in the L2TPv3 IP Encapsulation feature. A local user could use this flaw to escalate their privileges or crash the system. CVE-2016-10200, Important - A flaw was found that can be triggered in...

Scientific Linux Security Update : curl on SL7.x x86_64 (20170801)

Security Fixes : - Multiple integer overflow flaws leading to heap-based buffer overflows were found in the way curl handled escaping and unescaping of data. An attacker could potentially use these flaws to crash an application using libcurl by sending a specially crafted input to the affected...

Scientific Linux Security Update : qemu-kvm on SL7.x x86_64 (20170801)

Security Fixes : - An out-of-bounds memory access issue was found in Quick Emulator QEMU in the VNC display driver. This flaw could occur while refreshing the VNC display surface area in the 'vncrefreshserversurface'. A user inside a guest could use this flaw to crash the QEMU process...

Scientific Linux Security Update : X.org X11 libraries on SL7.x x86_64 (20170801)

The following packages have been upgraded to a later upstream version: libX11 1.6.5, libXaw 1.0.13, libXdmcp 1.1.2, libXfixes 5.0.3, libXfont 1.5.2, libXi 1.7.9, libXpm 3.5.12, libXrandr 1.5.1, libXrender 0.9.10, libXt 1.1.5, libXtst 1.2.3, libXv 1.0.11, libXvMC 1.0.10, libXxf86vm 1.1.4, libdrm...

Scientific Linux Security Update : log4j on SL7.x (noarch) (20170807)

Security Fixes : - It was found that when using remote logging with log4j socket server the log4j server would deserialize any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log event that, during deserialization, would execute arbitrary code in the...