Scientific Linux Security Update : NetworkManager and libnl3 on SL7.x x86_64 (20170801)

The libnl3 packages contain a convenience library that simplifies using the Linux kernel's Netlink sockets interface for network manipulation. The following packages have been upgraded to a later upstream version: NetworkManager 1.8.0, network-manager-applet 1.8.0. Security Fixes in the libnl3...

Scientific Linux Security Update : openldap on SL7.x x86_64 (20170801)

The following packages have been upgraded to a later upstream version: openldap 2.4.44. Security Fixes : - A double-free flaw was found in the way OpenLDAP's slapd server using the MDB backend handled LDAP searches. A remote attacker with access to search the directory could potentially use this...

Scientific Linux Security Update : glibc on SL7.x x86_64 (20170801)

Security Fixes : - A stack overflow vulnerability was found in nan functions that could cause applications, which process long strings with the nan function, to crash or, potentially, execute arbitrary code. CVE-2014-9761 - It was found that out-of-range time values passed to the strftime functio...

Scientific Linux Security Update : qemu-kvm on SL7.x x86_64 (20170801)

Security Fixes : - An out-of-bounds memory access issue was found in Quick Emulator QEMU in the VNC display driver. This flaw could occur while refreshing the VNC display surface area in the 'vncrefreshserversurface'. A user inside a guest could use this flaw to crash the QEMU process...

Scientific Linux Security Update : libsoup on SL7.x x86_64 (20170815)

Security Fixes : - A stack-based buffer overflow flaw was discovered within the HTTP processing of libsoup. A remote attacker could exploit this flaw to cause a crash or, potentially, execute arbitrary code by sending a specially crafted HTTP request to a server using the libsoup HTTP server...

Scientific Linux Security Update : tcpdump on SL7.x x86_64 (20170801)

The following packages have been upgraded to a later upstream version: tcpdump 4.9.0. Security Fixes : - Multiple out of bounds read and integer overflow vulnerabilities were found in tcpdump affecting the decoding of various protocols. An attacker could create a crafted pcap file or send special...

Scientific Linux Security Update : evince on SL7.x x86_64 (20170802)

Security Fixes : - It was found that evince did not properly sanitize the command line which is run to untar Comic Book Tar CBT files, thereby allowing command injection. A specially crafted CBT file, when opened by evince or evince- thumbnailer, could execute arbitrary commands in the context of...

Scientific Linux Security Update : curl on SL7.x x86_64 (20170801)

Security Fixes : - Multiple integer overflow flaws leading to heap-based buffer overflows were found in the way curl handled escaping and unescaping of data. An attacker could potentially use these flaws to crash an application using libcurl by sending a specially crafted input to the affected...

Scientific Linux Security Update : log4j on SL7.x (noarch) (20170807)

Security Fixes : - It was found that when using remote logging with log4j socket server the log4j server would deserialize any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log event that, during deserialization, would execute arbitrary code in the...

Scientific Linux Security Update : httpd on SL7.x x86_64 (20170815)

Security Fixes : - It was discovered that the httpd's modauthdigest module did not properly initialize memory before using it when processing certain headers related to digest authentication. A remote attacker could possibly use this flaw to disclose potentially sensitive information or cause htt...

Scientific Linux Security Update : groovy on SL7.x (noarch) (20170817)

Security Fixes : - It was found that a flaw in Apache groovy library allows remote code execution wherever deserialization occurs in the application. It is possible for an attacker to craft a special serialized object that will execute code directly when deserialized. All applications which rely ...

Scientific Linux Security Update : qemu-kvm on SL7.x x86_64 (20170815)

Security Fixes : - Quick Emulator QEMU built with the Network Block Device NBD Server support is vulnerable to a crash via a SIGPIPE signal. The crash can occur if a client aborts a connection due to any failure during negotiation or read operation. A remote user/process could use this flaw to...

Scientific Linux Security Update : gnutls on SL7.x x86_64 (20170801)

The following packages have been upgraded to a later upstream version: gnutls 3.3.26. Security Fixes : - A double-free flaw was found in the way GnuTLS parsed certain X.509 certificates with Proxy Certificate Information extension. An attacker could create a specially crafted certificate which,...

Scientific Linux Security Update : libtasn1 on SL7.x x86_64 (20170801)

The following packages have been upgraded to a later upstream version: libtasn1 4.10. Security Fixes : - A heap-based buffer overflow flaw was found in the way the libtasn1 library decoded certain DER-encoded inputs. A specially crafted DER- encoded input could cause an application using libtasn1...

Scientific Linux Security Update : pidgin on SL7.x x86_64 (20170801)

The following packages have been upgraded to a later upstream version: pidgin 2.10.11. Security Fixes : - A denial of service flaw was found in the way Pidgin's Mxit plug-in handled emoticons. A malicious remote server or a man-in-the-middle attacker could potentially use this flaw to crash Pidgi...

Scientific Linux Security Update : libreoffice on SL7.x x86_64 (20170801)

Security Fixes : - An out-of-bounds write flaw was found in the way Libreoffice rendered certain documents containing Polygon images. By tricking a user into opening a specially crafted LibreOffice file, an attacker could possibly use this flaw to execute arbitrary code with the privileges of the...

Scientific Linux Security Update : bash on SL7.x x86_64 (20170801)

Security Fixes : - An arbitrary command injection flaw was found in the way bash processed the hostname value. A malicious DHCP server could use this flaw to execute arbitrary commands on the DHCP client machines running bash under specific circumstances. CVE-2016-0634 - An arbitrary command...

Scientific Linux Security Update : authconfig on SL7.x x86_64 (20170801)

Security Fixes : - A flaw was found where authconfig could configure sssd in a way that treats existing and non-existing logins differently, leaking information on existence of a user. An attacker with physical or network access to the machine could enumerate users via a timing attack...

Scientific Linux Security Update : GStreamer on SL7.x x86_64 (20170802)

The following packages have been upgraded to a later upstream version: clutter-gst2 2.0.18, gnome-video-effects 0.4.3, gstreamer1 1.10.4, gstreamer1-plugins-bad-free 1.10.4, gstreamer1-plugins-base 1.10.4, gstreamer1-plugins-good 1.10.4, orc 0.4.26. Security Fixes : - Multiple flaws were found in...

Scientific Linux Security Update : git on SL7.x x86_64 (20170817)

Security Fixes : - A shell command injection flaw related to the handling of 'ssh' URLs has been discovered in Git. An attacker could use this flaw to execute shell commands with the privileges of the user running the Git client, for example, when performing a 'clone' action on a malicious...