Scientific Linux Security Update : libtasn1 on SL7.x x86_64 (20170801)

The following packages have been upgraded to a later upstream version: libtasn1 4.10. Security Fixes : - A heap-based buffer overflow flaw was found in the way the libtasn1 library decoded certain DER-encoded inputs. A specially crafted DER- encoded input could cause an application using libtasn1...

Scientific Linux Security Update : libsoup on SL7.x x86_64 (20170815)

Security Fixes : - A stack-based buffer overflow flaw was discovered within the HTTP processing of libsoup. A remote attacker could exploit this flaw to cause a crash or, potentially, execute arbitrary code by sending a specially crafted HTTP request to a server using the libsoup HTTP server...

Scientific Linux Security Update : tcpdump on SL7.x x86_64 (20170801)

The following packages have been upgraded to a later upstream version: tcpdump 4.9.0. Security Fixes : - Multiple out of bounds read and integer overflow vulnerabilities were found in tcpdump affecting the decoding of various protocols. An attacker could create a crafted pcap file or send special...

Scientific Linux Security Update : glibc on SL7.x x86_64 (20170801)

Security Fixes : - A stack overflow vulnerability was found in nan functions that could cause applications, which process long strings with the nan function, to crash or, potentially, execute arbitrary code. CVE-2014-9761 - It was found that out-of-range time values passed to the strftime functio...

Scientific Linux Security Update : NetworkManager and libnl3 on SL7.x x86_64 (20170801)

The libnl3 packages contain a convenience library that simplifies using the Linux kernel's Netlink sockets interface for network manipulation. The following packages have been upgraded to a later upstream version: NetworkManager 1.8.0, network-manager-applet 1.8.0. Security Fixes in the libnl3...

Scientific Linux Security Update : git on SL7.x x86_64 (20170801)

Security Fixes : - It was found that the git-prompt.sh script shipped with git failed to correctly handle branch names containing special characters. A specially crafted git repository could use this flaw to execute arbitrary commands if a user working with the repository configured their shell t...

Scientific Linux Security Update : gnutls on SL7.x x86_64 (20170801)

The following packages have been upgraded to a later upstream version: gnutls 3.3.26. Security Fixes : - A double-free flaw was found in the way GnuTLS parsed certain X.509 certificates with Proxy Certificate Information extension. An attacker could create a specially crafted certificate which,...

Scientific Linux Security Update : tomcat on SL7.x (noarch) (20170802)

The following packages have been upgraded to a later upstream version: tomcat 7.0.76. Security Fixes : - The Realm implementations did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default...

Scientific Linux Security Update : firefox on SL6.x, SL7.x i386/x86_64 (20170815)

This update upgrades Firefox to version 52.3.0 ESR. Security Fixes : - Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox...

Scientific Linux Security Update : samba on SL7.x x86_64 (20170801)

The following packages have been upgraded to a later upstream version: samba 4.6.2. Security Fixes : - A flaw was found in the way Samba handled dangling symlinks. An authenticated malicious Samba client could use this flaw to cause the smbd daemon to enter an infinite loop and use an excessive...

Scientific Linux Security Update : openssh on SL7.x x86_64 (20170801)

The following packages have been upgraded to a later upstream version: openssh 7.4p1. Security Fixes : - A covert timing channel flaw was found in the way OpenSSH handled authentication of non-existent users. A remote unauthenticated attacker could possibly use this flaw to determine valid user...

Scientific Linux Security Update : python on SL7.x x86_64 (20170801)

Security Fixes : - The Python standard library HTTP client modules such as httplib or urllib did not perform verification of TLS/SSL certificates when connecting to HTTPS servers. A man-in-the-middle attacker could use this flaw to hijack connections and eavesdrop or modify transferred data...

Scientific Linux Security Update : httpd on SL7.x x86_64 (20170815)

Security Fixes : - It was discovered that the httpd's modauthdigest module did not properly initialize memory before using it when processing certain headers related to digest authentication. A remote attacker could possibly use this flaw to disclose potentially sensitive information or cause htt...

Scientific Linux Security Update : openldap on SL7.x x86_64 (20170801)

The following packages have been upgraded to a later upstream version: openldap 2.4.44. Security Fixes : - A double-free flaw was found in the way OpenLDAP's slapd server using the MDB backend handled LDAP searches. A remote attacker with access to search the directory could potentially use this...

Scientific Linux Security Update : tigervnc and fltk on SL7.x x86_64 (20170801)

FLTK pronounced 'fulltick' is a cross-platform C++ GUI toolkit. It provides modern GUI functionality without the bloat, and supports 3D graphics via OpenGL and its built-in GLUT emulation. The following packages have been upgraded to a later upstream version: tigervnc 1.8.0, fltk 1.3.4. Security...

Scientific Linux Security Update : ghostscript on SL7.x x86_64 (20170802)

Security Fixes : - A NULL pointer dereference flaw was found in ghostscript's memgetbitsrectangle function. A specially crafted postscript document could cause a crash in the context of the gs process. CVE-2017-7207 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C...

Scientific Linux Security Update : pki-core on SL7.x x86_64 (20170801)

Security Fixes : - It was found that a mock CMC authentication plugin with a hard-coded secret was accidentally enabled by default in the pki-core package. An attacker could potentially use this flaw to bypass the regular authentication process and trick the CA server into issuing certificates...

Scientific Linux Security Update : postgresql on SL7.x x86_64 (20170801)

The following packages have been upgraded to a later upstream version: postgresql 9.2.21. Security Fixes : - It was found that some selectivity estimation functions did not check user privileges before providing information from pgstatistic, possibly leaking information. A non-administrative...

Scientific Linux Security Update : log4j on SL7.x (noarch) (20170807)

Security Fixes : - It was found that when using remote logging with log4j socket server the log4j server would deserialize any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log event that, during deserialization, would execute arbitrary code in the...

Scientific Linux Security Update : evince on SL7.x x86_64 (20170802)

Security Fixes : - It was found that evince did not properly sanitize the command line which is run to untar Comic Book Tar CBT files, thereby allowing command injection. A specially crafted CBT file, when opened by evince or evince- thumbnailer, could execute arbitrary commands in the context of...