Scientific Linux Security Update : pki-core on SL7.x x86_64 (20170801)

Security Fixes : - It was found that a mock CMC authentication plugin with a hard-coded secret was accidentally enabled by default in the pki-core package. An attacker could potentially use this flaw to bypass the regular authentication process and trick the CA server into issuing certificates...

Scientific Linux Security Update : git on SL6.x i386/x86_64 (20170817)

Security Fixes : - A shell command injection flaw related to the handling of 'ssh' URLs has been discovered in Git. An attacker could use this flaw to execute shell commands with the privileges of the user running the Git client, for example, when performing a 'clone' action on a malicious...

Scientific Linux Security Update : httpd on SL6.x i386/x86_64 (20170815)

Security Fixes : - It was discovered that the httpd's modauthdigest module did not properly initialize memory before using it when processing certain headers related to digest authentication. A remote attacker could possibly use this flaw to disclose potentially sensitive information or cause htt...

Scientific Linux Security Update : tomcat on SL7.x (noarch) (20170727)

Security Fixes : - A vulnerability was discovered in the error page mechanism in Tomcat's DefaultServlet implementation. A crafted HTTP request could cause undesired side effects, possibly including the removal or replacement of the custom error page. CVE-2017-5664 - A vulnerability was discovere...

Scientific Linux Security Update : graphite2 on SL7.x x86_64 (20170721)

The following packages have been upgraded to a newer upstream version: graphite2 1.3.10. Security Fixes : - Various vulnerabilities have been discovered in Graphite2. An attacker able to trick an unsuspecting user into opening specially crafted font files in an application using Graphite2 could...

Scientific Linux Security Update : java-1.8.0-openjdk on SL6.x, SL7.x i386/x86_64 (20170720)

Security Fixes : - It was discovered that the DCG implementation in the RMI component of OpenJDK failed to correctly handle references. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of RMI registry or a Java RMI application. CVE-2017-10102 - Multiple...

Scientific Linux Security Update : freeradius on SL6.x i386/x86_64 (20170718)

Security Fixes : - An out-of-bounds write flaw was found in the way FreeRADIUS server handled certain attributes in request packets. A remote attacker could use this flaw to crash the FreeRADIUS server or to execute arbitrary code in the context of the FreeRADIUS server process by sending a...

Scientific Linux Security Update : httpd on SL6.x i386/x86_64 (20170711)

Security Fixes : - It was discovered that the HTTP parser in httpd incorrectly allowed certain characters not permitted by the HTTP protocol specification to appear unencoded in HTTP request headers. If httpd was used in conjunction with a proxy or backend server that interpreted those characters...

Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20170711)

Security Fixes : - The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lacked certain checks for the end of a buffer. A remote attacker could trigger a pointer-arithmetic error or possibly cause other unspecified impacts using crafted requests related to fs/nfsd/nfs3xdr...

Scientific Linux Security Update : bind on SL6.x i386/x86_64 (20170705)

Security Fixes : - A flaw was found in the way BIND handled TSIG authentication for dynamic updates. A remote attacker able to communicate with an authoritative BIND server could use this flaw to manipulate the contents of a zone, by forging a valid TSIG or SIG0 signature for a dynamic update...

Scientific Linux Security Update : bind on SL7.x x86_64 (20170705)

Security Fixes : - A flaw was found in the way BIND handled TSIG authentication for dynamic updates. A remote attacker able to communicate with an authoritative BIND server could use this flaw to manipulate the contents of a zone, by forging a valid TSIG or SIG0 signature for a dynamic update...

Scientific Linux Security Update : qemu-kvm on SL7.x x86_64 (20170705)

Security Fixes : - Quick Emulator QEMU built with Network Block Device NBD Server support was vulnerable to a NULL pointer dereference issue. The flaw could occur when releasing a client, which was not initialized due to failed negotiation. A remote user or process could exploit this flaw to cras...

Scientific Linux Security Update : freeradius on SL7.x x86_64 (20170628)

Security Fixes : - An authentication bypass flaw was found in the way the EAP module in FreeRADIUS handled TLS session resumption. A remote unauthenticated attacker could potentially use this flaw to bypass the inner authentication check in FreeRADIUS by resuming an older unauthenticated TLS...

Scientific Linux Security Update : mercurial on SL6.x, SL7.x i386/x86_64 (20170627)

Security Fixes : - A flaw was found in the way 'hg serve --stdio' command in Mercurial handled command-line options. A remote, authenticated attacker could use this flaw to execute arbitrary code on the Mercurial server by using specially crafted command-line options. CVE-2017-9462 %NASLMINLEVEL...

Scientific Linux Security Update : sudo on SL6.x, SL7.x i386/x86_64 (20170623)

Security Fixes : - It was found that the original fix for CVE-2017-1000367 was incomplete. A flaw was found in the way sudo parsed tty information from the process status file in the proc filesystem. A local user with privileges to execute commands via sudo could use this flaw to escalate their...

Scientific Linux Security Update : thunderbird on SL6.x, SL7.x i386/x86_64 (20170621)

This update upgrades Thunderbird to version 52.2.0. Security Fixes : - Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running...

Scientific Linux Security Update : glibc on SL6.x i386/x86_64 (20170619) (Stack Clash)

Security Fixes : - A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap or different memory region and stack memory regions were adjacent to each other, an attacker could use this flaw to jump over the stack guard gap, cause controlled memory...

Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20170619) (Stack Clash)

Security Fixes : - A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap or different memory region and stack memory regions were adjacent to each other, an attacker could use this flaw to jump over the stack guard gap, cause controlled memory...

Scientific Linux Security Update : kernel on SL7.x x86_64 (20170619) (Stack Clash)

Security Fixes : - A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap or different memory region and stack memory regions were adjacent to each other, an attacker could use this flaw to jump over the stack guard gap, cause controlled memory...

Scientific Linux Security Update : glibc on SL7.x x86_64 (20170619) (Stack Clash)

Security Fixes : - A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap or different memory region and stack memory regions were adjacent to each other, an attacker could use this flaw to jump over the stack guard gap, cause controlled memory...