Scientific Linux Security Update : firefox on SL6.x, SL7.x i386/x86_64 (20170614)

This update upgrades Firefox to version 52.2.0 ESR. Security Fixes : - Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox...

Scientific Linux Security Update : qemu-kvm on SL7.x x86_64 (20170613)

Security Fixes : - An out-of-bounds r/w access issue was found in QEMU's Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside a guest could use this flaw to crash the QEMU process or, potentially, execut...

Scientific Linux Security Update : nss on SL6.x i386/x86_64 (20170530)

Security Fixes : - A NULL pointer dereference flaw was found in the way NSS handled empty SSLv2 messages. An attacker could use this flaw to crash a server application compiled against the NSS library. CVE-2017-7502 Bug Fixes : - The Network Security Services NSS code and Certificate Authority CA...

Scientific Linux Security Update : sudo on SL6.x, SL7.x i386/x86_64 (20170530)

Security Fixes : - A flaw was found in the way sudo parsed tty information from the process status file in the proc filesystem. A local user with privileges to execute commands via sudo could use this flaw to escalate their privileges to root. CVE-2017-1000367 %NASLMINLEVEL 70300 C Tenable Networ...

Scientific Linux Security Update : nss on SL7.x x86_64 (20170530)

Security Fixes : - A NULL pointer dereference flaw was found in the way NSS handled empty SSLv2 messages. An attacker could use this flaw to crash a server application compiled against the NSS library. CVE-2017-7502 Bug Fixes : - The Network Security Services NSS code and Certificate Authority CA...

Scientific Linux Security Update : samba on SL6.x, SL7.x i386/x86_64 (20170524) (SambaCry)

Security Fixes : - A remote code execution flaw was found in Samba. A malicious authenticated samba client, having write access to the samba share, could use this flaw to execute arbitrary code as root. CVE-2017-7494 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C...

Scientific Linux Security Update : samba4 on SL6.x i386/x86_64 (20170524) (SambaCry)

Security Fixes : - A remote code execution flaw was found in Samba. A malicious authenticated samba client, having write access to the samba share, could use this flaw to execute arbitrary code as root. CVE-2017-7494 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C...

Scientific Linux Security Update : rpcbind on SL6.x i386/x86_64 (20170523)

Security Fixes : - It was found that due to the way rpcbind uses libtirpc libntirpc, a memory leak can occur when parsing specially crafted XDR messages. An attacker sending thousands of messages to rpcbind could cause its memory usage to grow without bound, eventually causing it to be terminated...

Scientific Linux Security Update : samba on SL7.x x86_64 (20170522)

Security Fixes : - It was found that Samba always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users. CVE-2016-2125 - A flaw was found in t...

Scientific Linux Security Update : libtirpc on SL7.x x86_64 (20170521)

Security Fixes : - It was found that due to the way rpcbind uses libtirpc libntirpc, a memory leak can occur when parsing specially crafted XDR messages. An attacker sending thousands of messages to rpcbind could cause its memory usage to grow without bound, eventually causing it to be terminated...

Scientific Linux Security Update : rpcbind on SL7.x x86_64 (20170521)

Security Fixes : - It was found that due to the way rpcbind uses libtirpc libntirpc, a memory leak can occur when parsing specially crafted XDR messages. An attacker sending thousands of messages to rpcbind could cause its memory usage to grow without bound, eventually causing it to be terminated...

Scientific Linux Security Update : kdelibs on SL7.x x86_64 (20170522)

Security Fixes : - A privilege escalation flaw was found in the way kdelibs handled D-Bus messages. A local user could potentially use this flaw to gain root privileges by spoofing a callerID and leveraging a privileged helper application. CVE-2017-8422 %NASLMINLEVEL 70300 C Tenable Network...

Scientific Linux Security Update : ghostscript on SL6.x, SL7.x i386/x86_64 (20170512)

Security Fixes : - It was found that ghostscript did not properly validate the parameters passed to the .rsdparams and .eqproc functions. During its execution, a specially crafted PostScript document could execute code in the context of the ghostscript process, bypassing the -dSAFER protection...

Scientific Linux Security Update : jasper on SL6.x, SL7.x i386/x86_64 (20170509)

Security Fixes : Multiple flaws were found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code. CVE-2016-8654, CVE-2016-9560, CVE-2016-10249, CVE-2015-5203, CVE-2015-5221, CVE-2016-1577,...

Scientific Linux Security Update : qemu-kvm on SL6.x i386/x86_64 (20170509)

Security Fixes : - A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use...

Scientific Linux Security Update : bind on SL6.x i386/x86_64 (20170508)

Security Fixes : - A denial of service flaw was found in the way BIND handled DNSSEC validation. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. CVE-2017-3139 Note: This issue affected only the BIND versions as...

Scientific Linux Security Update : thunderbird on SL6.x, SL7.x i386/x86_64 (20170508)

This update upgrades Thunderbird to version 52.1.0. Security Fixes : - Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running...

Scientific Linux Security Update : java-1.8.0-openjdk on SL6.x i386/x86_64 (20170421)

Security Fixes : - An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges. CVE-2017-3511 - It was found that the...

Scientific Linux Security Update : firefox on SL7.x x86_64 (20170420)

This update upgrades Firefox to version 52.1.0 ESR. Security Fixes : - Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox...

Scientific Linux Security Update : java-1.8.0-openjdk on SL7.x x86_64 (20170421)

Security Fixes : - An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges. CVE-2017-3511 - It was found that the...