Scientific Linux Security Update : java-1.8.0-openjdk on SL6.x i386/x86_64 (20170421)

Security Fixes : - An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges. CVE-2017-3511 - It was found that the...

Scientific Linux Security Update : nss and nss-util on SL6.x, SL7.x i386/x86_64 (20170420)

The nss-util packages provide utilities for use with the Network Security Services NSS libraries. The following packages have been upgraded to a newer upstream version: nss 3.28.4, nss-util 3.28.4. Security Fixes : - An out-of-bounds write flaw was found in the way NSS performed certain...

Scientific Linux Security Update : bind on SL6.x i386/x86_64 (20170420)

Security Fixes : - A denial of service flaw was found in the way BIND handled a query response containing CNAME or DNAME resource records in an unusual order. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response...

Scientific Linux Security Update : firefox on SL6.x i386/x86_64 (20170420)

This update upgrades Firefox to version 52.1.0 ESR. Security Fixes : - Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox...

Scientific Linux Security Update : bind on SL7.x x86_64 (20170419)

Security Fixes : - A denial of service flaw was found in the way BIND handled a query response containing CNAME or DNAME resource records in an unusual order. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response...

Scientific Linux Security Update : libreoffice on SL6.x i386/x86_64 (20170418)

Security Fixes : - It was found that LibreOffice disclosed contents of a file specified in an embedded object's preview. An attacker could potentially use this flaw to expose details of a system running LibreOffice as an online service via a crafted document. CVE-2017-3157 %NASLMINLEVEL 70300 C...

Scientific Linux Security Update : qemu-kvm on SL7.x x86_64 (20170418)

Security Fixes : - A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use...

Scientific Linux Security Update : kernel on SL7.x x86_64 (20170412)

Security Fixes : - A race condition flaw was found in the NHLDC Linux kernel driver when accessing nhdlc.tbuf list that can lead to double free. A local, unprivileged user able to set the HDLC line discipline on the tty device could use this flaw to increase their privileges on the system...

Scientific Linux Security Update : tomcat on SL7.x (noarch) (20170412)

Security Fixes : - It was discovered that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By...

Scientific Linux Security Update : 389-ds-base on SL7.x x86_64 (20170412)

Security Fixes : - An invalid pointer dereference flaw was found in the way 389-ds-base handled LDAP bind requests. A remote unauthenticated attacker could use this flaw to make ns-slapd crash via a specially crafted LDAP bind request, resulting in denial of service. CVE-2017-2668 Bug Fixes : -...

Scientific Linux Security Update : libreoffice on SL7.x x86_64 (20170412)

Security Fixes : - It was found that LibreOffice disclosed contents of a file specified in an embedded object's preview. An attacker could potentially use this flaw to expose details of a system running LibreOffice as an online service via a crafted document. CVE-2017-3157 Bug Fixes : - Previousl...

Scientific Linux Security Update : util-linux on SL7.x x86_64 (20170412)

Security Fixes : - A race condition was found in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions. CVE-2017-2616 Bug Fixes : - The 'findmnt --target ' command prints all...

Scientific Linux Security Update : 389-ds-base on SL6.x i386/x86_64 (20170411)

Security Fixes : - An invalid pointer dereference flaw was found in the way 389-ds-base handled LDAP bind requests. A remote unauthenticated attacker could use this flaw to make ns-slapd crash via a specially crafted LDAP bind request, resulting in denial of service. CVE-2017-2668 Bug Fixes : -...

Scientific Linux Security Update : wireshark on SL6.x i386/x86_64 (20170321)

Security Fixes : - Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. CVE-2015-3811, CVE-2015-3812, CVE-2015-3813, CVE-2013-4075 %NASLMINLEVEL 70300 C Tenable Network...

Scientific Linux Security Update : curl on SL6.x i386/x86_64 (20170329)

Security Fixes : - It was found that the fix for CVE-2015-3148 in curl was incomplete. An application using libcurl with HTTP Negotiate authentication could incorrectly re-use credentials for subsequent requests to the same server. CVE-2017-2628 %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Scientific Linux Security Update : openssh on SL6.x i386/x86_64 (20170321)

Security Fixes : - It was discovered that the OpenSSH sshd daemon fetched PAM environment settings before running the login program. In configurations with UseLogin=yes and the pamenv PAM module configured to read user environment settings, a local user could use this flaw to execute arbitrary co...

Scientific Linux Security Update : coreutils on SL6.x i386/x86_64 (20170321)

Security Fixes : - A race condition was found in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions. CVE-2017-2616 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Scientific Linux Security Update : subscription-manager on SL6.x i386/x86_64 (20170321)

Security Fixes : - It was found that subscription-manager set weak permissions on files in /var/lib/rhsm/, causing an information disclosure. A local, unprivileged user could use this flaw to access sensitive data that could potentially be used in a social engineering attack. CVE-2016-4455...

Scientific Linux Security Update : quagga on SL6.x i386/x86_64 (20170321)

Security Fixes : - A stack-based buffer overflow flaw was found in the way Quagga handled IPv6 router advertisement messages. A remote attacker could use this flaw to crash the zebra daemon resulting in denial of service. CVE-2016-1245 - A stack-based buffer overflow flaw was found in the way the...

Scientific Linux Security Update : samba4 on SL6.x i386/x86_64 (20170321)

Security Fixes : - It was found that Samba always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users. CVE-2016-2125 - A flaw was found in t...