Scientific Linux Security Update : bash on SL6.x i386/x86_64 (20170321)

Security Fixes : - An arbitrary command injection flaw was found in the way bash processed the hostname value. A malicious DHCP server could use this flaw to execute arbitrary commands on the DHCP client machines running bash under specific circumstances. CVE-2016-0634 - An arbitrary command...

Scientific Linux Security Update : gnutls on SL6.x i386/x86_64 (20170321)

The following packages have been upgraded to a later upstream version: gnutls 2.12.23. Security Fixes : - A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL...

Scientific Linux Security Update : ocaml on SL6.x i386/x86_64 (20170321)

Security Fixes : - An integer conversion flaw was found in the way OCaml's String handled its length. Certain operations on an excessively long String could trigger a buffer overflow or result in an information leak. CVE-2015-8869 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descripti...

Scientific Linux Security Update : glibc on SL6.x i386/x86_64 (20170321)

Security Fixes : - A stack overflow vulnerability was found in nan functions that could cause applications, which process long strings with the nan function, to crash or, potentially, execute arbitrary code. CVE-2014-9761 - It was found that out-of-range time values passed to the strftime functio...

Scientific Linux Security Update : tigervnc on SL6.x i386/x86_64 (20170321)

Security Fixes : - A denial of service flaw was found in the TigerVNC's Xvnc server. A remote unauthenticated attacker could use this flaw to make Xvnc crash by terminating the TLS handshake process early. CVE-2016-10207 - A buffer overflow flaw, leading to memory corruption, was found in TigerVN...

Scientific Linux Security Update : qemu-kvm on SL6.x i386/x86_64 (20170321)

Security Fixes : - An integer overflow flaw and an out-of-bounds read flaw were found in the way QEMU's VGA emulator set certain VGA registers while in VBE mode. A privileged guest user could use this flaw to crash the QEMU process instance. CVE-2016-3712 %NASLMINLEVEL 70300 C Tenable Network...

Scientific Linux Security Update : libguestfs on SL6.x x86_64 (20170321)

Security Fixes : - An integer conversion flaw was found in the way OCaml's String handled its length. Certain operations on an excessively long String could trigger a buffer overflow or result in an information leak. CVE-2015-8869 Note: The libguestfs packages in this advisory were rebuilt with a...

Scientific Linux Security Update : icoutils on SL7.x x86_64 (20170322)

Security Fixes : - Multiple vulnerabilities were found in icoutils, in the wrestool program. An attacker could create a crafted executable that, when read by wrestool, could result in memory corruption leading to a crash or potential code execution. CVE-2017-5208, CVE-2017-5333, CVE-2017-6009 - A...

Scientific Linux Security Update : openjpeg on SL7.x x86_64 (20170322)

Security Fixes : - Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in OpenJPEG. A specially crafted JPEG2000 image could cause an application using OpenJPEG to crash or, potentially, execute arbitrary code. CVE-2016-5139, CVE-2016-5158, CVE-2016-5159,...

Scientific Linux Security Update : firefox on SL7.x x86_64 (20170317)

Security Fixes : - A flaw was found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. CVE-2017-5428 %NASLMINLEVEL 70300 C Tenable Network Securit...

Scientific Linux Security Update : openjpeg on SL6.x i386/x86_64 (20170319)

Security Fixes : - Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in OpenJPEG. A specially crafted JPEG2000 image could cause an application using OpenJPEG to crash or, potentially, execute arbitrary code. CVE-2016-5139, CVE-2016-5158, CVE-2016-5159,...

Scientific Linux Security Update : tomcat6 on SL6.x (noarch) (20170315)

Security Fixes : - It was discovered that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By...

Scientific Linux Security Update : thunderbird on SL5.x, SL6.x, SL7.x i386/x86_64 (20170314)

This update upgrades Thunderbird to version 45.8.0. Security Fixes : - Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running...

Scientific Linux Security Update : firefox on SL5.x, SL6.x i386/x86_64 (20170308)

This update upgrades Firefox to version 45.8.0 ESR. Security Fixes : - Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox...

Scientific Linux Security Update : firefox on SL7.x x86_64 (20170308)

This update upgrades Firefox to version 52.0 ESR. Security Fixes : - Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox...

Scientific Linux Security Update : kvm on SL5.x x86_64 (20170307)

Security Fixes : - Quick emulator QEMU built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process...

Scientific Linux Security Update : qemu-kvm on SL7.x x86_64 (20170302)

Security Fixes : - Quick emulator QEMU built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64 (20170224)

Security Fixes : - A use-after-free flaw was found in the way the Linux kernel's Datagram Congestion Control Protocol DCCP implementation freed SKB socket buffer resources for a DCCPPKTREQUEST packet when the IPV6RECVPKTINFO option is set on the socket. A local, unprivileged user could use this...

Scientific Linux Security Update : kernel on SL7.x x86_64 (20170222)

Security Fixes : - A use-after-free flaw was found in the way the Linux kernel's Datagram Congestion Control Protocol DCCP implementation freed SKB socket buffer resources for a DCCPPKTREQUEST packet when the IPV6RECVPKTINFO option is set on the socket. A local, unprivileged user could use this...

Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20170222)

Security Fixes : - A use-after-free flaw was found in the way the Linux kernel's Datagram Congestion Control Protocol DCCP implementation freed SKB socket buffer resources for a DCCPPKTREQUEST packet when the IPV6RECVPKTINFO option is set on the socket. A local, unprivileged user could use this...