Scientific Linux Security Update : kernel on SL7.x x86_64 (2022:1198)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:1198-1 advisory. - kernel: use-after-free in RDMA listen CVE-2021-4028 - kernel: fget: check that the fd still exists after getting a ref to it CVE-2021-4083 Note...

[SECURITY] Fedora 36 Update: OpenSceneGraph-3.6.5-5.fc36

The OpenSceneGraph is an OpenSource, cross platform graphics toolkit for the development of high performance graphics applications such as flight simulators, games, virtual reality and scientific visualization. Based around the concept of a SceneGraph, it provides an object oriented framework on...

Scientific Linux Security Update : log4j on SL6.x, SL7.x i686/x86_64 (2021:5206)

The remote Scientific Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2021:5206-1 advisory. - log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender CVE-2021-4104 Note that Nessus has not tested for this...

Scientific Linux Security Update : thunderbird on SL7.x x86_64 (2022:0850)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:0850-1 advisory. - Mozilla: Use-after-free in XSLT parameter processing CVE-2022-26485 - Mozilla: Use-after-free in WebGPU IPC Framework CVE-2022-26486 - expat:...

Scientific Linux Security Update : firefox on SL7.x i686/x86_64 (2022:0824)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:0824-1 advisory. - Mozilla: Use-after-free in XSLT parameter processing CVE-2022-26485 - Mozilla: Use-after-free in WebGPU IPC Framework CVE-2022-26486 - expat:...

Scientific Linux Security Update : 389-ds-base on SL7.x x86_64 (2022:0628)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2022:0628-1 advisory. - 389-ds-base: double-free of the virtual attribute context in persistent search CVE-2021-4091 Note that Nessus has not tested for this issue but has...

Scientific Linux Security Update : openldap on SL7.x i686/x86_64 (2022:0621)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:0621-1 advisory. - openldap: assertion failure in Certificate List syntax validation CVE-2020-25709 - openldap: assertion failure in CSN normalization with invali...

Scientific Linux Security Update : cyrus-sasl on SL7.x i686/x86_64 (2022:0666)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2022:0666-1 advisory. - cyrus-sasl: failure to properly escape SQL input allows an attacker to execute arbitrary SQL commands CVE-2022-24407 Note that Nessus has not tested for...

Scientific Linux Security Update : python-pillow on SL7.x i686/x86_64 (2022:0609)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:0609-1 advisory. - python-pillow: PIL.ImageMath.eval allows evaluation of arbitrary expressions CVE-2022-22817 - python-pillow: buffer over-read during...

Scientific Linux Security Update : kernel on SL7.x x86_64 (2022:0620)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:0620-1 advisory. - kernel: use after free in eventpoll.c may lead to escalation of privilege CVE-2020-0466 - kernel: Use After Free in unixgc which could result i...

Scientific Linux Security Update : thunderbird on SL7.x x86_64 (2022:0538)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:0538-1 advisory. - Mozilla: Extensions could have bypassed permission confirmation during update CVE-2022-22754 - Mozilla: Memory safety bugs fixed in Firefox 97...

Scientific Linux Security Update : firefox on SL7.x i686/x86_64 (2022:0514)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:0514-1 advisory. - Mozilla: Extensions could have bypassed permission confirmation during update CVE-2022-22754 - Mozilla: Memory safety bugs fixed in Firefox 97...

Scientific Linux Security Update : aide on SL7.x x86_64 (2022:0473)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2022:0473-1 advisory. - aide: heap-based buffer overflow on outputs larger than B64BUF CVE-2021-45417 Note that Nessus has not tested for this issue but has instead relied only...

Friday Squid Blogging: Are Squid from Another Planet?

An actually serious scientific journal has published a paper speculating that octopus and squid could be of extraterrestrial origin. News article. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog posting guidelines here...

Scientific Linux Security Update : samba on SL7.x i686/x86_64 (2022:0328)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2022:0328-1 advisory. - samba: Out-of-bounds heap read/write vulnerability in VFS module vfsfruit allows code execution CVE-2021-44142 Note that Nessus has not tested for this...

Scientific Linux Security Update : java-1.8.0-openjdk on SL7.x i686/x86_64 (2022:0306)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:0306-1 advisory. - OpenJDK: Incomplete deserialization class filtering in ObjectInputStream Serialization, 8264934 CVE-2022-21248 - OpenJDK: Insufficient URI chec...

Scientific Linux Security Update : polkit on SL7.x i686/x86_64 (2022:0274)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2022:0274-1 advisory. - polkit: Local privilege escalation in pkexec due to incorrect handling of argument vector CVE-2021-4034 Note that Nessus has not tested for this issue b...

Scientific Linux Security Update : java-11-openjdk on SL7.x i686/x86_64 (2022:0204)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:0204-1 advisory. - OpenJDK: Incomplete deserialization class filtering in ObjectInputStream Serialization, 8264934 CVE-2022-21248 - OpenJDK: Incorrect reading of...

Scientific Linux Security Update : httpd on SL7.x x86_64 (2022:0143)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:0143-1 advisory. - httpd: modlua: Possible buffer overflow when parsing multipart content CVE-2021-44790 - httpd: modsession: Heap overflow via a crafted...

Scientific Linux Security Update : gegl on SL7.x i686/x86_64 (2022:0162)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2022:0162-1 advisory. - gegl: shell expansion via a crafted pathname CVE-2021-45463 Note that Nessus has not tested for this issue but has instead relied only on the...