Scientific Linux Security Update : java-11-openjdk on SL7.x x86_64 (20201022)

Security Fixes : - OpenJDK: Credentials sent over unencrypted LDAP connection JNDI, 8237990 CVE-2020-14781 - OpenJDK: Certificate blacklist bypass via alternate certificate encodings Libraries, 8237995 CVE-2020-14782 - OpenJDK: Integer overflow leading to out-of-bounds access Hotspot, 8241114...

Scientific Linux Security Update : firefox on SL7.x x86_64 (20201022)

Security Fixes : - Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4 CVE-2020-15683 - chromium-browser: Use after free in WebRTC CVE-2020-15969 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid141838;...

Scientific Linux Security Update : libtiff on SL7.x x86_64 (20201001)

Security Fixes : - libtiff: integer overflow in TIFFCheckMalloc and TIFFCheckRealloc in tifaux.c CVE-2019-14973 - libtiff: integer overflow leading to heap-based buffer overflow in tifgetimage.c CVE-2019-17546 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

Scientific Linux Security Update : mod_auth_openidc on SL7.x x86_64 (20201001)

Security Fixes : - modauthopenidc: Open redirect in logout url when using URLs with leading slashes CVE-2019-14857 - modauthopenidc: Open redirect issue exists in URLs with slash and backslash CVE-2019-20479 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

Scientific Linux Security Update : pcp on SL7.x x86_64 (20201001)

Security Fixes : - pcp: Local privilege escalation in pcp spec file %post section CVE-2019-3695 - pcp: Local privilege escalation in pcp spec file through migratetempdirs CVE-2019-3696 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description...

Scientific Linux Security Update : libxslt on SL7.x x86_64 (20201001)

Security Fixes : - libxslt: xsltCheckRead and xsltCheckWrite routines security bypass by crafted URL CVE-2019-11068 - libxslt: use after free in xsltCopyText in transform.c could lead to information disclosure CVE-2019-18197 C Tenable Network Security, Inc. The descriptive text is C Scientific...

Scientific Linux Security Update : expat on SL7.x x86_64 (20201001)

Security Fixes : - expat: large number of colons in input makes parser consume high amount of resources, leading to DoS CVE-2018-20843 - expat: heap-based buffer over-read via crafted XML input CVE-2019-15903 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

Scientific Linux Security Update : libpng on SL7.x x86_64 (20201001)

Security Fixes : - libpng: does not check length of chunks against user limit CVE-2017-12652 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid141657; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

Scientific Linux Security Update : OpenEXR on SL7.x x86_64 (20201001)

Security Fixes : - OpenEXR: out-of-bounds read during Huffman uncompression CVE-2020-11761 - OpenEXR: std::vector out-of-bounds read and write in ImfTileOffsets.cpp CVE-2020-11763 - OpenEXR: out-of-bounds write in copyIntoFrameBuffer function in ImfMisc.cpp CVE-2020-11764 C Tenable Network...

Scientific Linux Security Update : python-pillow on SL7.x x86_64 (20201001)

Security Fixes : - python-pillow: out-of-bounds read in ImagingFliDecode when loading FLI images CVE-2020-5313 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid141709; scriptversion"1.3";...

Scientific Linux Security Update : ipa on SL7.x x86_64 (20201001)

Security Fixes : - js-jquery: Cross-site scripting via cross-domain ajax requests CVE-2015-9251 - bootstrap: XSS in the data-target attribute CVE-2016-10735 - bootstrap: Cross-site Scripting XSS in the collapse data-parent attribute CVE-2018-14040 - bootstrap: Cross-site Scripting XSS in the...

Scientific Linux Security Update : openldap on SL7.x x86_64 (20201001)

Security Fixes : - openldap: denial of service via nested boolean expressions in LDAP search filters CVE-2020-12243 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid141663; scriptversion"1.3";...

Scientific Linux Security Update : unoconv on SL7.x (noarch) (20201001)

Security Fixes : - unoconv: mishandling of pathname leads to SSRF and local file inclusion CVE-2019-17400 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid141680; scriptversion"1.3";...

Scientific Linux Security Update : libcroco on SL7.x x86_64 (20201001)

Security Fixes : - libcroco: Stack overflow in function crparserparseanycore in cr-parser.c CVE-2020-12825 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid141761; scriptversion"1.3";...

Scientific Linux Security Update : hunspell on SL7.x x86_64 (20201001)

Security Fixes : - hunspell: out-of-bounds read in SuggestMgr::leftcommonsubstring in suggestmgr.cxx CVE-2019-16707 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid141683; scriptversion"1.3";...

Scientific Linux Security Update : spamassassin on SL7.x x86_64 (20201001)

Security Fixes : - spamassassin: crafted email message can lead to DoS CVE-2019-12420 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid141762; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

Scientific Linux Security Update : python3 on SL7.x x86_64 (20201001)

Security Fixes : - python: XSS vulnerability in the documentation XML-RPC server in servertitle field CVE-2019-16935 - python: wrong backtracking in urllib.request.AbstractBasicAuthHandler allows for a ReDoS CVE-2020-8492 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

Scientific Linux Security Update : tigervnc on SL7.x x86_64 (20201001)

Security Fixes : - tigervnc: Stack use-after-return due to incorrect usage of stack memory in ZRLEDecoder CVE-2019-15691 - tigervnc: Heap buffer overflow triggered from CopyRectDecoder due to incorrect value checks CVE-2019-15692 - tigervnc: Heap buffer overflow in TightDecoder::FilterGradient...

Scientific Linux Security Update : kernel on SL7.x x86_64 (20201001)

Security Fixes : - kernel: use-after-free in sound/core/timer.c CVE-2019-19807 - kernel: out of bounds write in function i2csmbusxferemulated in drivers/i2c/i2c-core-smbus.c CVE-2017-18551 - kernel: race condition in smptasktimedout and smptaskdone in drivers/scsi/libsas/sasexpander.c leads to...

Scientific Linux Security Update : squid on SL7.x x86_64 (20201001)

Security Fixes : - squid: HTTP Request Smuggling could result in cache poisoning CVE-2020-15810 - squid: HTTP Request Splitting could result in cache poisoning CVE-2020-15811 - squid: Information Disclosure issue in FTP Gateway CVE-2019-12528 - squid: Improper input validation issues in HTTP...