Scientific Linux Security Update : freerdp on SL7.x x86_64 (20200609)

Security Fixes : - freerdp: Out-of-bounds write in cryptorsacommon in libfreerdp/crypto/crypto.c CVE-2020-13398 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid137293; scriptversion"1.4";...

Scientific Linux Security Update : unbound on SL7.x x86_64 (20200609)

Security Fixes : - unbound: amplification of an incoming query into a large number of queries directed to a target CVE-2020-12662 - unbound: infinite loop via malformed DNS answers received from upstream servers CVE-2020-12663 C Tenable Network Security, Inc. The descriptive text is C Scientific...

Scientific Linux Security Update : freerdp on SL6.x i386/x86_64 (20200609)

Security Fixes : - freerdp: Out-of-bounds write in cryptorsacommon in libfreerdp/crypto/crypto.c CVE-2020-13398 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid137292; scriptversion"1.4";...

Scientific Linux Security Update : firefox on SL7.x x86_64 (20200603)

Security Fixes : - Mozilla: Use-after-free in SharedWorkerService CVE-2020-12405 - Mozilla: JavaScript Type confusion with NativeTypes CVE-2020-12406 - Mozilla: Memory safety bugs fixed in Firefox 77 and Firefox ESR 68.9 CVE-2020-12410 C Tenable Network Security, Inc. The descriptive text is C...

Scientific Linux Security Update : firefox on SL6.x i386/x86_64 (20200603)

Security Fixes : - Mozilla: Use-after-free in SharedWorkerService CVE-2020-12405 - Mozilla: JavaScript Type confusion with NativeTypes CVE-2020-12406 - Mozilla: Memory safety bugs fixed in Firefox 77 and Firefox ESR 68.9 CVE-2020-12410 C Tenable Network Security, Inc. The descriptive text is C...

Scientific Linux Security Update : bind on SL6.x i386/x86_64 (20200603)

Security Fixes : - bind: BIND does not sufficiently limit the number of fetches performed when processing referrals CVE-2020-8616 - bind: A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c CVE-2020-8617 C Tenable Network Security, Inc. The...

Scientific Linux Security Update : freerdp on SL7.x x86_64 (20200528)

Security Fixes : - freerdp: Out-of-bounds write in planar.c CVE-2020-11521 - freerdp: Integer overflow in region.c CVE-2020-11523 - freerdp: Out-of-bounds write in interleaved.c CVE-2020-11524 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if...

Scientific Linux Security Update : python-pip on SL7.x (noarch) (20200512)

Security Fixes : - python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure CVE-2018-20060 - python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service CVE-2019-11236 - python-urllib3:...

Scientific Linux Security Update : bind on SL7.x x86_64 (20200601)

Security Fixes : - bind: BIND does not sufficiently limit the number of fetches performed when processing referrals CVE-2020-8616 - bind: A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c CVE-2020-8617 C Tenable Network Security, Inc. The...

Scientific Linux Security Update : python-virtualenv on SL7.x (noarch) (20200512)

Security Fixes : - python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure CVE-2018-20060 - python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service CVE-2019-11236 - python-requests: Redire...

Scientific Linux Security Update : git on SL7.x x86_64 (20200529)

Security Fixes : - git: Crafted URL containing new lines, empty host or lacks a scheme can cause credential leak CVE-2020-11008 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid136991; scriptversion"1.3";...

Scientific Linux Security Update : kernel on SL7.x x86_64 (20200512)

Security Fixes : - kernel: double free may be caused by the function allocatetracebuffer in the file kernel/trace/trace.c CVE-2017-18595 - kernel: use-after-free in blkaddtrace in kernel/trace/blktrace.c CVE-2019-19768 - Kernel: NetLabel: NULL pointer dereference while receiving CIPSO packet with...

Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20200512)

Security Fixes : - Kernel: NetLabel: NULL pointer dereference while receiving CIPSO packet with null category may cause kernel panic CVE-2020-10711 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include"compat.inc"; if description scriptid136603; scriptversion"1.4";...

Scientific Linux Security Update : thunderbird on SL7.x x86_64 (20200511)

Security Fixes : - Mozilla: Use-after-free during worker shutdown CVE-2020-12387 - Mozilla: Memory safety bugs fixed in Firefox 76 and Firefox ESR 68.8 CVE-2020-12395 - usrsctp: Buffer overflow in AUTH chunk input validation CVE-2020-6831 - Mozilla: Arbitrary local file access with 'Copy as cURL'...

Scientific Linux Security Update : thunderbird on SL6.x i386/x86_64 (20200511)

Security Fixes : - Mozilla: Use-after-free during worker shutdown CVE-2020-12387 - Mozilla: Memory safety bugs fixed in Firefox 76 and Firefox ESR 68.8 CVE-2020-12395 - usrsctp: Buffer overflow in AUTH chunk input validation CVE-2020-6831 - Mozilla: Arbitrary local file access with 'Copy as cURL'...

Scientific Linux Security Update : squid on SL7.x x86_64 (20200506)

Security Fixes : - squid: improper check for new member in ESIExpression::Evaluate allows for stack-based buffer overflow CVE-2019-12519 - squid: improper access restriction upon Digest Authentication nonce replay could lead to remote code execution CVE-2020-11945 - squid: parsing of header...

Scientific Linux Security Update : firefox on SL6.x i386/x86_64 (20200506)

Security Fixes : - Mozilla: Use-after-free during worker shutdown CVE-2020-12387 - Mozilla: Memory safety bugs fixed in Firefox 76 and Firefox ESR 68.8 CVE-2020-12395 - Mozilla: Buffer overflow in SCTP chunk input validation CVE-2020-6831 - Mozilla: Arbitrary local file access with 'Copy as cURL'...

Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20200422) (Stack Clash)

Security Fixes : - kernel: rtlp2pnoaie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel lacks a certain upper-bound check, leading to a buffer overflow CVE-2019-17666 - kernel: offset2lib allows for the stack guard page to be jumped over CVE-2017-1000371 C Tenable Network Security...

Scientific Linux Security Update : python-twisted-web on SL7.x x86_64 (20200423)

Security Fixes : - python-twisted: HTTP request smuggling when presented with two Content-Length headers CVE-2020-10108 - python-twisted: HTTP request smuggling when presented with a Content-Length and a chunked Transfer-Encoding header CVE-2020-10109 C Tenable Network Security, Inc. The...

Scientific Linux Security Update : git on SL7.x x86_64 (20200421)

Security Fixes : - git: Crafted URL containing new lines can cause credential leak CVE-2020-5260 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include"compat.inc"; if description scriptid135886; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate...