Scientific Linux Security Update : libvncserver on SL7.x x86_64 (20200323)

Security Fixes : - libvncserver: HandleCursorShape integer overflow resulting in heap-based buffer overflow CVE-2019-15690 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid134847; scriptversion"1.4";...

Scientific Linux Security Update : thunderbird on SL7.x x86_64 (20200319)

Security Fixes : - Mozilla: Use-after-free when removing data about origins CVE-2020-6805 - Mozilla: BodyStream::OnInputStreamReady was missing protections against state confusion CVE-2020-6806 - Mozilla: Use-after-free in cubeb during stream destruction CVE-2020-6807 - Mozilla: Memory safety bug...

Scientific Linux Security Update : icu on SL6.x i386/x86_64 (20200318)

Security Fixes : - ICU: Integer overflow in UnicodeString::doAppend CVE-2020-10531 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid134692; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

Scientific Linux Security Update : python-imaging on SL6.x i386/x86_64 (20200318)

Security Fixes : - python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c CVE-2020-5312 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include"compat.inc"; if description scriptid134694; scriptversion"1.3";...

Scientific Linux Security Update : icu on SL7.x x86_64 (20200318)

Security Fixes : - ICU: Integer overflow in UnicodeString::doAppend CVE-2020-10531 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid134693; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

Scientific Linux Security Update : zsh on SL6.x i386/x86_64 (20200318)

Security Fixes : - zsh: insecure dropping of privileges when unsetting PRIVILEGED option CVE-2019-20044 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid134695; scriptversion"1.3";...

Scientific Linux Security Update : python-pip on SL7.x (noarch) (20200317)

Security Fixes : - python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure CVE-2018-20060 - python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service CVE-2019-11236 - python-urllib3:...

Scientific Linux Security Update : python-virtualenv on SL7.x (noarch) (20200317)

Security Fixes : - python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure CVE-2018-20060 - python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service CVE-2019-11236 - python-requests: Redire...

Scientific Linux Security Update : firefox on SL6.x i386/x86_64 (20200316)

This update upgrades Firefox to version 68.6.0 ESR. Security Fixes : - Mozilla: Use-after-free when removing data about origins CVE-2020-6805 - Mozilla: BodyStream::OnInputStreamReady was missing protections against state confusion CVE-2020-6806 - Mozilla: Use-after-free in cubeb during stream...

Scientific Linux Security Update : zsh on SL7.x x86_64 (20200317)

Security Fixes : - zsh: insecure dropping of privileges when unsetting PRIVILEGED option CVE-2019-20044 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid134652; scriptversion"1.3";...

Scientific Linux Security Update : tomcat on SL7.x (noarch) (20200317)

Security Fixes : - tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability CVE-2020-1938 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'deprecatednasllevel.inc'; include"compat.inc"; if description scriptid134651; scriptversion"1.8";...

Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20200311)

Security Fixes : - kernel: buffer overflow in cfg80211mgdwextgiwessid in net/wireless /wext-sme.c CVE-2019-17133 - kernel: unprivileged users able to create RAW sockets in AFISDN network protocol. CVE-2019-17055 Bug Fixes : - LACP bond does not function because bonding driver sees slave speed &...

Scientific Linux Security Update : qemu-kvm on SL6.x i386/x86_64 (20200310)

Security Fixes : - QEMU: slirp: heap buffer overflow during packet reassembly CVE-2019-14378 - QEMU: slirp: OOB buffer access while emulating tcp protocols in tcpemu CVE-2020-7039 - QEMU: Slirp: use-after-free during packet reassembly CVE-2019-15890 C Tenable Network Security, Inc. The descriptiv...

Scientific Linux Security Update : sudo on SL6.x i386/x86_64 (20200305)

Security Fixes : - sudo: Stack based buffer overflow when pwfeedback is enabled CVE-2019-18634 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid134346; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

Scientific Linux Security Update : xerces-c on SL7.x x86_64 (20200304)

Security Fixes : - xerces-c: XML parser contains a use-after-free error triggered during the scanning of external DTDs CVE-2018-1311 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid134275; scriptversion"1.3";...

Scientific Linux Security Update : http-parser on SL7.x x86_64 (20200304)

Security Fixes : - nodejs: HTTP request smuggling using malformed Transfer-Encoding header CVE-2019-15605 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid134273; scriptversion"1.3";...

Scientific Linux Security Update : xerces-c on SL6.x i386/x86_64 (20200304)

Security Fixes : - xerces-c: XML parser contains a use-after-free error triggered during the scanning of external DTDs CVE-2018-1311 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid134274; scriptversion"1.3";...

Scientific Linux Security Update : ppp on SL7.x x86_64 (20200227)

Security Fixes : - ppp: Buffer overflow in the eaprequest and eapresponse functions in eap.c CVE-2020-8597 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid134151; scriptversion"1.6";...

Scientific Linux Security Update : java-1.7.0-openjdk on SL6.x i386/x86_64 (20200227)

Security Fixes : - OpenJDK: Use of unsafe RSA-MD5 checksum in Kerberos TGS Security, 8229951 CVE-2020-2601 - OpenJDK: Serialization filter changes via jdk.serialFilter property modification Serialization, 8231422 CVE-2020-2604 - OpenJDK: Improper checks of SASL message properties in GssKrb5Base...

Scientific Linux Security Update : ppp on SL6.x i386/x86_64 (20200227)

Security Fixes : - ppp: Buffer overflow in the eaprequest and eapresponse functions in eap.c CVE-2020-8597 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid134150; scriptversion"1.6";...