Scientific Linux Security Update : qemu-kvm on SL6.x i386/x86_64 (20190924)

Security Fixes : - QEMU: slirp: heap buffer overflow while reassembling fragmented datagrams CVE-2018-11806 - QEMU: slirp: heap buffer overflow in tcpemu CVE-2019-6778 - QEMU: ne2000: integer overflow leads to buffer overflow issue CVE-2018-10839 - QEMU: pcnet: integer overflow leads to buffer...

Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20190923)

Security Fixes : - A buffer overflow flaw was found in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs, logged the buffer descriptors during migration. A privileged guest user able to pass descriptors with invalid length to the host when migration is underway,...

Scientific Linux Security Update : dovecot on SL6.x i386/x86_64 (20190923)

dovecot: improper NULL byte handling in IMAP and ManageSieve protocol parsers leads to out of bounds writes CVE-2019-11500 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid129277; scriptversion"1.4";...

Scientific Linux Security Update : dovecot on SL7.x x86_64 (20190920)

Security Fixes : - dovecot: improper NULL byte handling in IMAP and ManageSieve protocol parsers leads to out of bounds writes CVE-2019-11500 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE pages list...

Scientific Linux Security Update : kernel on SL7.x x86_64 (20190920)

Security Fixes : - A buffer overflow flaw was found in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs, logged the buffer descriptors during migration. A privileged guest user able to pass descriptors with invalid length to the host when migration is underway,...

Scientific Linux Security Update : thunderbird on SL6.x i386/x86_64 (20190919)

This update upgrades Thunderbird to version 60.9.0. Security Fixes : - Mozilla: Covert Content Attack on S/MIME encryption using a crafted multipart/alternative message CVE-2019-11739 - Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 CVE-2019-11740 - Mozill...

Scientific Linux Security Update : thunderbird on SL7.x x86_64 (20190918)

This update upgrades Thunderbird to version 60.9.0. Security Fixes : - Mozilla: Covert Content Attack on S/MIME encryption using a crafted multipart/alternative message CVE-2019-11739 - Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 CVE-2019-11740 - Mozill...

Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20190912)

Security Fixes : - kernel: Memory corruption due to incorrect socket cloning CVE-2018-9568 - kernel: a NULL pointer dereference in drivers/scsi/megaraid/megaraidsasbase.c leading to DoS CVE-2019-11810 For more details about the security issues, including the impact, a CVSS score, acknowledgments,...

Scientific Linux Security Update : firefox on SL7.x x86_64 (20190911)

Security Fixes : - Mozilla: Sandbox escape through Firefox Sync CVE-2019-9812 - Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 CVE-2019-11740 - Mozilla: Same-origin policy violation with SVG filters and canvas to steal cross-origin images CVE-2019-11742 -...

Scientific Linux Security Update : firefox on SL6.x i386/x86_64 (20190910)

This update upgrades Firefox to version 60.9.0 ESR. Security Fixes: - Mozilla: Sandbox escape through Firefox Sync CVE-2019-9812 - Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 CVE-2019-11740 - Mozilla: Same-origin policy violation with SVG filters and...

Scientific Linux Security Update : kernel on SL7.x x86_64 (20190903)

Security Fixes: - kernel: hw: Spectre SWAPGS gadget vulnerability CVE-2019-1125 - kernel: brcmfmac heap buffer overflow in brcmfwowlndresults CVE-2019-9500 Bug Fixes: - mlx4 VXLAN over VLAN TCP segmentation - Race condition in /dev/sg due to missing synchronization causes corruption in RHV - pani...

Scientific Linux Security Update : ghostscript on SL7.x x86_64 (20190903)

Security Fixes: - ghostscript: Safer mode bypass by .forceput exposure in .pdfhookDSCCreator 701445 CVE-2019-14811 - ghostscript: Safer mode bypass by .forceput exposure in setuserparams 701444 CVE-2019-14812 - ghostscript: Safer mode bypass by .forceput exposure in setsystemparams 701443...

Scientific Linux Security Update : qemu-kvm on SL7.x x86_64 (20190903)

Security Fixes: - QEMU: qxl: NULL pointer dereference while releasing spice resources CVE-2019-12155 -- C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128502; scriptversion"1.4";...

Scientific Linux Security Update : kdelibs and kde-settings on SL7.x x86_64 (20190903)

kdelibs: malicious desktop files and configuration files lead to code execution with minimal user interaction CVE-2019-14744 Bug Fixes: - kde.csh profile file contains bourne-shell code -- C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if...

Scientific Linux Security Update : pango on SL7.x x86_64 (20190828)

Security Fixes : - pango: pangolog2visgetembeddinglevels heap-based buffer overflow CVE-2019-1010238 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128311; scriptversion"1.4";...

Scientific Linux Security Update : python-requests on SL7.x x86_64 (20190806)

Security Fixes : - python-requests: Redirect from HTTPS to HTTP does not remove Authorization header CVE-2018-18074 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128255; scriptversion"1.5";...

Scientific Linux Security Update : advancecomp on SL7.x x86_64 (20190806)

Security Fixes : - advancecomp: NULL pointer dereference in function beuint32read in endianrw.h CVE-2019-8379 - advancecomp: denial of service in function advpngunfilter8 in lib/png.c CVE-2019-8383 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; i...

Scientific Linux Security Update : ntp on SL7.x x86_64 (20190806)

Security Fixes : - ntp: Stack-based buffer overflow in ntpq and ntpdc allows denial of service or code execution CVE-2018-12327 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128244; scriptversion"1.4";...

Scientific Linux Security Update : tomcat on SL7.x x86_64 (20190806)

Security Fixes : - tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources CVE-2018-1304 - tomcat: Late application of security constraints can lead to resource exposure for unauthorised users CVE-2018-1305 - tomcat: Insecure defaults in...

Scientific Linux Security Update : libreoffice on SL7.x x86_64 (20190806)

Security Fixes : - libreoffice: Arbitrary python functions in arbitrary modules on the filesystem can be executed without warning CVE-2018-16858 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128233; scriptversion"1.4";...