Scientific Linux Security Update : advancecomp on SL7.x x86_64 (20190806)

Security Fixes : - advancecomp: NULL pointer dereference in function beuint32read in endianrw.h CVE-2019-8379 - advancecomp: denial of service in function advpngunfilter8 in lib/png.c CVE-2019-8383 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; i...

Scientific Linux Security Update : python-requests on SL7.x x86_64 (20190806)

Security Fixes : - python-requests: Redirect from HTTPS to HTTP does not remove Authorization header CVE-2018-18074 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128255; scriptversion"1.5";...

Scientific Linux Security Update : opensc on SL7.x x86_64 (20190806)

The following packages have been upgraded to a later upstream version: opensc 0.19.0. Security Fixes : - opensc: Buffer overflows handling responses from Muscle Cards in card- muscle.c:musclelistfiles CVE-2018-16391 - opensc: Buffer overflows handling responses from TCOS Cards in card-...

Scientific Linux Security Update : libreoffice on SL7.x x86_64 (20190806)

Security Fixes : - libreoffice: Arbitrary python functions in arbitrary modules on the filesystem can be executed without warning CVE-2018-16858 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128233; scriptversion"1.4";...

Scientific Linux Security Update : linux-firmware on SL7.x x86_64 (20190806)

Security Fixes : - kernel: Bluetooth implementations may not sufficiently validate elliptic curve parameters during Diffie-Hellman key exchange CVE-2018-5383 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128239;...

Scientific Linux Security Update : tomcat on SL7.x x86_64 (20190806)

Security Fixes : - tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources CVE-2018-1304 - tomcat: Late application of security constraints can lead to resource exposure for unauthorised users CVE-2018-1305 - tomcat: Insecure defaults in...

Scientific Linux Security Update : perl-Archive-Tar on SL7.x x86_64 (20190806)

Security Fixes : - perl: Directory traversal in Archive::Tar CVE-2018-12015 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128250; scriptversion"1.4"; scriptsetattributeattribute:"pluginmodificationdate", value:"2024/05/01"...

Scientific Linux Security Update : python-urllib3 on SL7.x x86_64 (20190806)

Security Fixes : - python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure CVE-2018-20060 - python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service CVE-2019-11236 C Tenable Network Securit...

Scientific Linux Security Update : glibc on SL7.x x86_64 (20190806)

Security Fixes : - glibc: getaddrinfo should reject IP addresses with trailing characters CVE-2016-10739 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128220; scriptversion"1.4";...

Scientific Linux Security Update : ntp on SL7.x x86_64 (20190806)

Security Fixes : - ntp: Stack-based buffer overflow in ntpq and ntpdc allows denial of service or code execution CVE-2018-12327 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128244; scriptversion"1.4";...

Scientific Linux Security Update : mod_auth_openidc on SL7.x x86_64 (20190806)

Security Fixes : - modauthopenidc: OIDCCLAIM and OIDCAuthNHeader not skipped in an 'AuthType oauth20' configuration CVE-2017-6413 - modauthopenidc: Shows user-supplied content on error pages CVE-2017-6059 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

Scientific Linux Security Update : kernel on SL7.x x86_64 (20190806)

Security Fixes : - Kernel: vhostnet: infinite loop while receiving packets leads to DoS CVE-2019-3900 - Kernel: page cache side channel attacks CVE-2019-5489 - kernel: Buffer overflow in hidpprocessreport CVE-2018-9363 - kernel: l2tp: Race condition between pppol2tpsessioncreate and l2tpethcreate...

Scientific Linux Security Update : spice-gtk on SL7.x x86_64 (20190806)

The libgovirt packages contain a library that allows applications to use the oVirt Representational State Transfer REST API to list virtual machines VMs managed by an oVirt instance. The library is also used to get the connection parameters needed to establish a connection to the VMs using Simple...

Scientific Linux Security Update : freerdp and vinagre on SL7.x x86_64 (20190806)

The vinagre packages provide the Vinagre remote desktop viewer for the GNOME desktop. The following packages have been upgraded to a later upstream version: freerdp 2.0.0. Security Fixes : - freerdp: out of bounds read in drdynvcprocesscapabilityrequest CVE-2018-1000852 C Tenable Network Security...

Scientific Linux Security Update : binutils on SL7.x x86_64 (20190806)

Security Fixes : - binutils: integer overflow leads to heap-based buffer overflow in objdump CVE-2018-1000876 - binutils: Stack Exhaustion in the demangling functions provided by libiberty CVE-2018-12641 - binutils: NULL pointer dereference in workstuffcopytofrom in cplus- dem.c. CVE-2018-12697 C...

Scientific Linux Security Update : http-parser on SL7.x x86_64 (20190806)

Security Fixes : - nodejs: Denial of Service with large HTTP headers CVE-2018-12121 - nodejs: HTTP parser allowed for spaces inside Content-Length header values CVE-2018-7159 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include"compat.inc"; if description...

Scientific Linux Security Update : procps-ng on SL7.x x86_64 (20190806)

Security Fixes : - procps-ng, procps: Local privilege escalation in top CVE-2018-1122 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128253; scriptversion"1.6"; scriptsetattributeattribute:"pluginmodificationdate",...

Scientific Linux Security Update : ghostscript on SL7.x x86_64 (20190806)

The following packages have been upgraded to a later upstream version: ghostscript 9.25. Security Fixes : - ghostscript: status command permitted with -dSAFER in psi/zfile.c allowing attackers to identify the size and existence of files CVE-2018-11645 C Tenable Network Security, Inc. The...

Scientific Linux Security Update : libmspack on SL7.x x86_64 (20190806)

Security Fixes : - libmspack: Out-of-bounds write in mspack/cab.h CVE-2018-18584 - libmspack: chmdreadheaders fails to reject filenames containing NULL bytes CVE-2018-18585 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description...

Scientific Linux Security Update : zziplib on SL7.x x86_64 (20190806)

Security Fixes : - zziplib: Bus error caused by loading of a misaligned address inzzip/zip.c CVE-2018-6541 - zziplib: Memory leak triggered in the function zzipparserootdirectory in zip.c CVE-2018-16548 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...