Scientific Linux Security Update : zziplib on SL7.x x86_64 (20181030)

Security Fixes : - zziplib: out of bound read in mmapped.c:zzipdiskfread causes crash CVE-2018-7725 - zziplib: Bus error in zip.c:zzipparserootdirectory cause crash via crafted zip file CVE-2018-7726 - zziplib: Memory leak in memdisk.c:zzipmemdisknew can lead to denial of service via crafted zip...

Scientific Linux Security Update : libcdio on SL7.x x86_64 (20181030)

Security Fixes : - libcdio: Heap-based buffer over-read in printiso9660recurse function in iso-info.c CVE-2017-18198 - libcdio: NULL pointer dereference in reallocsymlink in rock.c CVE-2017-18199 - libcdio: Double free in getcdtextgeneric in lib/driver/cdiogeneric.c CVE-2017-18201 C Tenable Netwo...

Scientific Linux Security Update : python on SL7.x x86_64 (20181030)

Security Fixes : - python: DOS via regular expression backtracking in difflib.ISLINEJUNK method in difflib CVE-2018-1061 - python: DOS via regular expression catastrophic backtracking in apop method in pop3lib CVE-2018-1060 C Tenable Network Security, Inc. The descriptive text is C Scientific...

Scientific Linux Security Update : glibc on SL7.x x86_64 (20181030)

Security Fixes : - glibc: Incorrect handling of RPATH in elf/dl-load.c can be used to execute code loaded from arbitrary libraries CVE-2017-16997 - glibc: Integer overflow in posixmemalign in memalign functions CVE-2018-6485 - glibc: Integer overflow in stdlib/canonicalize.c on 32-bit architectur...

Scientific Linux Security Update : python-paramiko on SL7.x (noarch) (20181030)

Security Fixes : - python-paramiko: Authentication bypass in authhandler.py CVE-2018-1000805 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid119197; scriptversion"1.6"; scriptsetattributeattribute:"pluginmodificationdate",...

Scientific Linux Security Update : libkdcraw on SL7.x x86_64 (20181030)

LibRaw: Stack-based buffer overflow in quicktake100loadraw function in internal/dcrawcommon.cpp CVE-2018-5805 LibRaw: Heap-based buffer overflow in LibRaw::kodakycbcrloadraw function in internal/dcrawcommon.cpp CVE-2018-5800 LibRaw: NULL pointer dereference in LibRaw::unpack function...

Scientific Linux Security Update : xorg-x11-server on SL7.x x86_64 (20181031)

Security Fixes : - xorg-x11-server: Incorrect permission check in Xorg X server allows for privilege escalation CVE-2018-14665 The SL Team added a fix for upstream bug 1650634 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description...

Scientific Linux Security Update : samba on SL7.x x86_64 (20181030)

Security Fixes : - samba: Weak authentication protocol regression CVE-2018-1139 - samba: Insufficient input validation in libsmbclient CVE-2018-10858 - samba: NULL pointer dereference in printer server process CVE-2018-1050 C Tenable Network Security, Inc. The descriptive text is C Scientific...

Scientific Linux Security Update : binutils on SL7.x x86_64 (20181030)

Security Fixes : - binutils: Improper bounds check in coffgen.c:coffpointerizeaux allows for denial of service when parsing a crafted COFF file CVE-2018-7208 - binutils: integer overflow via an ELF file with corrupt dwarf1 debug information in libbfd library CVE-2018-7568 - binutils: integer...

Scientific Linux Security Update : zsh on SL7.x x86_64 (20181030)

Security Fixes : - zsh: Stack-based buffer overflow in genmatchesfiles at compctl.c CVE-2018-1083 - zsh: buffer overflow for very long fds in & fd syntax CVE-2014-10071 - zsh: buffer overflow when scanning very long directory paths for symbolic links CVE-2014-10072 - zsh: NULL dereference in cd i...

Scientific Linux Security Update : jasper on SL7.x x86_64 (20181030)

Security Fixes : - jasper: reachable assertion in JPCNOMINALGAIN CVE-2016-9396 - jasper: NULL pointer exception in jp2encode CVE-2017-1000050 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid119185; scriptversion"1.5";...

Scientific Linux Security Update : thunderbird on SL7.x x86_64 (20181109)

This update upgrades Thunderbird to version 60.3.0. Security Fixes : - Mozilla: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3 CVE-2018-12390 - Mozilla: Crash with nested event loops CVE-2018-12392 - Mozilla: Integer overflow during Unicode conversion while loading JavaScript...

Scientific Linux Security Update : ovmf on on SL7.x x86_64 (20181030)

Security Fixes : - openssl: Handling of crafted recursive ASN.1 structures can cause a stack overflow and resulting denial of service CVE-2018-0739 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid119195; scriptversion"1.5";...

Scientific Linux Security Update : openssl on SL7.x x86_64 (20181030)

Security Fixes : - openssl: ROHNP - Key Extraction Side Channel in Multiple Crypto Libraries CVE-2018-0495 - openssl: Malicious server can send large prime to client during DHE TLS handshake causing the client to hang CVE-2018-0732 - openssl: Handling of crafted recursive ASN.1 structures can cau...

Scientific Linux Security Update : gnutls on SL7.x x86_64 (20181030)

Security Fixes : - gnutls: HMAC-SHA-256 vulnerable to Lucky thirteen attack due to not enough dummy function calls CVE-2018-10844 - gnutls: HMAC-SHA-384 vulnerable to Lucky thirteen attack due to use of wrong constant CVE-2018-10845 - gnutls: 'Just in Time' PRIME + PROBE cache-based side channel...

Scientific Linux Security Update : java-1.7.0-openjdk on SL7.x x86_64 (20181030)

Security Fixes : - OpenJDK: Improper field access checks Hotspot, 8199226 CVE-2018-3169 - OpenJDK: Incomplete enforcement of the trustURLCodebase restriction JNDI, 8199177 CVE-2018-3149 - OpenJDK: Incorrect handling of unsigned attributes in signed Jar manifests Security, 8194534 CVE-2018-3136 -...

Scientific Linux Security Update : wget on SL7.x x86_64 (20181030)

Security Fixes : - wget: Cookie injection allows malicious website to write arbitrary cookie entries into cookie jar CVE-2018-0494 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid119201; scriptversion"1.5";...

Scientific Linux Security Update : java-11-openjdk on SL7.x x86_64 (20181107)

Security Fixes : - OpenJDK: Improper field access checks Hotspot, 8199226 CVE-2018-3169 - OpenJDK: Unrestricted access to scripting engine Scripting, 8202936 CVE-2018-3183 - OpenJDK: Incomplete enforcement of the trustURLCodebase restriction JNDI, 8199177 CVE-2018-3149 - OpenJDK: Incorrect handli...

Scientific Linux Security Update : 389-ds-base on SL7.x x86_64 (20181030)

Security Fixes : - 389-ds-base: Mishandled search requests in servers/slapd/search.c:dosearch allows for denial of service CVE-2018-14648 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid119176; scriptversion"1.6";...

Scientific Linux Security Update : git on SL7.x x86_64 (20181031)

Security Fixes : - git: arbitrary code execution via .gitmodules CVE-2018-17456 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid119206; scriptversion"1.6"; scriptsetattributeattribute:"pluginmodificationdate",...