Scientific Linux Security Update : seamonkey on SL3.x, SL4.x i386/x86_64

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey. CVE-2009-1392, CVE-2009-1833, CVE-2009-1838, CVE-2009-1841 A flaw was found in the...

Scientific Linux Security Update : krb5 on SL5.x, SL4.x, SL3.x i386/x86_64

David Coffey discovered an uninitialized pointer free flaw in the RPC library used by kadmind. On Scientific Linux 4 and 5, glibc detects attempts to free invalid pointers. A remote unauthenticated attacker who can access kadmind could trigger this flaw and cause kadmind to crash. CVE-2007-2442...

Scientific Linux Security Update : cups on SL3.x, SL4.x, SL5.x i386/x86_64

SL 3 and SL 4 only A flaw was found in the way CUPS handled the addition and removal of remote shared printers via IPP. A remote attacker could send malicious UDP IPP packets causing the CUPS daemon to attempt to dereference already freed memory and crash. CVE-2008-0597 A memory management flaw w...

Scientific Linux Security Update : ghostscript on SL3.x, SL4.x, SL5.x i386/x86_64

Multiple integer overflow flaws which could lead to heap-based buffer overflows, as well as multiple insufficient input validation flaws, were found in Ghostscript's International Color Consortium Format library icclib. Using specially crafted ICC profiles, an attacker could create a malicious...

Scientific Linux Security Update : evolution on SL4.x, SL3.x i386/x86_64

A flaw was found in the way Evolution processed certain APOP authentication requests. A remote attacker could potentially acquire certain portions of a user's authentication credentials by sending certain responses when evolution-data-server attempted to authenticate against an APOP server...

Scientific Linux Security Update : perl on SL3.x, SL4.x, SL5.x i386/x86_64

A flaw was found in Perl's regular expression engine. A specially crafted regular expression with Unicode characters could trigger a buffer overflow, causing Perl to crash, or possibly execute arbitrary code with the privileges of the user running Perl. CVE-2008-1927 %NASLMINLEVEL 70300 C Tenable...

Scientific Linux Security Update : seamonkey on SL3.x, SL4.x i386/x86_64

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey. CVE-2009-1303, CVE-2009-1305 Several flaws were found in the way malformed web content...

Scientific Linux Security Update : cups on SL3.x i386/x86_64

An integer overflow flaw, leading to a heap-based buffer overflow, was discovered in the Tagged Image File Format TIFF decoding routines used by the CUPS image-converting filters, 'imagetops' and 'imagetoraster'. An attacker could create a malicious TIFF file that could, potentially, execute...

Scientific Linux Security Update : seamonkey on SL3.x, SL4.x i386/x86_64

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey. CVE-2008-0016, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-40...

Scientific Linux Security Update : cpio on SL3.x, SL4.x, SL5.x i386/x86_64

CVE-2005-4268 cpio large filesize buffer overflow CVE-2007-4476 tar/cpio stack crashing in safernamesuffix CVE-2010-0624 tar, cpio: Heap-based buffer overflow by expanding a specially crafted archive A heap-based buffer overflow flaw was found in the way cpio expanded archive files. If a user wer...

Scientific Linux Security Update : seamonkey on SL3.x, SL4.x i386/x86_64

A flaw was found in the way that SeaMonkey parsed malformed HTML mail messages. If a user opened a specially crafted HTML mail message, it could cause SeaMonkey to crash or, possibly, to execute arbitrary code as the user running SeaMonkey. CVE-2009-2210 After installing the update, SeaMonkey mus...

Scientific Linux Security Update : openafs on SL3.x, SL4.x, SL5.x i386/x86_64

An attacker with control of a fileserver, or the ability to forge RX packets, can crash the cache manager, and hence the kernel, of affected Linux AFS clients. CVE-2009-1250 An attacker with control of a fileserver, or the ability to forge RX packets, can crash the cache manager, and hence the...

Scientific Linux Security Update : gimp on SL5.x, SL4.x, SL3.x i386/x86_64

Multiple integer overflow and input validation flaws were found in The GIMP's image loaders. An attacker could create a carefully crafted image file that could cause The GIMP to crash or possibly execute arbitrary code if the file was opened by a victim. CVE-2006-4519, CVE-2007-2949, CVE-2007-374...

Scientific Linux Security Update : tzdata on SL3.x, SL4.x, SL5.x i386/x86_64

This updated package addresses the following change to Daylight Saving Time DST observations : - during Ramadan, that is, during the period between 2010-08-11 and 2010-09-08, Egypt will suspend DST. The DST period will be officially restored on 2010-09-09. BZ618593, BZ618597, BZ618599 %NASLMINLEV...

Scientific Linux Security Update : nss_ldap on SL3.x i386/x86_64

When the nssldap plug-in attempted to format the list of a group's members for an application, it did not correctly detect when the space provided to store that list was insufficient. For large groups, this resulted in a corrupt heap, which typically resulted in the calling application crashing, ...

Scientific Linux Security Update : XFree86 on SL3.x i386/x86_64

An input validation flaw was discovered in X.org's Security and Record extensions. A malicious authorized client could exploit this issue to cause a denial of service crash or, potentially, execute arbitrary code with root privileges on the X.Org server. CVE-2008-1377 Multiple integer overflow...

Scientific Linux Security Update : bind on SL3.x, SL4.x, SL5.x i386/x86_64

A flaw was discovered in the way BIND checked the return value of the OpenSSL DSAdoverify function. On systems using DNSSEC, a malicious zone could present a malformed DSA certificate and bypass proper certificate validation, allowing spoofing attacks. CVE-2009-0025 For users of Red Hat Enterpris...

Scientific Linux Security Update : seamonkey on SL3.x i386/x86_64

CVE-2009-2404 nss regexp heap overflow Moxie Marlinspike reported a heap overflow flaw in a regular expression parser in the NSS library provided by SeaMonkey used to match common names in certificates. A malicious website could present a carefully-crafted certificate in such a way as to trigger...

Scientific Linux Security Update : squid on SL3.x, SL4.x, SL5.x i386/x86_64

A flaw was found in the way squid manipulated HTTP headers for cached objects stored in system memory. An attacker could use this flaw to cause a squid child process to exit. This interrupted existing connections and made proxy services unavailable. Note: the parent squid process started a new...

Scientific Linux Security Update : seamonkey on SL3.x, SL4.x i386/x86_64

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey. CVE-2009-0040, CVE-2009-0772, CVE-2009-0774, CVE-2009-0775 A flaw was found in the way...