Scientific Linux Security Update : thunderbird on SL4.x, SL5.x i386/x86_64

Several flaws were found in the processing of some malformed HTML mail content. An HTML mail message containing such malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. CVE-2008-1233, CVE-2008-1235, CVE-2008-1236, CVE-2008-12...

Scientific Linux Security Update : boost on SL5.x i386/x86_64 (20120221)

The boost packages provide free, peer-reviewed, portable C++ source libraries with emphasis on libraries which work well with the C++ Standard Library. Invalid pointer dereference flaws were found in the way the Boost regular expression library processed certain, invalid expressions. An attacker...

Scientific Linux Security Update : subversion on SL5.x i386/x86_64

A NULL pointer dereference flaw was found in the way the moddavsvn module processed certain requests to lock working copy paths in a repository. A remote attacker could issue a lock request that could cause the httpd process serving the request to crash. CVE-2011-0715 This update also fixes the...

Scientific Linux Security Update : poppler on SL5.x i386/x86_64

CVE-2009-3608 xpdf/poppler: integer overflow in ObjectStream::ObjectStream oCERT-2009-016 CVE-2009-3609 xpdf/poppler: ImageStream::ImageStream integer overflow CVE-2009-3603 xpdf/poppler: SplashBitmap::SplashBitmap integer overflow Multiple integer overflow flaws were found in poppler. An attacke...

Scientific Linux Security Update : httpd on SL5.x, SL4.x i386/x86_64

The Apache HTTP Server did not verify that a process was an Apache child process before sending it signals. A local attacker with the ability to run scripts on the Apache HTTP Server could manipulate the scoreboard and cause arbitrary processes to be terminated which could lead to a denial of...

Scientific Linux Security Update : icu on SL5.x i386/x86_64

Will Drewry reported multiple flaws in the way libicu processed certain malformed regular expressions. If an application linked against ICU, such as OpenOffice.org, processed a carefully crafted regular expression, it may be possible to execute arbitrary code as the user running the application...

Scientific Linux Security Update : flac on SL5.x, SL4.x i386/x86_64

A security flaw was found in the way flac processed audio data. An attacker could create a carefully crafted FLAC audio file in such a way that it could cause an application linked with flac libraries to crash or execute arbitrary code when it was opened. CVE-2007-4619 This update actually went o...

Scientific Linux Security Update : gstreamer-plugins-base on SL5.x i386/x86_64

An integer overflow flaw which caused a heap-based buffer overflow was discovered in the Vorbis comment tags reader. An attacker could create a carefully-crafted Vorbis file that would cause an application using GStreamer to crash or, potentially, execute arbitrary code if opened by a victim...

Scientific Linux Security Update : openssl on SL5.x i386/x86_64

CVE-2009-2409 deprecate MD2 in SSL cert validation Kaminsky CVE-2009-4355 openssl significant memory leak in certain SSLv3 requests DoS It was found that the OpenSSL library did not properly re-initialize its internal state in the SSLlibraryinit function after previous calls to the...

Scientific Linux Security Update : pcre on SL5.x i386/x86_64

This importance of this has been reduced to 'Important' We have renumbered the release for SL5 so that it doesn't conflict with the previous pcre security update. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'deprecatednasllevel.inc';...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64 (20120529)

The kernel packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issue : - It was found that the datalen parameter of the sockallocsendpskb function in the Linux kernel's networking implementation was not validated before use. A local...

Scientific Linux Security Update : mysql on SL5.x i386/x86_64

CVE-2009-4019 mysql: DoS crash when comparing GIS items from subquery and when handling subqueires in WHERE and assigning a SELECT result to a @variable CVE-2009-4028 mysql: client SSL certificate verification flaw CVE-2009-4030 mysql: Incomplete fix for CVE-2008-2079 / CVE-2008-4098 It was...

Scientific Linux Security Update : lcms on SL5.x i386/x86_64

Multiple insufficient input validation flaws were discovered in LittleCMS. An attacker could use these flaws to create a specially crafted image file which could cause an application using LittleCMS to crash, or, possibly, execute arbitrary code when opened. CVE-2008-5316, CVE-2008-5317...

Scientific Linux Security Update : libxml2 on SL3.x, SL4.x, SL5.x i386/x86_64

An integer overflow flaw causing a heap-based buffer overflow was found in the libxml2 XML parser. If an application linked against libxml2 processed untrusted, malformed XML content, it could cause the application to crash or, possibly, execute arbitrary code. CVE-2008-4226 A denial of service...

Scientific Linux Security Update : cups on SL3.x, SL4.x, SL5.x i386/x86_64

SL 3 and SL 4 only A flaw was found in the way CUPS handled the addition and removal of remote shared printers via IPP. A remote attacker could send malicious UDP IPP packets causing the CUPS daemon to attempt to dereference already freed memory and crash. CVE-2008-0597 A memory management flaw w...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64

These updated packages fix the following security issues : - A security flaw was found in the Linux kernel memory copy routines, when running on certain AMD64 systems. If an unsuccessful attempt to copy kernel memory from source to destination memory locations occurred, the copy routines did not...

Scientific Linux Security Update : gnutls on SL4.x, SL5.x i386/x86_64

CVE-2009-2730 gnutls: incorrect verification of SSL certificate with NUL in name GNUTLS-SA-2009-4 A flaw was discovered in the way GnuTLS handles NULL characters in certain fields of X.509 certificates. If an attacker is able to get a carefully-crafted certificate signed by a Certificate Authorit...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64

These new kernel packages contain fixes for the following security issues : - a flaw in the handling of IPv6 type 0 routing headers that allowed remote users to cause a denial of service that led to a network amplification between two routers CVE-2007-2242, Important. - a flaw in the nfnetlinklog...

Scientific Linux Security Update : tzdata on SL3.x, SL4.x, SL5.x i386/x86_64

The tzdata package contains data files with rules for various time zones around the world. This updated tzdata package addresses the following changes to Daylight Savings Time DST observations : - Cuba is starting DST on March 16 as of 2008 it started DST on March 8 in 2007. - Syria is starting D...

Scientific Linux Security Update : kdebase on SL4.x, SL5.x i386/x86_64

A privilege escalation flaw was found in the KDE Display Manager KDM. A local user with console access could trigger a race condition, possibly resulting in the permissions of an arbitrary file being set to world-writable, allowing privilege escalation. CVE-2010-0436 The system should be rebooted...