Scientific Linux Security Update : kvm on SL5.x x86_64 (20151022)

A heap buffer overflow flaw was found in the way QEMU's NE2000 NIC emulation implementation handled certain packets received over the network. A privileged user inside a guest could use this flaw to crash the QEMU instance denial of service or potentially execute arbitrary code on the host...

Scientific Linux Security Update : openldap on SL5.x, SL6.x, SL7.x i386/x86_64 (20150929)

A flaw was found in the way the OpenLDAP server daemon slapd parsed certain Basic Encoding Rules BER data. A remote attacker could use this flaw to crash slapd via a specially crafted packet. CVE-2015-6908 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C Scientific...

Scientific Linux Security Update : firefox on SL5.x, SL6.x, SL7.x i386/x86_64 (20150922)

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. CVE-2015-4500, CVE-2015-4509, CVE-2015-4510 After installing the updat...

Scientific Linux Security Update : bind on SL5.x i386/x86_64 (20150903)

A denial of service flaw was found in the way BIND parsed certain malformed DNSSEC keys. A remote attacker could use this flaw to send a specially crafted DNS query for example, a query requiring a response from a zone containing a deliberately malformed key that would cause named functioning as ...

Scientific Linux Security Update : bind97 on SL5.x i386/x86_64 (20150903)

A denial of service flaw was found in the way BIND parsed certain malformed DNSSEC keys. A remote attacker could use this flaw to send a specially crafted DNS query for example, a query requiring a response from a zone containing a deliberately malformed key that would cause named functioning as ...

Scientific Linux Security Update : glibc on SL5.x i386/x86_64 (20150817)

An invalid free flaw was found in glibc's getaddrinfo function when used with the AIIDN flag. A remote attacker able to make an application call this function could use this flaw to execute arbitrary code with the permissions of the user running the application. Note that this flaw only affected...

Scientific Linux Security Update : mysql55-mysql on SL5.x i386/x86_64 (20150817)

This update fixes several vulnerabilities in the MySQL database server. CVE-2014-6568, CVE-2015-0374, CVE-2015-0381, CVE-2015-0382, CVE-2015-0391, CVE-2015-0411, CVE-2015-0432, CVE-2015-0433, CVE-2015-0441, CVE-2015-0499, CVE-2015-0501, CVE-2015-0505, CVE-2015-2568, CVE-2015-2571, CVE-2015-2573,...

Scientific Linux Security Update : bind on SL5.x i386/x86_64 (20150729)

A flaw was found in the way BIND handled requests for TKEY DNS resource records. A remote attacker could use this flaw to make named functioning as an authoritative DNS server or a DNS resolver exit unexpectedly with an assertion failure via a specially crafted DNS request packet. CVE-2015-5477...

Scientific Linux Security Update : bind97 on SL5.x i386/x86_64 (20150729)

A flaw was found in the way BIND handled requests for TKEY DNS resource records. A remote attacker could use this flaw to make named functioning as an authoritative DNS server or a DNS resolver exit unexpectedly with an assertion failure via a specially crafted DNS request packet. CVE-2015-5477...

Scientific Linux Security Update : openssl on SL5.x i386/x86_64 (20150630) (Logjam)

An out-of-bounds read flaw was found in the X509cmptime function of OpenSSL. A specially crafted X.509 certificate or a Certificate Revocation List CRL could possibly cause a TLS/SSL server or client using OpenSSL to crash. CVE-2015-1789 A NULL pointer dereference was found in the way OpenSSL...

Scientific Linux Security Update : firefox on SL5.x, SL6.x, SL7.x i386/x86_64 (20150703)

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. CVE-2015-2724, CVE-2015-2725, CVE-2015-2722, CVE-2015-2727,...

Scientific Linux Security Update : kvm on SL5.x x86_64 (20150513) (Venom)

An out-of-bounds memory access flaw was found in the way QEMU's virtual Floppy Disk Controller FDC handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileg...

Scientific Linux Security Update : kvm on SL5.x x86_64 (20150422)

It was found that KVM's Write to Model Specific Register WRMSR instruction emulation would write non-canonical values passed in by the guest to certain MSRs in the host's context. A privileged guest user could use this flaw to crash the host. CVE-2014-3610 A race condition flaw was found in the w...

Scientific Linux Security Update : firefox on SL5.x, SL6.x, SL7.x i386/x86_64 (20150225)

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. CVE-2015-0836, CVE-2015-0831, CVE-2015-0827 An information leak flaw w...

Scientific Linux Security Update : rpm on SL5.x, SL6.x i386/x86_64 (20141209)

It was found that RPM wrote file contents to the target installation directory under a temporary name, and verified its cryptographic signature only after the temporary file has been written completely. Under certain conditions, the system interprets the unverified temporary file contents and...

Scientific Linux Security Update : bind on SL5.x, SL6.x, SL7.x i386/x86_64 (20141212)

A denial of service flaw was found in the way BIND followed DNS delegations. A remote attacker could use a specially crafted zone containing a large number of referrals which, when looked up and processed, would cause named to use excessive amounts of memory or crash. CVE-2014-8500 After installi...

Scientific Linux Security Update : xorg-x11-server on SL5.x i386/x86_64 (20141211)

Multiple integer overflow flaws and out-of-bounds write flaws were found in the way the X.Org server calculated memory requirements for certain X11 core protocol and GLX extension requests. A malicious, authenticated client could use either of these flaws to crash the X.Org server or, potentially...

Scientific Linux Security Update : bind97 on SL5.x i386/x86_64 (20141212)

A denial of service flaw was found in the way BIND followed DNS delegations. A remote attacker could use a specially crafted zone containing a large number of referrals which, when looked up and processed, would cause named to use excessive amounts of memory or crash. CVE-2014-8500 After installi...

Scientific Linux Security Update : firefox on SL5.x, SL6.x, SL7.x i386/x86_64 (20141015)

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. CVE-2014-1574, CVE-2014-1578, CVE-2014-1581, CVE-2014-1576,...

Scientific Linux Security Update : krb5 on SL5.x i386/x86_64 (20140916)

It was found that if a KDC served multiple realms, certain requests could cause the setupserverrealm function to dereference a NULL pointer. A remote, unauthenticated attacker could use this flaw to crash the KDC using a specially crafted request. CVE-2013-1418, CVE-2013-6800 A NULL pointer...