Scientific Linux Security Update : cups on SL3.x, SL4.x, SL5.x i386/x86_64

SL 3 and SL 4 only A flaw was found in the way CUPS handled the addition and removal of remote shared printers via IPP. A remote attacker could send malicious UDP IPP packets causing the CUPS daemon to attempt to dereference already freed memory and crash. CVE-2008-0597 A memory management flaw w...

Scientific Linux Security Update : curl on SL5.x i386/x86_64

Wesley Miaw discovered that when deflate compression was used, libcurl could call the registered write callback function with data exceeding the documented limit. A malicious server could use this flaw to crash an application using libcurl or, potentially, execute arbitrary code. Note: This issue...

Scientific Linux Security Update : sudo on SL5.x i386/x86_64

A flaw was found in the way sudo handled the presence of duplicated environment variables. A local user authorized to run commands using sudo could use this flaw to set additional values for the environment variables set by sudo, which could result in those values being used by the executed comma...

Scientific Linux Security Update : sudo on SL5.x i386/x86_64

A flaw was discovered in a way sudo handled group specifications in 'run as' lists in the sudoers configuration file. If sudo configuration allowed a user to run commands as any user of some group and the user was also a member of that group, sudo incorrectly allowed them to run defined commands...

Scientific Linux Security Update : ntp on SL4.x, SL5.x i386/x86_64

A flaw was discovered in the way the ntpd daemon checked the return value of the OpenSSL EVPVerifyFinal function. On systems using NTPv4 authentication, this could lead to an incorrect verification of cryptographic signatures, allowing time-spoofing attacks. CVE-2009-0021 Note: This issue only...

Scientific Linux Security Update : krb5 on SL5.x i386/x86_64

A use-after-free flaw was discovered in the MIT Kerberos administration daemon, kadmind. A remote, authenticated attacker could use this flaw to crash the kadmind daemon. Administrative privileges are not required to trigger this flaw, as any realm user can request information about their own...

Scientific Linux Security Update : xorg-x11-server on SL5.x i386/x86_64

An input validation flaw was discovered in X.org's Security and Record extensions. A malicious authorized client could exploit this issue to cause a denial of service crash or, potentially, execute arbitrary code with root privileges on the X.Org server. CVE-2008-1377 Multiple integer overflow...

Scientific Linux Security Update : icu on SL5.x i386/x86_64

A flaw was found in the way ICU processed certain, invalid byte sequences during Unicode conversion. If an application used ICU to decode malformed, multibyte character data, it may have been possible to bypass certain content protection mechanisms, or display information in a manner misleading t...

Scientific Linux Security Update : iscsi-initiator-utils on SL5.x i386/x86_64

Olaf Kirch discovered two flaws in open-iscsi. A local attacker could use these flaws to cause the server daemon to stop responding, leading to a denial of service. CVE-2007-3099, CVE-2007-3100. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

Scientific Linux Security Update : openldap on SL5.x i386/x86_64

A flaw was found in the way OpenLDAP's slapd daemon handled malformed objectClasses LDAP attributes. A local or remote attacker could create an LDAP request which could cause a denial of service by crashing slapd. CVE-2007-5707 In addition, the following feature was added : - OpenLDAP client tool...

Scientific Linux Security Update : tzdata on SL3.x, SL4.x, SL5.x i386/x86_64

This updated package addresses the following change to Daylight Saving Time DST observations : - during Ramadan, that is, during the period between 2010-08-11 and 2010-09-08, Egypt will suspend DST. The DST period will be officially restored on 2010-09-09. BZ618593, BZ618597, BZ618599 %NASLMINLEV...

Scientific Linux Security Update : gnutls on SL4.x, SL5.x i386/x86_64

CVE-2009-2730 gnutls: incorrect verification of SSL certificate with NUL in name GNUTLS-SA-2009-4 A flaw was discovered in the way GnuTLS handles NULL characters in certain fields of X.509 certificates. If an attacker is able to get a carefully-crafted certificate signed by a Certificate Authorit...

Scientific Linux Security Update : openldap on SL4.x, SL5.x i386/x86_64

A denial of service flaw was found in the way the OpenLDAP slapd daemon processed certain network messages. An unauthenticated remote attacker could send a specially crafted request that would crash the slapd daemon. CVE-2008-2952 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descripti...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64 (20120529)

The kernel packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issue : - It was found that the datalen parameter of the sockallocsendpskb function in the Linux kernel's networking implementation was not validated before use. A local...

Scientific Linux Security Update : tcpdump on SL5.x i386/x86_64

Problem description : Moritz Jodeit discovered a denial of service bug in the tcpdump IEEE 802.11 processing code. If a certain link type was explicitly specified, an attacker could inject a carefully crafted frame onto the IEEE 802.11 network that could crash a running tcpdump session...

Scientific Linux Security Update : mailman on SL4.x, SL5.x i386/x86_64

Multiple input sanitization flaws were found in the way Mailman displayed usernames of subscribed users on certain pages. If a user who is subscribed to a mailing list were able to trick a victim into visiting one of those pages, they could perform a cross-site scripting XSS attack against the...

Scientific Linux Security Update : scsi-target-utils on SL5.x, SL6.x i386/x86_64

A double-free flaw was found in scsi-target-utils' tgtd daemon. A remote attacker could trigger this flaw by sending carefully-crafted network traffic, causing the tgtd daemon to crash. CVE-2011-0001 All running scsi-target-utils services must be restarted for the update to take effect...

Scientific Linux Security Update : cpuspeed on SL5.x i386/x86_64

cpuspeed was moved to the security errata from the fastbugs errata because the latest kernel security update depends on it. This package adds the following enhancements : - Userspace needed to support the loading of the new Powernow-k8 module that has changed from being built in. By rectifying th...

Scientific Linux Security Update : ndiswrapper on SL5.x i386/x86_64

This release is corresponding with the first kernel security update with the new 2.6.18-92 kernel. We have built new kernel modules for all the kernels we have released. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

Scientific Linux Security Update : automake on SL5.x i386/x86_64

Automake-generated Makefiles made certain directories world-writable when preparing source archives, as was recommended by the GNU Coding Standards. If a malicious, local user could access the directory where a victim was creating distribution archives, they could use this flaw to modify the file...