Scientific Linux Security Update : kvm on SL5.x x86_64 (20130409)

A flaw was found in the way KVM handled guest time updates when the buffer the guest registered by writing to the MSRKVMSYSTEMTIME machine state register MSR crossed a page boundary. A privileged guest user could use this flaw to crash the host or, potentially, escalate their privileges, allowing...

Scientific Linux Security Update : bind97 on SL5.x i386/x86_64 (20130328)

A denial of service flaw was found in the libdns library. A remote attacker could use this flaw to send a specially crafted DNS query to named that, when processed, would cause named to use an excessive amount of memory, or possibly crash. CVE-2013-2266 Note: This update disables the syntax...

Scientific Linux Security Update : boost on SL5.x, SL6.x i386/x86_64 (20130321)

A flaw was found in the way the orderedmalloc routine in Boost sanitized the 'nextsize' and 'maxsize' parameters when allocating memory. If an application used the Boost C++ libraries for memory allocation, and performed memory allocation based on user-supplied input, an attacker could use this...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64 (20130311)

This update fixes the following security issues : - A flaw was found in the way file permission checks for the '/dev/cpu/x/msr' files were performed in restricted root environments for example, when using a capability-based security model. A local user with the ability to write to these files cou...

Scientific Linux Security Update : kvm on SL5.x x86_64 (20130307)

A flaw was found in the way QEMU-KVM emulated the e1000 network interface card when the host was configured to accept jumbo network frames, and a guest using the e1000 emulated driver was not. A remote attacker could use this flaw to crash the guest or, potentially, execute arbitrary code with ro...

Scientific Linux Security Update : ruby on SL5.x i386/x86_64 (20130307)

It was discovered that Ruby's REXML library did not properly restrict XML entity expansion. An attacker could use this flaw to cause a denial of service by tricking a Ruby application using REXML to read text nodes from specially crafted XML content, which will result in REXML consuming large...

Scientific Linux Security Update : java-1.7.0-openjdk on SL5.x, SL6.x i386/x86_64 (20130116)

Two improper permission check issues were discovered in the reflection API in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. CVE-2012-3174, CVE-2013-0422 This erratum also upgrades the OpenJDK package to IcedTea7 2.3.4. All running...

Scientific Linux Security Update : thunderbird on SL5.x, SL6.x i386/x86_64 (20130108)

Several flaws were found in the processing of malformed content. Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. CVE-2013-0744, CVE-2013-0746, CVE-2013-0750, CVE-2013-0753, CVE-2013-0754, CVE-2013-0762...

Scientific Linux Security Update : selinux-policy enhancement update on SL5.x, SL6.x i386/x86_64 (20121119)

This update adds the following enhancements : - An SELinux policy for openshift packages has been added This update has been placed in the security tree to avoid selinux related problems. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64 (20121113)

The kernel packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issue : - It was found that a previous update did not correctly fix the CVE-2009-4307 issue, a divide-by-zero flaw in the ext4 file system code. A local, unprivileged use...

Scientific Linux Security Update : java-1.6.0-sun on SL5.x i386/x86_64 (20121018) (ROBOT)

As a reminder, the openjdk Java environment is available in Scientific Linux 5. Updates for openjdk are released in a similar manner to other security updates. Scientific Linux 6 does not bundle the closed source Java environment. All running instances of Sun/Oracle Java must be restarted for the...

Scientific Linux Security Update : bind97 on SL5.x i386/x86_64 (20121012)

A flaw was found in the way BIND handled certain combinations of resource records. A remote attacker could use this flaw to cause a recursive resolver, or an authoritative server in certain configurations, to lockup. CVE-2012-5166 After installing the update, the BIND daemon named will be restart...

Scientific Linux Security Update : bind on SL5.x, SL6.x i386/x86_64 (20121012)

A flaw was found in the way BIND handled certain combinations of resource records. A remote attacker could use this flaw to cause a recursive resolver, or an authoritative server in certain configurations, to lockup. CVE-2012-5166 After installing the update, the BIND daemon named will be restart...

Scientific Linux Security Update : tzdata enhancement update on SL5.x, SL6.x i386/x86_64 (20121004)

This update adds the following enhancements : - Daylight saving time in Fiji will start at 2:00 a.m. on Sunday, 21st October 2012, and end at 3 am on Sunday, 20th January 2013. - Tokelau was listed in an incorrect time zone for as long as the Zoneinfo project was in existence. The actual zone was...

Scientific Linux Security Update : yum-autoupdate update on SL5.x, SL6.x i386/x86_64 (20120925)

The Scientific Linux team was made aware of a problem with the use of temp files in the yum-autoupdate script by Elias Persson. The problem should be corrected in these packages. These packages also include some minor feature updates for each release. For SL5, the script now includes the 'PRERUN'...

Scientific Linux Security Update : postgresql and postgresql84 on SL5.x, SL6.x i386/x86_64 (20120913)

It was found that the optional PostgreSQL xml2 contrib module allowed local files and remote URLs to be read and written to with the privileges of the database server when parsing Extensible Stylesheet Language Transformations XSLT. An unprivileged database user could use this flaw to read and...

Scientific Linux Security Update : openoffice.org on SL5.x i386/x86_64 (20120801)

OpenOffice.org is an office productivity suite that includes desktop applications, such as a word processor, spreadsheet application, presentation manager, formula editor, and a drawing program. Multiple heap-based buffer overflow flaws were found in the way OpenOffice.org processed encryption...

Scientific Linux Security Update : pidgin on SL3.x, SL4.x, SL5.x i386/x86_64

An invalid pointer dereference bug was found in the way the Pidgin OSCAR protocol implementation processed lists of contacts. A remote attacker could send a specially crafted contact list to a user running Pidgin, causing Pidgin to crash. CVE-2009-3615 A NULL pointer dereference flaw was found in...

Scientific Linux Security Update : firefox on SL5.x i386/x86_64

Mozilla Firefox is an open source Web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as t...

Scientific Linux Security Update : libvorbis on SL3.x, SL4.x, SL5.x i386/x86_64

CVE-2009-3379 libvorbis: security fixes mentioned in MFSA 2009-63 Multiple flaws were found in the libvorbis library. A specially crafted Ogg Vorbis media format file Ogg could cause an application using libvorbis to crash or, possibly, execute arbitrary code when opened. CVE-2009-3379 The deskto...