Scientific Linux Security Update : kdenetwork on SL7.x x86_64 (20141111)

A NULL pointer dereference flaw was found in the way LibVNCServer handled certain ClientCutText message. A remote attacker could use this flaw to crash the VNC server by sending a specially crafted ClientCutText message from a VNC client. CVE-2014-6053 A divide-by-zero flaw was found in the way...

Scientific Linux Security Update : libvirt on SL6.x i386/x86_64 (20130919)

libvirt invokes the PolicyKit pkcheck utility to handle authorization. A race condition was found in the way libvirt used this utility, allowing a local user to bypass intended PolicyKit authorizations or execute arbitrary commands with root privileges. CVE-2013-4311 Note: With this update, libvi...

Scientific Linux Security Update : ruby on SL6.x i386/x86_64 (20130307)

It was discovered that Ruby's REXML library did not properly restrict XML entity expansion. An attacker could use this flaw to cause a denial of service by tricking a Ruby application using REXML to read text nodes from specially crafted XML content, which will result in REXML consuming large...

Scientific Linux Security Update : libvirt on SL6.x i386/x86_64 (20130221)

It was discovered that libvirt made certain invalid assumptions about dnsmasq's command line options when setting up DNS masquerading for virtual machines, resulting in dnsmasq incorrectly processing network packets from network interfaces that were intended to be prohibited. This update includes...