CHG000000013739[domain_realm] section will be updated. The [domain_realm] section provides a translation from a domain name or hostname to a Kerberos realm name. We need to map pingdev.fnal.gov to FERMI domain. Additionally 38 translations will be removed since these hostnames no longer exist in DNS. [instancemapping] section will be removed, since there is no AFS at Fermilab anymore.Scientific Linux FermiScientific Linux Fermi 6krb5-fermi-config-5.3-1.6.1.noarch.rpm45bf513697d573439f9e8ed99d0694b28f5f31104632c906a676455407d1245ckrb5-fermi-krb5.conf-5.3-1.6.1.noarch.rpm3af1836760ceade7f97ed616cd7257e89af81eeb96934a08123fd0a61525cdf8CHG000000016873Currently the krb5.conf file has SULLY as the first DC and this machine is located in Accelerator Division's server room. As a group, we have decided to move the servers around so that the first server is ELMO, which is located in FCC.Scientific Linux FermiScientific Linux Fermi 6krb5-fermi-krb5.conf-5.4-1.1.noarch.rpma420dcdb61417cddafa7d52d5a1eb994aaa078f316097e7cf5a915cbdac021b7krb5-fermi-config-5.4-1.1.noarch.rpmcac2ce2dc2a325cbac8afd178276cd2c745e67ad81f30b85d9219bca9efebe98CHG000000016874Scientific Linux FermiScientific Linux Fermi 6krb5-fermi-config-5.5-1.noarch.rpm9014eb7ad74684ebabf09a8464db9989bb561139cd497b9b825e0dd9ff0bae75krb5-fermi-krb5.conf-5.5-1.noarch.rpm4de82f88966cb22d714c6ea7bc248a21bd883b788f657fcbdd1b8d6d60b33594CHG000000017316In some instances the /etc/kdc.list entries were not automatically inserted into the correct place within /etc/krb5.confScientific Linux FermiScientific Linux Fermi 6krb5-fermi-config-5.5-2.noarch.rpmf5131ccf50fd9828d170160783a92079c52ffc2a2b0c5c133219d8dd0718dfbckrb5-fermi-krb5.conf-5.5-2.noarch.rpme30f6238343a490bf2298e9295c9de2a56b85cc897f37b92f8db4ff7819c6740ENHC0001404Scientific Linux FermiScientific Linux Fermi 6python-cups-1.9.72-22.el6.i686.rpm3397bca8296bd39cb5d0847faeba2ad58763fd841769b07da41894a157b0bd7epython-cups-1.9.72-22.el6.x86_64.rpm451b309c7de34fe012e4cb4661bd3ee08e090c0b6df2bd86078ab1592ad0794bpython-cups-doc-1.9.72-22.el6.noarch.rpm630dc10acd979646404830d81d8fdf6dd893b434772dfbc47f35af43d26c0a5bENHC0002852Scientific Linux FermiScientific Linux Fermi 6cigetcert-1.16-1.el6.noarch.rpm423334be9e3e512dd23864310a2da825177e464584119b34e8f9249152b85526ENHC0002973The wrapper script of cigetcert to unsets more variables such as PYTHONHOME, in response to a user bug report.Scientific Linux FermiScientific Linux Fermi 6cigetcert-1.16-2.el6.noarch.rpmbe82c4e090f65882fb35d8d138968e1335fed049e5fe941e8458f9ebf3244611ENHC0003766Scientific Linux FermiScientific Linux Fermi 6kmod-openafs-1.6.22.3-1.SL610.el6.noarch.rpm2acf39e723919085e97abdd00b5c8c8a6b67fffa13ca88b7d78f549ab6ce3dbckmod-openafs-754-1.6.22.3-286.sl6.754.x86_64.rpm23550de9023d881436c96c76fdeebf78d2ea10f1a5aeb1f921aea3e2ebe53797ENHC0004153Authentication Services operates a non-accredited CA that is integrated with the FERMI and SERVICES domains.Scientific Linux FermiScientific Linux Fermi 6fermilab-conf_ca-certs-2019.01-2.sl6.noarch.rpmc08eac2053aaaa2ce047f54b41c6615bfbb67247fd0251000eaac3a90d66121cOPENAFS-SA-2016-003Security Fix(es): There are three different kinds of “dead” residual directory entry leaks, each with a different cause: 1. There may be partial name data after the null terminator in a live directory entry. This happens when a previously used directory entry becomes free, then is reused for a directory entry with a shorter name. 2. “Dead” directory entries are left uncleared after an object is deleted or renamed. 3. Residual directory entries may be inadvertently picked up when a new directory is created or an existing directory is extended by a 2kiB page. This happens because the fileserver shares a buffer pool for directories of all AFS users, but does not clear each buffer upon reuse. This is the most severe problem because the leaked information may be from other directories or volumes for which the AFS user is not authorized.moderateScientific Linux FermiScientific Linux Fermi 6openafs-compat-1.6.20-256.sl6.x86_64.rpme108410df761b21a2c969d71d734b1716380cf7a9e81707afb2ec7d296a2b14aopenafs-devel-1.6.20-256.sl6.x86_64.rpm82dea60acec742b92007a6446be12f22902bf493382793fbb64bd605dcfc7bb5openafs-authlibs-1.6.20-256.sl6.x86_64.rpm40f39753e489f7978d5d904163febbe82167bf05d5aa604fd66ca4166acdd58bopenafs-server-1.6.20-256.sl6.x86_64.rpmfddeaa657f511cb0d2d157b336f42ac762a7b4b2ca0d46056bda073a9e23dc82openafs-1.6.20-256.sl6.x86_64.rpm3ac7b5248b58723cd87dcecc6c2975ed0ed0dd57a5c315c0f48a07758c23fc3aopenafs-authlibs-devel-1.6.20-256.sl6.x86_64.rpmf788c57a557cd97ef06d2b7a79eeab3ef6a354f8bb8cc4441f970aba4a4dd1f2openafs-plumbing-tools-1.6.20-256.sl6.x86_64.rpm8b1d199ad4c5df91fe80e30a8a92ab384a83eea0bb635027ca8deaeff6be03c8openafs-client-1.6.20-256.sl6.x86_64.rpm6d5065413ccbec328321dcc629cc673c3fa2334b108cdc995934917f32baf890openafs-kernel-source-1.6.20-256.sl6.x86_64.rpm5ecb1dd88248884cbb97f34949de37da61777ed4bbdc02f5766f177508b2cd82openafs-module-tools-1.6.20-256.sl6.x86_64.rpmaadc97f578c2d6e52ad4dd1f60743cc83f66ceb102a31f6e3156859531c3d221openafs-kpasswd-1.6.20-256.sl6.x86_64.rpm8dc9bd2b5fa6f2366cf312e3eb62d1e5dc959ec81ecf38d3407e9471af17ca7aopenafs-krb5-1.6.20-256.sl6.x86_64.rpm4847a1d641b1617af77803f297efb54c09c25d6b3421d2a2738345dc159fd245kmod-openafs-642-1.6.20-256.sl6.642.6.2.x86_64.rpm9e1e6b0beb5b7e37427a217ec1623716bebd3526558cde6dd8963c23aee1e5caOPENAFS-SA-2017-001Security Fix(es): * Certain values transmitted in RX ACK packets were not sanity checked by OpenAFS receiving peers, which could lead to an assertion being triggered during construction of outgoing packets on the same connection, resulting in server process crashes or client kernel panics.importantScientific Linux FermiScientific Linux Fermi 6openafs-kpasswd-1.6.20-257.sl6.x86_64.rpm94e1f12822e9ec2d737b057903169c70747b8d97c8fe39702cf0543090a415a1openafs-client-1.6.20-257.sl6.x86_64.rpm1b31d1e5aab3e0da0bd2f27f018a98f4d30e7b719ea182dfc28941456f64c066openafs-1.6.20-257.sl6.x86_64.rpm9036f9f4899423dcb82a670540117df70237d041d939ca47a0bc93dd23ff2a38openafs-krb5-1.6.20-257.sl6.x86_64.rpm9988c4f84218d3a1db15ec22d7b19c096f40cf2ca962bafb84bba2656fd93ee0openafs-authlibs-1.6.20-257.sl6.x86_64.rpm3d3f4824e88a68f9a83d6cf762082658c85c841c6d3de254e4d5a2083ffc35abopenafs-devel-1.6.20-257.sl6.x86_64.rpm11ca4ccc9d3d844841720cc5a2b0b6c1dc7c617d576734c08d989bd76b625be1openafs-plumbing-tools-1.6.20-257.sl6.x86_64.rpmfd69ab4eb539c7d455ebd46b4dc96dcae820203b267627d0aac3fa0ab738e849openafs-server-1.6.20-257.sl6.x86_64.rpm5743132722200f9ee74344f9166892ac1c3214ff11b4dd7c94fa49f1cab01a71openafs-module-tools-1.6.20-257.sl6.x86_64.rpmaf715561b346bd2a7c685ec9813582cab89b6afd76bc984bec55b91c8aca61acopenafs-compat-1.6.20-257.sl6.x86_64.rpmd3356a30d19dba87efff88a4af30f5cb64233570b3c64b95b6ac3be9c11f5c84kmod-openafs-696-1.6.20-257.sl6.696.x86_64.rpm0a9e26c61c5729ffb7fbde672fb005f9b19bc377bd93592f62e04fd6068c1505openafs-authlibs-devel-1.6.20-257.sl6.x86_64.rpm0f72d1954e79d472a98300261c13502a1d1f315e04b109a9bc0a66145fa340c9openafs-kernel-source-1.6.20-257.sl6.x86_64.rpm94c33766578b5cc5c6d0754fbca9c13e51c98d52447b05552008f28da0faf500OPENAFS-SA-2018-001:2:3These releases include fixes for three security advisories, OPENAFS-SA-2018-001, OPENAFS-SA-2018-002, and OPENAFS-SA-2018-003. OPENAFS-SA-2018-001 only affects deployments that run the 'butc' utility as part of the in-tree backup system, but is of high severity for those sites which are affected -- an anonymous attacker could replace entire volumes with attacker-controlled contents. OPENAFS-SA-2018-002 is for information leakage over the network via uninitialized RPC output variables. A number of RPCs are affected, some of which require the caller to be authenticated, but in some cases hundreds of bytes of data can be leaked per call. Of note is that cache managers are also subject to (kernel) memory leakage via AFSCB_ RPCs. OPENAFS-SA-2018-003 is a denial of service whereby anonymous attackers can cause server processes to consume large quantities of memory for a sustained period of time. The changes to fix OPENAFS-SA-2018-001 require behavior change in both butc(8) and backup(8) to use authenticated connections; old and new versions of these utilities will not interoperate absent specific configuration of the new tool to use the old (insecure) behavior. These changes also are expected to cause backup(8)'s interactive mode to be limited to only butc connections requiring (or not requiring) authentication within a given interactive session, based on the initial arguments selected.moderateScientific Linux FermiScientific Linux Fermi 6openafs-kernel-source-1.6.23-289.sl6.x86_64.rpmf82d22b80619a8a1c46043755c9082ea746aed969eabce6d32701bf81341e5c4openafs-authlibs-devel-1.6.23-289.sl6.x86_64.rpm45d80b2acddccb161ef91a76a9a855a5763082555476e066963ab987f715480dopenafs-krb5-1.6.23-289.sl6.x86_64.rpm8fc8d281d910add9d1a30b7f07a93a6594371a7a5e449457a25b6c3fec8ec34copenafs-plumbing-tools-1.6.23-289.sl6.x86_64.rpmd583324395d84d5a9ce3864cde95ddce86171c513df0858f15cbc0d63ac041ccopenafs-kpasswd-1.6.23-289.sl6.x86_64.rpm2a508e3a04813969ce738f78648b989db591bc99604be2e21decb5fc021ca65dopenafs-devel-1.6.23-289.sl6.x86_64.rpm6d5d2065894c13e83993c745cd005f0b6022f28e4fffe14e7818ae88e6b6e285openafs-client-1.6.23-289.sl6.x86_64.rpm3917b71fe72c3248bbc22e100e4beb3ad4af60dc4a10d3fdee084f42bc3fb2f4openafs-1.6.23-289.sl6.x86_64.rpmbcb9f337543ca2d584ea90c7f60a5dee261fad54c0a5cf07fdfd295f27417a68openafs-compat-1.6.23-289.sl6.x86_64.rpm2d8c83efea6f9a377dcda3f329e2e4f631cb04d196eff5bf947bf831ec156d08openafs-authlibs-1.6.23-289.sl6.x86_64.rpm9f3fd90cd2f87b3dd59962ab71edeba71728218a9a30a254a68652fa923cda22kmod-openafs-754-1.6.23-289.sl6.754.3.5.x86_64.rpm84391800d7faa2a01f9e03a59ae8b2e08129b6f8289bbc457e6d6ee70e66f632openafs-server-1.6.23-289.sl6.x86_64.rpm44766130fe57be33233914d4f12ed74ab395db49906c8a1d1f7be89b661277a4openafs-module-tools-1.6.23-289.sl6.x86_64.rpm63f30a73657fbf18b40529617cc1e57ae793c3800f378cd22f88d1518d7d30b0RITM0891205Security Fixes: * Fix OPENAFS-SA-2019-001: information leakage in failed RPC output Generated RPC handler routines ran output variables through XDR encoding even when the call had failed and would shortly be aborted (and for which uninitialized output variables is common); any complete packets assembled in the process would be sent to the peer, leaking the contents of the uninitialized memory in question. * Fix OPENAFS-SA-2019-002: information leakage from uninitialized scalars Generated RPC handler routines did not initialize output variables of scalar (fixed-length) type, since they did not require dedicated logic to free. Such variables allocated on the stack could remain uninitialized in some cases (including those affected by OPENAFS-SA-2019-001), and the contents of uninitialized memory would be returned to the peer.importantScientific Linux FermiScientific Linux Fermi 6openafs-authlibs-1.6.24-290.sl6.x86_64.rpmfea8bab1cc1ed15e72e75626848f6cfb235c06e84a4a1fb4d3749f6878182718openafs-1.6.24-290.sl6.x86_64.rpmd86fa3aaaa802a7acbd190fbf1aa1b04e72b461316e463f886e97e379f247518openafs-compat-1.6.24-290.sl6.x86_64.rpmd29e961a4b682f46ce7d6ae987670b635504ec7fdbf63cbd45abe0f9d12531e3openafs-plumbing-tools-1.6.24-290.sl6.x86_64.rpm63a97c4102da6966c889dc23b6fa7a560821e165ea78f8c614c21cc9b11eab53kmod-openafs-754-1.6.24-290.sl6.754.23.1.x86_64.rpm66d3ee336d466a82277ed22b07b1644a4c2fb57cbe07f5c2956ca80ee945ce64openafs-kpasswd-1.6.24-290.sl6.x86_64.rpm7af9a098ed37e1d92cbf79f789c50c94a09f70ad4d4c07945a5773f30f86de42openafs-devel-1.6.24-290.sl6.x86_64.rpm99a3bde197baa412919fc3759af351839cf33e542745b188cc5392e2d55957b7openafs-client-1.6.24-290.sl6.x86_64.rpmacf60321282eda222115ce0493f624a3f843a479bbcf7478e3a43b93adb00b42openafs-krb5-1.6.24-290.sl6.x86_64.rpmd65d3305f2ed0ed024c392b8183102afd100912f20e85f614b6d5f8fd253f4aaopenafs-server-1.6.24-290.sl6.x86_64.rpm14c2c84e8ee8c1548758eb2be1dd02e69593514aacbf30606df5a4e89b90ed04openafs-module-tools-1.6.24-290.sl6.x86_64.rpmc53dd789208489a3fde9a3fd0a266e9b3f99850b6b72c3e745317ea0c1fd0a9bopenafs-kernel-source-1.6.24-290.sl6.x86_64.rpm8984c8a53a4938801ee8b5bf26253e36f7a3487c7f58df91636cab89cb1b1851openafs-authlibs-devel-1.6.24-290.sl6.x86_64.rpm369ef7fafc626d25e7e9d3407157d31fbae8ab6bd31c26be38bbef0b24d0870cSLBA-2016:0995-1This update fixes the following bug: * A previous regression in dracut caused systems with iSCSI offloading or iSCSI Boot Firmware Table (iBFT) to stop booting in some cases. Consequently, freshly installed Scientific Linux 6.8 systems with "iscsi_firmware" on the kernel command line could be unable to boot. This update fixes the bug, and systems in the described scenario are able to boot.Scientific Linux FermiScientific Linux Fermi 6dracut-kernel-004-409.el6_8.2.noarch.rpm17642998741daee2d9092d04400c27d97877a6a44df6502edbe97f21a76836a4dracut-tools-004-409.el6_8.2.noarch.rpm013a84a8fcfa3cc0e14eea50929788adfeaf218409e5b0d962480af8e36a895bdracut-fips-aesni-004-409.el6_8.2.noarch.rpm7e9f6bf09d401fe1120a23cd6e5ec1278761dc942a9f4add2f03c0ccd6a95deedracut-generic-004-409.el6_8.2.noarch.rpm41f165ab4da51641d88966489c7708879c496ca78180d90ec1f160f378976423dracut-network-004-409.el6_8.2.noarch.rpm0cd1fb15b22fd47d2c990b1dc95a7f855ff48c09937f1e80bd68dce010bfb6e9dracut-fips-004-409.el6_8.2.noarch.rpm3efbb0877197e7eae1e59764d2d892198af29edb030bf3cfd58a925d0b32535adracut-caps-004-409.el6_8.2.noarch.rpm11a7c1c68f94c27b5bcd72bc378984f30f459ef92caf03b4b87bbb24d30c6591dracut-004-409.el6_8.2.noarch.rpm755b97ea8f38cbb6f4a76b85eac4a2b5c117de343e15bc7270a2e28e17a14b03SLBA-2016:1266-1This update fixes the following bugs: * In 2015, Egypt did not observe Daylight Savings Time (DST). However, in 2016, Egypt observes DST from July 7 at 24:00 to October 27 at 24:00. As a consequence of this change, the tzdata package had incorrect data regarding DST in Egypt in 2016. This has been fixed, and tzdata now has the correct data.Scientific Linux FermiScientific Linux Fermi 6tzdata-java-2016e-1.el6.noarch.rpme1a4af31a55615a2cecd4cfeecaf097374c0d5126930ca32cf81efaad4c3fe52tzdata-2016e-1.el6.noarch.rpm42427f93789cbf7a712c2b2842f7dde1645f624692e2fb9005af7381c487a2dfSLBA-2016:2096-1This update fixes the following bug: * This update fixes the daylight saving time (DST) date for Palestine. The correct date and time is October 29, 2016 at 01:00.Scientific Linux FermiScientific Linux Fermi 6tzdata-2016h-1.el6.noarch.rpm1bc56b0f7e90fbb151f43b8bb2b9c2fd0c7deb65bd51677c9dd4c871c197313etzdata-java-2016h-1.el6.noarch.rpm73c6299e358cfd72cf152a348f74e0ab88b3015b4c98f8582e62b998a349941dSLBA-2016:2660-1The tzdata packages have been updated as follows: * A new time zone Asia/Famagusta has been created, which is a UTC+03 year round time zone. As of 2016-10-30, Cyprus split into two time zones. Northern Cyprus is now in the Asia/Famagusta time zone. * The Pacific/Tongatapu time zone will reintroduce Daylight Saving Time (DST) on 2016-11-06. * The Antarctica/Casey time zone has changed from UTC+08 to UTC+11 on 2016-10-22.Scientific Linux FermiScientific Linux Fermi 6tzdata-2016i-1.el6.noarch.rpm51021abb88fb7552df1aab8739fda3e647e061ba41105586ecbe3d2c54f00fb1tzdata-java-2016i-1.el6.noarch.rpm2f08cb4c79bd12bb6a620f876c3f7a85bf63acb38600d963445dd700d51e5f3bSLBA-2017:0306-1This update fixes the following bug: * A missing SELinux rule was previously causing errors when adding a webhook using the gluster-eventsapi command. The rule to allow "glusterd_t" domain binds on glusterd UDP port has been added, and adding a webhook using gluster- eventsapi now works properly.Scientific Linux FermiScientific Linux Fermi 6selinux-policy-mls-3.7.19-292.el6_8.3.noarch.rpm612d47d59c1414ad2dab622512531fc48e444dbe9b89c3bbaaef17d2eb13f5d7selinux-policy-3.7.19-292.el6_8.3.noarch.rpm178817e226d6baee9e2bd8dc6e9849cd45584de2f4f769df15d65f5036d1b8aeselinux-policy-targeted-3.7.19-292.el6_8.3.noarch.rpm090b200629aa18495f20ad5c09c87f49406de35f299b8526622f75b24c509950selinux-policy-doc-3.7.19-292.el6_8.3.noarch.rpm29bed18b6b655579a0bc075ad893aade17383368c279c0e5e92435d8fcc71a72selinux-policy-minimum-3.7.19-292.el6_8.3.noarch.rpme4caba6c9f79680f567b42fc7966dd63b8a764d32c9338df69d3af089d859fe8SLBA-2017:0472-1The tzdata packages have been updated as follows: * Mongolia no longer observes DST. * The Magallanes Region of Chile has moved from a UTC-04/-03 scheme to UTC-03 all year. Starting 2017-05-13 at 23:00, the clocks for the Magallanes Region will differ from America/Santiago. To accommodate for this change, the new America/Punta_Arenas zone has been created. * The zone1970.tab file has been added to the list of files to be installed with the tzdata packages installation.Scientific Linux FermiScientific Linux Fermi 6tzdata-java-2017a-1.el6.noarch.rpm4e39b931c86e93566fdc97b5ce2e2e7c5b6ff388496f9aae52700decf5ea553etzdata-2017a-1.el6.noarch.rpm037c2782146fb0c464bac96539845bbbeb830ec1963d607cafdb822c5d5f73d0SLBA-2017:0602-1The resource-agents packages provide the Pacemaker and RGManager service managers with a set of scripts. These scripts interface with several services to allow operating in a high-availability (HA) environment.Scientific Linux FermiScientific Linux Fermi 6resource-agents-3.9.5-46.el6.x86_64.rpm0e8a5a5365c86c0b19cd4c6dcc04882fa4b9237cc66a4c7b4dbd711892963e25SLBA-2017:0627-1Scientific Linux FermiScientific Linux Fermi 6selinux-policy-doc-3.7.19-307.el6.noarch.rpme6e6a8aae1b5ebd860ba507ed772c8a4f3dfbab02de689ad2403fc332e2ffbeeselinux-policy-targeted-3.7.19-307.el6.noarch.rpm25bbb3278f4b0c6135dfce27cbe743f284e113c8630656a837c2f23cba4335a2selinux-policy-3.7.19-307.el6.noarch.rpm29c83cb6cddf1f8e710306aaea2c8cad138959cfd9833ae5fb7e9a6d2709374dselinux-policy-mls-3.7.19-307.el6.noarch.rpm398b732bd2bdc10ddf3edff04b24e8b453af1d8468e2671933b4343d70065032selinux-policy-minimum-3.7.19-307.el6.noarch.rpm0d73d4de3058dc63bd1b9d95c04d88601da4348e981355d87a562fe8053e49b3SLBA-2017:0696-1Scientific Linux FermiScientific Linux Fermi 6yum-plugin-list-data-1.1.30-40.el6.noarch.rpm3dfe726b496c9708e3343cf27f634238b16a9bbbf99d1a7da11390c24a3022c5yum-plugin-filter-data-1.1.30-40.el6.noarch.rpm812eaeb03a9491ea38484649f94fa57c5d3ee5becd6fdb3174339f562622a22eyum-plugin-ovl-1.1.30-40.el6.noarch.rpm5906127a1c9834bc244fe9fa27441ea6669c4cd2a4b43fd8703f0776cebd5ccayum-NetworkManager-dispatcher-1.1.30-40.el6.noarch.rpm2901e3552256f245091d2f14bd1c7b1a074834fa049824cc5ba73a1cea3a1074yum-plugin-changelog-1.1.30-40.el6.noarch.rpmea0ccae84995abb5a8c493fcfbc903356d745d2955721e46f04c359f3eecec6byum-plugin-rpm-warm-cache-1.1.30-40.el6.noarch.rpme5876ceb9d4c492b3b06ac9a95e69735fd6a0d4911425706ec465730e8c60b5dyum-plugin-fs-snapshot-1.1.30-40.el6.noarch.rpme2d32bfed08416c85737a4ca63f927bd1efb2ec098312358a3c15dfa838c9798yum-plugin-tsflags-1.1.30-40.el6.noarch.rpm90f155f4730e9d0d7f39229fd7d1323ccbc67b69b4a5d4dafec949fb26b7fbcayum-plugin-protectbase-1.1.30-40.el6.noarch.rpm1257e21a8695cb60ceceaebc398b7b1fe43e6cc7ab13d55e713b9026d13b34dbyum-plugin-local-1.1.30-40.el6.noarch.rpmb50610b99ff61f8a61a2f67f3b0dd3aa75520acb12a5f173676ae00f44663eefyum-plugin-security-1.1.30-40.el6.noarch.rpm7c21edc2fd60d5ede4bb736747ecd2cc11aff43db83bf952e9ee5e58c41a4543yum-updateonboot-1.1.30-40.el6.noarch.rpmce06c2224c44ec217aacdcd501d5135d6352a8320cc5310e2bbc30e9f297236byum-plugin-remove-with-leaves-1.1.30-40.el6.noarch.rpmbf7035a0917efbfa6ff19052c92b25102fb5bdad56208fa4c59936a0c14c96b7yum-plugin-tmprepo-1.1.30-40.el6.noarch.rpmc79f1c61c480f12d8263c6181e86ec1b093f32b0846d65e3009896ef89e996d6yum-plugin-versionlock-1.1.30-40.el6.noarch.rpmbf5271c0fecf727e2596e67f8baa40db7eaef57e52d80a25704c6c1108472457yum-plugin-upgrade-helper-1.1.30-40.el6.noarch.rpmd854e40894470026231e7a9b9735e7893b0a7350fe94a5e5b3c4a8dd5a2c38b1yum-plugin-priorities-1.1.30-40.el6.noarch.rpm9945db5a7a156612aa1bd5045d1a5f81ca788fe642a30ef0ad9c5a147662b2a6yum-plugin-show-leaves-1.1.30-40.el6.noarch.rpm13d55d17c68373a1876a87c09d90f168ccbcda6e13ac05a3412527ec4083c601yum-plugin-auto-update-debug-info-1.1.30-40.el6.noarch.rpm36277616bd554cd3fdbc5ba2875380e5c021c995a172ca25398073cae67b9c04yum-plugin-verify-1.1.30-40.el6.noarch.rpmaea09613189f98d4807ac75c3afdbc7547ea783b444d1ded8385200020c246c5yum-plugin-fastestmirror-1.1.30-40.el6.noarch.rpm7e8632abde998147ced6ce6adad0980c61845027bd9e895c8c26883eb5180c4ayum-plugin-merge-conf-1.1.30-40.el6.noarch.rpm2a7a8b8bd4300d269d7f3ddf708bc5f1bf1ed107f8bf2c554fd13756f6003960yum-plugin-keys-1.1.30-40.el6.noarch.rpmba270aed752c12e9e6fc9590e2a020906f5d5ffe59279ffac8bc83fe0e868a38yum-utils-1.1.30-40.el6.noarch.rpmf72ab989deed3d75d479b11b37ba658964df14ddd1db78e682707a447916c558yum-plugin-ps-1.1.30-40.el6.noarch.rpmfc4c6fc7cc3761cc1496e64079ee670444b9357b11c89afeb3aa34a2ce7f8fb4yum-plugin-post-transaction-actions-1.1.30-40.el6.noarch.rpm64169819e4dd38e1243e52d7b9993d5bd8cc9e1b3fa04c5eac396259b381af3cyum-plugin-aliases-1.1.30-40.el6.noarch.rpmb4b9e99616afbfbc23ab310d1c30fb418849d957206b94e7e0565e729890fe51SLBA-2017:0697-1Scientific Linux FermiScientific Linux Fermi 6device-mapper-multipath-libs-0.4.9-100.el6.x86_64.rpm9e0b615ee35635d1ce605c9183c9e272a62b1a686f5b54c53d848392810b5defdevice-mapper-multipath-0.4.9-100.el6.x86_64.rpmcba4300fcb88bb31eed1866455776a62a6ddb56e8833594cde9a6336404c882fdevice-mapper-multipath-libs-0.4.9-100.el6.i686.rpm9f90a63fd7d8f13ac275293abd44a12ff9323e1761d9f59b53d4d37c1111e319kpartx-0.4.9-100.el6.x86_64.rpm3a0b1cb9941797619390bc291a333e8c6752885dcc459a8afe98e1c391ae66fdSLBA-2017:0700-1Scientific Linux FermiScientific Linux Fermi 6xorg-x11-drv-mga-1.6.3-11.el6.x86_64.rpm2cc47b232acd907f8b07480b2b9f88f3218abdfc6a9a34b15306f702ccc6e9ffSLBA-2017:0702-1Scientific Linux FermiScientific Linux Fermi 6yum-cron-3.2.29-81.el6.noarch.rpmaf29d4249148b45a35581e4dc12835848cc10821ad6b4fd62b6bec6a376ba290yum-3.2.29-81.el6.noarch.rpmbeb8bb3f68320f47172369b4711c479aaba35a4bb257b30b3d3a3d4ef7a17883SLBA-2017:0713-1Scientific Linux FermiScientific Linux Fermi 6python-requests-2.6.0-4.el6.noarch.rpm76b4f822c128b5254bd72cd5233cfe4009682597064836c728ae81a4c35199fbSLBA-2017:0729-1Scientific Linux FermiScientific Linux Fermi 6xorg-x11-server-source-1.17.4-16.sl6.noarch.rpm8f9c3f754b88bd417364a0726fb9af996043d94a396977caa66f9b370f183805xorg-x11-server-devel-1.17.4-16.sl6.x86_64.rpm20b3ec39b691fcd7adbc24eb3eb8caf76255757aaa6fa50a5e13dde0947b6be8xorg-x11-server-Xnest-1.17.4-16.sl6.x86_64.rpmb7706125bf83ff8ef505fc0e28b885e7a995e8a5dab56d4b0e88bff0025fee16xorg-x11-server-devel-1.17.4-16.sl6.i686.rpm762920a817e8ad177aa60b188ef689285f2fd8770385214b6de5f0b9e002ae30xorg-x11-server-Xdmx-1.17.4-16.sl6.x86_64.rpma8748a05f421338d05013cb69c26c04c0fabd6692a9a3b59a9283c07a37f3e39xorg-x11-server-Xephyr-1.17.4-16.sl6.x86_64.rpm779b174f0b6d8d467cde7411c57bf44061356e66441d3b7a77088d1257bfe44fxorg-x11-server-Xvfb-1.17.4-16.sl6.x86_64.rpm517af86de8bc811eb322162c733e09bd9455a5970bc38b754b58c90fb3a5ed32xorg-x11-server-Xorg-1.17.4-16.sl6.x86_64.rpmed12b8afa285bf9fd30e60840c52055df02b1d3d387c97e451eaa6c0785487e6xorg-x11-server-common-1.17.4-16.sl6.x86_64.rpm251c331467acc4b1fc0fbb5f9bfcd02be2c64ea20fe3914d3403acef27b425acSLBA-2017:0730-1Scientific Linux FermiScientific Linux Fermi 6xorg-x11-drv-mach64-6.9.5-1.el6.x86_64.rpm6347a556ab5ce796a99aedba7769ca41761f017e208b5f81a48353e1ccecd931SLBA-2017:0748-1Scientific Linux FermiScientific Linux Fermi 6virt-what-1.11-1.3.el6.x86_64.rpm4cb23d954c7b65c879643c93701585c19373af19a28e27e1dcaa9694e6c1e347SLBA-2017:0757-1Scientific Linux FermiScientific Linux Fermi 6systemtap-sdt-devel-2.9-7.el6.x86_64.rpm42a6e067912ad3f363e15c0f5418d23c86953110fef3033387e8f03f0a62356bsystemtap-server-2.9-7.el6.x86_64.rpm84fef294b5f574135e409a1ce29fa0ab2719df46be63abe72e8a7eb92fa9b106systemtap-runtime-virtguest-2.9-7.el6.x86_64.rpm65784f17e20d254b904cf7f124ad0894850d5c07ff960f6bccce595cc1765fe6systemtap-sdt-devel-2.9-7.el6.i686.rpmbc726c5936be4bf267d3de5b2ef431a2a059e0a5b6c8b922f9f250b599df0190systemtap-2.9-7.el6.x86_64.rpm00a78428e7d27f6ad2a2db9b97ec23d492e141553059859c7820c6df5af6988fsystemtap-initscript-2.9-7.el6.x86_64.rpm9746de7e3488c51c0c6f2e3df8cbab70d7d39478e73b669a38baa53b20234508systemtap-runtime-2.9-7.el6.x86_64.rpmaa885fc0972f5aff1025e72766453b0ec940d255ec2d3367e1f21b1329ae44d5systemtap-client-2.9-7.el6.x86_64.rpm4f6fe91e3ab3ca1e066b10fd941a9ba43e71f3d4a1147094979bcb7f832a965csystemtap-devel-2.9-7.el6.x86_64.rpm01c9dd136cc37e280cf05802a0a00f334eaa19a64333576c218fbc7bcb2e49b8systemtap-testsuite-2.9-7.el6.x86_64.rpm823e81a19be147d7d7011549fb3889c331b3bd234f618000eb4aed2ea1b41c5eSLBA-2017:0775-1Scientific Linux FermiScientific Linux Fermi 6plymouth-core-libs-0.8.3-29.sl6.x86_64.rpm36708f25f021d1f5fce5996481f4d49dfcc0f9c36193128528ea5c6ebeb57236plymouth-theme-fade-in-0.8.3-29.sl6.noarch.rpm860754d239945c9f7c6897c1ce09314566bcc9040701b83f0979ec60ba8a1d82plymouth-core-libs-0.8.3-29.sl6.i686.rpme3e2034b2d00342bdfc8aa78f8770ad55b704622a6e31363af5d728b5840159fplymouth-scripts-0.8.3-29.sl6.x86_64.rpmc677bf2dbdde7edc2c1affebcbf3f43e2a83e24c5c61ddae73b265f13523c9abplymouth-plugin-two-step-0.8.3-29.sl6.x86_64.rpm96b348f04813d5f047a4838d586f8319ce387ed1d3a5076736d01ba875ffa3c2plymouth-theme-rings-0.8.3-29.sl6.noarch.rpm6fe03e8fae79c27fdeecbee33b27f1a43cbb0ce8338af72b547ead44dba128f7plymouth-utils-0.8.3-29.sl6.x86_64.rpm15701d492a3d2e3e6b4c320a5d5bf634b3d80c4fb34197a7d2a4702f7beadd0fplymouth-plugin-fade-throbber-0.8.3-29.sl6.x86_64.rpmddcca169f199f1ba8b01662fd59dca834ea4d2c7837f47fd968371fa3d625604plymouth-plugin-space-flares-0.8.3-29.sl6.x86_64.rpmf79aa0e451d213e30a97eff2d5553f016fb28d195e555f7911f5b4df9bdaf0a6plymouth-plugin-throbgress-0.8.3-29.sl6.x86_64.rpm474b61cd1f7f6f3672a7fe56913c65b5dfa8502ca54e760eb235ed0a7c513a50plymouth-0.8.3-29.sl6.x86_64.rpm744be69b8ad7836541fabc367012ecba899cc52ecb8e9984ccd210a68aa605d8plymouth-gdm-hooks-0.8.3-29.sl6.x86_64.rpmd703f27de3a7e1dea5eb1c9ff0a0b2416f6d687619d5d12f7b78871143aed0afplymouth-theme-solar-0.8.3-29.sl6.noarch.rpmd854e20abe915ba44bce1408187090a2f60199d1ef5cf1237df9d82ee9249018plymouth-plugin-label-0.8.3-29.sl6.x86_64.rpm7c19c95c03776b7bd41c64a25b3522cd3c11d2867a5420a07b7e87871587c3b4plymouth-theme-script-0.8.3-29.sl6.noarch.rpm238129117581837b4047e6fae9ffc34741ca0145db8526735830f64fcf3a2b61plymouth-devel-0.8.3-29.sl6.i686.rpm798450604f7698a9869abf2869b29b47dc91d24e50f29b61767e22bc8bb4b422plymouth-graphics-libs-0.8.3-29.sl6.x86_64.rpmc06a722e809fba0b0c628db6f84e87793726010450d20968d9a1ea59f2f05d4bplymouth-plugin-script-0.8.3-29.sl6.x86_64.rpm6ec7988f086548ae105e5bd90ba91646423715e9e58b3d4d1a4a80f4c4eb5036plymouth-theme-spinfinity-0.8.3-29.sl6.noarch.rpm93b4dc724ee71e888203e3118f0deab45f2d822cb745db30bac22122ad8df87cplymouth-system-theme-0.8.3-29.sl6.noarch.rpmf3cd59bd54664b36ec92a0217d26623c7ccd842993f001c8e69daa7bdbb2978dplymouth-graphics-libs-0.8.3-29.sl6.i686.rpm3d9f961321fb1e06414f2463327a4eca0b3e7637498d437e33c50e971cf3b7c7plymouth-devel-0.8.3-29.sl6.x86_64.rpm6500cb281b68239cbabec52ae23bc1bc177b7810c724d3ce674868a5d893577bSLBA-2017:0798-1Scientific Linux FermiScientific Linux Fermi 6lvm2-libs-2.02.143-12.el6.x86_64.rpmd4fb84ff3fb65ed1a9fb48af2b0e3d05edee6a25c9247485deccaa300c5120b7lvm2-devel-2.02.143-12.el6.i686.rpm1721bdbb6cd733281fab1fe13cbe67846a4db3f3cb0d63ba7ee3efbecd42be38device-mapper-libs-1.02.117-12.el6.i686.rpm93b57aa74d31392916a07f908a1b2577fffcb5eb40116f5e438a82ce6b016f7fdevice-mapper-event-libs-1.02.117-12.el6.i686.rpm730968f38c4325f1cc2d22969275a6033d268dd841155b002c043ba0fa09b3dbdevice-mapper-event-devel-1.02.117-12.el6.i686.rpm0f41bddfc35c496fdca97189598195ee38300315211371d4c8ee806c64bec32blvm2-2.02.143-12.el6.x86_64.rpmd3ef02dfd53ca984d2f5deea573c5421795b0124d6a26c80a66a7b4d467ce9a4device-mapper-event-devel-1.02.117-12.el6.x86_64.rpm4da859cd3f0a8ed1f2e55c47492e2a6f101d7ee4345ce826a311eff824febf4edevice-mapper-devel-1.02.117-12.el6.x86_64.rpm60cb8de6365c3837755ed822821638c8a738deb4b03302349c7dca9024e6d1fblvm2-cluster-2.02.143-12.el6.x86_64.rpm7d8c7b54f04d422b5afcbbd62bea3012ded3d2e853772d46aaac0f8893122867lvm2-libs-2.02.143-12.el6.i686.rpm78d40aeee2b883fb970bd23854a5b365d0ad5c50cf8cd648860c09eef4acf597device-mapper-devel-1.02.117-12.el6.i686.rpmbeefab6ad730d20a7bda0dff837db7d3d1f0a0d4de811f737a85390cbfc26db8device-mapper-libs-1.02.117-12.el6.x86_64.rpmc2d5e1e3c7d83a60a72b3a0eb565cfad5d549a1a949838978ea64f7151445b94device-mapper-event-1.02.117-12.el6.x86_64.rpmd1a113f510c0d6409703112edb24a98d54a821204cc3f975089d2a1c6e64f026lvm2-devel-2.02.143-12.el6.x86_64.rpmb55de2c5cf0052b2f99b3218c8f1235c9c92cf1b1f60de3ce073331ba1f0acebcmirror-2.02.143-12.el6.x86_64.rpm520512b23bfd8597c3d0b724207fd114d8d941a71b419f248fd90db09ce6b278device-mapper-1.02.117-12.el6.x86_64.rpm1d9db39d9180b771c07a33ae66b38be92742610a0bc3d1bac9f110b1741b8b55device-mapper-event-libs-1.02.117-12.el6.x86_64.rpm919013537c0e65433b94f3decf8d2a454377edf817b3f6d8a69da44864905ed8SLBA-2017:0807-1The libpciaccess library provides portable PCI access routines across multiple operating systems. The Direct Rendering Manager runtime library (libdrm) provides a user- space interface library for direct rendering clients. The xorg-x11-font-utils package provides X.Org X11 font utilities required for font installation, conversion and generation. The xorg-x11-util-macros package provides X.Org X11 autotools macros required for building various packages that comprise the X Window System. The xorg-x11-proto-devel package provides X.Org X11 protocol headers.Scientific Linux FermiScientific Linux Fermi 6libXrandr-devel-1.5.1-1.el6.i686.rpme1540e0fa118695364b4cc74097de8682f0064e7b15dacafc055a6ffb3e4d008xorg-x11-proto-devel-7.7-14.el6.noarch.rpmf4982fcdc51011d964f5e6154fc7c6bf9ca6eb1a901c52b2f34d37bc4fa5c357libxcb-devel-1.12-4.el6.x86_64.rpma050a13bb79fbc070122d111268220c929648c4e295fcca5bf215bd07a0f43cclibxcb-1.12-4.el6.i686.rpm0e27055dc89be4776c9b28440fd8812b24a0398c06142eeee3462c3d7e52b71elibXtst-devel-1.2.3-1.el6.i686.rpm5645f74f95374ab11e0097ff505f05014f56d22cba41105730370f0995e58442libX11-devel-1.6.4-3.el6.i686.rpmda0cc100ca39054fcb327e7575c400d1f90c059ef61e577e78e83df429ede433libXfixes-5.0.3-1.el6.x86_64.rpm9971b778a55375ce583c0d17f5ddea9867ff6896d7469fbdf5dc705e7a502eb1libXrender-0.9.10-1.el6.x86_64.rpm4f441041f1d6f93ea37f2e45926e92f9397941cfe2455f2db8f4053ea963f1e1libX11-1.6.4-3.el6.i686.rpm7323a0f1a8a3b6c32d9adb3517cdddc916e3ef6e1f3e9bc3f8fe5b01d83e4b77libX11-1.6.4-3.el6.x86_64.rpm0a5e26ffa2076960e066a526c1d9df7355a20c64c07744153ffce271db243317libXv-devel-1.0.11-1.el6.i686.rpme95fbfa14fb734fbf440582a4a07c1c6de0cd1621dec8b285edc1af8e8219617libXfixes-devel-5.0.3-1.el6.i686.rpm077f398bfd8f98348243518d5a2f2582272089a2fe8faf3440a40038997a4833libXi-1.7.8-1.el6.x86_64.rpmd5669bf5065f14aea0a8f1a637611f55f871916f9a9279eb5de55ba4cb2cc9b5libXtst-devel-1.2.3-1.el6.x86_64.rpmb2df1bc676db3f8d985f383073a8830ce3123424ae9f3563c92e2642226d8620libXrandr-devel-1.5.1-1.el6.x86_64.rpmefb6a83e82af6fc114598b0a2639df6e92f1ca241eec4ea65c15afdf82c1c3falibxcb-doc-1.12-4.el6.noarch.rpmd4f228f0ecf8c6cc63ffe0a95ab390c5892b1eb3bdfb321ca9bb7c5c60f651adlibXvMC-1.0.10-1.el6.x86_64.rpm623af00bd9f134df52d74737a3c3e3cf679b51f87daf5991de01fc00c58402d2libX11-devel-1.6.4-3.el6.x86_64.rpm13621f32e1ae912f820cc4b774ae1853c43645c1241fbd45200970683a98d1b4xcb-proto-1.12-1.el6.noarch.rpm1dcfc4ec6f180a230736873837f5fa11f4dc91715264cba26f1813253dd496aalibXv-1.0.11-1.el6.i686.rpm4e241d4d9f3d3583c88155cf27a2e3c4b8bb0be3b99d5c38e8c0f92fc4385b26libX11-common-1.6.4-3.el6.noarch.rpme150e172456ecdfa04b94d1b51e87bf9734f157aba000ba3aea0b07265faf1b6libxcb-1.12-4.el6.x86_64.rpmf84fc6041aec31fd0683f0f04bae488b82f4e37af38780ce896fcd6deaaeaaf9libXrender-devel-0.9.10-1.el6.x86_64.rpmf0f3f5178304e1be5b6edcd6e7fae8d5d069b95d31a69a0c19293aa40b4ddaaelibxcb-python-1.12-4.el6.x86_64.rpm80c6bd5a18850ab9bc02dc60439de8638a676c40569d037f6cdb4623ca1bd4eflibXvMC-1.0.10-1.el6.i686.rpm90449fb358b2dfa50d7385ea0e9b4e8cfc0246500034ac4f10b44e9ac8cd6b93libXi-devel-1.7.8-1.el6.x86_64.rpm3c479cb52c8dc6c6b93ee8add49ad9fbf5e5dc5d65949bd0b455dd87c4e1e7e6libXfixes-5.0.3-1.el6.i686.rpm1dfddfac566a877e0216d0c141b413cf05d4b27ed772e5d06e9dbf53bb2f1006libXtst-1.2.3-1.el6.x86_64.rpmf3348acd487f37dd2dc597ef2c79b553ecfe3517a8f6a829f9529b4effb50fb6libXfixes-devel-5.0.3-1.el6.x86_64.rpma48c8aac41440a79a9c37c74e95f754dcb08b72c7a20a51d20fdae1e54112a56libxcb-devel-1.12-4.el6.i686.rpm8ffd90bf1e11a21ac34b9a9bd426f7e2b2deca946dfd375ab0fc2a4d79fae8e6libXi-devel-1.7.8-1.el6.i686.rpm4662323d61500018ec5d818f0e06ddbb667fcfec6bdbc7df3b16ae63674ae5f3libXvMC-devel-1.0.10-1.el6.i686.rpm8d0fe522b9e0b1bd527d4bdeed7ec48210d1d7a49942b8ef3579171c0f8a2ce9libXrandr-1.5.1-1.el6.i686.rpmc13506bb3318f1e900ec69804f86cbfb543c061347dc092e2824540a91e44863libXv-1.0.11-1.el6.x86_64.rpm8f7b2eb195e4d706ff1db19ef3988fbac146f04d9c2740b440b73c41c7355341libXtst-1.2.3-1.el6.i686.rpm71d5d8f07dbd1d8f9708c6bf5841c746255c898be9f54d303c40e6caa724e2d5libXv-devel-1.0.11-1.el6.x86_64.rpmf2d68ba4f7a9fb5b751866ebc735ae37699d1b7b98d7b8ffc7183cdc870a3ea3libXrender-devel-0.9.10-1.el6.i686.rpm27c9f398a6550afdfffaf221977485bdcb7fecde5fd6122a44c080c83035db12libXvMC-devel-1.0.10-1.el6.x86_64.rpmf0adae961c3ca719609b69dc088c340f0deb266eac9a11b89f6f44d55c2ecb46libXi-1.7.8-1.el6.i686.rpm19b2eb4d9eff88f1eac56bafbdbb8be9fb9db25adccd72b2171a88feeee11650libXrandr-1.5.1-1.el6.x86_64.rpm8d18a34a38b64ed530454af5d497c13eb29d59e68ff1b2d83e8e341325d4aff4libXrender-0.9.10-1.el6.i686.rpm97162c4b07565ec4e168f868c1cccd813239b4d0fe5f0574eb2722070a499ebdSLBA-2017:0812-1Scientific Linux FermiScientific Linux Fermi 6python-prettytable-0.7.2-11.el6.noarch.rpmb0f94eab5125347f1765762bd9f4c10129cb6745968d4ff2bbc51162b2def377SLBA-2017:0839-1This update adds the following enhancement: * Haiti began daylight saving time (DST) on March 12, 2017.Scientific Linux FermiScientific Linux Fermi 6tzdata-2017b-1.el6.noarch.rpmcce8e6fb65711f66a670c1045de4110a65bfc0f3d4b85442afe6bac36dedac8ctzdata-java-2017b-1.el6.noarch.rpmfcabb622dd0627a7a9e21b60a0071e1dfc013e636757ff0520bb8f2a245bd980SLBA-2017:1434-1* An updated version of libntirpc (1.4.3-4) that contains changes to the transport independent RPC (TI-RPC) library for NFS-Ganesha is included in this package. Since NFS-Ganesha consumes those functions, it is now recompiled against libntirpc-1.4.3.4.Scientific Linux FermiScientific Linux Fermi 6libntirpc-devel-1.4.3-4.el6.x86_64.rpmf15706da9676aa2008cd74f028f768cc0063631d6f87f4885036d43c1c67971blibntirpc-1.4.3-4.el6.i686.rpmaa739173de0c89da88042f870e535b085b38898fc0e87138cdd7f015fe626a91nfs-ganesha-2.4.1-11.el6.x86_64.rpma0b8ee4f4e85170551b472e0a3b10b181e95c567a0ccc07e348a9e4b2f8ff203libntirpc-devel-1.4.3-4.el6.i686.rpm61b1482b67b4bc65c3ec6eedac7610335172b4369167a3636d4f120fc3b1e089nfs-ganesha-gluster-2.4.1-11.el6.x86_64.rpm8d1d58815c14b5b22261855e392bc40e0ba5fc8b70a2beef2185478294c8090blibntirpc-1.4.3-4.el6.x86_64.rpm267398c6f4f82f1e4dc12e499972508a9811c66798cfa56f2302ad19599d6febSLBA-2017:1435-1This update fixes the following bug: * Prior to this update, the rpcbind utility terminated unexpectedly on start. A patch has been applied, and rpcbind now starts as expected.Scientific Linux FermiScientific Linux Fermi 6rpcbind-0.2.0-13.el6_9.1.x86_64.rpm9a8fcfa50f5b9d9bef59d1af2266af4952ad8956f644b56068f07362144e06e6SLBA-2018:0176-1Scientific Linux FermiScientific Linux Fermi 6selinux-policy-targeted-3.7.19-307.el6_9.3.noarch.rpm95423e3b58cc925b5a358890bedd91f31454e27b968fabca5fd8f091373254e2selinux-policy-doc-3.7.19-307.el6_9.3.noarch.rpmba63efd959353ba6c550f8dd623aee421da76cd9b93e18df71bca5760d199e12selinux-policy-3.7.19-307.el6_9.3.noarch.rpmcdbf6e7669e5d5f1a21068eb68125c559ff0b471ba26d51256027df7950db09bselinux-policy-minimum-3.7.19-307.el6_9.3.noarch.rpm0a01da2f03e640243879ffe83610ca1da8bb70bda284221db154eb9de7754c1bselinux-policy-mls-3.7.19-307.el6_9.3.noarch.rpm91ad7b260c80b7cef0ba31e3922f18eb53e022b02fa8bbdaa6c5a8ff1f0e3948SLBA-2018:0597-1* The Antarctica/Casey time zone has been changed from UTC+11 to UTC+8.Scientific Linux FermiScientific Linux Fermi 6tzdata-2018d-1.el6.noarch.rpmb0311e8b6f5dc1b3944f1de7961e85bd237abc109eebda3fa51c40dc8e33d4d7tzdata-java-2018d-1.el6.noarch.rpm155eef77fc54cb05c666c1b5a742488d2aab7adbe2c7d486c4d61e8f5d6ca01bSLBA-2018:1339-1* In this update, the upstream project now defaults to using the "vanguard" data implementation which includes negative DST offsets. However, we are continuing to provide the "rearguard" format for data which does not use negative DST offsets to provide better compatibility with existing tools. We intend to transition to the "vanguard" data implementation in the future.Scientific Linux FermiScientific Linux Fermi 6tzdata-java-2018e-3.el6.noarch.rpm40fb5cb634cedda909a94696ce1f83da58b67dafc599b8ec342db293b9871368tzdata-2018e-3.el6.noarch.rpmf7e03d38a6de62a054de45a2db10340f06a9a4e30d9d1c80314fbe6cfc0bb050SLBA-2018:1857-1Scientific Linux FermiScientific Linux Fermi 6copy-jdk-configs-3.3-9.el6.noarch.rpm3265471cef84f21333bce8cf101268b52cc7f6fa5fdc136ecbf9de61dd9d02e9SLBA-2018:1923-1Scientific Linux FermiScientific Linux Fermi 6clufter-common-0.77.1-1.el6.noarch.rpm389e5b2cce8fb7ab6ba9b39c28b18bd0644221daf28822e7d7e088644eb22558clufter-lib-pcs-0.77.1-1.el6.noarch.rpm4a497cae3fab4d2d531668a02d125f74c4e1a983b45980bc46308606deda709cpython-clufter-0.77.1-1.el6.noarch.rpm3fcabeebdbf603bb3eafcba40097095d9d7a5ea062e4835ff5bd2b6255724ce3clufter-bin-0.77.1-1.el6.x86_64.rpmfd243027eee983fb2f0162e70a89bcbd5abec6eb141373ec79f3109f7c5e63c9clufter-lib-general-0.77.1-1.el6.noarch.rpm5857472ac34d33a8e087f4da84d34ed4d4d2607a59075bb0df81446e66511cf3clufter-cli-0.77.1-1.el6.noarch.rpm2250b16cc8a423dd2304b30d5fa3c8deac5917ed6557626bc5506af9880f31adclufter-lib-ccs-0.77.1-1.el6.noarch.rpme633dbc982b69031eab0027926cf39eea7e53abb357441b0f881625fa0529399SLBA-2018:3013-1* The Pacific/Fiji time zone will end Daylight Saving Time (DST) on January 13, 2019 rather than January 20, 2019. * Most regions in Chile will end Daylight Saving Time (DST) on the first Sunday in April, 2019.Scientific Linux FermiScientific Linux Fermi 6tzdata-java-2018f-1.el6.noarch.rpm92b0d5fce4699b908a80d999f188607d82d1e284ec4e219ca1a1e840b31d4c00tzdata-2018f-1.el6.noarch.rpmf0da448a10ba632c51d202b7889cd86ee06d2fe891e30282e2b31d44c2b4fd7aSLBA-2018:3454-1Scientific Linux FermiScientific Linux Fermi 6tzdata-java-2018g-1.el6.noarch.rpm2fb8cb6851408affdaafa8881f9fdb109c22d10226edaa8bdae769523c025baetzdata-2018g-1.el6.noarch.rpmdd6914d95ecc991db1d1a76a6d8c6d831e1c6ca386ccc5189abe9e2399a5660aSLBA-2019:0037-1The tzdata packages have been updated to version 2018i, which addresses recent time zone changes. Notably: * Africa/São Tomé and Príncipe changed from UTC+01 to UTC+00 on January 01, 2019. * Asia/Qyzylorda, Kazakhstan changed from UTC+06 to UTC+05 on December 21, 2018. * A new time zone, Asia/Qostanay, has been created because Qostanay, Kazakhstan did not transition with the Asia/Qyzylorda change. * America/Metlakatla, Alaska will observe Pacific Standard Time (PST) for this winter only. * Updates to Asia/Casablanca have been implemented based on a prediction that Morocco will continue to adjust clocks around Ramadan. * Changes to Asia/Tehran have been made based on predictions for Iran from 2038 through 2090.Scientific Linux FermiScientific Linux Fermi 6tzdata-2018i-1.el6.noarch.rpm60e2001038dfb303134d64a9068f1544d239b0ddca9c382a09982fa4cbdf3775tzdata-java-2018i-1.el6.noarch.rpm5a741f8213fd65ad537f949d2006bf2878358e743726a8e5844316a62c35b0a9SLBA-2019:0689-1The tzdata packages have been updated to version 2019a, which addresses recent time zone changes. Notably: * The Asia/Hebron and Asia/Gaza zones will start DST on 2019-03-30, rather than 2019-03-23 as previously predicted. * Metlakatla rejoined Alaska time on 2019-01-20, ending its observances of Pacific standard time.Scientific Linux FermiScientific Linux Fermi 6tzdata-java-2019a-1.el6.noarch.rpm09657e7344eb2c6f84d4f463481576d59b7a5dc54c76f86057c8edbb3615ccd5tzdata-2019a-1.el6.noarch.rpm988fc743347abada03a088728a3e751d7e0577ef016442fdb16bda5480454228SLBA-2019:1227-1This update fixes the following bug: * The spice-vdagent is not starting and spice is opening thousands of unix sockets.Scientific Linux FermiScientific Linux Fermi 6spice-vdagent-0.14.0-13.el6_10.1.x86_64.rpmd4e0eca00617843037c8723de659f94c0a6243e9c14013150e504cbfebfcacafSLBA-2019:1651-1* dentry with DCACHE_SHRINKING set but no task shrinking dcacheScientific Linux FermiScientific Linux Fermi 6kernel-headers-2.6.32-754.17.1.el6.x86_64.rpm779d46ae0df85342bb368f7a2c121fb85791d03e2d38e6f22c97df7016e2bd76kernel-firmware-2.6.32-754.17.1.el6.noarch.rpmd6eb649785de43e9eaabcc5b18bd4c9405cfd2ff40524467703ba5d63eb615f9kernel-2.6.32-754.17.1.el6.x86_64.rpmfe3fc89db662155457a5ce9bc11ac57a874bf6f4423d12ec386a604a3ba01725kernel-debug-devel-2.6.32-754.17.1.el6.i686.rpm6d04b7de6f99a043663bf889f4f4a1f108bd72960e6ae60a25eb40a8ce5021a3kernel-doc-2.6.32-754.17.1.el6.noarch.rpmd93f41a04c12482def9428979c1111bbd32d3366de833f6af0269ee8e77d1f6bkernel-debug-devel-2.6.32-754.17.1.el6.x86_64.rpm4eb851b6f5ae742860efff1e8fb2c2b61cd062251d929ad8c17a829a20f5c975perf-2.6.32-754.17.1.el6.x86_64.rpm5b265e92aba4ec9d70ce8a25e47045b7609e6cf8a01af7e9279d36a5673bf831kernel-abi-whitelists-2.6.32-754.17.1.el6.noarch.rpm6c25ef94a9ebc45d194d41b66918917019c5f3d25e72eae9d72243f4ff902a38kernel-debug-2.6.32-754.17.1.el6.x86_64.rpm7f59f6e0bbaee275a463847d773b7e560c102e35299d18019de513d84c237849kernel-devel-2.6.32-754.17.1.el6.x86_64.rpm01c5df3b945b468d025615c432794faa9d432006bcba62fa0e3dbe0c66166bcdpython-perf-2.6.32-754.17.1.el6.x86_64.rpm1919f274b8cf4b298dd049c61cb68f84eceff2011c04e76305d145aec2e9c72fSLBA-2019:1703-1* The 2019 spring DST transition for Palestine occurred on March 29, not March 30.Scientific Linux FermiScientific Linux Fermi 6tzdata-java-2019b-2.el6.noarch.rpm7008f8ae57c82cb201946f2fc12167249b4373a78bd8ffe548f9d63fb1099037tzdata-2019b-2.el6.noarch.rpm6f36b7d2cf5955cf97d56e2a64c64941cf74133b2f4425a9c97afdc037794563SLBA-2019:2871-1The tzdata packages have been updated to version 2019c, which addresses recent time zone changes. Notably: * Fiji will observe the daylight saving time (DST) from November 10, 2019 to January 12, 2020. * Norfolk Island will start to observe Australian-style DST on November 06, 2019.Scientific Linux FermiScientific Linux Fermi 6tzdata-java-2019c-1.el6.noarch.rpm6674b8c0d3301c748fe7b73ebfe17a14974cde36deb4d81ed6fa2742f85b868atzdata-2019c-1.el6.noarch.rpma39f2001bf8cfc0be237ccf50a9ace47f164e735c182ab8b5d999c2e637764eaSLBA-2020:1982-1The tzdata packages have been updated to version 2020a, which addresses recent time zone changes. Notably: In Morocco (the Africa/Casablanca time zone), daylight saving time starts on 2020-05-31 instead of on 2020-05-24. Canada's Yukon region (the America/Whitehorse and America/Dawson time zones) changed to a year-round UTC-07 time on 2020-03-08. The America/Godthab time zone has been renamed to America/Nuuk.Scientific Linux FermiScientific Linux Fermi 6tzdata-2020a-1.el6.noarch.rpm8b0c71c5689666a060de7b991d6d8c7ac2f5a903d8b42af4da0bef2812bcfe63tzdata-java-2020a-1.el6.noarch.rpmacc38f1677f866ea1fd1f115ecb9a4ed831d7a5b7ccda6b6effaf7a314659c4dSLBA-2020:4282-1The tzdata packages have been updated to version 2020b, which addresses recent time zone changes. Notably: * Yukon timezones represented by America/Whitehorse and America/Dawson will change time zone rules from -08/-07 to permanent -07 on November 01, 2020, not on August 03, 2020, contrary to what was in the version 2020a. * The most recent winter(+08)/summer(+11) transition for Casey Station, Antarctica was on April 04, 2020 at 00:01. * Obsolete pacificnew, systemv, and yearistype.sh files have been removed from the distribution.Scientific Linux FermiScientific Linux Fermi 6tzdata-2020b-2.el6.noarch.rpm45de9b5c05f500bb9f37ce3cf655437c91f107403bc843fe9ee441a5d2140d7etzdata-java-2020b-2.el6.noarch.rpm3c911a314eea6f7ab5633bbb68684d444288a2b595d69b2ff0bae0f9bf45fd34SLBA-2020:4329-1The tzdata packages have been updated to version 2020d, which addresses recent time zone changes. Notably: * Fiji starts the daylight saving time (DST) later than usual on December 20, 2020, rather than the predicted November O8, 2020. * Palestine will end summer time on October 24, 2020 rather than the predicted October 31, 2020.Scientific Linux FermiScientific Linux Fermi 6tzdata-2020d-1.el6.noarch.rpm32d9a91f4702285b3295efd420d69823bbeeefa05251da72f3fbae6a61771a7ctzdata-java-2020d-1.el6.noarch.rpm4d2f476832375f815cf1b39ef3c4e03c526f6b188af7f71d12a3d7e94f222e3cSLEA-2016:0683-1This update adds the following enhancements: * Asia/Magadan will switch from UTC+10 to UTC+11 on April 24, 2016 at 02:00. * America/Caracas will switch from UTC-0430 to UTC-04 on May 01, 2016 at 02:30. * New zone Asia/Tomsk, split off from Asia/Novosibirsk. It covers Tomsk Oblast, Russia, which will switch from UTC+06 to UTC+07 on May 29, 2016 at 02:00.Scientific Linux FermiScientific Linux Fermi 6tzdata-java-2016d-1.el6.noarch.rpmb72e66822289ec86634a58254c10abbf736bd689dfa8d4a55f3ec82ff9469230tzdata-2016d-1.el6.noarch.rpm3a7d2866fe4e8248ab873f448c080c24a6b72883797e54dd1e772acbd9f53e49SLEA-2016:1388-1Prior to this update, the data files provided by the tzdata package reflected the Egyptian government's plan to transition to daylight saving time (DST) on July 7, but the Egyptian government canceled the planned transition. This update provides tzdata data files that reflect the change of plans, and will thus provide correct time zone information. This update also includes a time zone transition for Asia/Novosibirsk from +06 to +07 on 2016-07-24 at 02:00.Scientific Linux FermiScientific Linux Fermi 6tzdata-2016f-1.el6.noarch.rpm1dcd62e1849aaa713a6810fd035249ee87bbce7699b999c7cd3c191a623160fatzdata-java-2016f-1.el6.noarch.rpm90bafdab03dd8bfc164b11cdab3460f3f871e41ccc991d08e489d1c43048eb06SLEA-2016:1982-1The tzdata packages have been upgraded to upstream version 2016g, which provides a number of enhancements over the previous version, notably: * This update takes into account that Turkey will not transition out of the DST (+03) time zone on 2016-10-30. * A new leap second will be added on 2016-12-31 23:59:60 UTC, as specified in the IERS Bulletin C 52.Scientific Linux FermiScientific Linux Fermi 6tzdata-java-2016g-2.el6.noarch.rpmf05a0748d6094749a630ee15fb572c95f69131b501c01d55aa2f247778b0899atzdata-2016g-2.el6.noarch.rpmbe4a9bed9b24b583eaa5f179d6d2670f34c52244837220e77990c3d9aca354a0SLEA-2016:2832-1The tzdata packages have been updated as follows: * The Saratov region of Russia will transition from UTC+03 to UTC+04 on 2016-12-04, resulting in a new time zone Europe/Saratov.Scientific Linux FermiScientific Linux Fermi 6tzdata-java-2016j-1.el6.noarch.rpmaae05e4f273d56b65a995ee9b66f365e8d131e51137efb4444c2a3bb8368c55ftzdata-2016j-1.el6.noarch.rpm19166b1b76c7f8f8fe6270bc8f4c1cc2240448a3a12f174c5f8b9c2810bf814cSLEA-2017:0671-1Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications.Scientific Linux FermiScientific Linux Fermi 6nspr-4.13.1-1.el6.i686.rpm31ad93d87ec3d49c3aa20d7e249e6f98da687e2be9d77897411065ebb8b29b42nspr-4.13.1-1.el6.x86_64.rpmb2f9b35b83037e478d7fa9414d64ac61657eb4d1aad67693aec28fdcf8e4e6e2nspr-devel-4.13.1-1.el6.x86_64.rpm43063ee9e9cb53bab90ca9a3f4a531e38594aeacd035d92371578997841ae79anspr-devel-4.13.1-1.el6.i686.rpmf4f309881bfa4c15f55c075b10b0d60f6f082d5c22d2cde509933553ee3e93cbSLEA-2017:0890-1The nss-util and nss packages have been upgraded to upstream version 3.28.3, which provides a number of bug fixes and enhancements over the previous version.Scientific Linux FermiScientific Linux Fermi 6nss-util-3.28.3-1.el6_9.x86_64.rpma73df1f8525552a09fde4cec06a4a7437f61db90897a76682a5e5ef0cfe8fe43nss-pkcs11-devel-3.28.3-3.el6_9.i686.rpm8697078f567eaa7fc24ca4ceeb358539f0e7f4aa8b677907c8280596d7468b72nss-sysinit-3.28.3-3.el6_9.x86_64.rpm687b09ef5d6f64a09d9102590cc6589690f0df819bb598402113d0d9defbaa53nss-devel-3.28.3-3.el6_9.x86_64.rpm99a53b9e76944ef265460a9af6923267a6580a244374106496aa51a7bf6f1c81nss-tools-3.28.3-3.el6_9.x86_64.rpm253403606974743f2abc40f8e639f986753e74943e94d51c922b7c9d63dce2b7nss-util-devel-3.28.3-1.el6_9.i686.rpm14d4aa8a9db94e6f7e6d602ca7035bcdc0af923dfdae46ed5ede9c30802f277bnss-3.28.3-3.el6_9.i686.rpm7cc5549f4579ec949595a04218a940b1a374e06b548b560adad9a037f3ae00f5nss-pkcs11-devel-3.28.3-3.el6_9.x86_64.rpm573397cc90a5e7ff9dc9d396b2532043359ef239183943bedd703b0e8e48148anss-devel-3.28.3-3.el6_9.i686.rpmae63529e5db2fa9582131bbbb98bc449442e2786a033b39266cab1c9eec334a4nss-util-devel-3.28.3-1.el6_9.x86_64.rpmf3254c7e1fbfe4eeae07795a2d880ab2081bacda8903f7ac1bd82ebc618574ccnss-3.28.3-3.el6_9.x86_64.rpmc39d7226c9b942d3040094d8f821b3be1e6c3bf57e133226ca94ed66b64dd232nss-util-3.28.3-1.el6_9.i686.rpm960d21d2f16a920a6a6e211873eb94ea1c1f92daf866d3b750b5bf7fcd17f972SLEA-2017:3052-1* Sudan will switch from UTC+03 to UTC+02 on November 1, 2017. * Tonga will no longer use DST (Daylight Saving Time). This change takes effect on November 5, 2017. * Fiji ends DST on January 14, 2018 instead of January 21, 2018. * Namibia, on September 3, 2017 will switch from UTC+01 with DST to UTC+02 around the year. This change takes effect on April 1, 2018. * On March 11, 2018, the Turks and Caicos Islands will change from UTC-04 to UTC-05 with US DST starting on March 11, 2018. Effective change date is November 4, 2018. * tzdata now includes two text versions of the time zone data: the "tzdata.zi" and "leapseconds" files.Scientific Linux FermiScientific Linux Fermi 6tzdata-2017c-1.el6.noarch.rpmc42f3d1defe0ae10931a797df80bbdd7d6973b4b48b586117c7880e683154835tzdata-java-2017c-1.el6.noarch.rpm70d1973c6bed76f1fd8c34e8202bace484f5934e816ff4f9754ceb9936e5ce72SLEA-2018:0232-1* Brazil's Daylight Saving Time (DST) will start on the first Sunday in November. * Support has been added for the "-t" option for the zic utility. This enables the user to put the configuration link in the specified file instead of the standard location.Scientific Linux FermiScientific Linux Fermi 6tzdata-java-2018c-1.el6.noarch.rpm9de078f2470d37c30f16a4285dc0b5edd1bb5ee3e78ce13131170778cffe62f3tzdata-2018c-1.el6.noarch.rpm1c881e691d7705bc094334b7863df3425281ef8fca91f469635a060f05aca5c0SLEA-2018:1580-1Scientific Linux FermiScientific Linux Fermi 6microcode_ctl-1.17-25.6.el6_9.x86_64.rpm347bbec26dda08c13b94ab38591eba0f132c01dda4ded9f85a36d9ca4734fc43SLEA-2018:1865-1Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. The nss-util packages provide utilities for use with the Network Security Services (NSS) libraries.Scientific Linux FermiScientific Linux Fermi 6nss-pkcs11-devel-3.36.0-8.el6.x86_64.rpm0aee85a49488ff785837a1ed8c0ac179392fe2b7702150c6058b2695b400f039nss-sysinit-3.36.0-8.el6.x86_64.rpm628bcd1b619465858e8d9b8f7dd07f689a0b645ab120a1f4c570a2a6992f0e1bnss-util-devel-3.36.0-1.el6.x86_64.rpm160b32f280e5d9e7e8d7bd28f2c77f984bc1dabfc67c2f270ea2a970df7b4677nspr-4.19.0-1.el6.x86_64.rpm32e7477bb01f399ad168b50889bbfc146d47efc6d64019f90a0c380691b975d7nspr-devel-4.19.0-1.el6.x86_64.rpm1214b86f9b6c67b2a3e9f61006557193796f0cd3bae9a10764dea3fa3490e5c2nspr-4.19.0-1.el6.i686.rpm60d40c88c7221813bcec0ceca5f8a07d850f933940c14cd19502685d7b583dc2nss-devel-3.36.0-8.el6.i686.rpme7e436d23ae1ecd3e63654c4cdcae3bf954f4ffc11caa84686d0272d3846012enss-devel-3.36.0-8.el6.x86_64.rpma609ef592f8d3c92d037f2fbb1bce69d7e1448b44487501e2c97746cb2e175eenss-tools-3.36.0-8.el6.x86_64.rpmd64887bb22a470a609151dea4540c064863a3e2363f810e6df8a7ee530d71369nss-3.36.0-8.el6.i686.rpm4a1bc97a7418714dc51bbf0684a5f1b1c6f3a27af7e3c1475d8f0b4c43991606nss-pkcs11-devel-3.36.0-8.el6.i686.rpmee086e9969f44c0e2e751191bfe182ff9da745839d4138f82861392531017a7dnss-util-3.36.0-1.el6.i686.rpmca0a5ca9aed228b393ee1d2e5fd89c0f40e76f196c210d211cd900c675837d18nss-3.36.0-8.el6.x86_64.rpm49d95a57783e1a641decdae6953b3930ae5726fd1689f543de8ff152cee67681nss-util-devel-3.36.0-1.el6.i686.rpm3974f0df1ad1e11b76134500efea0088dc5b0287a143b0fbf76cf0865005fb83nss-util-3.36.0-1.el6.x86_64.rpm8c5ab3b598a2b2496e49418fc6a34187f4ae6729e51ef77a754fa48216d48583nspr-devel-4.19.0-1.el6.i686.rpm656406402782c64b31d0d4cd33831a0d4d74ae74e5fcc664116482de27402dddSLEA-2019:1212-1This update adds the following enhancement: * The Intel CPU microcode has been updated to the latest upstream version to mitigate CVE-2018-12126, CVE-2018-12126, CVE-2018-12126, and CVE-2019-11091.Scientific Linux FermiScientific Linux Fermi 6microcode_ctl-1.17-33.11.el6_10.x86_64.rpmceeb75fb9b4f646cb4ccb3820dc0e6c3d1088560c5ccf310eb7c88931bd5aa2aSLEA-2019:3280-1The nss, nss-softokn and nss-util packages have been upgraded to upstream versions 3.44, and the nspr packages have been upgraded to upstream version 4.21. The upgraded versions provide a number of bug fixes and enhancements over the previous versions. Notably, these upgrades allow users to upgrade to Mozilla Firefox 68 Extended Support Release.Scientific Linux FermiScientific Linux Fermi 6nspr-4.21.0-1.el6_10.x86_64.rpm4a84d5e7737013cd6275743c31400f66ca7ffd8a7974681bf9b8c51ee9dcc8b7nss-util-devel-3.44.0-1.el6_10.x86_64.rpm409c22abd517d4624c6796e0a79289a62a726beba640ecdd078ec0555d7fe8b6nss-devel-3.44.0-7.el6_10.x86_64.rpmeaeec6525c1491c5a2e07189c092b5f96de29245ab88265323182f267e4a0ab5nss-3.44.0-7.el6_10.i686.rpm7cbd70bef055e0a871668e47ae1776c67a1a03bd86da3ff2ed88c5186e374539nss-util-3.44.0-1.el6_10.x86_64.rpmcdf0824fb34f00c118afc642f4498624a2892f92807cbf51dca9fc0a06930578nss-softokn-devel-3.44.0-5.el6_10.x86_64.rpm56264e297a333d2c4b1945c40d769d651707779eccc2a9d2f6f1bdea718affe1nss-tools-3.44.0-7.el6_10.x86_64.rpm241b9717428f59d940bc700c49f4157139e8ec6774b53a28b5da84635a8bb7b0nss-softokn-freebl-devel-3.44.0-5.el6_10.i686.rpm9a5978576dc18065ac5080ce9c925d5ca9cca66e2d67e068daf38cbf70a4eaadnss-util-3.44.0-1.el6_10.i686.rpm609f04ec4a2525a0d8d9a07b2ee809fea3ca69c1fc8344e4edf085c4eba37769nss-pkcs11-devel-3.44.0-7.el6_10.x86_64.rpm347f89d087fab209c6038d530e186ee540cbd900f18206cb06b1f42c378ea736nss-devel-3.44.0-7.el6_10.i686.rpmf5cc0e653315b63ed8f33b022a23930206be9436d42ad2a4c3afe9bcc5bfe820nspr-4.21.0-1.el6_10.i686.rpm3ec55d700846f9f7e59f2203aed75413c3393a4518541e28d30eae1594d03b98nss-3.44.0-7.el6_10.x86_64.rpmd6cc947dbb89aef1e0b654d81e9dfd2da66e428a7ee56640b7087471788c8dd1nss-softokn-freebl-3.44.0-5.el6_10.i686.rpm3ef47aa10369ef5e10b78e6e4d6871c8992140b3876acf2e67fda9822f68b021nss-util-devel-3.44.0-1.el6_10.i686.rpm63024af655b77fc6ac02b9548d5808451204a6226a1c702118ed8dcf1ce701a6nss-softokn-freebl-3.44.0-5.el6_10.x86_64.rpm3c935efd6af55e816e2c6e3f33452b389e2cc44b0e2a7db2f51be6d43b0541d0nspr-devel-4.21.0-1.el6_10.i686.rpm371c05559f0ebb77332c15478ef85f3febc3ab84a5cf77f08f1f3a6325985f33nss-softokn-freebl-devel-3.44.0-5.el6_10.x86_64.rpm8599d4352d0f052d5a3dc9f3215d8a56ff149c661c2ed421ce887d7db4edbdadnss-softokn-3.44.0-5.el6_10.i686.rpm5f346059c0b817e31dd71c56b780c8c08f6d501a5bf6c5177eb8b72d91b7c83anss-softokn-devel-3.44.0-5.el6_10.i686.rpm7cd6baf9f77fe0889bd3df37ba0b69d1a8098718c9adda2cf6ab1d95f721602cnss-pkcs11-devel-3.44.0-7.el6_10.i686.rpmc9ec26643fab67c23805dacaeceab64d9677edd959e2876ca109ec12a6265ec7nspr-devel-4.21.0-1.el6_10.x86_64.rpm276317affc7ec5db3dd23ab75ca247950401ca7cb7007c29edc7760fb14c6c4fnss-sysinit-3.44.0-7.el6_10.x86_64.rpm0428f3a5ae8f97960b4293aa0a2de1960689be608a7012fe62e86e2424a24bd6nss-softokn-3.44.0-5.el6_10.x86_64.rpmeddfa7f812a495fbc5ab980e6f2f41cfb26888bdd4f1f4eeec86036b6a525dd3SLSA-2016:0675-1Security Fix(es): * Multiple flaws were discovered in the Serialization and Hotspot components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions. (CVE-2016-0686, CVE-2016-0687) * It was discovered that the RMI server implementation in the JMX component in OpenJDK did not restrict which classes can be deserialized when deserializing authentication credentials. A remote, unauthenticated attacker able to connect to a JMX port could possibly use this flaw to trigger deserialization flaws. (CVE-2016-3427) * It was discovered that the JAXP component in OpenJDK failed to properly handle Unicode surrogate pairs used as part of the XML attribute values. Specially crafted XML input could cause a Java application to use an excessive amount of memory when parsed. (CVE-2016-3425) * It was discovered that the Security component in OpenJDK failed to check the digest algorithm strength when generating DSA signatures. The use of a digest weaker than the key strength could lead to the generation of signatures that were weaker than expected. (CVE-2016-0695) Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website.criticalScientific Linux FermiScientific Linux Fermi 6java-1.7.0-openjdk-devel-1.7.0.101-2.6.6.1.el6_7.x86_64.rpm029bea465d991b6432e02d86a10b9aadf71656c52b510393b55783b5c8378930java-1.7.0-openjdk-javadoc-1.7.0.101-2.6.6.1.el6_7.noarch.rpm3030c2513883d0cd33a7362b2acd90698987e4f1e3bd4ee604dad51ea97f0bd5java-1.7.0-openjdk-src-1.7.0.101-2.6.6.1.el6_7.x86_64.rpm1b6776f3b47f930d7ded2fc61439b094607ade0e348cdbcb504a5feb6ee24079java-1.7.0-openjdk-1.7.0.101-2.6.6.1.el6_7.x86_64.rpm7b0def1935cae9b265047885daf33ffce9a8d9128d3d6254dc0137e8554c8eeajava-1.7.0-openjdk-demo-1.7.0.101-2.6.6.1.el6_7.x86_64.rpmc9156c82949acb4a125cf6915f01c3c6d88fb4a8b169b8563bf775b1c63d3293SLSA-2016:0695-1This update upgrades Firefox to version 45.1.0 ESR. Security Fix(es): * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2016-2805, CVE-2016-2806, CVE-2016-2807, CVE-2016-2808, CVE-2016-2814)criticalScientific Linux FermiScientific Linux Fermi 6firefox-45.1.0-1.el6_7.x86_64.rpme1a8896294604abd3ae497571cc3110a42949b38677a422d3c30471c747cc29dfirefox-45.1.0-1.el6_7.i686.rpmf8d450d7c4917ad6cbcb888e8e6f2fa18f84ebcf30bb4960a04453daa34abe39SLSA-2016:0723-1Security Fix(es): * Multiple flaws were discovered in the Serialization and Hotspot components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions. (CVE-2016-0686, CVE-2016-0687) * It was discovered that the RMI server implementation in the JMX component in OpenJDK did not restrict which classes can be deserialized when deserializing authentication credentials. A remote, unauthenticated attacker able to connect to a JMX port could possibly use this flaw to trigger deserialization flaws. (CVE-2016-3427) * It was discovered that the JAXP component in OpenJDK failed to properly handle Unicode surrogate pairs used as part of the XML attribute values. Specially crafted XML input could cause a Java application to use an excessive amount of memory when parsed. (CVE-2016-3425) * It was discovered that the Security component in OpenJDK failed to check the digest algorithm strength when generating DSA signatures. The use of a digest weaker than the key strength could lead to the generation of signatures that were weaker than expected. (CVE-2016-0695)criticalScientific Linux FermiScientific Linux Fermi 6java-1.6.0-openjdk-demo-1.6.0.39-1.13.11.0.el6_7.x86_64.rpm8cadc6adcb4070fb2b09ceb61cf9ae8fd530d8b88733165e9359028ec80b2658java-1.6.0-openjdk-javadoc-1.6.0.39-1.13.11.0.el6_7.x86_64.rpmd308eff2c307afcf0754a4b5c021d1d6b8a189765a6162cdeaed28026c63c729java-1.6.0-openjdk-src-1.6.0.39-1.13.11.0.el6_7.x86_64.rpm4a20398d1463a4c3f9aac566e1f151d732c25436f380d8651c9ded6bf927edc0java-1.6.0-openjdk-devel-1.6.0.39-1.13.11.0.el6_7.x86_64.rpme5a59eab551f47125898dbc5a7472f3151ad302e0953c694d3a0ff1800a78863java-1.6.0-openjdk-1.6.0.39-1.13.11.0.el6_7.x86_64.rpmc89ff663fb06bf73fcb30f60dc7623f8f5a77d59917384e717722f1df3c78705SLSA-2016:0996-1Security Fix(es): * A flaw was found in the way OpenSSL encoded certain ASN.1 data structures. An attacker could use this flaw to create a specially crafted certificate which, when verified or re-encoded by OpenSSL, could cause it to crash, or execute arbitrary code using the permissions of the user running an application compiled against the OpenSSL library. (CVE-2016-2108) * Two integer overflow flaws, leading to buffer overflows, were found in the way the EVP_EncodeUpdate() and EVP_EncryptUpdate() functions of OpenSSL parsed very large amounts of input data. A remote attacker could use these flaws to crash an application using OpenSSL or, possibly, execute arbitrary code with the permissions of the user running that application. (CVE-2016-2105, CVE-2016-2106) * It was discovered that OpenSSL leaked timing information when decrypting TLS/SSL and DTLS protocol encrypted records when the connection used the AES CBC cipher suite and the server supported AES-NI. A remote attacker could possibly use this flaw to retrieve plain text from encrypted packets by using a TLS/SSL or DTLS server as a padding oracle. (CVE-2016-2107) * Several flaws were found in the way BIO_*printf functions were implemented in OpenSSL. Applications which passed large amounts of untrusted data through these functions could crash or potentially execute code with the permissions of the user running such an application. (CVE-2016-0799, CVE-2016-2842) * A denial of service flaw was found in the way OpenSSL parsed certain ASN.1-encoded data from BIO (OpenSSL's I/O abstraction) inputs. An application using OpenSSL that accepts untrusted ASN.1 BIO input could be forced to allocate an excessive amount of data. (CVE-2016-2109)importantScientific Linux FermiScientific Linux Fermi 6openssl-1.0.1e-48.el6_8.1.i686.rpm48192dd8c69b530522da04e582c5738fb59023e8a13958190286c7ad7ddbe87aopenssl-1.0.1e-48.el6_8.1.x86_64.rpm793cb586a8a3a39bc7c0f75dc62578edc414f97f067d52f762d46ee6b4074ee4openssl-static-1.0.1e-48.el6_8.1.x86_64.rpmd0ea66445ddae2c7db70d859dd67b4ec60c24bd53dd68a988c21e6bfbbd454dcopenssl-perl-1.0.1e-48.el6_8.1.x86_64.rpm9f6ee15d9c3eccbe0321f2ce234948690089c1e15fd34b9b0ebf09ecd87a61a0openssl-devel-1.0.1e-48.el6_8.1.i686.rpm7ecba0da895cb2359ce4e64e29487dd84c131f375ffcfbea43c6b8eaff058f4copenssl-devel-1.0.1e-48.el6_8.1.x86_64.rpm1828e10b33d8a29a927ab991df2e94bbd2a7dfaff474e2346b2db0fc8f921413SLSA-2016:0997-1Security Fix(es): * An out-of-bounds read/write access flaw was found in the way QEMU's VGA emulation with VESA BIOS Extensions (VBE) support performed read/write operations via I/O port methods. A privileged guest user could use this flaw to execute arbitrary code on the host with the privileges of the host's QEMU process. (CVE-2016-3710)importantScientific Linux FermiScientific Linux Fermi 6qemu-kvm-0.12.1.2-2.491.el6_8.1.x86_64.rpme22fb36fd79844840eb81794604a3ce060e71833c78d410693b20d3d9126d125qemu-kvm-tools-0.12.1.2-2.491.el6_8.1.x86_64.rpm33213bcab102e3a1de21bde7c218d53f3fd78e237609deb94fa9c0a7db680d87qemu-guest-agent-0.12.1.2-2.491.el6_8.1.x86_64.rpme9df85f41b0e6bf804f5b6d2fd5f0d5a7cfd2bca742370de6ade9e3e9d0f5d1cqemu-img-0.12.1.2-2.491.el6_8.1.x86_64.rpm03f83d6d260ef7b8fa5eb1219548e540b716240a79a4f36eb9027a445a08c226SLSA-2016:1041-1This update upgrades Thunderbird to version 38.8.0. Security Fix(es): * Two flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2016-2805, CVE-2016-2807)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-38.8.0-2.el6_8.x86_64.rpmfcfd4ba512c23ce3c1e80c6d9a56d27d330781a13143cb99dcf62f6645416ae3SLSA-2016:1138-1Security Fix(es): * A buffer overflow flaw was found in the way the Squid cachemgr.cgi utility processed remotely relayed Squid input. When the CGI interface utility is used, a remote attacker could possibly use this flaw to execute arbitrary code. (CVE-2016-4051) * Buffer overflow and input validation flaws were found in the way Squid processed ESI responses. If Squid was used as a reverse proxy, or for TLS/HTTPS interception, a remote attacker able to control ESI components on an HTTP server could use these flaws to crash Squid, disclose parts of the stack memory, or possibly execute arbitrary code as the user running Squid. (CVE-2016-4052, CVE-2016-4053, CVE-2016-4054) * An input validation flaw was found in Squid's mime_get_header_field() function, which is used to search for headers within HTTP requests. An attacker could send an HTTP request from the client side with specially crafted header Host header that bypasses same-origin security protections, causing Squid operating as interception or reverse-proxy to contact the wrong origin server. It could also be used for cache poisoning for client not following RFC 7230. (CVE-2016-4554) * An incorrect reference counting flaw was found in the way Squid processes ESI responses. If Squid is configured as reverse-proxy, for TLS/HTTPS interception, an attacker controlling a server accessed by Squid, could crash the squid worker, causing a Denial of Service attack. (CVE-2016-4556)moderateScientific Linux FermiScientific Linux Fermi 6squid-3.1.23-16.el6_8.4.x86_64.rpm16a7fd2ff1bb1c043bbd1c5ce7f1b6e955ef47a8fbc26a0c98fbba31b3c798d7SLSA-2016:1140-1Security Fix(es): * A buffer overflow flaw was found in the way the Squid cachemgr.cgi utility processed remotely relayed Squid input. When the CGI interface utility is used, a remote attacker could possibly use this flaw to execute arbitrary code. (CVE-2016-4051) * Buffer overflow and input validation flaws were found in the way Squid processed ESI responses. If Squid was used as a reverse proxy, or for TLS/HTTPS interception, a remote attacker able to control ESI components on an HTTP server could use these flaws to crash Squid, disclose parts of the stack memory, or possibly execute arbitrary code as the user running Squid. (CVE-2016-4052, CVE-2016-4053, CVE-2016-4054) * An input validation flaw was found in the way Squid handled intercepted HTTP Request messages. An attacker could use this flaw to bypass the protection against issues related to CVE-2009-0801, and perform cache poisoning attacks on Squid. (CVE-2016-4553) * An input validation flaw was found in Squid's mime_get_header_field() function, which is used to search for headers within HTTP requests. An attacker could send an HTTP request from the client side with specially crafted header Host header that bypasses same-origin security protections, causing Squid operating as interception or reverse-proxy to contact the wrong origin server. It could also be used for cache poisoning for client not following RFC 7230. (CVE-2016-4554) * A NULL pointer dereference flaw was found in the way Squid processes ESI responses. If Squid was used as a reverse proxy or for TLS/HTTPS interception, a malicious server could use this flaw to crash the Squid worker process. (CVE-2016-4555) * An incorrect reference counting flaw was found in the way Squid processes ESI responses. If Squid is configured as reverse-proxy, for TLS/HTTPS interception, an attacker controlling a server accessed by Squid, could crash the squid worker, causing a Denial of Service attack. (CVE-2016-4556)moderateScientific Linux FermiScientific Linux Fermi 6squid34-3.4.14-9.el6_8.3.x86_64.rpm4743710631093d3769302cf2820c836794de22893eb2af83407ea71f771c03c1SLSA-2016:1141-1Security Fix(es): * It was found that when NTP was configured in broadcast mode, a remote attacker could broadcast packets with bad authentication to all clients. The clients, upon receiving the malformed packets, would break the association with the broadcast server, causing them to become out of sync over a longer period of time. (CVE-2015-7979) * A denial of service flaw was found in the way NTP handled preemptable client associations. A remote attacker could send several crypto NAK packets to a victim client, each with a spoofed source address of an existing associated peer, preventing that client from synchronizing its time. (CVE-2016-1547) * It was found that an ntpd client could be forced to change from basic client/server mode to the interleaved symmetric mode. A remote attacker could use a spoofed packet that, when processed by an ntpd client, would cause that client to reject all future legitimate server responses, effectively disabling time synchronization on that client. (CVE-2016-1548) * A flaw was found in the way NTP's libntp performed message authentication. An attacker able to observe the timing of the comparison function used in packet authentication could potentially use this flaw to recover the message digest. (CVE-2016-1550) * An out-of-bounds access flaw was found in the way ntpd processed certain packets. An authenticated attacker could use a crafted packet to create a peer association with hmode of 7 and larger, which could potentially (although highly unlikely) cause ntpd to crash. (CVE-2016-2518) The CVE-2016-1548 issue was discovered by Miroslav Lichvar (Red Hat).moderateScientific Linux FermiScientific Linux Fermi 6ntp-doc-4.2.6p5-10.el6.1.noarch.rpm6865880083ffa40c7e5a6c0af3328ffcf072d1e36a86868c38e0c7cb71cb545bntp-4.2.6p5-10.el6.1.x86_64.rpma7504ac96bf4fdff71faf3c39bb533519abd32c5bc08d7e351eca395a15e9259ntp-perl-4.2.6p5-10.el6.1.x86_64.rpmcef842b726b093b3dee0939781a9d4941fbbf60a17b3b158569360ad60e38d21ntpdate-4.2.6p5-10.el6.1.x86_64.rpm4b869025e2c2241bd17180a0dff068493300dfe6d8fa5972b01d3f6f2bf75c14SLSA-2016:1204-1Security Fix(es): * A memory allocation flaw, leading to a heap-based buffer overflow, was found in spice's smartcard interaction, which runs under the QEMU-KVM context on the host. A user connecting to a guest VM using spice could potentially use this flaw to crash the QEMU-KVM process or execute arbitrary code with the privileges of the host's QEMU-KVM process. (CVE-2016-0749) * A memory access flaw was found in the way spice handled certain guests using crafted primary surface parameters. A user in a guest could use this flaw to read from and write to arbitrary memory locations on the host. (CVE-2016-2150) The CVE-2016-0749 issue was discovered by Jing Zhao (Red Hat) and the CVE-2016-2150 issue was discovered by Frediano Ziglio (Red Hat).importantScientific Linux FermiScientific Linux Fermi 6spice-server-devel-0.12.4-13.el6.1.x86_64.rpmc21ea4c672adcfff18461963e358874addde6c0383969a31bc745fe41eae8c68spice-server-0.12.4-13.el6.1.x86_64.rpm4ac5618bd0adecbb379d61b209ce3092bc2da8a097cbabb4e87d364614f9a748SLSA-2016:1217-1This update upgrades Firefox to version 45.2.0 ESR. Security Fix(es): * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2016-2818, CVE-2016-2819, CVE-2016-2821, CVE-2016-2822, CVE-2016-2828, CVE-2016-2831)criticalScientific Linux FermiScientific Linux Fermi 6firefox-45.2.0-1.el6_8.x86_64.rpmd6671617370041e511a425e7cd222e3a8e0bc29cc468b10ee21cb0c2955220b4firefox-45.2.0-1.el6_8.i686.rpm5181e4204b7f713975e3b48b22543365f007736a9249b17443d398ded41a3e64SLSA-2016:1237-1Security Fix(es): * It was discovered that ImageMagick did not properly sanitize certain input before using it to invoke processes. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would lead to arbitrary execution of shell commands with the privileges of the user running the application. (CVE-2016-5118) * It was discovered that ImageMagick did not properly sanitize certain input before passing it to the gnuplot delegate functionality. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would lead to arbitrary execution of shell commands with the privileges of the user running the application. (CVE-2016-5239) * Multiple flaws have been discovered in ImageMagick. A remote attacker could, for example, create specially crafted images that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would result in a memory corruption and, potentially, execution of arbitrary code, a denial of service, or an application crash. (CVE-2015-8896, CVE-2015-8895, CVE-2016-5240, CVE-2015-8897, CVE-2015-8898)importantScientific Linux FermiScientific Linux Fermi 6ImageMagick-doc-6.7.2.7-5.el6_8.x86_64.rpmdf32ef3572c1c86855cd515e4e5f349e2134433fa4542beaa69c08cc88e39d0bImageMagick-6.7.2.7-5.el6_8.x86_64.rpm843f94324c93cfe5f8d3887d18c0c20e94a9b26a1a5e8936e7d93b7b22b0badeImageMagick-devel-6.7.2.7-5.el6_8.x86_64.rpmf2f788f073189d2e433f5a92b6aae52cb902a8074926cf4491d3482203eb6de2ImageMagick-c++-6.7.2.7-5.el6_8.x86_64.rpm5232281b39a2f5fb79504d73dfcf78ae0556e93429d65470dabc533d7e619aa2ImageMagick-devel-6.7.2.7-5.el6_8.i686.rpm25a240ccb0f4c74b76b89b43b95946b2cfad66de03a4b096ae8de6fdfc1d152eImageMagick-perl-6.7.2.7-5.el6_8.x86_64.rpm809874029635761c374a4d9081b513631b9743641d92a6471413bfe791838c62ImageMagick-6.7.2.7-5.el6_8.i686.rpm4379f7ae86b38847700d998ccb9d2e23ce53d213e4f3db402c9f05e678722c10ImageMagick-c++-6.7.2.7-5.el6_8.i686.rpmef5817ecb24cb843bbbd223308c8649ba12d7fb0c79b7f6c7af76d491c8ea445ImageMagick-c++-devel-6.7.2.7-5.el6_8.x86_64.rpm93d424023a24964927ed4a88210b993b358bda6795fad35e417a26680464e661ImageMagick-c++-devel-6.7.2.7-5.el6_8.i686.rpm36843db7b6d799f0cb5a96a3797df90c0892f74795a1f5cc33e1a7e26985722fSLSA-2016:1267-1The setroubleshoot-plugins package provides a set of analysis plugins for use with setroubleshoot. Each plugin has the capacity to analyze SELinux AVC data and system data to provide user friendly reports describing how to interpret SELinux AVC denials. Security Fix(es): * Shell command injection flaws were found in the way the setroubleshoot executed external commands. A local attacker able to trigger certain SELinux denials could use these flaws to execute arbitrary code with root privileges. (CVE-2016-4445, CVE-2016-4989) * Shell command injection flaws were found in the way the setroubleshoot allow_execmod and allow_execstack plugins executed external commands. A local attacker able to trigger an execmod or execstack SELinux denial could use these flaws to execute arbitrary code with root privileges. (CVE-2016-4444, CVE-2016-4446) The CVE-2016-4444 and CVE-2016-4446 issues were discovered by Milos Malik (Red Hat) and the CVE-2016-4445 and CVE-2016-4989 issues were discovered by Red Hat Product Security.importantScientific Linux FermiScientific Linux Fermi 6setroubleshoot-3.0.47-12.el6_8.x86_64.rpm35396f58582eb7e9120147fbe65362d83a47b472ea619ac440685a3dab0fd04dsetroubleshoot-server-3.0.47-12.el6_8.x86_64.rpm8cb340d87275cc9d7b27d5de9d268b2c240a39cfcb6a78fb9ecb34ddd50472eesetroubleshoot-doc-3.0.47-12.el6_8.x86_64.rpm22e0aa49e02a2f6a3ce6547bba4b7360878678f8b34105ecbb46ecaa76226424setroubleshoot-plugins-3.0.40-3.1.el6_8.noarch.rpmcbdbcc5b7288b27f9d0f5af1c02147c80bf024bf94e5633996be4d3f1162b5e6SLSA-2016:1292-1Security Fix(es): A heap-based buffer overflow flaw was found in the way libxml2 parsed certain crafted XML input. A remote attacker could provide a specially crafted XML file that, when opened in an application linked against libxml2, would cause the application to crash or execute arbitrary code with the permissions of the user running the application. (CVE-2016-1834, CVE-2016-1840) Multiple denial of service flaws were found in libxml2. A remote attacker could provide a specially crafted XML file that, when processed by an application using libxml2, could cause that application to crash. (CVE-2016-1762, CVE-2016-1833, CVE-2016-1835, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838, CVE-2016-1839, CVE-2016-3627, CVE-2016-3705, CVE-2016-4447, CVE-2016-4448, CVE-2016-4449)importantScientific Linux FermiScientific Linux Fermi 6libxml2-static-2.7.6-21.el6_8.1.x86_64.rpm6e7f42865f80d9cb2f355f3c7ed08ef0295fd1f9a13f476df050b1660c088474libxml2-2.7.6-21.el6_8.1.i686.rpm6dd3f49101b77e722d3a9467414a73423ed45b2c4a9e8948edf2db872c5395c7libxml2-python-2.7.6-21.el6_8.1.x86_64.rpm95053dbb1cd7df03f7c75b869c3459d5354d339fe70f640f195e84c304400743libxml2-devel-2.7.6-21.el6_8.1.x86_64.rpm74961fafa02b5daed8bde601f070252bebeed554624e8573fd791ccbd36e8388libxml2-2.7.6-21.el6_8.1.x86_64.rpmfde1b18a52bba3a851d05b7c1508617c4c5ceaf655d74fb2fb61822ec1147381libxml2-devel-2.7.6-21.el6_8.1.i686.rpm6790c4313f8495dbf94713982866e072234eb919fe6e9f5b22641d767c0f7675SLSA-2016:1392-1This update upgrades Thunderbird to version 45.2.0. Security Fix(es): * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2016-2818)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-45.2-1.el6_8.x86_64.rpmff6c504a1d4e1cc1548cd815a65d16243ff2066a471dd27010c4e3eb7604960aSLSA-2016:1406-1Security Fix: * A flaw was found in the way certain interfaces of the Linux kernel's Infiniband subsystem used write() as bi-directional ioctl() replacement, which could lead to insufficient memory security checks when being invoked using the the splice() system call. A local unprivileged user on a system with either Infiniband hardware present or RDMA Userspace Connection Manager Access module explicitly loaded, could use this flaw to escalate their privileges on the system. (CVE-2016-4565, Important) This update also fixes the following bugs: * When providing some services and using the Integrated Services Digital Network (ISDN), the system could terminate unexpectedly due to the call of the tty_ldisc_flush() function. The provided patch removes this call and the system no longer hangs in the described scenario. * An update to the Scientific Linux 6 kernel added calls of two functions provided by the ipv6.ko kernel module, which added a dependency on that module. On systems where ipv6.ko was prevented from being loaded, the nfsd.ko and lockd.ko modules were unable to be loaded. Consequently, it was not possible to run an NFS server or to mount NFS file systems as a client. The underlying source code has been fixed by adding the symbol_get() function, which determines if nfsd.ko and lock.ko are loaded into memory and calls them through function pointers, not directly. As a result, the aforementioned kernel modules are allowed to be loaded even if ipv6.ko is not, and the NFS mount works as expected. * After upgrading the kernel, CPU load average increased compared to the prior kernel version due to the modification of the scheduler. The provided patch set reverts the calculation algorithm of this load average to the the previous version thus resulting in relatively lower values under the same system load. Updated dracut packages have also been included to satisfy dependencies.importantScientific Linux FermitrueScientific Linux Fermi 6kernel-debug-devel-2.6.32-642.3.1.el6.x86_64.rpmaa2704cd574d692f814977bb3b1165b69c20c0cb2a984db44a9e453a20163a41kernel-2.6.32-642.3.1.el6.x86_64.rpm39098b6d7dd34095d2af40d9afdaecf14e61170f57a6de2246096297da0a4f56kernel-debug-2.6.32-642.3.1.el6.x86_64.rpm39d62f7e9529c4bbd789f59d39b26ceb04c529afa36d473161c08e9a43e2f61dkernel-headers-2.6.32-642.3.1.el6.x86_64.rpmf859e9a95f62dc21ac832196baf87feec23f82b2aa8296f3aa5295ea09a97b8bperf-2.6.32-642.3.1.el6.x86_64.rpm29d5f23c846fda1bcd321d7044ebe289b8f50263ecfb7ebb62e56995598ab69bkernel-abi-whitelists-2.6.32-642.3.1.el6.noarch.rpmdca4966e034b8413994cc1eb86adda66a0ca5c9a87beaba245942b7a5feb632ekernel-debug-devel-2.6.32-642.3.1.el6.i686.rpm084d6cc35c03ffd3f8aabe41c05a0a5d27b1f390e05c42765fab3eaedeb761a5kernel-doc-2.6.32-642.3.1.el6.noarch.rpmf125a8dd16852a9d251e80de642b80dd9407a85850df5fa645591cd432c668f7python-perf-2.6.32-642.3.1.el6.x86_64.rpm9662612d19a6d45b5f76fd4c681b5f9bc3931da24f0a1a3bc87282c8427d90cakernel-devel-2.6.32-642.3.1.el6.x86_64.rpm99ea5147834f396bcedee5548960eb765be292c05cbcf2e380f67271ea3a7e1ckernel-firmware-2.6.32-642.3.1.el6.noarch.rpmffa3eea0324bbbf03aa50500e6347abdbb478a4baa558892d34691e14bde4bf6SLSA-2016:1421-1Security Fix(es): * It was discovered that httpd used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request. (CVE-2016-5387) Note: After this update, httpd will no longer pass the value of the Proxy request header to scripts via the HTTP_PROXY environment variable.importantScientific Linux FermiScientific Linux Fermi 6httpd-manual-2.2.15-54.sl6.noarch.rpmd492472e8cbafcea13d63554152f84304c241f7f5768e641322285863f55f41ehttpd-tools-2.2.15-54.sl6.x86_64.rpm5f9614dc1fcae0735822509aaade2b4a325f15e77ed79742c0e2131a09441174httpd-devel-2.2.15-54.sl6.x86_64.rpm8909cdc1b17a1ed7458b207784aefa75f9136ad1cb6ecad4af962715e558fc08httpd-devel-2.2.15-54.sl6.i686.rpm6eefc715b2077d07d769c3a5b8c944bb024b05ad5bd6b37a1eca67b496a9ceb8mod_ssl-2.2.15-54.sl6.x86_64.rpmc895056546e3cc82172e8e371c03936e5169bbf22a753908d58119c82b6f367bhttpd-2.2.15-54.sl6.x86_64.rpm05e15cd4d98cca6aea35d40a288535f7a9ce23aac10345ba7519e7ba68815e24SLSA-2016:1458-1Security Fix(es): * Multiple flaws were discovered in the Hotspot and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions. (CVE-2016-3606, CVE-2016-3587, CVE-2016-3598, CVE-2016-3610) * Multiple denial of service flaws were found in the JAXP component in OpenJDK. A specially crafted XML file could cause a Java application using JAXP to consume an excessive amount of CPU and memory when parsed. (CVE-2016-3500, CVE-2016-3508) * Multiple flaws were found in the CORBA and Hotsport components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2016-3458, CVE-2016-3550) Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website.criticalScientific Linux FermiScientific Linux Fermi 6java-1.8.0-openjdk-debug-1.8.0.101-3.b13.el6_8.x86_64.rpm5b6661bf349d83b3883231b46e4684e250b7145c11f8cb6a722b88d46a06c450java-1.8.0-openjdk-javadoc-1.8.0.101-3.b13.el6_8.noarch.rpm2d729363cc783d1de062aee0dfec759fe589169a96ae700e8e9f16db45049342java-1.8.0-openjdk-1.8.0.101-3.b13.el6_8.x86_64.rpmb1d9dffa937069fd927076bcc4859fe18971ee0d3db1ee51017cd107422d1518java-1.8.0-openjdk-demo-1.8.0.101-3.b13.el6_8.x86_64.rpm9eae8dd13ab43f1917a17b7186f35b8dfff3fc060607219843fce9d60acc5359java-1.8.0-openjdk-devel-1.8.0.101-3.b13.el6_8.x86_64.rpmca6071329519d1d1dbded8e9cd33ed82f325c74ae20d73fee2e1ce21bc99283fjava-1.8.0-openjdk-demo-debug-1.8.0.101-3.b13.el6_8.x86_64.rpmf0fc868fe5370fbcf7579ba37970a2db6b48ee3b8131b2cff5ef7f8bc12e7826java-1.8.0-openjdk-headless-debug-1.8.0.101-3.b13.el6_8.x86_64.rpm5261e18c69fd2f5fe4404b71e6a265bb64cb689d336d8a0dd06e55971a32568bjava-1.8.0-openjdk-devel-debug-1.8.0.101-3.b13.el6_8.x86_64.rpmb8f8ed991cfb6ffeff4912cc49147fa04f45dd75d2afd8f0e8bc648166e7f00cjava-1.8.0-openjdk-src-debug-1.8.0.101-3.b13.el6_8.x86_64.rpm3a99efdd70786812ced7aedb7b19c61c0f77758e4eec0744622b3e35d8850146java-1.8.0-openjdk-javadoc-debug-1.8.0.101-3.b13.el6_8.noarch.rpm40d50ca9ce65d96a924f6b8f3cdfce060be3230e35dcea3c4bf59e35ed1c91a8java-1.8.0-openjdk-src-1.8.0.101-3.b13.el6_8.x86_64.rpme0dbea5f47dc51489e23f68706bc3de8c6b0252f8c46530857dacb07983f168bjava-1.8.0-openjdk-headless-1.8.0.101-3.b13.el6_8.x86_64.rpmb69864973187abd188545ad150573b148f2cb9c1866360b37e8c3195383700cfSLSA-2016:1487-1Security Fix(es): * A flaw was found in the way Samba initiated signed DCE/RPC connections. A man-in-the-middle attacker could use this flaw to downgrade the connection to not use signing and therefore impersonate the server. (CVE-2016-2119)moderateScientific Linux FermiScientific Linux Fermi 6samba4-4.2.10-7.el6_8.x86_64.rpm045a12f19059838fff53feb8a440208a28d84bdfd287c25eb4cf4de4798b11b2samba4-winbind-krb5-locator-4.2.10-7.el6_8.x86_64.rpm7352adb1410b9fc4bc8f50e3cd62d28878da4350b0818cabce04278a6c3ad29csamba4-dc-libs-4.2.10-7.el6_8.x86_64.rpmc34d131fa0ffa05e56fcf935bc167e255f406ca1996c62125c4da59c57ec3b96samba4-pidl-4.2.10-7.el6_8.x86_64.rpmbbf280cc0ed1f00d5265409654de9326a2968eca668ac726a6fb39dd40052dc1samba4-client-4.2.10-7.el6_8.x86_64.rpmb101b64d8a2503685f67c9b561ac60b1c9262b6ee47dc4ef1fa371cce79feb1csamba4-common-4.2.10-7.el6_8.x86_64.rpm10070bd43c1f602eb940b1f65723e9b2cb417bc5577715f39348744838239d7fsamba4-winbind-4.2.10-7.el6_8.x86_64.rpm77009cba34a57d822d6e32b462443162edd62e89d4a2ca785148037dc2e9b108samba4-test-4.2.10-7.el6_8.x86_64.rpm3c54b8abff91e8fee4dddd328d88f5950787209fb911d641442418f7115dea82samba4-dc-4.2.10-7.el6_8.x86_64.rpmdb263dc7163a4e88f15582a7a8cfda9a761499fc6c5ef96dd5b563c64ebe522esamba4-libs-4.2.10-7.el6_8.x86_64.rpm9fac5077730b7132f251f36a99f135abebaa403c961ef5d49354f358ca82e2b7samba4-python-4.2.10-7.el6_8.x86_64.rpm9527babed5a35169bd38aeedd34997fa287fb69229738cd4fcee91e6cdfe2c84samba4-devel-4.2.10-7.el6_8.x86_64.rpmd3affd60753a113b106225f2bff12141bedbdc265abafc5a1c5f9e9e94d2e06esamba4-winbind-clients-4.2.10-7.el6_8.x86_64.rpm013c2ee4485e063006be2411238e8fabcefcf8dfdb2751fa0237dc69699412beSLSA-2016:1504-1Security Fix(es): * Multiple flaws were discovered in the Hotspot and Libraries components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions. (CVE-2016-3606, CVE-2016-3598, CVE-2016-3610) * Multiple denial of service flaws were found in the JAXP component in OpenJDK. A specially crafted XML file could cause a Java application using JAXP to consume an excessive amount of CPU and memory when parsed. (CVE-2016-3500, CVE-2016-3508) * Multiple flaws were found in the CORBA and Hotsport components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2016-3458, CVE-2016-3550)importantScientific Linux FermiScientific Linux Fermi 6java-1.7.0-openjdk-1.7.0.111-2.6.7.2.el6_8.x86_64.rpmb9c4ddf03f204e85baa8dfc30f10fc81181297d9b010f768624fe411aa006460java-1.7.0-openjdk-javadoc-1.7.0.111-2.6.7.2.el6_8.noarch.rpmfbcadfaa7ceac5cfdc4677a48acbfa6323e7f13b971e3bf9277116356f89f9c8java-1.7.0-openjdk-src-1.7.0.111-2.6.7.2.el6_8.x86_64.rpm103088e6c1088d46182a0e8ef113b29badf14f1c22d2fdd53a1ab0e5d86a7b1ajava-1.7.0-openjdk-demo-1.7.0.111-2.6.7.2.el6_8.x86_64.rpm0366e5664966ccd311d9c522649133b484c672b639f46e7f9c54adfe49b22555java-1.7.0-openjdk-devel-1.7.0.111-2.6.7.2.el6_8.x86_64.rpmaf18b52182d8b139902de26aa0a093f0644ffcec1e815b226c27820af86aa9ebSLSA-2016:1547-1Security Fix(es): * Multiple flaws have been discovered in libtiff. A remote attacker could exploit these flaws to cause a crash or memory corruption and, possibly, execute arbitrary code by tricking an application linked against libtiff into processing specially crafted files. (CVE-2014-9655, CVE-2015-1547, CVE-2015-8784, CVE-2015-8683, CVE-2015-8665, CVE-2015-8781, CVE-2015-8782, CVE-2015-8783, CVE-2016-3990, CVE-2016-5320) * Multiple flaws have been discovered in various libtiff tools (bmp2tiff, pal2rgb, thumbnail, tiff2bw, tiff2pdf, tiffcrop, tiffdither, tiffsplit, tiff2rgba). By tricking a user into processing a specially crafted file, a remote attacker could exploit these flaws to cause a crash or memory corruption and, possibly, execute arbitrary code with the privileges of the user running the libtiff tool. (CVE-2014-8127, CVE-2014-8129, CVE-2014-8130, CVE-2014-9330, CVE-2015-7554, CVE-2015-8668, CVE-2016-3632, CVE-2016-3945, CVE-2016-3991)importantScientific Linux FermiScientific Linux Fermi 6libtiff-static-3.9.4-18.el6_8.x86_64.rpmc6e95dac2f2b15e1ea53df8a2cbe173846f53dd1f8b3365f3b42a177ce447e25libtiff-3.9.4-18.el6_8.x86_64.rpm8bddb7a4f3cb5eeafe4e1044fdf5a9aab48301fea5d8d88910c64e08df2b9caflibtiff-devel-3.9.4-18.el6_8.i686.rpmfeaaad3dd9c26fa03808af2816cd013d1486274a7c55f5f93874d0a92ed2e2a1libtiff-3.9.4-18.el6_8.i686.rpm2e9b30db0c8d728e746675c1bc9f5aee3519a80778e20e4865a0cd5d2ee61184libtiff-devel-3.9.4-18.el6_8.x86_64.rpm5a4a9a451d18b957c8d80843a9b5d71c574a384338714e607eb0ccad14fa7a0aSLSA-2016:1551-1This update upgrades Firefox to version 45.3.0 ESR. Security Fix(es): * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2016-2836, CVE-2016-5258, CVE-2016-5259, CVE-2016-5252, CVE-2016-5263, CVE-2016-2830, CVE-2016-2838, CVE-2016-5254, CVE-2016-5262, CVE-2016-5264, CVE-2016-5265, CVE-2016-2837)criticalScientific Linux FermiScientific Linux Fermi 6firefox-45.3.0-1.el6_8.x86_64.rpmfaac264baf4e2490ea12bf79772f2f527b4929a4c91ea5e9b8a129cce42d423dfirefox-45.3.0-1.el6_8.i686.rpmf47a01caf0cef34eb5d2a6edb31f9d86906d52b8deb3b4f5cc79cbcd503da5b1SLSA-2016:1573-1Security Fix(es): * It was found that the fix for CVE-2016-4051 released via SLSA-2016:1138 did not properly prevent the stack overflow in the munge_other_line() function. A remote attacker could send specially crafted data to the Squid proxy, which would exploit the cachemgr CGI utility, possibly triggering execution of arbitrary code. (CVE-2016-5408)moderateScientific Linux FermiScientific Linux Fermi 6squid-3.1.23-16.el6_8.6.x86_64.rpm23a78589ec2bc0a8f4ab10091db4a1bbaaf3548c2d5b17656af17d7b33c003fdSLSA-2016:1585-1Security Fix(es): * Quick emulator(Qemu) built with the virtio framework is vulnerable to an unbounded memory allocation issue. It was found that a malicious guest user could submit more requests than the virtqueue size permits. Processing a request allocates a VirtQueueElement and therefore causes unbounded memory allocation on the host controlled by the guest. (CVE-2016-5403)moderateScientific Linux FermiScientific Linux Fermi 6qemu-guest-agent-0.12.1.2-2.491.el6_8.3.x86_64.rpm0271eaeb5ea51723ab135b1a557c4cf319c771f5d0921948cc6e3bb0e1ee6dabqemu-kvm-0.12.1.2-2.491.el6_8.3.x86_64.rpma330c544ac28e30cd15d382cb2710a848889d24fdb0c226c285f7b64d3111161qemu-kvm-tools-0.12.1.2-2.491.el6_8.3.x86_64.rpm355a9088693bafed1e83e1af3833f1fa39f0a6333b3a8f9075700e12dfb3e455qemu-img-0.12.1.2-2.491.el6_8.3.x86_64.rpm026645a65c96691415c6763c0d09868653a49cb47beed6c1249a4a3f71c1529cSLSA-2016:1609-1Security Fix(es): * It was discovered that PHP did not properly protect against the HTTP_PROXY variable name clash. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a PHP script to an attacker- controlled proxy via a malicious HTTP request. (CVE-2016-5385)moderateScientific Linux FermiScientific Linux Fermi 6php-pdo-5.3.3-48.el6_8.x86_64.rpm4a95261198a5fdaf9e5567e2716d9924c9505fce06d02d65453ba5b74fbd556dphp-pspell-5.3.3-48.el6_8.x86_64.rpm719e78355996485f01f6d449ce02ad2a5d1dd230ffd2acc85459fc574ce71bcephp-zts-5.3.3-48.el6_8.x86_64.rpmbf490f0d914d15d247e39b92900301b0d21411581eb603ed8463080f7aa07d83php-enchant-5.3.3-48.el6_8.x86_64.rpm88af02144a6b48bc6c026f3aad2648391982eb88b4004927b57cfe9fea10f9afphp-soap-5.3.3-48.el6_8.x86_64.rpm58285a87835df869bc0d5372ad65cf1287ae538bde471169de6430aa6e082ad7php-snmp-5.3.3-48.el6_8.x86_64.rpm045ba5219cb4c5ffda46c4d95432174b71b6149721fcf55e8e74b741cf9ee523php-pgsql-5.3.3-48.el6_8.x86_64.rpm723796fba77c9b543122ccd9d36c5953dfd499eff3ba75e4da9a81546d19eb79php-fpm-5.3.3-48.el6_8.x86_64.rpm19e877c5049cfc12efdf1c277b7b60dbcc80a32448044433c276e0793b9c4e48php-odbc-5.3.3-48.el6_8.x86_64.rpme5ee74f71ae8204cb606f592a4595485d1d754eb8ba98e5f2e93b1f40ce5e6dbphp-imap-5.3.3-48.el6_8.x86_64.rpm5e7665a4e33953b52c9929b0be8dd656a34c95d596c2ee717bf5346552299ee2php-embedded-5.3.3-48.el6_8.x86_64.rpmad53d37e380cfc5d0aed2ff21d26b81ee81d53dc94b9a2135ad17e52ecc0823fphp-devel-5.3.3-48.el6_8.x86_64.rpmf6412afdbd9e179eceb95faa4f4d9366182c42a289a02087dd8e65f475010d50php-gd-5.3.3-48.el6_8.x86_64.rpm8414c44489c2b234a2435cf8b52ba7fab2b0674648cf1fb61380bdffdc18010aphp-common-5.3.3-48.el6_8.x86_64.rpmccefb67d0cded417507ac432f8ec60102af580dec3713623e58738b3adf9d503php-bcmath-5.3.3-48.el6_8.x86_64.rpmf3abc0722db233dc6281a9616c530cc54f7b5786980e45c74ab7ffd56b80625bphp-ldap-5.3.3-48.el6_8.x86_64.rpm25999f350dc944bda8aa5d279025dad172233cebd0fc02001b3fbb996276b5f7php-xmlrpc-5.3.3-48.el6_8.x86_64.rpma6799234772acb5a08032fffd1aec7611a275b56384a857dd3af26d194f07acaphp-cli-5.3.3-48.el6_8.x86_64.rpmcb7642ba7d6c36c53387ec4e453f67d16ca4253810a4687410931f49ffa8e1c4php-xml-5.3.3-48.el6_8.x86_64.rpm004d293ce1f52b245821e87662720d8b12bb1fc154db449dfd00d083c732f019php-recode-5.3.3-48.el6_8.x86_64.rpm9da61fd4963f23c5a2782e7921081cfd28b1efa6686b44f5caff652acce359bbphp-mysql-5.3.3-48.el6_8.x86_64.rpm1899fb69a4dd6c6b60a33f9686ac7113ff0cf743c841b6fc31bd35b666c659c3php-intl-5.3.3-48.el6_8.x86_64.rpmf093a8b72dee024a5bf0a3e08fcfa6411e89ca3634dc38ce25082d9150fcc234php-mbstring-5.3.3-48.el6_8.x86_64.rpmd1191d5ccf994883088f2e889ead3d73654d23c6f069f4b38fb6a1b54468e024php-dba-5.3.3-48.el6_8.x86_64.rpm1f3f188c866a0a5adc60534bbb52ed1db9c081bf4a3d2024ac5ce97430312e37php-5.3.3-48.el6_8.x86_64.rpm52606ebcfa8af844d1c92ad2b8f87fd84d43623556e57eb67b24728d7bb8d807php-tidy-5.3.3-48.el6_8.x86_64.rpm91448584ee106e52d5b6d57341276c0631dfc46b8022639569cc800edf5df26bphp-process-5.3.3-48.el6_8.x86_64.rpm4e8e723b98c012645b208cec76afab68a5f88375fcf84187259173e5164d6470SLSA-2016:1626-1Security Fix(es): * It was discovered that the Python CGIHandler class did not properly protect against the HTTP_PROXY variable name clash in a CGI context. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a Python CGI script to an attacker-controlled proxy via a malicious HTTP request. (CVE-2016-1000110) * It was found that Python's smtplib library did not return an exception when StartTLS failed to be established in the SMTP.starttls() function. A man in the middle attacker could strip out the STARTTLS command without generating an exception on the Python SMTP client application, preventing the establishment of the TLS layer. (CVE-2016-0772) * It was found that the Python's httplib library (used by urllib, urllib2 and others) did not properly check HTTPConnection.putheader() function arguments. An attacker could use this flaw to inject additional headers in a Python application that allowed user provided header names or values. (CVE-2016-5699)moderateScientific Linux FermiScientific Linux Fermi 6tkinter-2.6.6-66.el6_8.x86_64.rpm9052e422a82d078ec86919b97a93eab22467638dc2298a36eb42610f2a2d6a1fpython-devel-2.6.6-66.el6_8.x86_64.rpmd4ac8de599b54438d4667b1ca8db9eecadc10b7ae49208f2e00ab47cbc14907dpython-tools-2.6.6-66.el6_8.x86_64.rpmf5f0cdf6cf663e236f679d36d42e72ec97c3d23978f016d3325a39d42a47c736python-devel-2.6.6-66.el6_8.i686.rpmdb53ba9713fe8b4160b294fe1171d1baacbe7f1c0e1a106d1a0ee61aafb4e260python-2.6.6-66.el6_8.i686.rpm60083273ddcb6e3f7c93666d0b460551516d1577e1e544352be5c11adff98a93python-test-2.6.6-66.el6_8.x86_64.rpm4117760775d823beee9ec0acf589ea34c862ac779bfd83ef1c70bcc5b93f0076python-libs-2.6.6-66.el6_8.x86_64.rpmf6266a8ec38c47e788717ac4344cb5d9798b6961b9aa763f9feb9c5cb12b3b48python-2.6.6-66.el6_8.x86_64.rpm891f80be227bb0cc40a3bbaa7793883a072558d1e0fa7e0e91526643e4e11529python-libs-2.6.6-66.el6_8.i686.rpmf58e00d14e841ebe3e0d6393b89466688314924c05f731e2b3e9fba5714737bdSLSA-2016:1664-1Security Fix(es): It was found that the RFC 5961 challenge ACK rate limiting as implemented in the Linux kernel's networking subsystem allowed an off-path attacker to leak certain information about a given connection by creating congestion on the global challenge ACK rate limit counter and then measuring the changes by probing packets. An off-path attacker could use this flaw to either terminate TCP connection and/or inject payload into non-secured TCP connection between two endpoints on the network. (CVE-2016-5696, Important) Bug Fix(es): * When loading the Direct Rendering Manager (DRM) kernel module, the kernel panicked if DRM was previously unloaded. The kernel panic was caused by a memory leak of the ID Resolver (IDR2). With this update, IDR2 is loaded during kernel boot, and the kernel panic no longer occurs in the described scenario. * When more than one process attempted to use the "configfs" directory entry at the same time, a kernel panic in some cases occurred. With this update, a race condition between a directory entry and a lookup operation has been fixed. As a result, the kernel no longer panics in the described scenario. * When shutting down the system by running the halt -p command, a kernel panic occurred due to a conflict between the kernel offlining CPUs and the sched command, which used the sched group and the sched domain data without first checking the data. The underlying source code has been fixed by adding a check to avoid the conflict. As a result, the described scenario no longer results in a kernel panic. * In some cases, running the ipmitool command caused a kernel panic due to a race condition in the ipmi message handler. This update fixes the race condition, and the kernel panic no longer occurs in the described scenario. * Previously, multiple Very Secure FTP daemon (vsftpd) processes on a directory with a large number of files led to a high contention rate on each inode's spinlock, which caused excessive CPU usage. With this update, a spinlock to protect a single memory-to-memory copy has been removed from the ext4_getattr() function. As a result, system CPU usage has been reduced and is no longer excessive in the described situation. * When the gfs2_grow utility is used to extend Global File System 2 (GFS2), the next block allocation causes the GFS2 kernel module to re-read its resource group index. If multiple processes in the GFS2 module raced to do the same thing, one process sometimes overwrote a valid object pointer with an invalid pointer, which caused either a kernel panic or a file system corruption. This update ensures that the resource group object pointer is not overwritten. As a result, neither kernel panic nor file system corruption occur in the described scenario. * Previously, the SCSI Remote Protocol over InfiniBand (IB-SRP) was disabled due to a bug in the srp_queue() function. As a consequence, an attempt to enable the Remote Direct Memory Access (RDMA) at boot caused the kernel to crash. With this update, srp_queue() has been fixed, and the system now boots as expected when RDMA is enabled. Enhancement(s): * This update optimizes the efficiency of the Transmission Control Protocol (TCP) when the peer is using a window under 537 bytes in size. As a result, devices that use maximum segment size (MSS) of 536 bytes or fewer will experience improved network performance.importantScientific Linux FermitrueScientific Linux Fermi 6kernel-headers-2.6.32-642.4.2.el6.x86_64.rpm24d2f10ad4deb6be92ded71c27280b8adc0f9a1b60887211d2044f84313d8f89python-perf-2.6.32-642.4.2.el6.x86_64.rpma856c1ee68b37972bc5893397eccb2d3c27a27bb92ccd7589253c9036aa2346ckernel-devel-2.6.32-642.4.2.el6.x86_64.rpm4ecc053d29093257e17e5a9684253c88233d0761f7ab67a1071b6b88cb98fc1bkernel-debug-devel-2.6.32-642.4.2.el6.i686.rpm499566c537b3dfdcf38a608f8beb90c76ef6754e7067e06098aba09e48b56bcekernel-abi-whitelists-2.6.32-642.4.2.el6.noarch.rpm9bd107c0a1d08f0d470bbbf877036c6ee3973b9e4895be018b26701aa1e4523dkernel-firmware-2.6.32-642.4.2.el6.noarch.rpm798e799de5c1244d69e47ad0c03b00cfce85bc28c002dd5713e7fc43d310d5d8kernel-debug-devel-2.6.32-642.4.2.el6.x86_64.rpmc084bcce9eb3d1bef56a38900b7a5738b0ef254c141eeeb023c6289ec70dd106kernel-2.6.32-642.4.2.el6.x86_64.rpm47be75127327731efdfcd776770762bc1077f10b9570875ba2103a73fe528f9aperf-2.6.32-642.4.2.el6.x86_64.rpmbdc7cdb01595c021fb741e0be71740fde0db25784489b862625497d906a3e3a9kernel-debug-2.6.32-642.4.2.el6.x86_64.rpm62aec8c2aa9659c2c1e908b0193c0a6a2d1d85546db21359ace706b7b64a9555kernel-doc-2.6.32-642.4.2.el6.noarch.rpm5bd3788c57ba50371a9fe27df4ada8d3352c468949108df8b90817395c43fa43SLSA-2016:1776-1Security Fix(es): * An insufficient bytecode verification flaw was discovered in the Hotspot component in OpenJDK. An untrusted Java application or applet could use this flaw to completely bypass Java sandbox restrictions. (CVE-2016-3606) * Multiple denial of service flaws were found in the JAXP component in OpenJDK. A specially crafted XML file could cause a Java application using JAXP to consume an excessive amount of CPU and memory when parsed. (CVE-2016-3500, CVE-2016-3508) * Multiple flaws were found in the CORBA and Hotsport components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2016-3458, CVE-2016-3550)importantScientific Linux FermiScientific Linux Fermi 6java-1.6.0-openjdk-devel-1.6.0.40-1.13.12.6.el6_8.x86_64.rpm1daa2f2494056695e8dc8aafdb108e248a7504f25883c0b630519fa44e408e62java-1.6.0-openjdk-javadoc-1.6.0.40-1.13.12.6.el6_8.x86_64.rpmb3a192e989322e7951aeba7b9f5696b82455985678d71c6385e0d93fd2d1ceb4java-1.6.0-openjdk-1.6.0.40-1.13.12.6.el6_8.x86_64.rpmdb81be18fd8348698bf6adfd662e898f61d51559fd96ec08f4e8cd3b6d27f7f0java-1.6.0-openjdk-src-1.6.0.40-1.13.12.6.el6_8.x86_64.rpm2a8caf9e41350301cb8c898558f5564ed56951bd101cbf18b1564579e1aec418java-1.6.0-openjdk-demo-1.6.0.40-1.13.12.6.el6_8.x86_64.rpme83161f91db8277343e64126057ec2ab525781766716b2e78c2977c44443a7d2SLSA-2016:1797-1Security Fix(es): * An insufficient permission check issue was found in the way IPA server treats certificate revocation requests. An attacker logged in with the 'retrieve certificate' permission enabled could use this flaw to revoke certificates, possibly triggering a denial of service attack. (CVE-2016-5404)moderateScientific Linux FermiScientific Linux Fermi 6ipa-python-3.0.0-50.el6_8.2.x86_64.rpm7d118191b083656411796b5c6945c5572e8fc3cf874d4b5a8068ca33c36ce09eipa-client-3.0.0-50.el6_8.2.x86_64.rpmb8f20f030d65b910f55706a1addb48f6fcbac642d29f08fd90567621b913f113ipa-admintools-3.0.0-50.el6_8.2.x86_64.rpm7525295422265ddbadc79e33918cd4c5f580e1b13a932e9dd11ffa62fc16d7fcipa-server-3.0.0-50.el6_8.2.x86_64.rpm6036857bbf358d6e8ea44aeb435917c25def07b8f9afce2176e66f4d3cacc594ipa-server-selinux-3.0.0-50.el6_8.2.x86_64.rpme24c59adb94b4f9d9771fd5d94ec1d448514b3a8865504c893d6788276f89f61ipa-server-trust-ad-3.0.0-50.el6_8.2.x86_64.rpm89a97e5fb1971d1d4b17b73de98acdac1a7d1ee0e013eb0bc2ae1aeb7839c578SLSA-2016:1809-1This update upgrades Thunderbird to version 45.3.0. Security Fix(es): * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2016-2836)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-45.3.0-1.el6_8.x86_64.rpm7243157b50f08339ba12290d3b450a443e9453c0ee02ec053a945884cfa491cbSLSA-2016:1850-1Security Fix(es): * A flaw was found in the way libarchive handled hardlink archive entries of non-zero size. Combined with flaws in libarchive's file system sandboxing, this issue could cause an application using libarchive to overwrite arbitrary files with arbitrary data from the archive. (CVE-2016-5418) * Multiple out-of-bounds read flaws were found in libarchive. Specially crafted AR or MTREE files could cause the application to read data out of bounds, potentially disclosing a small amount of application memory, or causing an application crash. (CVE-2015-8920, CVE-2015-8921) * A denial of service vulnerability was found in libarchive's handling of GZIP streams. A crafted GZIP file could cause libarchive to allocate an excessive amount of memory, eventually leading to a crash. (CVE-2016-7166) * A denial of service vulnerability was found in libarchive. A specially crafted CPIO archive containing a symbolic link to a large target path could cause memory allocation to fail, causing an application using libarchive that attempted to view or extract such archive to crash. (CVE-2016-4809) * Multiple instances of undefined behavior due to arithmetic overflow were found in libarchive. Specially crafted Compress streams or ISO9660 volumes could potentially cause the application to fail to read the archive, or to crash. (CVE-2015-8932, CVE-2016-5844)importantScientific Linux FermiScientific Linux Fermi 6libarchive-2.8.3-7.el6_8.x86_64.rpmae55e2d92424e8019a5309eee3b923e8e0a3d249ed5e3d1291ea79e95d476b8flibarchive-2.8.3-7.el6_8.i686.rpm0d098393bca197c17b24812e720f46a9c3c6861bd527aeda349a494b81a79696libarchive-devel-2.8.3-7.el6_8.i686.rpm79e98076171fa574efed22a6553519e7cf086778aad8502aaec25d4749c7b9f0libarchive-devel-2.8.3-7.el6_8.x86_64.rpm89bcb8e53c109d5b62fc85489dc155bf2ada1cb43a9b7be448ebdc7c63879230SLSA-2016:1912-1This update upgrades Firefox to version 45.4.0 ESR. Security Fix(es): * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2016-5257, CVE-2016-5278, CVE-2016-5270, CVE-2016-5272, CVE-2016-5274, CVE-2016-5276, CVE-2016-5277, CVE-2016-5280, CVE-2016-5281, CVE-2016-5284, CVE-2016-5250, CVE-2016-5261)criticalScientific Linux FermiScientific Linux Fermi 6firefox-45.4.0-1.el6_8.x86_64.rpmdbc2b292c6699e249842fd735bbc62a8863319e46ae685bbcc7aae77810dde10firefox-45.4.0-1.el6_8.i686.rpmf707ad6cd7b09b48ff4b1919f7f9f4fd2859cb371c283450b2cf4f010fbb7f86SLSA-2016:1940-1Security Fix(es): * A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support. (CVE-2016-6304) * It was discovered that OpenSSL did not always use constant time operations when computing Digital Signature Algorithm (DSA) signatures. A local attacker could possibly use this flaw to obtain a private DSA key belonging to another user or service running on the same system. (CVE-2016-2178) * It was discovered that the Datagram TLS (DTLS) implementation could fail to release memory in certain cases. A malicious DTLS client could cause a DTLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory. (CVE-2016-2179) * A flaw was found in the Datagram TLS (DTLS) replay protection implementation in OpenSSL. A remote attacker could possibly use this flaw to make a DTLS server using OpenSSL to reject further packets sent from a DTLS client over an established DTLS connection. (CVE-2016-2181) * An out of bounds write flaw was discovered in the OpenSSL BN_bn2dec() function. An attacker able to make an application using OpenSSL to process a large BIGNUM could cause the application to crash or, possibly, execute arbitrary code. (CVE-2016-2182) * A flaw was found in the DES/3DES cipher was used as part of the TLS/SSL protocol. A man-in-the-middle attacker could use this flaw to recover some plaintext data by capturing large amounts of encrypted traffic between TLS/SSL server and client if the communication used a DES/3DES based ciphersuite. (CVE-2016-2183) This update mitigates the CVE-2016-2183 issue by lowering priority of DES cipher suites so they are not preferred over cipher suites using AES. For compatibility reasons, DES cipher suites remain enabled by default and included in the set of cipher suites identified by the HIGH cipher string. Future updates may move them to MEDIUM or not enable them by default. * An integer underflow flaw leading to a buffer over-read was found in the way OpenSSL parsed TLS session tickets. A remote attacker could use this flaw to crash a TLS server using OpenSSL if it used SHA-512 as HMAC for session tickets. (CVE-2016-6302) * Multiple integer overflow flaws were found in the way OpenSSL performed pointer arithmetic. A remote attacker could possibly use these flaws to cause a TLS/SSL server or client using OpenSSL to crash. (CVE-2016-2177) * An out of bounds read flaw was found in the way OpenSSL formatted Public Key Infrastructure Time-Stamp Protocol data for printing. An attacker could possibly cause an application using OpenSSL to crash if it printed time stamp data from the attacker. (CVE-2016-2180) * Multiple out of bounds read flaws were found in the way OpenSSL handled certain TLS/SSL protocol handshake messages. A remote attacker could possibly use these flaws to crash a TLS/SSL server or client using OpenSSL. (CVE-2016-6306)importantScientific Linux FermiScientific Linux Fermi 6openssl-devel-1.0.1e-48.sl6_8.3.i686.rpm12bfc2005f0a2d121cbb7b8c085162a1ef4625b1d534086977a2a83b5d7b11b7openssl-1.0.1e-48.sl6_8.3.x86_64.rpm8adb40a9b7a833affdb3490cc20dbe7656c5afee7b519c493b08b795a5589096openssl-devel-1.0.1e-48.sl6_8.3.x86_64.rpm1c40233c19223cfdbd45d37e9db4b55d0a99b6a37e52f66637fe837e983c5a8eopenssl-static-1.0.1e-48.sl6_8.3.x86_64.rpmcc2f42a8b4048dbbaa86636c47990024f81bc69e317c887ec12a6fa2fecc7fe3openssl-perl-1.0.1e-48.sl6_8.3.x86_64.rpm4b149339824e7ead1d806080480d81aa92bb0c859961dc004bcafb3822d4a8feopenssl-1.0.1e-48.sl6_8.3.i686.rpm438ea01961b7a4b259c08197b49cdadf0502350f87947a7c3ae91531a073eb10SLSA-2016:1944-1Security Fix(es): * A denial of service flaw was found in the way BIND constructed a response to a query that met certain criteria. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS request packet. (CVE-2016-2776)importantScientific Linux FermiScientific Linux Fermi 6bind-libs-9.8.2-0.47.rc1.el6_8.1.x86_64.rpm845abf51708d77f0d69bd21f630f8dfc4896f28163a39d25fbde60151e51b2d8bind-sdb-9.8.2-0.47.rc1.el6_8.1.x86_64.rpm5ffd14a12018f62930a2ba579337274eff016bc2b538dd178630548eadde5c4dbind-utils-9.8.2-0.47.rc1.el6_8.1.x86_64.rpm4d12eb81ef361953ee7726d32486214e4ea1548d4e7bbc9e8504d0bc22779fbbbind-libs-9.8.2-0.47.rc1.el6_8.1.i686.rpm7ed4f220bb74da3d02a6235937e4627cd5c1a8a35d31705b3565f3beb7918c61bind-devel-9.8.2-0.47.rc1.el6_8.1.x86_64.rpm1f33e8053d0dfa5adfc0e878fa64234cd37fada2984308ab624d9ff27bf5701ebind-devel-9.8.2-0.47.rc1.el6_8.1.i686.rpm225ecf461de670e36346a49df85bcd152a4f758c0860a663b3b0571c2f7518c6bind-9.8.2-0.47.rc1.el6_8.1.x86_64.rpmac47945ff6929ab7e75995a91edee987016c9ed7cb46a73a2cfd6dda64303561bind-chroot-9.8.2-0.47.rc1.el6_8.1.x86_64.rpmeaff4b5d4589da4515fe211161d5e6c77ba5c7a8845e05ec7e9e2a99e3e862afSLSA-2016:1978-1Security Fix(es): * It was discovered that python-twisted-web used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request. (CVE-2016-1000111) Note: After this update, python-twisted-web will no longer pass the value of the Proxy request header to scripts via the HTTP_PROXY environment variable.importantScientific Linux FermiScientific Linux Fermi 6python-twisted-web-8.2.0-5.el6_8.x86_64.rpm699d6d5d1692f0e172a5f82aba29eeed0f201c174205902419c2bdeaecfb8f4fSLSA-2016:1985-1This update upgrades Thunderbird to version 45.4.0. Security Fix(es): * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2016-5257)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-45.4.0-1.el6_8.x86_64.rpmfc24bd8afdfdf25cc2c1c3d6339ec0557e2c17a5a679ef6658daaf27e8a77921SLSA-2016:2006-1Security Fix(es): * A flaw was found in the Linux kernel's keyring handling code, where in key_reject_and_link() an uninitialized variable would eventually lead to arbitrary free address which could allow attacker to use a use-after-free style attack. (CVE-2016-4470, Important) * A heap-based buffer overflow vulnerability was found in the Linux kernel's hiddev driver. This flaw could allow a local attacker to corrupt kernel memory, possible privilege escalation or crashing the system. (CVE-2016-5829, Moderate) The CVE-2016-4470 issue was discovered by David Howells (Red Hat Inc.). Bug Fix(es): * Previously, when two NFS shares with different security settings were mounted, the I/O operations to the kerberos-authenticated mount caused the RPC_CRED_KEY_EXPIRE_SOON parameter to be set, but the parameter was not unset when performing the I/O operations on the sec=sys mount. Consequently, writes to both NFS shares had the same parameters, regardless of their security settings. This update fixes this problem by moving the NO_CRKEY_TIMEOUT parameter to the auth->au_flags field. As a result, NFS shares with different security settings are now handled as expected. * In some circumstances, resetting a Fibre Channel over Ethernet (FCoE) interface could lead to a kernel panic, due to invalid information extracted from the FCoE header. This update adds santiy checking to the cpu number extracted from the FCoE header. This ensures that subsequent operations address a valid cpu, and eliminates the kernel panic. * Prior to this update, the following problems occurred with the way GSF2 transitioned files and directories from the "unlinked" state to the "free" state: The numbers reported for the df and the du commands in some cases got out of sync, which caused blocks in the file system to appear missing. The blocks were not actually missing, but they were left in the "unlinked" state. In some circumstances, GFS2 referenced a cluster lock that was already deleted, which led to a kernel panic. If an object was deleted and its space reused as a different object, GFS2 sometimes deleted the existing one, which caused file system corruption. With this update, the transition from "unlinked" to "free" state has been fixed. As a result, none of these three problems occur anymore. * Previously, the GFS2 file system in some cases became unresponsive due to lock dependency problems between inodes and the cluster lock. This occurred most frequently on nearly full file systems where files and directories were being deleted and recreated at the same block location at the same time. With this update, a set of patches has been applied to fix these lock dependencies. As a result, GFS2 no longer hangs in the described circumstances. * When used with controllers that do not support DCMD- MR_DCMD_PD_LIST_QUERY, the megaraid_sas driver can go into infinite error reporting loop of error reporting messages. This could cause difficulties with finding other important log messages, or even it could cause the disk to overflow. This bug has been fixed by ignoring the DCMD MR_DCMD_PD_LIST_QUERY query for controllers which do not support it and sending the DCMD SUCCESS status to the AEN functions. As a result, the error messages no longer appear when there is a change in the status of one of the arrays.importantScientific Linux FermitrueScientific Linux Fermi 6kernel-headers-2.6.32-642.6.1.el6.x86_64.rpmc6d6a895541608bb7ea3cca0b412681f949f2be64ff17eb3ebbb739cc72177e6kernel-2.6.32-642.6.1.el6.x86_64.rpm4ba62735160a8bdee993cb98c53c4c69beb642d860b04d77318ed30938ee5952kernel-debug-2.6.32-642.6.1.el6.x86_64.rpmaf6fe7194b365cfacc60a42f5d26b68eb2c7bb5d5e95ecaade4358dcb4bec94bkernel-firmware-2.6.32-642.6.1.el6.noarch.rpm554c8eb06816819f41d4c7ee41693b7f08379b5a4af468baf6a1d51739fad8ffkernel-abi-whitelists-2.6.32-642.6.1.el6.noarch.rpmbc0a55ed3f6af22af1e644fda84f6aa298f5984928f22348146b4b27631847f1perf-2.6.32-642.6.1.el6.x86_64.rpmc0a468e8dc1a5138e3581aeb566c8da548d36a1ecbf324dbdf8c40fc3ab3909akernel-devel-2.6.32-642.6.1.el6.x86_64.rpm21ee71101ed593626a99384e059e3749ec7b32cbdfb8977f9f0769f35e043007kernel-debug-devel-2.6.32-642.6.1.el6.x86_64.rpm79d5b6e19d09ae5e4efaebd0386b78fc91e147c2348820819a273f986778ac36python-perf-2.6.32-642.6.1.el6.x86_64.rpm50830dd8bd872412a9c98f5047d9a02ba194a2e68f70c92b41dd2145bef339a4kernel-debug-devel-2.6.32-642.6.1.el6.i686.rpm48523547abb5a9b8e55db041c790a29ab2b6014bfea21bdbb3b1031bbec476b0kernel-doc-2.6.32-642.6.1.el6.noarch.rpm60345739d4b03b5e21e9983e5c4566fb802bcbb10709b82391778defd5b48ebaSLSA-2016:2045-1Security Fix(es): * It was discovered that the Tomcat packages installed certain configuration files read by the Tomcat initialization script as writeable to the tomcat group. A member of the group or a malicious web application deployed on Tomcat could use this flaw to escalate their privileges. (CVE-2016-6325) * It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session. (CVE-2016-0714) * It was discovered that tomcat used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request. (CVE-2016-5388) * A directory traversal flaw was found in Tomcat's RequestUtil.java. A remote, authenticated user could use this flaw to bypass intended SecurityManager restrictions and list a parent directory via a '/..' in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory. (CVE-2015-5174) * It was found that Tomcat could reveal the presence of a directory even when that directory was protected by a security constraint. A user could make a request to a directory via a URL not ending with a slash and, depending on whether Tomcat redirected that request, could confirm whether that directory existed. (CVE-2015-5345) * It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs. (CVE-2016-0706) Bug Fix(es): * Due to a bug in the tomcat6 spec file, the catalina.out file's md5sum, size, and mtime attributes were compared to the file's attributes at installation time. Because these attributes change after the service is started, the "rpm -V" command previously failed. With this update, the attributes mentioned above are ignored in the RPM verification and the catalina.out file now passes the verification check.importantScientific Linux FermiScientific Linux Fermi 6tomcat6-webapps-6.0.24-98.el6_8.noarch.rpm2997ced8ecf9d7e179911e00ed63ba64cab978d9ee428cede4ebdb3a0b648fectomcat6-admin-webapps-6.0.24-98.el6_8.noarch.rpm8f6175283b9801d4ff2a5fa9024f8ff9f5867a1362dd0ffcbc64b1147e97ffcatomcat6-lib-6.0.24-98.el6_8.noarch.rpm480bb7f17c104c0eb270c574ab00dc29b74e42aa21143061ac1fc44ef114c74ctomcat6-jsp-2.1-api-6.0.24-98.el6_8.noarch.rpmb12e3c125c38385f2095c9fbbf121c4e2bbc25e1034da9d221d48526c2aef61ftomcat6-javadoc-6.0.24-98.el6_8.noarch.rpmebde1556a415a96f7913183c895633d0512fb84c48a57f625ea9240f9c6f000etomcat6-6.0.24-98.el6_8.noarch.rpm688d83a1790d5dd61551d505365acd8bd212c7203f691916a0bbecce9418bec2tomcat6-el-2.1-api-6.0.24-98.el6_8.noarch.rpmca084b61bfb27573109c778cbe7c0d67ffa37681062bccde65e6b97cf0cbb089tomcat6-servlet-2.5-api-6.0.24-98.el6_8.noarch.rpm4f56c066c7ff970800d26305f6842d982d47ed8ba49d1533a00689ef2ba6e93btomcat6-docs-webapp-6.0.24-98.el6_8.noarch.rpmb8965f0d81de61aaa637505eb75d6f8c506adbb422519ccb097e460172147364SLSA-2016:2079-1Security Fix(es): * It was discovered that the Hotspot component of OpenJDK did not properly check arguments of the System.arraycopy() function in certain cases. An untrusted Java application or applet could use this flaw to corrupt virtual machine's memory and completely bypass Java sandbox restrictions. (CVE-2016-5582) * It was discovered that the Hotspot component of OpenJDK did not properly check received Java Debug Wire Protocol (JDWP) packets. An attacker could possibly use this flaw to send debugging commands to a Java program running with debugging enabled if they could make victim's browser send HTTP requests to the JDWP port of the debugged application. (CVE-2016-5573) * It was discovered that the Libraries component of OpenJDK did not restrict the set of algorithms used for Jar integrity verification. This flaw could allow an attacker to modify content of the Jar file that used weak signing key or hash algorithm. (CVE-2016-5542) Note: After this update, MD2 hash algorithm and RSA keys with less than 1024 bits are no longer allowed to be used for Jar integrity verification by default. MD5 hash algorithm is expected to be disabled by default in the future updates. A newly introduced security property jdk.jar.disabledAlgorithms can be used to control the set of disabled algorithms. * A flaw was found in the way the JMX component of OpenJDK handled classloaders. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. (CVE-2016-5554) * A flaw was found in the way the Networking component of OpenJDK handled HTTP proxy authentication. A Java application could possibly expose HTTPS server authentication credentials via a plain text network connection to an HTTP proxy if proxy asked for authentication. (CVE-2016-5597) Note: After this update, Basic HTTP proxy authentication can no longer be used when tunneling HTTPS connection through an HTTP proxy. Newly introduced system properties jdk.http.auth.proxying.disabledSchemes and jdk.http.auth.tunneling.disabledSchemes can be used to control which authentication schemes can be requested by an HTTP proxy when proxying HTTP and HTTPS connections respectively. Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website.criticalScientific Linux FermiScientific Linux Fermi 6java-1.8.0-openjdk-1.8.0.111-0.b15.el6_8.x86_64.rpmf3c73d322619f600347fbee06c25f0df918019fc939ba364ac234a611cbec4a9java-1.8.0-openjdk-demo-debug-1.8.0.111-0.b15.el6_8.x86_64.rpmb5671fe4cac91c2c4f0d6b0fb90f9417bf2822cc50f719712c01f9a79366bdd5java-1.8.0-openjdk-devel-debug-1.8.0.111-0.b15.el6_8.x86_64.rpm968dcaee47bda804ab3cdd144945edfe2a7153e87e1dd474d46bfece372ede7ejava-1.8.0-openjdk-demo-1.8.0.111-0.b15.el6_8.x86_64.rpmb41e1f8bb852411021be08fccfaa59a63b144ae364939da9df360003cc7b2713java-1.8.0-openjdk-javadoc-debug-1.8.0.111-0.b15.el6_8.noarch.rpm9a4f8ece9b39a3adb58337235fe9bbe5f7e92129e9ca852fe448716c209396efjava-1.8.0-openjdk-src-debug-1.8.0.111-0.b15.el6_8.x86_64.rpm43ab42b7c52302a1d88543f2793dd88829f7bb51cfbe535d181eff25620345d0java-1.8.0-openjdk-headless-debug-1.8.0.111-0.b15.el6_8.x86_64.rpmbe4295b2065b86ffb17b076704864cfffcf8c2e1ae281d13e4e2c78e01a3cf50java-1.8.0-openjdk-javadoc-1.8.0.111-0.b15.el6_8.noarch.rpmdcb22f1e1a35c38c16b833e15a8c155935fcd31f73cdd1cfc09ee27bc02da6cejava-1.8.0-openjdk-headless-1.8.0.111-0.b15.el6_8.x86_64.rpmd4faa172ddba5b6386125f7a3bb710da3566bc05136db44a7b2f7438a7a994c9java-1.8.0-openjdk-debug-1.8.0.111-0.b15.el6_8.x86_64.rpm80f2bc24b5e9a6c3938aaef8ab34c1e5695b4e05829f1883f3df1572881d9aafjava-1.8.0-openjdk-src-1.8.0.111-0.b15.el6_8.x86_64.rpm9d34cda16498bd2cede0a5465ecf2a3bcd98a36ad97f27fa8007da652de89e23java-1.8.0-openjdk-devel-1.8.0.111-0.b15.el6_8.x86_64.rpmd76fdd92d75c6877a5bc85e8e283247dbf7b6730f3074e92e0fed630e524ef31SLSA-2016:2093-1Security Fix(es): * A denial of service flaw was found in the way BIND handled packets with malformed options. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS packet. (CVE-2016-2848)importantScientific Linux FermiScientific Linux Fermi 6bind-9.8.2-0.47.rc1.el6_8.2.x86_64.rpm1571c8842205bd3750e43cabb6a17ec3906fbb3bdf43180a530f6aff93f4f6dfbind-utils-9.8.2-0.47.rc1.el6_8.2.x86_64.rpmb06f47e5608951ed0681e6497f10d66f5014ae9c97eeef809b0c0355d8ba545cbind-chroot-9.8.2-0.47.rc1.el6_8.2.x86_64.rpm7738b5e7d17fe74c86e15a6f028fbddba09b53d43110cbb8950050bbad3ebdfebind-devel-9.8.2-0.47.rc1.el6_8.2.i686.rpm0f9820c649ad42856935e7809f29c15456e3ed23974869a2c471d19bcbf48dc3bind-libs-9.8.2-0.47.rc1.el6_8.2.x86_64.rpme151848244e24f44966ede974eb2e245fe62a251fdd96d0f22b5978055a49e01bind-libs-9.8.2-0.47.rc1.el6_8.2.i686.rpmab5ad2ae3cb0e498be09870850b99d17bbd0e48c28179a9d4962950c340a998dbind-devel-9.8.2-0.47.rc1.el6_8.2.x86_64.rpmf5ef2808a924aa690602d3818185d958c3cee2102d102a1d3b0e1d88b3b5e5c7bind-sdb-9.8.2-0.47.rc1.el6_8.2.x86_64.rpmbdf7952fed77bfd532ad48ee0db1b06dbff57b89134df840e6c529f63c07fad5SLSA-2016:2105-1Security Fix(es): * A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only memory mappings. An unprivileged, local user could use this flaw to gain write access to otherwise read-only memory mappings and thus increase their privileges on the system. (CVE-2016-5195, Important)importantScientific Linux FermitrueScientific Linux Fermi 6kernel-devel-2.6.32-642.6.2.el6.x86_64.rpm936602ed85aeaa37126dc7fd167d0efe93059453b5564101beb22b39c1f63424python-perf-2.6.32-642.6.2.el6.x86_64.rpm1017ac1a13a47f9fa9b7dae13e05087f690c11e27d31602a65aa09aa98b0a27bkernel-abi-whitelists-2.6.32-642.6.2.el6.noarch.rpmf1f5d6c9d24f5bcb0e2f53f43bee4a4a48d7853b3b8fbff64397b3ee3f2a9250kernel-debug-devel-2.6.32-642.6.2.el6.x86_64.rpmd1e956c218610187bf138e3d8cf8ec17e91706490849c076459c765a938e11d9kernel-debug-devel-2.6.32-642.6.2.el6.i686.rpm012c019b0cca4d48802ecb2d3d06d61b1499337b8771e33c699faf1c8e99d4f8perf-2.6.32-642.6.2.el6.x86_64.rpm382409f46a11ab841eb9a7da86f040aeccd68ed804599db52725ba9c270aca42kernel-2.6.32-642.6.2.el6.x86_64.rpm381fe26908878a00667ff0dd1fb5680a73979f502e2ca044629a8dd8850fb992kernel-headers-2.6.32-642.6.2.el6.x86_64.rpm2cbb5a1945e42963c5ed0f3d0003e880f0b7e625c62256d60831c423cc44be96kernel-debug-2.6.32-642.6.2.el6.x86_64.rpm79e408d52b9a508ff18544d03e723bf058c3c38fef9d1e5054976bd1106a4ea7kernel-firmware-2.6.32-642.6.2.el6.noarch.rpm4a0ebcc73c7cc2e0778d20d8dc081a4e69a93db18a832c370a1c7d5fb1574f08kernel-doc-2.6.32-642.6.2.el6.noarch.rpm68fd844e19f6d08fa7359df4004d2eae4ce32eff51204c2460bfb79faa40dc53SLSA-2016:2141-1Security Fix(es): * A denial of service flaw was found in the way BIND handled responses containing a DNAME answer. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2016-8864)importantScientific Linux FermiScientific Linux Fermi 6bind-9.8.2-0.47.rc1.el6_8.3.x86_64.rpm39bd3667ed283e3512068bd9a38f5a5f37e2d4c48eb1e6e764ec7deb21a553b4bind-devel-9.8.2-0.47.rc1.el6_8.3.x86_64.rpm973fb2f5466d065c0eb106618bae0d6bedad7d9ab9c28c37e311072da1b06ad0bind-sdb-9.8.2-0.47.rc1.el6_8.3.x86_64.rpm3423e3b07feb5b8a9fbd1064295bb7227c3cf256cbe85f6ca22b31d5a5a067c8bind-utils-9.8.2-0.47.rc1.el6_8.3.x86_64.rpm7df9a7e6133f690ecd7e529d9baa99b199a8bf207b358205bec221c69112f0b8bind-libs-9.8.2-0.47.rc1.el6_8.3.i686.rpmc0cb49d05cb02886ce5c3395c4b1ac3974436c7ab5153db297c0bfa11d245512bind-chroot-9.8.2-0.47.rc1.el6_8.3.x86_64.rpm400c36e6258346e281c5f3afb95223614751dbc006c4b1ba37353670f90cca03bind-devel-9.8.2-0.47.rc1.el6_8.3.i686.rpmf57713b59fcc082c4abbc2393da452610e58ef1413a25701fbb9c8ee89847bf8bind-libs-9.8.2-0.47.rc1.el6_8.3.x86_64.rpm078c9a8d0e1f590832e9fdc80386b3aae0bc03c54225b1a51207f472746d8415SLSA-2016:2658-1Security Fix(es): * It was discovered that the Hotspot component of OpenJDK did not properly check arguments of the System.arraycopy() function in certain cases. An untrusted Java application or applet could use this flaw to corrupt virtual machine's memory and completely bypass Java sandbox restrictions. (CVE-2016-5582) * It was discovered that the Hotspot component of OpenJDK did not properly check received Java Debug Wire Protocol (JDWP) packets. An attacker could possibly use this flaw to send debugging commands to a Java program running with debugging enabled if they could make victim's browser send HTTP requests to the JDWP port of the debugged application. (CVE-2016-5573) * It was discovered that the Libraries component of OpenJDK did not restrict the set of algorithms used for Jar integrity verification. This flaw could allow an attacker to modify content of the Jar file that used weak signing key or hash algorithm. (CVE-2016-5542) Note: After this update, MD2 hash algorithm and RSA keys with less than 1024 bits are no longer allowed to be used for Jar integrity verification by default. MD5 hash algorithm is expected to be disabled by default in the future updates. A newly introduced security property jdk.jar.disabledAlgorithms can be used to control the set of disabled algorithms. * A flaw was found in the way the JMX component of OpenJDK handled classloaders. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. (CVE-2016-5554) * A flaw was found in the way the Networking component of OpenJDK handled HTTP proxy authentication. A Java application could possibly expose HTTPS server authentication credentials via a plain text network connection to an HTTP proxy if proxy asked for authentication. (CVE-2016-5597) Note: After this update, Basic HTTP proxy authentication can no longer be used when tunneling HTTPS connection through an HTTP proxy. Newly introduced system properties jdk.http.auth.proxying.disabledSchemes and jdk.http.auth.tunneling.disabledSchemes can be used to control which authentication schemes can be requested by an HTTP proxy when proxying HTTP and HTTPS connections respectively.importantScientific Linux FermiScientific Linux Fermi 6java-1.7.0-openjdk-src-1.7.0.121-2.6.8.1.el6_8.x86_64.rpm45293314b723bb53e72de69816ac8289b38da04d5a66f7abf5135abf093084d9java-1.7.0-openjdk-devel-1.7.0.121-2.6.8.1.el6_8.x86_64.rpm4ce76a5303091bc6ec98bcb786e1989bb827b42b2041e539bf49076011deee89java-1.7.0-openjdk-1.7.0.121-2.6.8.1.el6_8.x86_64.rpmcc587d41297b5cd1c6cc6ac2e0aef88532f45c492b780748483b491fbbd12ed7java-1.7.0-openjdk-javadoc-1.7.0.121-2.6.8.1.el6_8.noarch.rpm506a38abfa34a5070a2014a09236e699a6812c1586c6a1b819a708a8bb573b82java-1.7.0-openjdk-demo-1.7.0.121-2.6.8.1.el6_8.x86_64.rpmd5e6c55d50fe38fbc4367c4ea5d3a24db97fc1b2ce4ca3942129c8a9a8713ab9SLSA-2016:2674-1Security Fix(es): * A design flaw was found in the libgcrypt PRNG (Pseudo-Random Number Generator). An attacker able to obtain the first 580 bytes of the PRNG output could predict the following 20 bytes. (CVE-2016-6313)moderateScientific Linux FermiScientific Linux Fermi 6libgcrypt-devel-1.4.5-12.el6_8.i686.rpm04234acdc46b31bf7c556d0d525a578e00c1c7f0190a67d46b6923ceb53b49felibgcrypt-devel-1.4.5-12.el6_8.x86_64.rpm39e1f522f744ef6479de16cc39601dc26f66d81a6ef13a5bcfb3d3b91953ee9dlibgcrypt-1.4.5-12.el6_8.x86_64.rpma198530b34dd4eb0e171b5c6a5bf980160b2e283b26ad67c423fe713ada2dafblibgcrypt-1.4.5-12.el6_8.i686.rpm7b45e6ed65eefc24a22f1b1175b86116aeb8c6cfac6a151808dcd41946367412SLSA-2016:2675-1Security Fix(es): * An authorization flaw was found in Pacemaker, where it did not properly guard its IPC interface. An attacker with an unprivileged account on a Pacemaker node could use this flaw to, for example, force the Local Resource Manager daemon to execute a script as root and thereby gain root access on the machine. (CVE-2016-7035)importantScientific Linux FermiScientific Linux Fermi 6pacemaker-libs-devel-1.1.14-8.el6_8.2.i686.rpmdb9ece9300fcbb5a2f140aa3f2c6449b02b5f89f60b3601ffdda3f68503a9b4fpacemaker-1.1.14-8.el6_8.2.x86_64.rpmdd8d2f1923b8a27193af6d83c42c853fc5b7b4d2dd832aa0b925fed377fb6484pacemaker-cts-1.1.14-8.el6_8.2.x86_64.rpme81fb64c53d95ee184429c78151f77f93813cd7250ba6e08bae4bec13a659ea9pacemaker-cli-1.1.14-8.el6_8.2.x86_64.rpmb68da423100cbe451d7ca37b9d464b469cf53d9e48e0f14e34d4f1e411c0972epacemaker-libs-1.1.14-8.el6_8.2.x86_64.rpm544db6f58e75befd0bf042a47a2b6e3830ee6466bc85e8a4809cbe0d6a8d10c1pacemaker-doc-1.1.14-8.el6_8.2.x86_64.rpm9ae522d375ba6a96f6878319ce489baed8d37ed0acff88699d219c1d5b124938pacemaker-cluster-libs-1.1.14-8.el6_8.2.x86_64.rpmf04e020a184a50e25d520926de624a6d4ed908f6e82cba54f94b23b5a9b191bcpacemaker-remote-1.1.14-8.el6_8.2.x86_64.rpmb75482eee75c2462db65f4e07672ac2c3861d0f29ee39fb5935592a497d7209cpacemaker-libs-1.1.14-8.el6_8.2.i686.rpm3534bf6774c4036e30df663f051c36fbf3f1136427a529ada0a78b01f3ee7f8bpacemaker-cluster-libs-1.1.14-8.el6_8.2.i686.rpma147916934130fb129b9c0ce3cb158cd0bddd6505fc81cc8e9b5bb24bdf18d38pacemaker-libs-devel-1.1.14-8.el6_8.2.x86_64.rpmd71b1fe3f5c62e3c12e5403926fdbbe3fd474f8111da6c347bbea801bdaa50c2SLSA-2016:2702-1Security Fix(es): * It was found that the sandbox tool provided in policycoreutils was vulnerable to a TIOCSTI ioctl attack. A specially crafted program executed via the sandbox command could use this flaw to execute arbitrary commands in the context of the parent shell, escaping the sandbox. (CVE-2016-7545)importantScientific Linux FermiScientific Linux Fermi 6policycoreutils-newrole-2.0.83-30.1.el6_8.x86_64.rpmea335420218800af0926312ef054d4bca600e4e8e22c18c4c6bc8c4a85549cdapolicycoreutils-python-2.0.83-30.1.el6_8.x86_64.rpm09ddd84383c1844602b004eb4a378d685414c068d4f62e06f6c71fb84030e148policycoreutils-2.0.83-30.1.el6_8.x86_64.rpm33cc8a9ae02472b4588851aaf202875353de8daac09ba863c8771e689ae5fba3policycoreutils-gui-2.0.83-30.1.el6_8.x86_64.rpm910decb28c134be55e964e583e8c495fd2659a9b6d6f95f8c686fee51a1cbcfdpolicycoreutils-sandbox-2.0.83-30.1.el6_8.x86_64.rpm04dd35a1da2bd8b87da83058d934374e8c320a6bd627d9596db9c09567e178cdSLSA-2016:2765-1Security Fix(es): * It was found that 389 Directory Server was vulnerable to a flaw in which the default ACI (Access Control Instructions) could be read by an anonymous user. This could lead to leakage of sensitive information. (CVE-2016-5416) * An information disclosure flaw was found in 389 Directory Server. A user with no access to objects in certain LDAP sub-tree could send LDAP ADD operations with a specific object name. The error message returned to the user was different based on whether the target object existed or not. (CVE-2016-4992) * It was found that 389 Directory Server was vulnerable to a remote password disclosure via timing attack. A remote attacker could possibly use this flaw to retrieve directory server password after many tries. (CVE-2016-5405) Bug Fix(es): * Previously, a bug in the changelog iterator buffer caused it to point to an incorrect position when reloading the buffer. This caused replication to skip parts of the changelog, and consequently some changes were not replicated. This bug has been fixed, and replication data loss due to an incorrectly reloaded changelog buffer no longer occurs. * Previously, if internal modifications were generated on a consumer (for example by the Account Policy plug-in) and additional changes to the same attributes were received from replication, a bug caused Directory Server to accumulate state information on the consumer. The bug has been fixed by making sure that replace operations are only applied if they are newer than existing attribute deletion change sequence numbers (CSNs), and state information no longer accumulates in this situation. Enhancement(s): * In a multi-master replication environment where multiple masters receive updates at the same time, it was previously possible for a single master to obtain exclusive access to a replica and hold it for a very long time due to problems such as a slow network connection. During this time, other masters were blocked from accessing the same replica, which considerably slowed down the replication process. This update adds a new configuration attribute, "nsds5ReplicaReleaseTimeout", which can be used to specify a timeout in seconds. After the specified timeout period passes, the master releases the replica, allowing other masters to access it and send their updates.moderateScientific Linux FermiScientific Linux Fermi 6389-ds-base-libs-1.2.11.15-84.el6_8.i686.rpmd1bfb6fb92159b23a1c78501fe09b9c7d0de119252a07abf94adcbf1e9ef993c389-ds-base-devel-1.2.11.15-84.el6_8.i686.rpm999bc7238fdfe1a537b5cd7b5cf2bd8dbc315086c3a910e222b8899ab49d86c5389-ds-base-libs-1.2.11.15-84.el6_8.x86_64.rpmd18788826e46074978642023458cf376450c440f648d9b1f9d5317e60055288e389-ds-base-devel-1.2.11.15-84.el6_8.x86_64.rpma7d3a43ecddf83ec874ed0004252f1e8db5a5b2697daa9ab4c6fe97558895a9e389-ds-base-1.2.11.15-84.el6_8.x86_64.rpm6809326082c9f59db3ad6853e4b05395ad7a6f0def55a88e64276a7ba0eb3c4cSLSA-2016:2766-1Security Fix(es): * It was found that stacking a file system over procfs in the Linux kernel could lead to a kernel stack overflow due to deep nesting, as demonstrated by mounting ecryptfs over procfs and creating a recursion by mapping /proc/environ. An unprivileged, local user could potentially use this flaw to escalate their privileges on the system. (CVE-2016-1583, Important) * It was reported that on s390x, the fork of a process with four page table levels will cause memory corruption with a variety of symptoms. All processes are created with three level page table and a limit of 4TB for the address space. If the parent process has four page table levels with a limit of 8PB, the function that duplicates the address space will try to copy memory areas outside of the address space limit for the child process. (CVE-2016-2143, Moderate) Bug Fix(es): * Use of a multi-threaded workload with high memory mappings sometiems caused a kernel panic, due to a race condition between the context switch and the pagetable upgrade. This update fixes the switch_mm() by using the complete asce parameter instead of the asce_bits parameter. As a result, the kernel no longer panics in the described scenario. * When iptables created the Transmission Control Protocol (TCP) reset packet, a kernel crash could occur due to uninitialized pointer to the TCP header within the Socket Buffer (SKB). This update fixes the transport header pointer in TCP reset for both IPv4 and IPv6, and the kernel no longer crashes in the described situation. * Previously, when the Enhanced Error Handling (EEH) mechanism did not block the PCI configuration space access and an error was detected, a kernel panic occurred. This update fixes EEH to fix this problem. As a result, the kernel no longer panics in the described scenario. * When the lockd service failed to start up completely, the notifier blocks were in some cases registered on a notification chain multiple times, which caused the occurrence of a circular list on the notification chain. Consequently, a soft lock-up or a kernel oops occurred. With this update, the notifier blocks are unregistered if lockd fails to start up completely, and the soft lock-ups or the kernel oopses no longer occur under the described circumstances. * When the Fibre Channel over Ethernet (FCoE) was configured, the FCoE MaxFrameSize parameter was incorrectly restricted to 1452. With this update, the NETIF_F_ALL_FCOE symbol is no longer ignored, which fixes this bug. MaxFrameSize is now restricted to 2112, which is the correct value. * When the fnic driver was installed on Cisco UCS Blade Server, the discs were under certain circumstances put into the offline state with the following error message: "Medium access timeout failure. Offlining disk!". This update fixes fnic to set the Small Computer System Interface (SCSI) status as DID_ABORT after a successful abort operation. As a result, the discs are no longer put into the offlined state in the described situation.importantScientific Linux FermitrueScientific Linux Fermi 6kernel-abi-whitelists-2.6.32-642.11.1.el6.noarch.rpm0adbeecb285985374e30fdbf84cc4342c144074d1ea2896e63893936606fc453kernel-2.6.32-642.11.1.el6.x86_64.rpmae8bd63ab7c8696c6144010ffae666a7379f026452964723674fdbddc92a0fbdkernel-debug-devel-2.6.32-642.11.1.el6.i686.rpm4bd2050751ec90f557a44a4f3bfe6cac045d71a9eb1ab3ab002974daf5f71e02perf-2.6.32-642.11.1.el6.x86_64.rpm44075de55fe9a0f02436bf3897f6445703e0e06e5bd52a5015ba0741c3ad014bkernel-doc-2.6.32-642.11.1.el6.noarch.rpm89fd2720630b715c741f382a1cad5d2c70624964a5b3788d128f5d707ff1a828kernel-debug-2.6.32-642.11.1.el6.x86_64.rpm17f83b6751ae72a399cf7e2d775656d0ced38c92bb49a49de0f3ac68e42bb825kernel-firmware-2.6.32-642.11.1.el6.noarch.rpm0f020bdf0a662a63f2f51a5a237dd15898902d682c9f8041c96f4bc19bf2f73dkernel-debug-devel-2.6.32-642.11.1.el6.x86_64.rpm141e3490cc1180db467d5fb16cb1df1089a7274b9f0c64a5f4ccd8b5a08fb44akernel-devel-2.6.32-642.11.1.el6.x86_64.rpm3e30f11fdb0adaa62ad3f26ca137d2b418e10a06d765a31dd2ddef3ca8254108python-perf-2.6.32-642.11.1.el6.x86_64.rpm2ae5ba77bc16ef3793f8b7dbda4d25fe03a464ac691bf5ad92ea239297507b19kernel-headers-2.6.32-642.11.1.el6.x86_64.rpm22fbf279b0774f7525fc81714e07ec932801ae587da1d8da642f761deb4625b9SLSA-2016:2779-1The nss-util packages provide utilities for use with the Network Security Services (NSS) libraries. The following packages have been upgraded to a newer upstream version: nss (3.12.3), nss-util (3.12.3). Security Fix(es): * Multiple buffer handling flaws were found in the way NSS handled cryptographic data from the network. A remote attacker could use these flaws to crash an application using NSS or, possibly, execute arbitrary code with the permission of the user running the application. (CVE-2016-2834) * A NULL pointer dereference flaw was found in the way NSS handled invalid Diffie-Hellman keys. A remote client could use this flaw to crash a TLS/SSL server using NSS. (CVE-2016-5285) * It was found that Diffie Hellman Client key exchange handling in NSS was vulnerable to small subgroup confinement attack. An attacker could use this flaw to recover private keys by confining the client DH key to small subgroup of the desired group. (CVE-2016-8635)moderateScientific Linux FermiScientific Linux Fermi 6nss-pkcs11-devel-3.21.3-2.el6_8.i686.rpm98904ced1e2ea2fe4ad60d28b6f2b190ea0dea0f0a553ca53f6522a9a646c814nss-util-3.21.3-1.el6_8.i686.rpm33141bcfa11b5652bd974126dc816958c77b3c0729b089fd58d97e85fb0bfdd8nss-3.21.3-2.el6_8.i686.rpmd26027f7e0f9dd771640120c2ffce75692f3aebe65256e7a9f4d6d59613fd2f9nss-tools-3.21.3-2.el6_8.x86_64.rpme528f376c74c4b7b62a04ab26a1686a30f439a96f4fdd0a9a03e1e39756f0780nss-util-devel-3.21.3-1.el6_8.x86_64.rpma0b4fef4b479f761d4e7796f011a0d80ff2ff228859863fd82d3056d7c69fc8anss-util-3.21.3-1.el6_8.x86_64.rpm4b912fab02e0c883d22acdff4a6a67349469f19483d320e61efab93fa7efb31dnss-devel-3.21.3-2.el6_8.i686.rpmaaf32f62f91d2d057a56b2d373b1863a6679bc5a2d4d13a8451ab08316d123afnss-sysinit-3.21.3-2.el6_8.x86_64.rpm3d77957eec19eebdf578e57184f5614f7bdb6952b9821f6f8a669f9a2f0c4103nss-util-devel-3.21.3-1.el6_8.i686.rpm07fc5f0159fbaef3550eceb3e720611e2d117bcf6a00b1ed84b65f83b9c22b57nss-pkcs11-devel-3.21.3-2.el6_8.x86_64.rpmd100aec92454b3c5a782c5bc6095366b90eb1976932d12c8f573a449384cad0enss-3.21.3-2.el6_8.x86_64.rpm36e041fa4c4d964697e4cdec0dbc4a9d052bd3ef8ab5c79532a949af13bf0a96nss-devel-3.21.3-2.el6_8.x86_64.rpmef75c3327ca2c3657c3d7e567fd5b6a30330dc8f6dcde3186a98d38d4d9ae1b4SLSA-2016:2780-1This update upgrades Firefox to version 45.5.0 ESR. Security Fix(es): * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2016-5296, CVE-2016-5297, CVE-2016-9066, CVE-2016-5291, CVE-2016-5290) * A flaw was found in the way Add-on update process was handled by Firefox. A Man-in-the-Middle attacker could use this flaw to install a malicious signed add-on update. (CVE-2016-9064)criticalScientific Linux FermiScientific Linux Fermi 6firefox-45.5.0-1.el6_8.i686.rpm930a35ffaaaa27fafb95dce4e7e45cf1991fd6dbaaf20e544a7ca825b28b23bcfirefox-45.5.0-1.el6_8.x86_64.rpma39181a9e9bf8257be2701330cce84c3bcd2773d0e946ea46f0d89e4491e7eb9SLSA-2016:2820-1Security Fix(es): * Two integer overflow flaws, leading to heap-based buffer overflows, were found in the memcached binary protocol. An attacker could create a specially crafted message that would cause the memcached server to crash or, potentially, execute arbitrary code. (CVE-2016-8704, CVE-2016-8705)importantScientific Linux FermiScientific Linux Fermi 6memcached-1.4.4-3.el6_8.1.x86_64.rpm356138162f1711408c897efb232b4291bdd708459a30b993efc0e7bd8f5f107fmemcached-devel-1.4.4-3.el6_8.1.x86_64.rpmfc0deb1c382171f3615a630c9ca30d9dac30144c575a5ec8095871defefb1682memcached-devel-1.4.4-3.el6_8.1.i686.rpm7fac4bb44e8640626fc40daae583b353d4dd159b4a74174cd62345accb3e8c5eSLSA-2016:2824-1Security Fix(es): * An out-of-bounds read flaw was found in the way Expat processed certain input. A remote attacker could send specially crafted XML that, when parsed by an application using the Expat library, would cause that application to crash or, possibly, execute arbitrary code with the permission of the user running the application. (CVE-2016-0718)moderateScientific Linux FermiScientific Linux Fermi 6expat-2.0.1-13.el6_8.i686.rpm3615b8cb6c8d315466be6f524ff5308b3b20b9ab3475f16087bed07ac7aa139bexpat-devel-2.0.1-13.el6_8.x86_64.rpm4d6eb1ab044c20313c79b57f05ef9045f9960d1f68cc8755aef6bf1c66659dd5expat-2.0.1-13.el6_8.x86_64.rpm7771af7bccf7c70582eeb1407a2af4cb12018e71e9744efefa06d802b734657cexpat-devel-2.0.1-13.el6_8.i686.rpma6cb13a30fe68020f09d00adc104892c1f5aa1a76a07af92aaf556dccc230aabSLSA-2016:2825-1This update upgrades Thunderbird to version 45.5.0 Security Fix(es): * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2016-5290)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-45.5.0-1.el6_8.x86_64.rpm10c277e19e08be5a73e8fcf1e9e181e10101d2e8bec0fe0070948a1bb1f99c68SLSA-2016:2843-1This update upgrades Firefox to version 45.5.1 ESR. Security Fix(es): * A flaw was found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2016-9079)criticalScientific Linux FermiScientific Linux Fermi 6firefox-45.5.1-1.el6_8.x86_64.rpm729700cb23ae532639a93333d2ff9ac751fe3c1f690260eacf686fae56c9bbe8firefox-45.5.1-1.el6_8.i686.rpmf03e0653b482f295c95cd751b4a9d85e82e1309ee4125daf3b537ba3f514efc6SLSA-2016:2850-1This update upgrades Thunderbird to version 45.5.1. Security Fix(es): * A flaw was found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2016-9079)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-45.5.1-1.el6_8.x86_64.rpm2945b5dda342455deb292fd4f361d03dabc04f12042623fd1afe4f91757d141aSLSA-2016:2872-1Security Fix(es): * It was discovered that the sudo noexec restriction could have been bypassed if application run via sudo executed system(), popen(), or wordexp() C library functions with a user supplied argument. A local user permitted to run such application via sudo with noexec restriction could use these flaws to execute arbitrary commands with elevated privileges. (CVE-2016-7032, CVE-2016-7076) These issues were discovered by Florian Weimer (Red Hat).moderateScientific Linux FermiScientific Linux Fermi 6sudo-devel-1.8.6p3-25.el6_8.x86_64.rpm1cc99173f573e9fa8308741af59c054c495a3fa65352b413a669d6aebf853d35sudo-1.8.6p3-25.el6_8.x86_64.rpm77166a1bb59692573a518f221633dac41e60180a0da4378ea0f2d0019ab91b5bsudo-devel-1.8.6p3-25.el6_8.i686.rpmae50a8f2eca5f15dfc46c08a656d8fc35e28d83e19170844bd05bcf9c86eb35bSLSA-2016:2946-1This update upgrades Firefox to version 45.6.0 ESR. Security Fix(es): * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2016-9893, CVE-2016-9899, CVE-2016-9895, CVE-2016-9897, CVE-2016-9898, CVE-2016-9900, CVE-2016-9901, CVE-2016-9902, CVE-2016-9904, CVE-2016-9905)criticalScientific Linux FermiScientific Linux Fermi 6firefox-45.6.0-1.el6_8.i686.rpmd64b021574d5adef0dea64203737609c4fab8d120e67e33ec17c4c880f41258ffirefox-45.6.0-1.el6_8.x86_64.rpm137d7ec8cbc16a80ec07f4ee3f31bbb5ec78eee4e6c09f264d361531653832ccSLSA-2016:2972-1Security Fix(es): * A vulnerability was found in vim in how certain modeline options were treated. An attacker could craft a file that, when opened in vim with modelines enabled, could execute arbitrary commands with privileges of the user running vim. (CVE-2016-1248)moderateScientific Linux FermiScientific Linux Fermi 6vim-enhanced-7.4.629-5.el6_8.1.x86_64.rpm3c3527462404f8c2820c5c99d961286f1cf21a1987797a706278c00b07a025b6vim-filesystem-7.4.629-5.el6_8.1.x86_64.rpmae0593172179c3f7940d763cf8bd2b96e6cdd06bdba6e1c71f5ccb73e7205a24vim-X11-7.4.629-5.el6_8.1.x86_64.rpm13feb709de8e9592ee9516b6b506e7ef834140f0aa0a24baf5cebf56f3f19d1avim-common-7.4.629-5.el6_8.1.x86_64.rpmf9583f9f958b089da972fc428eec078feb1e98684166901cf5e062922abf51a6vim-minimal-7.4.629-5.el6_8.1.x86_64.rpm0d9364987391735749523aeb0232be02e510759facb5a61a3fd23ad8191c511fSLSA-2016:2973-1This update upgrades Thunderbird to version 45.6.0. Security Fix(es): * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2016-9893, CVE-2016-9899, CVE-2016-9895, CVE-2016-9900, CVE-2016-9901, CVE-2016-9902, CVE-2016-9905)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-45.6.0-1.el6_8.x86_64.rpm88d76725098f763649937dd531faecbd85a5111a591bec703401295eadb53082SLSA-2016:2974-1Security Fix(es): * An integer overflow flaw, leading to a heap-based buffer overflow, was found in GStreamer's VMware VMnc video file format decoding plug-in. A remote attacker could use this flaw to cause an application using GStreamer to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2016-9445) * A memory corruption flaw was found in GStreamer's Nintendo NSF music file format decoding plug-in. A remote attacker could use this flaw to cause an application using GStreamer to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2016-9447) Note: This updates removes the vulnerable Nintendo NSF plug-in.importantScientific Linux FermiScientific Linux Fermi 6gstreamer-plugins-bad-free-devel-docs-0.10.19-5.el6_8.x86_64.rpmeddfe978ff7a0e97622e726151bffbd462520136f63d30f824274feba0c8f94fgstreamer-plugins-bad-free-0.10.19-5.el6_8.i686.rpmfc2bf51e98dee113c79514423f4406cad455ce94ced094b0f3669809a5773ec2gstreamer-plugins-bad-free-extras-0.10.19-5.el6_8.i686.rpmb65cb71d3aa7b9651be42750d675f2b7d80075ae4891b0976277c023a8a324e0gstreamer-plugins-bad-free-extras-0.10.19-5.el6_8.x86_64.rpmfc570601b179478a33a2418809b5e11910e42f683beb7b5e8b7760665174521dgstreamer-plugins-bad-free-0.10.19-5.el6_8.x86_64.rpm9e77f3aa2f77eb717796d41a91c824304eb40a848318d25a7d26662f93553e63gstreamer-plugins-bad-free-devel-0.10.19-5.el6_8.x86_64.rpm3e3973cfd1b06a86a2588a1474783969f1b0ce5031263663773791da0b92ad1agstreamer-plugins-bad-free-devel-0.10.19-5.el6_8.i686.rpmc0033ff162bee6c56ab075d94081b70d8b0bbab385400b1258758b0ca618fd86SLSA-2016:2975-1Security Fix(es): * Multiple flaws were discovered in GStreamer's FLC/FLI/FLX media file format decoding plug-in. A remote attacker could use these flaws to cause an application using GStreamer to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2016-9634, CVE-2016-9635, CVE-2016-9636, CVE-2016-9808) * An invalid memory read access flaw was found in GStreamer's FLC/FLI/FLX media file format decoding plug-in. A remote attacker could use this flaw to cause an application using GStreamer to crash. (CVE-2016-9807) Note: This updates removes the vulnerable FLC/FLI/FLX plug-in.importantScientific Linux FermiScientific Linux Fermi 6gstreamer-plugins-good-0.10.23-4.el6_8.i686.rpm8bc4dedf738fc2398e740a11d420863167b67e436f616ae7eeb79047b94bf19dgstreamer-plugins-good-devel-0.10.23-4.el6_8.i686.rpm33844c31d90cfcf245f0abf778b9d84ba7a5fc666075c46cf0903eab0280dbcfgstreamer-plugins-good-devel-0.10.23-4.el6_8.x86_64.rpmd2c0236965af4fc4cdfbfa0359971c05c47d12b253a9680a490bc5a2766b30ddgstreamer-plugins-good-0.10.23-4.el6_8.x86_64.rpm3490f647a4514e2a238301174e7a6d6e01d2ee88a0d72b12a4910296483b1c6bSLSA-2017:0014-1Security Fix(es): * It was found that the ghostscript functions getenv, filenameforall and .libfile did not honor the -dSAFER option, usually used when processing untrusted documents, leading to information disclosure. A specially crafted postscript document could read environment variable, list directory and retrieve file content respectively, from the target. (CVE-2013-5653, CVE-2016-7977) * It was found that the ghostscript function .initialize_dsc_parser did not validate its parameter before using it, allowing a type confusion flaw. A specially crafted postscript document could cause a crash code execution in the context of the gs process. (CVE-2016-7979) * It was found that ghostscript did not sufficiently check the validity of parameters given to the .sethalftone5 function. A specially crafted postscript document could cause a crash, or execute arbitrary code in the context of the gs process. (CVE-2016-8602)moderateScientific Linux FermiScientific Linux Fermi 6ghostscript-gtk-8.70-21.el6_8.1.x86_64.rpm0a8972ff84814ec2fea93247bf3e57489c6d46007bddb66bc897988b33a49819ghostscript-doc-8.70-21.el6_8.1.x86_64.rpm4515c15bf4c92dcd4ca8771a1e58f905b899845733d02c09cc26001f2536db16ghostscript-8.70-21.el6_8.1.i686.rpmba7ab42de9bd6463b1cb8ff35d0211533ce9c0618b2699cce0b4b5d0544ac452ghostscript-devel-8.70-21.el6_8.1.i686.rpma579cf7eb48b385dd1a0452b986086958d69c0c46973c1e41b02d8963c25d34bghostscript-devel-8.70-21.el6_8.1.x86_64.rpmf8ea47fb82a66c7f4026b35c57205cb7bfe87bab6a6930de7073643e552c1d2cghostscript-8.70-21.el6_8.1.x86_64.rpm2abbfc8cdb83f46e9556520dabe035fca07bcca84f17f093e971b5abe805df95SLSA-2017:0036-1Security Fix(es): * A use-after-free vulnerability was found in the kernels socket recvmmsg subsystem. This may allow remote attackers to corrupt memory and may allow execution of arbitrary code. This corruption takes place during the error handling routines within __sys_recvmmsg() function. (CVE-2016-7117, Important) * An out-of-bounds heap memory access leading to a Denial of Service, heap disclosure, or further impact was found in setsockopt(). The function call is normally restricted to root, however some processes with cap_sys_admin may also be able to trigger this flaw in privileged container environments. (CVE-2016-4998, Moderate) * A use-after-free vulnerability was found in tcp_xmit_retransmit_queue and other tcp_* functions. This condition could allow an attacker to send an incorrect selective acknowledgment to existing connections, possibly resetting a connection. (CVE-2016-6828, Moderate) Bug Fix(es): * When parallel NFS returned a file layout, a kernel crash sometimes occurred. This update removes the call to the BUG_ON() function from a code path of a client that returns the file layout. As a result, the kernel no longer crashes in the described situation. * When a guest virtual machine (VM) on Microsoft Hyper-V was set to crash on a Nonmaskable Interrupt (NMI) that was injected from the host, this VM became unresponsive and did not create the vmcore dump file. This update applies a set of patches to the Virtual Machine Bus kernel driver (hv_vmbus) that fix this bug. As a result, the VM now first creates and saves the vmcore dump file and then reboots. * From Scientific Linux 6.6 to 6.8, the IPv6 routing cache occasionally showed incorrect values. This update fixes the DST_NOCOUNT mechanism, and the IPv6 routing cache now shows correct values. * When using the ixgbe driver and the software Fibre Channel over Ethernet (FCoE) stack, suboptimal performance in some cases occurred on systems with a large number of CPUs. This update fixes the fc_exch_alloc() function to try all the available exchange managers in the list for an available exchange ID. This change avoids failing allocations, which previously led to the host busy status. * When the vmwgfx kernel module loads, it overrides the boot resolution automatically. Consequently, users were not able to change the resolution by manual setting of the kernel's 'vga=' parameter in the /boot/grub/grub.conf file. This update adds the 'nomodeset' parameter, which can be set in the /boot/grub/grub.conf file. The 'nomodeset' parameter allows the users to prevent the vmwgfx driver from loading. As a result, the setting of the 'vga=' parameter works as expected, in case that vmwgfx does not load. * When Scientific Linux 6.8 was booted on SMBIOS 3.0 based systems, Desktop Management Interface (DMI) information, which is referenced by several applications, such as NEC server's memory RAS utility, was missing entries in the sysfs virtual file system. This update fixes the underlying source code, and sysfs now shows the DMI information as expected. * Previously, bonding mode active backup and the propagation of the media access control (MAC) address to a VLAN interface did not work in Scientific Linux 6.8, when the fail_over_mac bonding parameter was set to fail_over_mac=active. With this update, the underlying source code has been fixed so that the VLANs continue inheriting the MAC address of the active physical interface until the VLAN MAC address is explicitly set to any value. As a result, IPv6 EUI64 addresses for the VLAN can reflect any changes to the MAC address of the physical interface, and Duplicate Address Detection (DAD) behaves as expected.importantScientific Linux FermitrueScientific Linux Fermi 6kernel-abi-whitelists-2.6.32-642.13.1.el6.noarch.rpmc171521ea01dd684e221c09c9805e1e5c82b3e6b9bc3e66bdbba918c42c9c19bkernel-debug-devel-2.6.32-642.13.1.el6.x86_64.rpm5b89813f1f14bfc19d55e56f12189b8a81c9c48a6b788d46d7f1416ca3c36264kernel-devel-2.6.32-642.13.1.el6.x86_64.rpmd899131ffd822a98585dc96291cafcf338314438217c3846b425454c08ec98fakernel-debug-devel-2.6.32-642.13.1.el6.i686.rpm8b69f6c581df75030f040af001898b16380e127590214a8b6c55e18302e3e1f3kernel-2.6.32-642.13.1.el6.x86_64.rpmb975f3990139b0dae17b448a498c2644c1bdbd1389556d53587d02648bf59f18kernel-debug-2.6.32-642.13.1.el6.x86_64.rpm1a545f924ffaa3fd2163a32c606a174c202bcc152530e3de6d83d0ae8ef7eab2kernel-doc-2.6.32-642.13.1.el6.noarch.rpm9eec6c2154ee118fcd279dedd57c085b93496b2d11f1f213817579045a4a937akernel-headers-2.6.32-642.13.1.el6.x86_64.rpm0b472bcbff513b4f84659cca8ffc456f27a50fb1a5d4c95289ab8c39477ae356perf-2.6.32-642.13.1.el6.x86_64.rpm0a3f8acb5ebe2529fdb8677abc450974f6fd558a136efdba27da9696e24864cekernel-firmware-2.6.32-642.13.1.el6.noarch.rpmbf1ee812e5e093dfbc8426baa67d9a6451ebb7a8466076a74fd3b87cb185a6a4python-perf-2.6.32-642.13.1.el6.x86_64.rpm8e9b20beb95a9ba5a022a24f8efa0a43148092513d443772821665ee2fb81188SLSA-2017:0061-1Security Fix(es): * It was discovered that the Hotspot component of OpenJDK did not properly check arguments of the System.arraycopy() function in certain cases. An untrusted Java application or applet could use this flaw to corrupt virtual machine's memory and completely bypass Java sandbox restrictions. (CVE-2016-5582) * It was discovered that the Hotspot component of OpenJDK did not properly check received Java Debug Wire Protocol (JDWP) packets. An attacker could possibly use this flaw to send debugging commands to a Java program running with debugging enabled if they could make victim's browser send HTTP requests to the JDWP port of the debugged application. (CVE-2016-5573) * It was discovered that the Libraries component of OpenJDK did not restrict the set of algorithms used for Jar integrity verification. This flaw could allow an attacker to modify content of the Jar file that used weak signing key or hash algorithm. (CVE-2016-5542) Note: After this update, MD2 hash algorithm and RSA keys with less than 1024 bits are no longer allowed to be used for Jar integrity verification by default. MD5 hash algorithm is expected to be disabled by default in the future updates. A newly introduced security property jdk.jar.disabledAlgorithms can be used to control the set of disabled algorithms. * A flaw was found in the way the JMX component of OpenJDK handled classloaders. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. (CVE-2016-5554) * A flaw was found in the way the Networking component of OpenJDK handled HTTP proxy authentication. A Java application could possibly expose HTTPS server authentication credentials via a plain text network connection to an HTTP proxy if proxy asked for authentication. (CVE-2016-5597) Note: After this update, Basic HTTP proxy authentication can no longer be used when tunneling HTTPS connection through an HTTP proxy. Newly introduced system properties jdk.http.auth.proxying.disabledSchemes and jdk.http.auth.tunneling.disabledSchemes can be used to control which authentication schemes can be requested by an HTTP proxy when proxying HTTP and HTTPS connections respectively.importantScientific Linux FermiScientific Linux Fermi 6java-1.6.0-openjdk-src-1.6.0.41-1.13.13.1.el6_8.x86_64.rpmc0695c1a4426c5adabd2aed3146cbb3676477612ddc46892553d988154d30158java-1.6.0-openjdk-javadoc-1.6.0.41-1.13.13.1.el6_8.x86_64.rpmb839c3b1fed3f523344cfa8e9d24da316b9e6bf7d18cfcf0f73a65f3b4451ee3java-1.6.0-openjdk-devel-1.6.0.41-1.13.13.1.el6_8.x86_64.rpm096eca761760aa8e49fe775d7340eb1ec78b79778a350953c4d0e2c642954272java-1.6.0-openjdk-1.6.0.41-1.13.13.1.el6_8.x86_64.rpm212f7570e2b9be2e2d1960172c9c5edb0b4388e1ad078b9918f031bba33ece29java-1.6.0-openjdk-demo-1.6.0.41-1.13.13.1.el6_8.x86_64.rpm21c2dc23f940dc7e97ec05df2b4729366cfa794e593158a293fd89f1ad5737baSLSA-2017:0063-1Security Fix(es): * A denial of service flaw was found in the way BIND handled a query response containing inconsistent DNSSEC information. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2016-9147)importantScientific Linux FermiScientific Linux Fermi 6bind-libs-9.8.2-0.47.rc1.el6_8.4.i686.rpm9a27a3db4d42258757d79b06c6cfb01d28026e29d6d6e726df4877500547f2b4bind-chroot-9.8.2-0.47.rc1.el6_8.4.x86_64.rpmb4aff172bbe56fd208971b6bfc448c200e54deea0e9802a8bb251746ff96202ebind-utils-9.8.2-0.47.rc1.el6_8.4.x86_64.rpmfed8e401b8f15878cf7684d147da0c9d132d9a72ee27eaf99d348259f2c14792bind-devel-9.8.2-0.47.rc1.el6_8.4.i686.rpma79f1ca81e1ea9fcc5c8958ccbf0d806d7d93365bd6885a74f2ba16294c26c71bind-devel-9.8.2-0.47.rc1.el6_8.4.x86_64.rpm5803a60c64b30073d08097b7e2241c3cdaf1e02495672f8aedf48866a8109827bind-libs-9.8.2-0.47.rc1.el6_8.4.x86_64.rpmd99333129ffc6b353817405072b0ae6eef6165d6214d95baf88e1368281329a8bind-sdb-9.8.2-0.47.rc1.el6_8.4.x86_64.rpm5bce375355e98a5b7928dd2bdf2e4194e1e387028dc70a178153e6627e857a7dbind-9.8.2-0.47.rc1.el6_8.4.x86_64.rpm59fb4d20172cda4b01c14b95df37ccd9c3a06ff4b621a11d37a57df2eb278f40SLSA-2017:0180-1Security Fix(es): * It was discovered that the RMI registry and DCG implementations in the RMI component of OpenJDK performed deserialization of untrusted inputs. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of RMI registry or a Java RMI application. (CVE-2017-3241) This issue was addressed by introducing whitelists of classes that can be deserialized by RMI registry or DCG. These whitelists can be customized using the newly introduced sun.rmi.registry.registryFilter and sun.rmi.transport.dgcFilter security properties. * Multiple flaws were discovered in the Libraries and Hotspot components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions. (CVE-2017-3272, CVE-2017-3289) * A covert timing channel flaw was found in the DSA implementation in the Libraries component of OpenJDK. A remote attacker could possibly use this flaw to extract certain information about the used key via a timing side channel. (CVE-2016-5548) * It was discovered that the Libraries component of OpenJDK accepted ECSDA signatures using non-canonical DER encoding. This could cause a Java application to accept signature in an incorrect format not accepted by other cryptographic tools. (CVE-2016-5546) * It was discovered that the 2D component of OpenJDK performed parsing of iTXt and zTXt PNG image chunks even when configured to ignore metadata. An attacker able to make a Java application parse a specially crafted PNG image could cause the application to consume an excessive amount of memory. (CVE-2017-3253) * It was discovered that the Libraries component of OpenJDK did not validate the length of the object identifier read from the DER input before allocating memory to store the OID. An attacker able to make a Java application decode a specially crafted DER input could cause the application to consume an excessive amount of memory. (CVE-2016-5547) * It was discovered that the JAAS component of OpenJDK did not use the correct way to extract user DN from the result of the user search LDAP query. A specially crafted user LDAP entry could cause the application to use an incorrect DN. (CVE-2017-3252) * It was discovered that the Networking component of OpenJDK failed to properly parse user info from the URL. A remote attacker could cause a Java application to incorrectly parse an attacker supplied URL and interpret it differently from other applications processing the same URL. (CVE-2016-5552) * Multiple flaws were found in the Networking components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2017-3261, CVE-2017-3231) * A flaw was found in the way the DES/3DES cipher was used as part of the TLS/SSL protocol. A man-in-the-middle attacker could use this flaw to recover some plaintext data by capturing large amounts of encrypted traffic between TLS/SSL server and client if the communication used a DES/3DES based ciphersuite. (CVE-2016-2183) This update mitigates the CVE-2016-2183 issue by adding 3DES cipher suites to the list of legacy algorithms (defined using the jdk.tls.legacyAlgorithms security property) so they are only used if connecting TLS/SSL client and server do not share any other non-legacy cipher suite. Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website.criticalScientific Linux FermiScientific Linux Fermi 6java-1.8.0-openjdk-javadoc-debug-1.8.0.121-0.b13.el6_8.noarch.rpmc1138e7ae5a141f57bf2e1ca48ab14f8f0852b2cc2c1cfe0ea1750258007637ejava-1.8.0-openjdk-1.8.0.121-0.b13.el6_8.x86_64.rpma01148ee52df04f5125f12f163930490f2960966d8cdb7c16bc80eeb076daeefjava-1.8.0-openjdk-devel-debug-1.8.0.121-0.b13.el6_8.x86_64.rpme345dcd8279488f160ddb534e7b077b80edc6c3ea95cb34290ef00aca54010f6java-1.8.0-openjdk-src-debug-1.8.0.121-0.b13.el6_8.x86_64.rpmf1d73ab6a31db88a09aa35e3fec964994a9ba8c5efcdcbce444509ea6825db5bjava-1.8.0-openjdk-devel-1.8.0.121-0.b13.el6_8.x86_64.rpm401303e835c19c02117eae66f559da3864aa62db213474b936d075a55f93b16ajava-1.8.0-openjdk-javadoc-1.8.0.121-0.b13.el6_8.noarch.rpm74fe19d2464fd21fda7d5477235c2c7576a05bcff7a7c3ff9b410691de5cfe3cjava-1.8.0-openjdk-debug-1.8.0.121-0.b13.el6_8.x86_64.rpmfdae3e54699089bb9613a5c11494ef67713e43d12216b193a326bab6bdeaa4f6java-1.8.0-openjdk-src-1.8.0.121-0.b13.el6_8.x86_64.rpm096e407444e8d4522be5c85c7599e389878ce870b30a12fdea18777b172b8b7bjava-1.8.0-openjdk-demo-debug-1.8.0.121-0.b13.el6_8.x86_64.rpmdce60e58d5971c62d42c2e87e6190368584987ad1237d364cbd70f05666ea0f4java-1.8.0-openjdk-headless-1.8.0.121-0.b13.el6_8.x86_64.rpm39fba38dbe6e30bd038df97bd3af508eb78ed3c1819c8f31f1876c345186a9acjava-1.8.0-openjdk-headless-debug-1.8.0.121-0.b13.el6_8.x86_64.rpm92d6a220e52423125530de02dc7d89f5ecd7b443eede93e3ccafcfced4088658java-1.8.0-openjdk-demo-1.8.0.121-0.b13.el6_8.x86_64.rpmaca9975bae8d12ad6bc32ad5605043ae47721001aa0746987fa7c75035327db6SLSA-2017:0183-1Security Fix(es): * It was found that squid did not properly remove connection specific headers when answering conditional requests using a cached request. A remote attacker could send a specially crafted request to an HTTP server via the squid proxy and steal private data from other connections. (CVE-2016-10002)moderateScientific Linux FermiScientific Linux Fermi 6squid34-3.4.14-9.el6_8.4.x86_64.rpmab30eb39b352bcd91cb2078e39c8dab20f42eac21fdc5b02a0b38b836cb8096dSLSA-2017:0184-1Security Fix(es): * It was discovered that the MySQL logging functionality allowed writing to MySQL configuration files. An administrative database user, or a database user with FILE privileges, could possibly use this flaw to run arbitrary commands with root privileges on the system running the database server. (CVE-2016-6662) * A race condition was found in the way MySQL performed MyISAM engine table repair. A database user with shell access to the server running mysqld could use this flaw to change permissions of arbitrary files writable by the mysql system user. (CVE-2016-6663, CVE-2016-5616)importantScientific Linux FermiScientific Linux Fermi 6mysql-libs-5.1.73-8.el6_8.i686.rpm3ae7749281395d87188923fc17a9e66871548f14f417203703dd07a0cd271a0bmysql-bench-5.1.73-8.el6_8.x86_64.rpm7dfc3122434597386d650e04c9129621f95f9b6df4c45cb3ae243a93a667f4camysql-embedded-5.1.73-8.el6_8.i686.rpm4254ef63aa37c4bfafff6c7a6f29b98271bc4a26a57191f8de0ec40caed2e725mysql-libs-5.1.73-8.el6_8.x86_64.rpm2ce1fb8919f626c7bd7376c43df24048ae23730bac1cccc07754596ce0276e1amysql-devel-5.1.73-8.el6_8.i686.rpm28a0929bdeec6c520eea383e9dc8f398a5572945528cee989287189b384f49a9mysql-embedded-devel-5.1.73-8.el6_8.x86_64.rpm83edab22b9d9eb4a2c472ad7aa7fcca95589fc2ba0a7f414414f281d5c1377fcmysql-server-5.1.73-8.el6_8.x86_64.rpm2370764742f243939d5e2d8fa53c5d7463336d89dd8c32eff2eef8aaa19e388fmysql-test-5.1.73-8.el6_8.x86_64.rpm28c2d644024db3708947ad92b652e50f300a2b1cf3b4365323d482baef35aa0dmysql-embedded-devel-5.1.73-8.el6_8.i686.rpm0ad1113c3e52b67a7f3fd05b3d7209c1f77b4a1bb6d35789bfe3d3dbe05577d0mysql-embedded-5.1.73-8.el6_8.x86_64.rpmed0c15dcb63549f7870fe09aefb405acf8d130890d159d7b266bc88136c6dceemysql-5.1.73-8.el6_8.x86_64.rpm83afdfe30dae3a365ea5608dbfa8f773cf803d29f1663a42920459792e52e143mysql-devel-5.1.73-8.el6_8.x86_64.rpm03a1d0d315ff4132e790294aa019b6733808b8c38e70d1a13adee75132b5349fSLSA-2017:0190-1This update upgrades Firefox to version 45.7.0 ESR. Security Fix(es): * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2017-5373, CVE-2017-5375, CVE-2017-5376, CVE-2017-5378, CVE-2017-5380, CVE-2017-5383, CVE-2017-5386, CVE-2017-5390, CVE-2017-5396)criticalScientific Linux FermiScientific Linux Fermi 6firefox-45.7.0-2.el6_8.x86_64.rpmcc33e17b26b9cb8b8a8643947c3b2579b3ee341039eba147d815c9d866217f21firefox-45.7.0-2.el6_8.i686.rpm13a5085b51a25f77ac34922ad8cc37c6183bdc09d1e69b845541a096d604a843firefox-45.7.0-1.el6_8.i686.rpmc40e3121e4607e09acc8bba4aa3146a742297335cb2ef0d281fcf4937aa04b71firefox-45.7.0-1.el6_8.x86_64.rpme1b6d209b0475bb797d7d30c4be2a3f63aa80f5dccd2d3c25f3e7fa6597da465SLSA-2017:0225-1Security Fix(es): * Multiple flaws have been discovered in libtiff. A remote attacker could exploit these flaws to cause a crash or memory corruption and, possibly, execute arbitrary code by tricking an application linked against libtiff into processing specially crafted files. (CVE-2016-9533, CVE-2016-9534, CVE-2016-9535) * Multiple flaws have been discovered in various libtiff tools (tiff2pdf, tiffcrop, tiffcp, bmp2tiff). By tricking a user into processing a specially crafted file, a remote attacker could exploit these flaws to cause a crash or memory corruption and, possibly, execute arbitrary code with the privileges of the user running the libtiff tool. (CVE-2015-8870, CVE-2016-5652, CVE-2016-9540, CVE-2016-9537, CVE-2016-9536)moderateScientific Linux FermiScientific Linux Fermi 6libtiff-devel-3.9.4-21.el6_8.x86_64.rpmf4c18643aaca64f969a7b03c98bd349551ff48ccda6dd351dd0c390161266b84libtiff-3.9.4-21.el6_8.x86_64.rpmd0e46fdfe7f7de71cf221ce04c9ebe2ad9a819900d1d9ff4d2dc1dd850eccce3libtiff-3.9.4-21.el6_8.i686.rpm33d18b53a5c280266dba99dd5c4dfe8f83c919dcf987c7bd332f2241c5354921libtiff-static-3.9.4-21.el6_8.x86_64.rpma4ac5a5ceac776dae06a5a8c5809e96508b6587b76d8b09d68a86a6feeaad617libtiff-devel-3.9.4-21.el6_8.i686.rpmbb284ebfc72c3b084d881df484aec2e5e1f41e908b29c2f08cec66489ba12220SLSA-2017:0238-1This update upgrades Thunderbird to version 45.7.0. Security Fix(es): * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2017-5373, CVE-2017-5375, CVE-2017-5376, CVE-2017-5378, CVE-2017-5380, CVE-2017-5383, CVE-2017-5390, CVE-2017-5396)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-45.7.0-1.el6_8.x86_64.rpmd5251731f9bce5ca6efc7d233d51a005f576bd5d482078a61683fac6b4f7b9aaSLSA-2017:0252-1Security Fix(es): * It was found that when ntp is configured with rate limiting for all associations the limits are also applied to responses received from its configured sources. A remote attacker who knows the sources can cause a denial of service by preventing ntpd from accepting valid responses from its sources. (CVE-2016-7426) * A flaw was found in the control mode functionality of ntpd. A remote attacker could send a crafted control mode packet which could lead to information disclosure or result in DDoS amplification attacks. (CVE-2016-9310) * A flaw was found in the way ntpd implemented the trap service. A remote attacker could send a specially crafted packet to cause a null pointer dereference that will crash ntpd, resulting in a denial of service. (CVE-2016-9311) * A flaw was found in the way ntpd running on a host with multiple network interfaces handled certain server responses. A remote attacker could use this flaw which would cause ntpd to not synchronize with the source. (CVE-2016-7429) * A flaw was found in the way ntpd calculated the root delay. A remote attacker could send a specially-crafted spoofed packet to cause denial of service or in some special cases even crash. (CVE-2016-7433)moderateScientific Linux FermiScientific Linux Fermi 6ntp-perl-4.2.6p5-10.el6_8.2.x86_64.rpm1dbde138144c10e426d902a2aab5cf65bcca9c68b24d134c70d2cceb1fede24cntp-4.2.6p5-10.el6_8.2.x86_64.rpmeaeb4f427801b2e7ff88d2d210b8f644f29d468240c869dfb54051ac45bd4e24ntp-doc-4.2.6p5-10.el6_8.2.noarch.rpmefe173af8e9ca6f18d31e7258f7d3632c16d68a10755e8e03d0fb3c19f594553ntpdate-4.2.6p5-10.el6_8.2.x86_64.rpm6dcba1152f191fbae24ba457176b86bac4345e8c90de62b7071b5b751b3d7673SLSA-2017:0253-1Security Fix(es): * A vulnerability was discovered in spice in the server's protocol handling. An authenticated attacker could send crafted messages to the spice server causing a heap overflow leading to a crash or possible code execution. (CVE-2016-9577) * A vulnerability was discovered in spice in the server's protocol handling. An attacker able to connect to the spice server could send crafted messages which would cause the process to crash. (CVE-2016-9578)moderateScientific Linux FermiScientific Linux Fermi 6spice-server-devel-0.12.4-13.el6_8.2.x86_64.rpm07b1cd1a82720a2af0f1e5874e8aa49cfece4bd309d843b5423962894f026339spice-server-0.12.4-13.el6_8.2.x86_64.rpm86baffc74e060ac4d33844d76c9db8f3c7e64628829e13c31a571d0966b4ce04SLSA-2017:0269-1Security Fix(es): * It was discovered that the RMI registry and DCG implementations in the RMI component of OpenJDK performed deserialization of untrusted inputs. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of RMI registry or a Java RMI application. (CVE-2017-3241) This issue was addressed by introducing whitelists of classes that can be deserialized by RMI registry or DCG. These whitelists can be customized using the newly introduced sun.rmi.registry.registryFilter and sun.rmi.transport.dgcFilter security properties. * Multiple flaws were discovered in the Libraries and Hotspot components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions. (CVE-2017-3272, CVE-2017-3289) * A covert timing channel flaw was found in the DSA implementation in the Libraries component of OpenJDK. A remote attacker could possibly use this flaw to extract certain information about the used key via a timing side channel. (CVE-2016-5548) * It was discovered that the Libraries component of OpenJDK accepted ECSDA signatures using non-canonical DER encoding. This could cause a Java application to accept signature in an incorrect format not accepted by other cryptographic tools. (CVE-2016-5546) * It was discovered that the 2D component of OpenJDK performed parsing of iTXt and zTXt PNG image chunks even when configured to ignore metadata. An attacker able to make a Java application parse a specially crafted PNG image could cause the application to consume an excessive amount of memory. (CVE-2017-3253) * It was discovered that the Libraries component of OpenJDK did not validate the length of the object identifier read from the DER input before allocating memory to store the OID. An attacker able to make a Java application decode a specially crafted DER input could cause the application to consume an excessive amount of memory. (CVE-2016-5547) * It was discovered that the JAAS component of OpenJDK did not use the correct way to extract user DN from the result of the user search LDAP query. A specially crafted user LDAP entry could cause the application to use an incorrect DN. (CVE-2017-3252) * It was discovered that the Networking component of OpenJDK failed to properly parse user info from the URL. A remote attacker could cause a Java application to incorrectly parse an attacker supplied URL and interpret it differently from other applications processing the same URL. (CVE-2016-5552) * Multiple flaws were found in the Networking components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2017-3261, CVE-2017-3231) * A flaw was found in the way the DES/3DES cipher was used as part of the TLS/SSL protocol. A man-in-the-middle attacker could use this flaw to recover some plaintext data by capturing large amounts of encrypted traffic between TLS/SSL server and client if the communication used a DES/3DES based ciphersuite. (CVE-2016-2183) This update mitigates the CVE-2016-2183 issue by adding 3DES cipher suites to the list of legacy algorithms (defined using the jdk.tls.legacyAlgorithms security property) so they are only used if connecting TLS/SSL client and server do not share any other non-legacy cipher suite.criticalScientific Linux FermiScientific Linux Fermi 6java-1.7.0-openjdk-src-1.7.0.131-2.6.9.0.el6_8.x86_64.rpm95a23a810e0e07d2fd938233e8f8747415e5388aca72ffd544d1ddb42f6f4c6ajava-1.7.0-openjdk-1.7.0.131-2.6.9.0.el6_8.x86_64.rpmd2862ec5f08c2524717bad91669f1f946d7cb93777d46cb15b73d7f84a71c596java-1.7.0-openjdk-devel-1.7.0.131-2.6.9.0.el6_8.x86_64.rpmc5c1a1a1e332b69ecfabb031aa263da5cb66ec6dba303a1a4bf3105cb23a64cejava-1.7.0-openjdk-javadoc-1.7.0.131-2.6.9.0.el6_8.noarch.rpmcec52da5b4651e98942f333978cc8e2adf6706b747e796c6a442642658caa563java-1.7.0-openjdk-demo-1.7.0.131-2.6.9.0.el6_8.x86_64.rpmb7fb855ba23ba40002fbb6ecc9d080e2a969f9c3de7ddbfdee5c922a45ffb6efSLSA-2017:0286-1Security Fix(es): * An integer underflow leading to an out of bounds read flaw was found in OpenSSL. A remote attacker could possibly use this flaw to crash a 32-bit TLS/SSL server or client using OpenSSL if it used the RC4-MD5 cipher suite. (CVE-2017-3731) * A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections form other clients. (CVE-2016-8610)moderateScientific Linux FermiScientific Linux Fermi 6openssl-1.0.1e-48.sl6_8.4.x86_64.rpmdd258ab9fc22694e8a7c0f6d7ceb671a358e4f75c67db86d144af895bae8b056openssl-devel-1.0.1e-48.sl6_8.4.i686.rpm6b20c4cb87c930ca05a0fdd8830a5df4c45f86f25baf25143a804a5f9f40bbcbopenssl-1.0.1e-48.sl6_8.4.i686.rpme12f8db124e6f308c5cdbf2af112999317a6789d82c3a04f6d46fea56b7b6f25openssl-perl-1.0.1e-48.el6_8.4.x86_64.rpmfc60fdfecd866be901961c3c20d932e801123679540dff24ecf6c744c6e91e50openssl-static-1.0.1e-48.sl6_8.4.x86_64.rpm1f0bd605ce5915fd8b790a4a6b66e6b136f409acc56b5328103f675568ac3c09openssl-devel-1.0.1e-48.sl6_8.4.x86_64.rpmccf2ee4d618e72b865fc268e36bc5c2e29380332ca88937d1700751cec6e7f78openssl-1.0.1e-48.el6_8.4.i686.rpm3cb71a00f3b543c77c6e32ae43f09f77a6ec1a9035af3b25f81f2e9d1baac0c7openssl-devel-1.0.1e-48.el6_8.4.i686.rpmeb2e349ba79aa7252233dfbaffe89865dcfc4b88c1e7fe65f157be77ce030da5openssl-1.0.1e-48.el6_8.4.x86_64.rpm0dd5f611b06364e8c3e496160d397940ad4cf1a8edc0b96cea3036bdc0ebccfaopenssl-perl-1.0.1e-48.sl6_8.4.x86_64.rpmad6a90f86effac4f6dedacbd6a1fed598c00d02154bc960c3f1b9143f46f78ffopenssl-devel-1.0.1e-48.el6_8.4.x86_64.rpm68f49fad48857714b4cfd5ea6a2cf2c8efb84e150ffe5aaec433c15127e371adopenssl-static-1.0.1e-48.el6_8.4.x86_64.rpmdda3e7cb91a96c132f431d27d9213a85dc5f63dcbb54fb2c2e00dca7d2d432f9SLSA-2017:0293-1Security Fix(es): * A use-after-free flaw was found in the way the Linux kernel's Datagram Congestion Control Protocol (DCCP) implementation freed SKB (socket buffer) resources for a DCCP_PKT_REQUEST packet when the IPV6_RECVPKTINFO option is set on the socket. A local, unprivileged user could use this flaw to alter the kernel memory, allowing them to escalate their privileges on the system. (CVE-2017-6074, Important)importantScientific Linux FermitrueScientific Linux Fermi 6kernel-debug-2.6.32-642.13.2.el6.x86_64.rpm31f14229137cc160b6578e4e9ef3fd1fefba9e5953cbe52a03aa8ef7cb36fc33kernel-abi-whitelists-2.6.32-642.13.2.el6.noarch.rpm6e7dc601051e6b4e615e8475cfe4a0423612c2999e4387b8d6cb9d90bf8cca95kernel-firmware-2.6.32-642.13.2.el6.noarch.rpm46dba8452717d1b061f24f66bb13b68e1b70b1c575810c0b3938adaf0d0b765bpython-perf-2.6.32-642.13.2.el6.x86_64.rpm62d30dbdb431b11f96cab5c4e6d6b70b3b95383148a23e5d864839130871cb72kernel-devel-2.6.32-642.13.2.el6.x86_64.rpm2a621d007d34f2a313787f90040b87c5a21c254fd0fe44fc67e39dbdcf5c5dc7perf-2.6.32-642.13.2.el6.x86_64.rpm8366faa4bdee149dca26a1403f3172a31e68aaadb3827929523657a8777405d3kernel-debug-devel-2.6.32-642.13.2.el6.x86_64.rpm2cea911885afed63a7326b3bb44d866635c33a3cedabfb199bc1d85b9f3ef2c6kernel-2.6.32-642.13.2.el6.x86_64.rpm37b7ab82c6b638ea965cc5e52be20e039b8b91cd5382837189cc7f42bbddc2bdkernel-headers-2.6.32-642.13.2.el6.x86_64.rpm070a7766db41fb171b7c6fe0679a594ba0d227353f5516e1d550abdac9be2e2fkernel-doc-2.6.32-642.13.2.el6.noarch.rpm4c4c832078f635becb5dc2d09f6970ac567226b1e8bb9060e9eedda24bc4e9ackernel-debug-devel-2.6.32-642.13.2.el6.i686.rpm2d61d4b48c47e8a139d556e23acaf968fc7c9da1184062d2ba55a94aa61e90a1SLSA-2017:0307-1Security Fix(es): * When creating audit records for parameters to executed children processes, an attacker can convince the Linux kernel audit subsystem can create corrupt records which may allow an attacker to misrepresent or evade logging of executing commands. (CVE-2016-6136, Moderate) * A flaw was found in the Linux kernel's implementation of the SCTP protocol. A remote attacker could trigger an out-of-bounds read with an offset of up to 64kB potentially causing the system to crash. (CVE-2016-9555, Moderate) Bug Fix(es): * The qlnic driver previously attempted to fetch pending transmission descriptors before all writes were complete, which lead to firmware hangs. With this update, the qlcnic driver has been fixed to complete all writes before the hardware fetches any pending transmission descriptors. As a result, the firmware no longer hangs with the qlcnic driver. * Previously, when a NFS share was mounted, the file-system (FS) cache was incorrectly enabled even when the "-o fsc" option was not used in the mount command. Consequently, the cachefilesd service stored files in the NFS share even when not instructed to by the user. With this update, NFS does not use the FS cache if not instructed by the "-o fsc" option. As a result, NFS no longer enables caching if the "-o fsc" option is not used. * Previously, an NFS client and NFS server got into a NFS4 protocol loop involving a WRITE action and a NFS4ERR_EXPIRED response when the current_fileid counter got to the wraparound point by overflowing the value of 32 bits. This update fixes the NFS server to handle the current_fileid wraparound. As a result, the described NFS4 protocol loop no longer occurs. * Previously, certain configurations of the Hewlett Packard Smart Array (HPSA) devices caused hardware to be set offline incorrectly when the HPSA driver was expected to wait for existing I/O operations to complete. Consequently, a kernel panic occurred. This update prevents the described problem. As a result, the kernel panic no longer occurs. * Previously, memory corruption by copying data into the wrong memory locations sometimes occurred, because the __copy_tofrom_user() function was returning incorrect values. This update fixes the __copy_tofrom_user() function so that it no longer returns larger values than the number of bytes it was asked to copy. As a result, memory corruption no longer occurs in he described scenario. * Previously, guest virtual machines (VMs) on a Hyper-V server cluster got in some cases rebooted during the graceful node failover test, because the host kept sending heartbeat packets independently of guests responding to them. This update fixes the bug by properly responding to all the heartbeat messages in the queue, even if they are pending. As a result, guest VMs no longer get rebooted under the described circumstances. * When the "punching hole" feature of the fallocate utility was used on an ext4 file system inode with extent depth of 1, the extent tree of the inode sometimes became corrupted. With this update, the underlying source code has been fixed, and extent tree corruption no longer occurs in the described situation.moderateScientific Linux FermitrueScientific Linux Fermi 6kernel-debug-devel-2.6.32-642.15.1.el6.i686.rpm89aca47288e7d6f37aafb9bdc583b11f82eabe1a3d490ab8bc255f20b3a34ba3kernel-debug-devel-2.6.32-642.15.1.el6.x86_64.rpm69916e965c8291b8fd694f7dd9229676271be38f7a203e8807c83d5450bb9365kernel-doc-2.6.32-642.15.1.el6.noarch.rpm78485a3ef75c1070d0d9a3c3586359679bb62c923b0d2e6636224e1cc9bb4e4bperf-2.6.32-642.15.1.el6.x86_64.rpm4f366f0292e8465237a898df9a599a7b2b96e7ad1747bbd01ca5d73244e46d76kernel-firmware-2.6.32-642.15.1.el6.noarch.rpmea7a83c7ad39c16c1778763d04ec50f47b625db07bb32549755d6356c6be723fkernel-devel-2.6.32-642.15.1.el6.x86_64.rpm6100e8e2bf74c47b7b21cf7e79b9d84ed2fe9f8b36062598dacf46903ca6903epython-perf-2.6.32-642.15.1.el6.x86_64.rpm89fafbb00efd7cfaa52d7cc47b2a2919d4db7b1c4584f47706db29517e516c7dkernel-abi-whitelists-2.6.32-642.15.1.el6.noarch.rpmd8772a5a713ccd8ccf66504653e2693f9be9aa993b2c89aa1ea7c9090e27ba0ckernel-debug-2.6.32-642.15.1.el6.x86_64.rpmb0adb7bf9846f0e6154006c3251f09fa732fb2785bc8194d1a8eb3bad9156b2dkernel-headers-2.6.32-642.15.1.el6.x86_64.rpm60ace0c44f57e8bbf48c4d3f9df0e811b6c47c660d7833de09b84377bfe88426kernel-2.6.32-642.15.1.el6.x86_64.rpm4ceb0824a680551ee839124d993c2c01923ff0d73d9a1390632fbce8ca4a11efSLSA-2017:0309-1Security Fix(es): * Quick emulator (Qemu) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the Qemu process resulting in DoS or potentially execute arbitrary code on the host with privileges of Qemu process on the host. (CVE-2017-2615) * An out-of-bounds read-access flaw was found in the QEMU emulator built with IP checksum routines. The flaw could occur when computing a TCP/UDP packet's checksum, because a QEMU function used the packet's payload length without checking against the data buffer's size. A user inside a guest could use this flaw to crash the QEMU process (denial of service). (CVE-2016-2857) This update also fixes the following bug: * Previously, rebooting a guest virtual machine more than 128 times in a short period of time caused the guest to shut down instead of rebooting, because the virtqueue was not cleaned properly. This update ensures that the virtqueue is cleaned more reliably, which prevents the described problem from occurring. After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.importantScientific Linux FermiScientific Linux Fermi 6qemu-img-0.12.1.2-2.491.el6_8.6.x86_64.rpmc686896ad1c07c34a76de43b1e1daaf26fb9320a586fb753d136a8f6e4349b6dqemu-kvm-tools-0.12.1.2-2.491.el6_8.6.x86_64.rpma3bc6536bd765785eb0e504f0e94ae917c8404c2cf06b54ac4770f92d0a65cbcqemu-kvm-0.12.1.2-2.491.el6_8.6.x86_64.rpmf5072b6e83f19159fd1d49931005ee123640e5854fc6ced8c6f41e46786f8b6dqemu-guest-agent-0.12.1.2-2.491.el6_8.6.x86_64.rpm6dd910afcf8960599df0a235be76d30a36f0480a3dfea8509eecee8a53d64b93SLSA-2017:0352-1Security Fix(es): * Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620)importantScientific Linux FermiScientific Linux Fermi 6qemu-kvm-tools-0.12.1.2-2.491.el6_8.7.x86_64.rpm9fd047912a1f0b9219f3687b837a504e399962a3e73466b3cc451bcd558e7c97qemu-img-0.12.1.2-2.491.el6_8.7.x86_64.rpmfe8428bd685249e91bb56329283eff53dde3598bfb42b8de3f3e13037ef7dd57qemu-kvm-0.12.1.2-2.491.el6_8.7.x86_64.rpm1c20793c80053429418d0522c6614716090eff16cc0449f65e3cdecb3ac2e92aqemu-guest-agent-0.12.1.2-2.491.el6_8.7.x86_64.rpm918ad7ef73d337be9256eeb063b6cfaaa5432d482c00561209a3f43445c1a4a4SLSA-2017:0459-1This update upgrades Firefox to version 45.8.0 ESR. Security Fix(es): * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2017-5398, CVE-2017-5400, CVE-2017-5401, CVE-2017-5402, CVE-2017-5404, CVE-2017-5407, CVE-2017-5408, CVE-2017-5410, CVE-2017-5405)criticalScientific Linux FermiScientific Linux Fermi 6firefox-45.8.0-2.el6_8.i686.rpm3ad7d36bab185466f081fa6bf23a5dfd65dda49d4b79e0acbf9ee88dd6e08ff1firefox-45.8.0-2.el6_8.x86_64.rpmf24a9987710288e3cd4ec6bf2120e17ea7fdda259d98b0ffe1af60d9ed55be43SLSA-2017:0498-1This update upgrades Thunderbird to version 45.8.0. Security Fix(es): * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2017-5398, CVE-2017-5400, CVE-2017-5401, CVE-2017-5402, CVE-2017-5404, CVE-2017-5407, CVE-2017-5408, CVE-2017-5410, CVE-2017-5405)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-45.8.0-1.el6_8.x86_64.rpm463bfd46a9d6852eee16b1083f4dd8a4b593896e079fad91a14190872f843fe0SLSA-2017:0527-1Security Fix(es): * It was discovered that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other then their own. (CVE-2016-6816) Note: This fix causes Tomcat to respond with an HTTP 400 Bad Request error when request contains characters that are not permitted by the HTTP specification to appear not encoded, even though they were previously accepted. The newly introduced system property tomcat.util.http.parser.HttpParser.requestTargetAllow can be used to configure Tomcat to accept curly braces ({ and }) and the pipe symbol (|) in not encoded form, as these are often used in URLs without being properly encoded. * A bug was discovered in the error handling of the send file code for the NIO HTTP connector. This led to the current Processor object being added to the Processor cache multiple times allowing information leakage between requests including, and not limited to, session ID and the response body. (CVE-2016-8745)moderateScientific Linux FermiScientific Linux Fermi 6tomcat6-servlet-2.5-api-6.0.24-105.el6_8.noarch.rpme377d5e4a3074598c9687e30471c4ef45312d40d5ed8b494a562c8b59e7e6c3dtomcat6-admin-webapps-6.0.24-105.el6_8.noarch.rpm5b1e9173f10acc133e4b2423a69dae930825e7ce85fdae97d86dcc9e1820fa26tomcat6-javadoc-6.0.24-105.el6_8.noarch.rpmea8016853a7d1a78e745768c32ec8750afa8ece6463756abe5c320ea25e72358tomcat6-6.0.24-105.el6_8.noarch.rpma1e705a5ee7246db14182cbceeefea237e7d09d626ff7fb9ce5709eeeafe7440tomcat6-docs-webapp-6.0.24-105.el6_8.noarch.rpm83bf6794daa975bd0300c84411c602d6ede6046cb50bd74ca913934c81c0c3a4tomcat6-lib-6.0.24-105.el6_8.noarch.rpm2280198b9fd68113650bcdf121632458836d8c63a4a95266322908b424efef88tomcat6-jsp-2.1-api-6.0.24-105.el6_8.noarch.rpmd9c68e6aa964d99eb100026f27c342d9773a1b1927aff08aee291d38cd0d2a06tomcat6-el-2.1-api-6.0.24-105.el6_8.noarch.rpm8e35a1f4b7cd8ca05549622fe14522ebdd0be5ced4405d39f2d44d0bcd3af74btomcat6-webapps-6.0.24-105.el6_8.noarch.rpmcc1ea43866eb7afe17d93428824316ab8093463ad18c185042dafc16ac1a9a00SLSA-2017:0559-1Security Fix(es): * Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in OpenJPEG. A specially crafted JPEG2000 image could cause an application using OpenJPEG to crash or, potentially, execute arbitrary code. (CVE-2016-5139, CVE-2016-5158, CVE-2016-5159, CVE-2016-7163) * A vulnerability was found in the patch for CVE-2013-6045 for OpenJPEG. A specially crafted JPEG2000 image, when read by an application using OpenJPEG, could cause heap-based buffer overflows leading to a crash or, potentially, arbitrary code execution. (CVE-2016-9675)moderateScientific Linux FermiScientific Linux Fermi 6openjpeg-devel-1.3-16.el6_8.i686.rpm4f3a1a2e2df881c6bc043fa6972b2b4de259a2aab0ed9daef968a936362018b0openjpeg-1.3-16.el6_8.x86_64.rpm502163ae48a4b15698f6365f2d2c85d0b63d4e1146661f8c7a9e205279a43092openjpeg-devel-1.3-16.el6_8.x86_64.rpm167d8a4053bc59cdffdbce5f584312df24924c2e72ace3b7061bff47e1feab49openjpeg-libs-1.3-16.el6_8.i686.rpm4441a6964c015cac4c9a4bdecdd962dafaec44be84769df2bffaeb8aa78bfb44openjpeg-libs-1.3-16.el6_8.x86_64.rpma39801c11e63c05307950083ac97613a92688ca7bfc2a8ffcc01404a1ef3ec80SLSA-2017:0564-1Security Fix(es): * An integer conversion flaw was found in the way OCaml's String handled its length. Certain operations on an excessively long String could trigger a buffer overflow or result in an information leak. (CVE-2015-8869) Note: The libguestfs packages in this advisory were rebuilt with a fixed version of OCaml to address this issue.moderateScientific Linux FermiScientific Linux Fermi 6python-libguestfs-1.20.11-20.el6.x86_64.rpm17c22735e836ea1f24c65d7c1b0f3dead21b507e8b1b1a804a864be255932c47libguestfs-java-1.20.11-20.el6.x86_64.rpmb571e601d979c1193ef0adab755ff737f6f870af53b712f3cf7d47ba07b44a64libguestfs-tools-c-1.20.11-20.el6.x86_64.rpmd1cd4a1f782a1e714e0db0c1a9aa397336139e2eb448665bb33207db01c342f2perl-Sys-Guestfs-1.20.11-20.el6.x86_64.rpm49fdcb80229ccb788953992e081c914a1c3bc196567d4f4439c4169e85888af1libguestfs-java-devel-1.20.11-20.el6.x86_64.rpmf1b2a81457565d9aad5331fa2ff6f826a4498d6d3d7f485046e7d20fbefe3372libguestfs-tools-1.20.11-20.el6.x86_64.rpmb799d14a829acda820fa53e96ddc268a4a55e10de4d8706b0a6394b91b21ea86libguestfs-devel-1.20.11-20.el6.x86_64.rpm97b448181017534d25c4128bd47944b636f58883a070373038998cb8ae4d67a1ocaml-libguestfs-1.20.11-20.el6.x86_64.rpm925821361b40a6f511d4b4705e7c8a565152e17427686eceb5e9b32ca859f40alibguestfs-1.20.11-20.el6.x86_64.rpm7c02bba1d1acb23f9a3d73ce21207e2a576e9904bf1789b69ecfc0429ff7ad4druby-libguestfs-1.20.11-20.el6.x86_64.rpm7026384d2f18566a3b6dbb8b34a10d0e7e8b3881ea5fe3b1f73667fb272e0763ocaml-libguestfs-devel-1.20.11-20.el6.x86_64.rpm3f99155b5297aa589ca28dc6521c01bcb5ffc105248d961d680fad39dc240df1libguestfs-javadoc-1.20.11-20.el6.x86_64.rpm177616770248b0816ae112ac05954e0ec417399373852a42803ec99a1229265fSLSA-2017:0565-1Security Fix(es): * An integer conversion flaw was found in the way OCaml's String handled its length. Certain operations on an excessively long String could trigger a buffer overflow or result in an information leak. (CVE-2015-8869)moderateScientific Linux FermiScientific Linux Fermi 6ocaml-camlp4-devel-3.11.2-5.el6.x86_64.rpm9107e52c51bb3197f32fd198bd8f864515f12ccea5198e408272213e8badd744ocaml-labltk-devel-3.11.2-5.el6.x86_64.rpmc3f17c92e40448d2508e5b0fa6df4456b33dc4b4610f271091185d419322910docaml-camlp4-3.11.2-5.el6.x86_64.rpmc227e3f1c6b22a2a36e459bfb30f652564378181c20d11147e698c98bf5afaf6ocaml-3.11.2-5.el6.x86_64.rpm97727831dc1c0c548a061d98ccb3b052778c71c7a1cf740638d67e03ea425399ocaml-docs-3.11.2-5.el6.x86_64.rpme8862e1670aee27458884a54dc31f3d65008362314d354f41e3fcec87baf596focaml-labltk-3.11.2-5.el6.x86_64.rpmeef7ae51321f5e61878928018083d36c302040cc61702f9ca04c4f3d925aa566ocaml-ocamldoc-3.11.2-5.el6.x86_64.rpmadc47aaec1028def7eb619bef441dd2d47a430f682464dab3a8a93213ef29e67ocaml-emacs-3.11.2-5.el6.x86_64.rpm14c06ff52dac1371e3d66c9b3db3a44a9e1c41e684b329422a9a3c960e02de23ocaml-camlp4-devel-3.11.2-5.el6.i686.rpmda48a898e242736acaca10bb5852ab2b45ae45785412926e8d53478c5e6f4f9docaml-source-3.11.2-5.el6.x86_64.rpm9482a7fa15e0acfd6c7ec1589d084e02522ef94d0821178e445b1ed42fe87692ocaml-x11-3.11.2-5.el6.x86_64.rpmdaf19cb13bf4aeab1ff5afaf52e0cfcc5efbccd43d459735aa2bde70536356eaocaml-runtime-3.11.2-5.el6.x86_64.rpm03980ff555d8239b808b794ee5ec2cf8b8e34836342ab3dcea584ec5c57e293bocaml-labltk-devel-3.11.2-5.el6.i686.rpm3800a804af0f57446953e11743d40670c035fb3c0d8dd233dc4c7959a37a48c5SLSA-2017:0574-1The following packages have been upgraded to a later upstream version: gnutls (2.12.23). Security Fix(es): * A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections form other clients. (CVE-2016-8610) * Multiple flaws were found in the way gnutls processed OpenPGP certificates. An attacker could create specially crafted OpenPGP certificates which, when parsed by gnutls, would cause it to crash. (CVE-2017-5335, CVE-2017-5336, CVE-2017-5337)moderateScientific Linux FermiScientific Linux Fermi 6gnutls-guile-2.12.23-21.el6.i686.rpme2f7bb53da9778cb790fae9dd22a7a4357f2ae344f475aa4e32aa861ee0e1e55gnutls-guile-2.12.23-21.el6.x86_64.rpm199b6c346447f4cbbe42dc9c711e3a593dac67410b801cd04c19f3b6fd928f48gnutls-devel-2.12.23-21.el6.x86_64.rpme9a1801ea4ad56031de381a2f6ed4b790307a81f5edaca730ed12a3d2defd545gnutls-devel-2.12.23-21.el6.i686.rpm58ad8689a956cffd92e6ecbf798190a140fe9d66a473bb1d08251f949fc17778gnutls-2.12.23-21.el6.x86_64.rpm058a57510905ca0decc6166c67e6cd176d07146ab4137fd7408c5ac795168a47gnutls-2.12.23-21.el6.i686.rpmf9b79851ccdbb61f7279a79ea398de57be9129ad14645802717cecb233c3a2d1gnutls-utils-2.12.23-21.el6.x86_64.rpm3c764341dcc1ab0a46040461446e76060b7418901843957bf312b59c1c5a61a8SLSA-2017:0621-1Security Fix(es): * An integer overflow flaw and an out-of-bounds read flaw were found in the way QEMU's VGA emulator set certain VGA registers while in VBE mode. A privileged guest user could use this flaw to crash the QEMU process instance. (CVE-2016-3712)moderateScientific Linux FermiScientific Linux Fermi 6qemu-kvm-tools-0.12.1.2-2.503.el6.x86_64.rpm5f115e1eea0458cfb09f58e9242688719660795da8862339f382d9b0a70d758eqemu-img-0.12.1.2-2.503.el6.x86_64.rpmd69f3757dc4bcba67f756e03cfce2219283049ca42f12311e01c437845e8c578qemu-kvm-0.12.1.2-2.503.el6.x86_64.rpme5d6958df40bc4873ce9ca0624955ef27183187f1555116da6de0734cdf28351qemu-guest-agent-0.12.1.2-2.503.el6.x86_64.rpm76c2bdf327779973fd910d724e4932c141133815693cf3604bbf7ec8fded3fd4SLSA-2017:0630-1Security Fix(es): * A denial of service flaw was found in the TigerVNC's Xvnc server. A remote unauthenticated attacker could use this flaw to make Xvnc crash by terminating the TLS handshake process early. (CVE-2016-10207) * A buffer overflow flaw, leading to memory corruption, was found in TigerVNC viewer. A remote malicious VNC server could use this flaw to crash the client vncviewer process resulting in denial of service. (CVE-2017-5581)moderateScientific Linux FermiScientific Linux Fermi 6tigervnc-server-applet-1.1.0-24.el6.noarch.rpmc205bf42bb39388fde4e9bd15f777a9b805804c84da095fe21d437ec9227f8b8tigervnc-1.1.0-24.el6.x86_64.rpmdc031585c4c4267cb2df17dcefc1c54e20617097cb3120db90b9a29c39a4162dtigervnc-server-1.1.0-24.el6.x86_64.rpm5280bfa826e5da4cc08b0bf20d6847d31e9040f2d891a94ec8fab41eef607104tigervnc-server-module-1.1.0-24.el6.x86_64.rpm38ab60296e4a3b6f15b3f2780794fac84ff839ed67431f185fd4d8d252cb29e0SLSA-2017:0631-1Security Fix(es): * Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2015-3811, CVE-2015-3812, CVE-2015-3813, CVE-2013-4075)moderateScientific Linux FermiScientific Linux Fermi 6wireshark-devel-1.8.10-25.el6.x86_64.rpm8079a3e5c2f3b94a182c8f1b6f37407cb3e5e91bc4071dadd5b0916ba7fee788wireshark-1.8.10-25.el6.i686.rpm27962e02447cecd1532d96cf8f7877ea48e145a841fa42eb74883d68425ebe20wireshark-devel-1.8.10-25.el6.i686.rpme31eed6cf9ab619d37a461785ece2bc469151944bd163e22ba7be7ad33376310wireshark-1.8.10-25.el6.x86_64.rpme4cd65bde4e5564c0b043df7b69dbbb452a16a4e964547af03223d7a914df5c4wireshark-gnome-1.8.10-25.el6.x86_64.rpm9136de493042f0b381380e098e41f1d302982ff05e6e7c6219543e9143c21778SLSA-2017:0641-1Security Fix(es): * It was discovered that the OpenSSH sshd daemon fetched PAM environment settings before running the login program. In configurations with UseLogin=yes and the pam_env PAM module configured to read user environment settings, a local user could use this flaw to execute arbitrary code as root. (CVE-2015-8325)moderateScientific Linux FermiScientific Linux Fermi 6openssh-server-5.3p1-122.el6.x86_64.rpmcb4d4f39a1a02ddee8f186b00a3d68cfeea6ac65071aea4af1b584f20f22f90fopenssh-5.3p1-122.el6.x86_64.rpm1622eafa106c9cabe7e144500add4d62c91c76e0d257b4b57d81f70b1e5adef8openssh-ldap-5.3p1-122.el6.x86_64.rpme2b25c7af2027f6beb54f80c9e03deddaee65a1c67ab5a4f3af8a47134439882openssh-clients-5.3p1-122.el6.x86_64.rpmcf67d3ef9bcdbe1900da2e37baf20d3e536aa60de551196fe2ad82dc827e1f31openssh-askpass-5.3p1-122.el6.x86_64.rpmd151021897665b666d4aa16f56c26ab3eb5cde365a06a1142191d7b4ec0194f3pam_ssh_agent_auth-0.9.3-122.el6.x86_64.rpm518dbc26ffb56d596a7c3036274566ab537055fb39fd7d0cb43a87b304112a5bpam_ssh_agent_auth-0.9.3-122.el6.i686.rpm543cde734e09fc76a49702474e0708778a7272ff7047b94ed32817eefc474d45SLSA-2017:0654-1Security Fix(es): * A race condition was found in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions. (CVE-2017-2616)moderateScientific Linux FermiScientific Linux Fermi 6coreutils-8.4-46.el6.x86_64.rpm8ddb6717a3435ee65b55d154c05b5fe7f66112828f857f7e2ed61ed8f1107198coreutils-libs-8.4-46.el6.x86_64.rpm9712ad5837a1ace8590b3e30df6a716d6c06aed36e6ae4fb8bfc87c3aa71229eSLSA-2017:0662-1Security Fix(es): * It was found that Samba always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users. (CVE-2016-2125) * A flaw was found in the way Samba handled PAC (Privilege Attribute Certificate) checksums. A remote, authenticated attacker could use this flaw to crash the winbindd process. (CVE-2016-2126)moderateScientific Linux FermiScientific Linux Fermi 6samba-domainjoin-gui-3.6.23-41.el6.x86_64.rpm8092f20ca0a5163a414b64929f4ace092a4fd55bf9ff33d5679e15b17f41b59flibsmbclient-3.6.23-41.el6.i686.rpm4a0002aa8a816a6c268a074466461530b88929e2488cdbc8022a585330f8de59libsmbclient-3.6.23-41.el6.x86_64.rpmfe97104c205308e6910d724560620c7042fdb6c71294fa9f92597d84b8ea127csamba-client-3.6.23-41.el6.x86_64.rpm8a7c10b2a6d4a4435b0a6fc7242be811dd7a8deb5eb3644299a2e398b05cacd5samba-glusterfs-3.6.23-41.el6.x86_64.rpmab109bfa73bc73005123441a139bd448ad24499d5aa6648c9f480a8322b97674libsmbclient-devel-3.6.23-41.el6.i686.rpma5368298e5623b69446a5746cfc72a8ec904db29682b022c5e8739fa90945c0dsamba-winbind-devel-3.6.23-41.el6.i686.rpmd9fc9a47a5ba98b9b5622f85cb787b1c6c2cf9db7d8c798bfb5f61c01e311730samba-swat-3.6.23-41.el6.x86_64.rpm4829f585d34ae77de08392ff592493c46d1755edab2b86c69c9bf1d445271b53samba-common-3.6.23-41.el6.i686.rpmb449d5c1a6a393e880e39c5634aad6690ecdaa567c864203c3f5a7d974ababa7samba-doc-3.6.23-41.el6.x86_64.rpm9d72e5f7f0a94fadbeb91d39acb071033353df7fd63710e1c6bfe410b8679194libsmbclient-devel-3.6.23-41.el6.x86_64.rpm16c346822db0cbb503b7d8c658013781f136b86a43ecc6138d984355e3c816f4samba-winbind-krb5-locator-3.6.23-41.el6.x86_64.rpm556dab947a8269adfb4720381f7339209fe52abf9a7610f5afa0e2d530206b51samba-winbind-clients-3.6.23-41.el6.i686.rpm746097bac4bb6d4c1b8b2a310d4a47631cdaf29be1bf6c959dbd65c589d0e11csamba-common-3.6.23-41.el6.x86_64.rpm4aef8df838908df293a8e1f3a531646104d0546d597ae8431cc95f53e9140fc1samba-3.6.23-41.el6.x86_64.rpmd24f1c240529cde6a3bc6f34636ab3fa231f64c83e1c1c6ba7ee192a4ac216b8samba-winbind-3.6.23-41.el6.x86_64.rpm3b3aafaaef35e1df9b1ad83d74c2730cb09c7ba453a4a37d32f88028607e3c70samba-winbind-clients-3.6.23-41.el6.x86_64.rpmbab4345da5681a2a373a02ef5014d5b7b026dc8afda011655c1d9a95c313b33asamba-winbind-devel-3.6.23-41.el6.x86_64.rpmbde761521ba41450710105a0657c05d206eafad4827136cbb4c5987ae28c357eSLSA-2017:0680-1Security Fix(es): * A stack overflow vulnerability was found in nan* functions that could cause applications, which process long strings with the nan function, to crash or, potentially, execute arbitrary code. (CVE-2014-9761) * It was found that out-of-range time values passed to the strftime() function could result in an out-of-bounds memory access. This could lead to application crash or, potentially, information disclosure. (CVE-2015-8776) * An integer overflow vulnerability was found in hcreate() and hcreate_r() functions which could result in an out-of-bounds memory access. This could lead to application crash or, potentially, arbitrary code execution. (CVE-2015-8778) * A stack based buffer overflow vulnerability was found in the catopen() function. An excessively long string passed to the function could cause it to crash or, potentially, execute arbitrary code. (CVE-2015-8779)moderateScientific Linux FermitrueScientific Linux Fermi 6glibc-2.12-1.209.el6.x86_64.rpm1fd33393730d411c8adbb89e99301f76105fafcdb8431eb3b5863a4b88ee3c7fglibc-headers-2.12-1.209.el6.x86_64.rpmbd2af058bfc2b404c689190f2b340f8dd1a96f41476fff8301e609a076fae5c4glibc-common-2.12-1.209.el6.x86_64.rpme2c50e8f6066995e38722b282e110d7592306c32e0fdd066b2574568e9c09d23glibc-static-2.12-1.209.el6.i686.rpmdcd5c6984fa68879783e0c99970ace2b6054cfec8f300d65aeee865799ee4ecbglibc-static-2.12-1.209.el6.x86_64.rpm6b9fd2e625de61c585c1c0a795babf0143a8aee1b09b7d1f2389ca7246327190glibc-2.12-1.209.el6.i686.rpm19ee5487de898c28918b5c2f782361ae7241736c8d98303510008c956ea0fe68glibc-devel-2.12-1.209.el6.i686.rpme7b5e0b047ce56d4ca7a8b6e208df8e68a07a5663c543b3178ac6138559783bfglibc-utils-2.12-1.209.el6.x86_64.rpmaf6dfeca16331db8c048323686a6ee1b076bf77e1b0bef3619395d71cb0dabd6glibc-devel-2.12-1.209.el6.x86_64.rpm1d632a8c91fef07f5ca5a647e3254770f5191359f857f09f3b7dff98548a0048nscd-2.12-1.209.el6.x86_64.rpmdeff1c06c116817b74f9df1a1494eab704eb1053daea6c84ae52d9534ce4e194SLSA-2017:0698-1Security Fix(es): * It was found that subscription-manager set weak permissions on files in /var/lib/rhsm/, causing an information disclosure. A local, unprivileged user could use this flaw to access sensitive data that could potentially be used in a social engineering attack. (CVE-2016-4455)moderateScientific Linux FermiScientific Linux Fermi 6subscription-manager-plugin-container-1.18.10-1.el6.x86_64.rpm3496a314e13428c344e0ebccd6082ae5111e33a36f9ba73aeff4cfa3745dcad8python-rhsm-certificates-1.18.6-1.el6.x86_64.rpme9d8d0308ea057107988c6a695fa29f5f72b25d98b6d7cbf07ced18c8ce87dc3subscription-manager-gui-1.18.10-1.el6.x86_64.rpm7160e7259a429375a226e9d92d6a31f5b8f6656b774e2f9cf6d43aa9dab5dc7epython-rhsm-1.18.6-1.el6.x86_64.rpm972a64684f701ee6fe21fe8fba78a9693778050f453c2e7b9c0b62376e64dad5subscription-manager-1.18.10-1.el6.x86_64.rpmc646d81f838cf1d1f52b7275c84b3350cbb75d2c438f5ac8e9d8a86df3e6f6cdSLSA-2017:0725-1Security Fix(es): * An arbitrary command injection flaw was found in the way bash processed the hostname value. A malicious DHCP server could use this flaw to execute arbitrary commands on the DHCP client machines running bash under specific circumstances. (CVE-2016-0634) * An arbitrary command injection flaw was found in the way bash processed the SHELLOPTS and PS4 environment variables. A local, authenticated attacker could use this flaw to exploit poorly written setuid programs to elevate their privileges under certain circumstances. (CVE-2016-7543) * A denial of service flaw was found in the way bash handled popd commands. A poorly written shell script could cause bash to crash resulting in a local denial of service limited to a specific bash session. (CVE-2016-9401)moderateScientific Linux FermiScientific Linux Fermi 6bash-4.1.2-48.el6.x86_64.rpm557c501c2850f1d1786d44f9957d3f3f03c1ee50ca53d1e861ffb37dbed3e42bbash-doc-4.1.2-48.el6.x86_64.rpm83b08129f9e069188525cd7ce0ad2ed264bebe712590d59d2d256c2a692efb96SLSA-2017:0744-1Security Fix(es): * It was found that Samba always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users. (CVE-2016-2125) * A flaw was found in the way Samba handled PAC (Privilege Attribute Certificate) checksums. A remote, authenticated attacker could use this flaw to crash the winbindd process. (CVE-2016-2126)moderateScientific Linux FermiScientific Linux Fermi 6samba4-winbind-4.2.10-9.el6.x86_64.rpma0cb3696716d6ef2a292056ada2f7c1affd6055c18a5a20b4908cf8f0d958076samba4-4.2.10-9.el6.x86_64.rpm69e04a2f10fa9aac733b0f9c65d9fdfd76a642350f46ca493ccee22a49890ffbsamba4-pidl-4.2.10-9.el6.x86_64.rpm21e4b9ee94f6db7c77c9a9234c0a085b64f8420d79aae15db04497f572a05ce1samba4-winbind-clients-4.2.10-9.el6.x86_64.rpm28c07fe3940dd927f98bf78c6d83ef5d2d73066d410d970efc21bfe9a3fab17bsamba4-dc-4.2.10-9.el6.x86_64.rpma4ecdaa102e8fe555ff9b37422bfd2e8bc820877e6f7527f91bf1ff3f9f62ee7samba4-client-4.2.10-9.el6.x86_64.rpm09aceb2f07917136d6344a745d1f0d531e0d87c6b6e0dbfe27c08471805bee43samba4-winbind-krb5-locator-4.2.10-9.el6.x86_64.rpm494f43f4d83da2652d99a5b6714a71eca10653b8ddb8ded5e3ae64cd57b6d222samba4-libs-4.2.10-9.el6.x86_64.rpma3a9de2f0738c78d1adb21b5845afb211f3e8a74148fdffaad0adf7ef3ff78dfsamba4-devel-4.2.10-9.el6.x86_64.rpm9ab15850a6d9dc1ce7a79e161c5cdb93661d640d6458000d2b50a5fdc546a0d9samba4-python-4.2.10-9.el6.x86_64.rpm399fd139f0aaf96ac27947a398feff2ca2b360bf5d02a4283354be2c763d2d93samba4-test-4.2.10-9.el6.x86_64.rpm81ae50339f91c0c43c145c98aa4ef25cc6713367572f0a05a0b96f05bd86138dsamba4-common-4.2.10-9.el6.x86_64.rpm1d59073e7a72b97562e705308eab7edf0358ca4450b23070e2bb706711e111c1samba4-dc-libs-4.2.10-9.el6.x86_64.rpmca4015b5613f49bd7f7c82ec24dfcd7adf755092f30ab4d92e01c59f402b5bffSLSA-2017:0794-1Security Fix(es): * A stack-based buffer overflow flaw was found in the way Quagga handled IPv6 router advertisement messages. A remote attacker could use this flaw to crash the zebra daemon resulting in denial of service. (CVE-2016-1245) * A stack-based buffer overflow flaw was found in the way the Quagga BGP routing daemon (bgpd) handled Labeled-VPN SAFI routes data. A remote attacker could use this flaw to crash the bgpd daemon resulting in denial of service. (CVE-2016-2342) * A denial of service flaw was found in the Quagga BGP routing daemon (bgpd). Under certain circumstances, a remote attacker could send a crafted packet to crash the bgpd daemon resulting in denial of service. (CVE-2016-4049) * A denial of service flaw affecting various daemons in Quagga was found. A remote attacker could use this flaw to cause the various Quagga daemons, which expose their telnet interface, to crash. (CVE-2017-5495) * A stack-based buffer overflow flaw was found in the way the Quagga OSPFD daemon handled LSA (link-state advertisement) packets. A remote attacker could use this flaw to crash the ospfd daemon resulting in denial of service. (CVE-2013-2236)moderateScientific Linux FermiScientific Linux Fermi 6quagga-contrib-0.99.15-14.el6.x86_64.rpme097b54ecf49f093838eec4e2e1c9a982ed191af162d96afe0b96518736dbed6quagga-0.99.15-14.el6.x86_64.rpm62a0ace592f6eae348725a7b4f7434a792def0f006dcd879c9e36ed2c3dc74fcquagga-devel-0.99.15-14.el6.x86_64.rpmefec956e32ac8da8216b880e1fc59f7d6efcd28775f772cbe2fa218a132c95a5quagga-devel-0.99.15-14.el6.i686.rpma701c3d18347bfc83ddad14e2bebe8851e487940d7ed01dd29876209fa3b2b65SLSA-2017:0817-1Security Fix(es): * It was discovered that a remote attacker could leverage the generation of IPv6 atomic fragments to trigger the use of fragmentation in an arbitrary IPv6 flow (in scenarios in which actual fragmentation of packets is not needed) and could subsequently perform any type of a fragmentation- based attack against legacy IPv6 nodes that do not implement RFC6946. (CVE-2016-10142, Moderate) * A flaw was discovered in the way the Linux kernel dealt with paging structures. When the kernel invalidated a paging structure that was not in use locally, it could, in principle, race against another CPU that is switching to a process that uses the paging structure in question. A local user could use a thread running with a stale cached virtual->physical translation to potentially escalate their privileges if the translation in question were writable and the physical page got reused for something critical (for example, a page table). (CVE-2016-2069, Moderate) * A race condition flaw was found in the ioctl_send_fib() function in the Linux kernel's aacraid implementation. A local attacker could use this flaw to cause a denial of service (out-of-bounds access or system crash) by changing a certain size value. (CVE-2016-6480, Moderate) * It was found that when the gcc stack protector was enabled, reading the /proc/keys file could cause a panic in the Linux kernel due to stack corruption. This happened because an incorrect buffer size was used to hold a 64-bit timeout value rendered as weeks. (CVE-2016-7042, Moderate) * It was found that when file permissions were modified via chmod and the user modifying them was not in the owning group or capable of CAP_FSETID, the setgid bit would be cleared. Setting a POSIX ACL via setxattr sets the file permissions as well as the new ACL, but doesn't clear the setgid bit in a similar way. This could allow a local user to gain group privileges via certain setgid applications. (CVE-2016-7097, Moderate) * A flaw was found in the Linux networking subsystem where a local attacker with CAP_NET_ADMIN capabilities could cause an out-of-bounds memory access by creating a smaller-than-expected ICMP header and sending to its destination via sendto(). (CVE-2016-8399, Moderate) * It was found that the blk_rq_map_user_iov() function in the Linux kernel's block device implementation did not properly restrict the type of iterator, which could allow a local attacker to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging write access to a /dev/sg device. (CVE-2016-9576, CVE-2016-10088, Moderate) * A flaw was found in the USB-MIDI Linux kernel driver: a double-free error could be triggered for the 'umidi' object. An attacker with physical access to the system could use this flaw to escalate their privileges. (CVE-2016-2384, Low)moderateScientific Linux FermitrueScientific Linux Fermi 6kernel-debug-devel-2.6.32-696.el6.x86_64.rpm03c194a8259f62fcb8cf8376a004bb49a6db8019606dde154e6e1b8384ffd042kernel-debug-2.6.32-696.el6.x86_64.rpm11c6f31cdf311ec4104e43275836048c48f0f8383b67f78eaf716dbb65cb68edkmod-openafs-1.6.20-1.SL69.sl6.noarch.rpm992d75a446ba1607f4c3c150da54734fdfd64ba16f3ef628e65ca949388786bckernel-firmware-2.6.32-696.el6.noarch.rpm0c6698e1d158e5a5fc4bb241e1f330c8167ecff0ddddf6cd67d4f9e8c526f4aekernel-devel-2.6.32-696.el6.x86_64.rpme84321083f69425895df13802bbea0c3bdbc384b9bbf0c18442a86d31be80afepython-perf-2.6.32-696.el6.x86_64.rpm5a7b609eb8203cec4a60e6df355e75945e3265b259cc5b991888d1ebf612b0b3kernel-headers-2.6.32-696.el6.x86_64.rpm656d0efe4f5279bc24aac792ce48d76a388eeba8491408a63e07ceb114f9f749kmod-openafs-696-1.6.20-256.sl6.696.x86_64.rpmf374ee737e15faa39fc0c81ed2a11d35654bedca731746415b37cb3c18fd2037perf-2.6.32-696.el6.x86_64.rpm36da3e23c29f89dd9589bafc60e2d3b527bd2e5ca3392b65b97f2c4edd4caf06kernel-debug-devel-2.6.32-696.el6.i686.rpm25a8e77adb41b97b7239edc9eec0d389a081cc3615710d7489a1649c27734e2ckernel-doc-2.6.32-696.el6.noarch.rpmfb228f439e308f22fe95bb40c8040aa48aa10b1e9beab156632186a49bd5ab01kernel-abi-whitelists-2.6.32-696.el6.noarch.rpm373fc25e40b0055243999fdc6accdcee6af21e033ba3fa8a2d898d300a535185kernel-2.6.32-696.el6.x86_64.rpmf48b42d12bf2d367963e9361a275d813ae727a74b04d2a6087e9cc15a1e31680SLSA-2017:0847-1Security Fix(es): * It was found that the fix for CVE-2015-3148 in curl was incomplete. An application using libcurl with HTTP Negotiate authentication could incorrectly re-use credentials for subsequent requests to the same server. (CVE-2017-2628)moderateScientific Linux FermiScientific Linux Fermi 6libcurl-7.19.7-53.el6_9.i686.rpm5bbc01fe12b11dcaff88c84555839fa0d8ced7475befb2ef0645fe82c53d72falibcurl-devel-7.19.7-53.el6_9.i686.rpmb723bd289740d91c37ead4ad92e9ee01d201e59e0d10944afff717028d913729libcurl-7.19.7-53.el6_9.x86_64.rpmf42d050a0dbcaf125f8f6b6517cee7c6786a6a8c73cd995415251c6c701a208dcurl-7.19.7-53.el6_9.x86_64.rpm7271cc38759b352c355189a96454a71b791ba06c12390202651202c5cf1a9e57libcurl-devel-7.19.7-53.el6_9.x86_64.rpma659acd33e19b7b3da63f3392545cb0deb2f0d557cbf02b7220b0e81fd5251d7SLSA-2017:0892-1Security Fix(es): * A race condition flaw was found in the N_HLDC Linux kernel driver when accessing n_hdlc.tbuf list that can lead to double free. A local, unprivileged user able to set the HDLC line discipline on the tty device could use this flaw to increase their privileges on the system. (CVE-2017-2636, Important) * A flaw was found in the Linux kernel's implementation of seq_file where a local attacker could manipulate memory in the put() function pointer. This could lead to memory corruption and possible privileged escalation. (CVE-2016-7910, Moderate) Bug Fix(es): * Previously, Chelsio firmware included an incorrectly-formatted firmware bin file. As a consequence, the firmware could not be flashed. This update provides a firmware bin file that is formatted correctly. As a result, Chelsio firmware can now be flashed successfully. * When multiple simultaneous processes attempted to read from the /proc/stat file, spinlock overhead was generated on Non-Uniform Memory Access (NUMA) systems. Consequently, a large amount of CPU was consumed. With this update, the underlying source code has been fixed to avoid taking spinlock when the interrupt line does not exist. As a result, the spinlock overhead is now generated less often, and multiple simultaneous processes can now read /proc/stat without consuming a large amount of CPU.importantScientific Linux FermiScientific Linux Fermi 6perf-2.6.32-696.1.1.el6.x86_64.rpmb60d13645139400267e29ed532a883c58688468a6c77671e5e56116d413b2f83kernel-firmware-2.6.32-696.1.1.el6.noarch.rpm99251ff0907542bd7fd8bf2bd89548df6ab158d06b2591dc834cdf5c3146fc01kernel-debug-devel-2.6.32-696.1.1.el6.i686.rpm152b8060c254955fe8c240f1050ac698518e1f35a10c3532f226aae117dcedbakernel-debug-2.6.32-696.1.1.el6.x86_64.rpme5b7c502325fdf981012d79c7dacb5b303ba3a606b0cef3e4511e3e3571f4f76kernel-headers-2.6.32-696.1.1.el6.x86_64.rpmf9f6456c4dc9ab2154f9523999c37ea385e37c97cfe5e22993d1481660103c38kernel-doc-2.6.32-696.1.1.el6.noarch.rpm260f9ad642f08d9100a572a96305a661ca619add94c6c9ef3e8141460f185366kernel-debug-devel-2.6.32-696.1.1.el6.x86_64.rpmd9b47532c86dff6945d0a548c6340d6acaa5ad09c58c82944eba1552cb1d5f83kernel-abi-whitelists-2.6.32-696.1.1.el6.noarch.rpm05d7b53bb95ca3ad750e6d569f27a6531b3e50979592ab0f0f9c6e15bf0921cckernel-2.6.32-696.1.1.el6.x86_64.rpmf1067bf44ae2b65e9b75d6cae3ed8d77a5b1b68a76ba3a87e324c1c3aa27da23kernel-devel-2.6.32-696.1.1.el6.x86_64.rpm95319c7365296664493fcd9232a1f7cb1bca0092195c82267f578ad46a6a70d2python-perf-2.6.32-696.1.1.el6.x86_64.rpmfcc18e2e8c4c44f32049e9e05d0771e7a4cf4d308c79421ef1afdf0633525e9fSLSA-2017:0893-1Security Fix(es): * An invalid pointer dereference flaw was found in the way 389-ds-base handled LDAP bind requests. A remote unauthenticated attacker could use this flaw to make ns-slapd crash via a specially crafted LDAP bind request, resulting in denial of service. (CVE-2017-2668) Bug Fix(es): * Previously, the "deref" plug-in failed to dereference attributes that use distinguished name (DN) syntax, such as "uniqueMember". With this patch, the "deref" plug-in can dereference such attributes and additionally "Name and Optional UID" syntax. As a result, the "deref" plug-in now supports any syntax.importantScientific Linux FermiScientific Linux Fermi 6389-ds-base-devel-1.2.11.15-91.el6_9.x86_64.rpm740712276da2a2ae987fec916dcf6bba3f6d3f4eeffb1bf682e35dda90d9ee3c389-ds-base-libs-1.2.11.15-91.el6_9.x86_64.rpm7395a9fe5f157e4888a7de0fe8784d028220c3f61e416baffa4ff667ad8486c0389-ds-base-devel-1.2.11.15-91.el6_9.i686.rpm472cc03be66eccdccc246531706b5b3c02dd4c4358294f1b0fed36f63055a7d1389-ds-base-1.2.11.15-91.el6_9.x86_64.rpmb0e0597dc690bafc02fb72127e6c8b106a62b1e1ff4d08b75368bd2ffc245183389-ds-base-libs-1.2.11.15-91.el6_9.i686.rpmb3fd82a5f4c54bf59adfbe3d51349111e872806340e2bfbdb27b76e40e55cd0fSLSA-2017:0979-1Security Fix(es): * It was found that LibreOffice disclosed contents of a file specified in an embedded object's preview. An attacker could potentially use this flaw to expose details of a system running LibreOffice as an online service via a crafted document. (CVE-2017-3157)moderateScientific Linux FermiScientific Linux Fermi 6autocorr-cs-4.3.7.2-2.el6_9.1.noarch.rpm2154934563d2380e3b827a156f8621ae84f697ea4f4a757b0c2aaf812367c3balibreoffice-langpack-ru-4.3.7.2-2.el6_9.1.x86_64.rpm98b2b25d46002ad8c0f96e7877571ac306802ecf5975464c7ee60f545cd44051libreoffice-glade-4.3.7.2-2.el6_9.1.x86_64.rpm13fd8e61572672dbc82d4222dc25a4ee5f6bda4a9bbd938cbdd7f5b45b86e2d9autocorr-ro-4.3.7.2-2.el6_9.1.noarch.rpm069b7f785f4fff02f70970193e0a2c9c7e09c4f5131b09d83d3786a22dcb0edblibreoffice-langpack-eu-4.3.7.2-2.el6_9.1.x86_64.rpm4e53d306b30e4b3c859c5310bc4f8e5844eeb0a89d74fd4a6d41e52046711e48libreoffice-headless-4.3.7.2-2.el6_9.1.x86_64.rpm4e092919e5a8a19c2af11821941e0ef694f774043a0591bf19c1b23e5e2f3b92libreoffice-langpack-nr-4.3.7.2-2.el6_9.1.x86_64.rpm3a5bd2c56609647688c98b42f115df4334d8bf4a16d4fb1c4f0ada7669f212dblibreoffice-langpack-mai-4.3.7.2-2.el6_9.1.x86_64.rpm7f568824fdda40a63044e72dc2e4f9905d0a0b7456d5c27adbe5f104d1754151libreoffice-langpack-ss-4.3.7.2-2.el6_9.1.x86_64.rpmdf1633923a87944a7f555ac4b042219bbfe2a34591df6162a57f53388627da49libreoffice-langpack-el-4.3.7.2-2.el6_9.1.x86_64.rpm2ff8a0895b0c2e5622a1eed38dcd4183bd304eb295213add8c984403f0dfe9bdlibreoffice-core-4.3.7.2-2.el6_9.1.x86_64.rpm3739d4861d6b19177325931a4f24a5c997898a1732dfe83d5aaf2cb2f01be04flibreoffice-langpack-ta-4.3.7.2-2.el6_9.1.x86_64.rpm7e2bb7c736ff006dd9aba498132154cf10b7d547b3d8d7e1605f7af6eafde2a5autocorr-bg-4.3.7.2-2.el6_9.1.noarch.rpm64033fac639e2edd9b6c8e1a7e63c369cb1fff881df021472fe1c13b8aece486libreoffice-langpack-uk-4.3.7.2-2.el6_9.1.x86_64.rpma5f3a9964d888ead375fff7f5b31bc12b4884ce5eedb5376a4f67cae10d12d4blibreoffice-langpack-he-4.3.7.2-2.el6_9.1.x86_64.rpm5bf41eeb6f4e52867e18eb6dc70be4896cb3117f0c0262fb7c17e7ed4aa9c934autocorr-hu-4.3.7.2-2.el6_9.1.noarch.rpm531b3b4aa2a290b9566d22f51164807b7f4362fccb4bcb2bf8e561c1044e16d5libreoffice-langpack-ms-4.3.7.2-2.el6_9.1.x86_64.rpm0272b47fb1496aa6baa18610ebad4b184b35df2a64a25b81c024bf8f946d6d30libreoffice-officebean-4.3.7.2-2.el6_9.1.x86_64.rpm811d7a108887fd8828d62911de06fe016590ec4fa72f846f5787d326d4abf68fautocorr-af-4.3.7.2-2.el6_9.1.noarch.rpm1c2f4cb40ca90b5c5a70d20b2b6d6c61b0daa9e0c7b9e9de4a59e1843e71b1cclibreoffice-langpack-ve-4.3.7.2-2.el6_9.1.x86_64.rpm794f0396c62b4ee6d43f1abb6619648d7c0d697cd344e28e656e1708e7d8c587libreoffice-langpack-te-4.3.7.2-2.el6_9.1.x86_64.rpm9ddb0de2e2ea292b333b04c1016e8852216e42406bcb29884c69418bcce2c20clibreoffice-langpack-nl-4.3.7.2-2.el6_9.1.x86_64.rpm307930c4457be86820f2eea999982d40ea78d7cd437db9d60684262b48898a76libreoffice-gdb-debug-support-4.3.7.2-2.el6_9.1.i686.rpm7b3afd43e8fb2ee32149e9c20afd31b989e127434cb0ede1290c4e82ff40bd27libreoffice-sdk-doc-4.3.7.2-2.el6_9.1.x86_64.rpm8bb15a958a5a15d56f132ad94d707bec8b8616abc933915a3238a5a970ee7241libreoffice-impress-4.3.7.2-2.el6_9.1.x86_64.rpmdc8c58b2f8c2194611eebb72162197342e3143eccd80c8252ad483e6efbca6eblibreoffice-langpack-bg-4.3.7.2-2.el6_9.1.x86_64.rpm06539c279450f9e22ee097614e1453777a8ddb4c74c34c0fcbacc79c5563abeflibreoffice-pyuno-4.3.7.2-2.el6_9.1.x86_64.rpme4f842be2f42886e06f6def901fac5ea8df6781b02da57afceed85348de6e884libreoffice-langpack-lt-4.3.7.2-2.el6_9.1.x86_64.rpm99de06d17dfd0cb005b6ac27b71deda2afa783467d04511285653a25171b748aautocorr-sv-4.3.7.2-2.el6_9.1.noarch.rpm4f05489a659db751a27aa5e9a06896326f9afd04779148d969a414fa665d9ecalibreoffice-langpack-gu-4.3.7.2-2.el6_9.1.x86_64.rpm523a141d0f136bfe2434c2642890798a3eb66ade899d1b478be442ade9241cedlibreoffice-base-4.3.7.2-2.el6_9.1.x86_64.rpm5bbd973f751a980411e6a959afa79f1ed59b953e944b138663dbf889acf8e5fbautocorr-is-4.3.7.2-2.el6_9.1.noarch.rpm50b80dd7b0ef8b80e7b38d43dbe3240544911af61475098f7e40abd02938dc7eautocorr-fi-4.3.7.2-2.el6_9.1.noarch.rpm5b11a0f1cb83bde880b62e187dbdfdddc9ec5f0a23f6c4352ee0abefe139a3d8libreoffice-wiki-publisher-4.3.7.2-2.el6_9.1.x86_64.rpm769d6956ee36477f0425a069d0697213779896fc61019b138ff8db6a52195738libreoffice-langpack-ts-4.3.7.2-2.el6_9.1.x86_64.rpmb1dd83b612c2af1a394c1f2840a961aeee14fb4bd13cf6a624a7533b1cfcb502libreoffice-langpack-ja-4.3.7.2-2.el6_9.1.x86_64.rpmbd108fd843cc258848e1b850c16bb9e24c968a5469c1fd98e475edef7c58381blibreoffice-filters-4.3.7.2-2.el6_9.1.x86_64.rpmc5670ff390668563f64d1fd4039176f964d42e1cce609139f794fd0b998cbbeelibreoffice-langpack-et-4.3.7.2-2.el6_9.1.x86_64.rpm64117f825d8ccdf7cf6043b3f559665c16bb79ed504e75e3462ed35669668dbalibreoffice-langpack-nb-4.3.7.2-2.el6_9.1.x86_64.rpm848a4df7abef5fb4391dc6bd0b7c2b6c3a25371879cacb41e318686b06f6b748libreoffice-graphicfilter-4.3.7.2-2.el6_9.1.x86_64.rpmd6e9a2563a5cb5749ab59a9c8aff9aad870b8f30e8b0045dfba33bbe6de1b098autocorr-lt-4.3.7.2-2.el6_9.1.noarch.rpmefda3860a2142487504c79780d1654a0fe9bd3a3ffadfbe3cc381423930bb825libreoffice-langpack-sl-4.3.7.2-2.el6_9.1.x86_64.rpm9f908a450381b0b2471a937f046cabaffb45427cdf53716cb381878d0ee24518libreoffice-langpack-zh-Hans-4.3.7.2-2.el6_9.1.x86_64.rpm128e33a2f46273cf166ca1417176de66ff0645fa604741683a62ecb029ee19bfautocorr-pl-4.3.7.2-2.el6_9.1.noarch.rpmad322e797da44d9709da666b83e2f2ef764584bb76843a9b34b483c874245ae5libreoffice-langpack-es-4.3.7.2-2.el6_9.1.x86_64.rpmde4d9dbc0acb18012857f6d7667b9f42e7db0759f46753df5075fcf7454e95c8libreoffice-langpack-sv-4.3.7.2-2.el6_9.1.x86_64.rpm96787c995e8c5b0a5d4152193a0151640d09241b254300978306c2e4430e5a55libreoffice-langpack-da-4.3.7.2-2.el6_9.1.x86_64.rpm1f6c058ed50f920d7140cfcbc48dc74ef852db014d3ee608133b2a7c5d5da914libreoffice-langpack-pl-4.3.7.2-2.el6_9.1.x86_64.rpm5fc2658b463131cc5affcbcf3c53c7d64d4e542bc808f811b3b90270aa9ecd20libreoffice-nlpsolver-4.3.7.2-2.el6_9.1.x86_64.rpmbb70ebb137bd916abf7f54c039d7818b35d1350034230183657b84f9a65e453dlibreoffice-langpack-zh-Hant-4.3.7.2-2.el6_9.1.x86_64.rpm5aef935429c9c2d468bf57fcbc52a983684da85a75f97246d0aa3cbd38b77968libreoffice-langpack-bn-4.3.7.2-2.el6_9.1.x86_64.rpma3822f490e2e48dd86324af29b58a63ffd10daf435ffe2503c8a813b7963efc5libreoffice-langpack-ur-4.3.7.2-2.el6_9.1.x86_64.rpm67c103595e071272cbf0a9bf7ec081c5c738af514dd05a2c83ba1de1e35cc21cautocorr-vi-4.3.7.2-2.el6_9.1.noarch.rpm3cfbf3b3afe292e05482014e9fc6b0f58da4f19389a6e9e1f78d58d8876149ealibreoffice-langpack-hu-4.3.7.2-2.el6_9.1.x86_64.rpm9bf3bb01f24cfc717245467b0f32e21136b79e29657b8270c1563036aff61cb7libreoffice-draw-4.3.7.2-2.el6_9.1.x86_64.rpme798b559161703a6b1356527fb1c30f2a0112e372d4c88d818a465cbc95db226libreoffice-math-4.3.7.2-2.el6_9.1.x86_64.rpm223adae39ea4b37d3aec566ca4baea00de3193825412908c84a817d4f373a349autocorr-it-4.3.7.2-2.el6_9.1.noarch.rpm95d95a26541b13ff8d4de01cde064a01164e5d6265fcd4e1e5122db096f95235libreoffice-langpack-ar-4.3.7.2-2.el6_9.1.x86_64.rpm0e77a22833f5af41e9ddf9d63a348d0740611a64abe6971bdaa4863220f079b7libreoffice-langpack-fi-4.3.7.2-2.el6_9.1.x86_64.rpm931b49fa65c0ff544a5ca6bdf372e835deadab9bd8e8b5aba05aacfb1b8599e2libreoffice-langpack-nn-4.3.7.2-2.el6_9.1.x86_64.rpmaa14d5633880a7300b6d8ab5ec4f9b9b1111da0270456cff00aee4f97ec6ef81libreoffice-langpack-ro-4.3.7.2-2.el6_9.1.x86_64.rpm0324c8f7d406d588c1e9a7c83f3c4a01ac6fdd62c46b077111900ddf940e4eb7autocorr-ca-4.3.7.2-2.el6_9.1.noarch.rpmdf1032de82277a7a7101dc0d05ea1b97ec12bfd6b2d00652616a8036813401dclibreoffice-langpack-ml-4.3.7.2-2.el6_9.1.x86_64.rpm6658ecfc5b73ef6f291c550efcdf8c03e0a1c5364479fa9a87f8aec156f67d15libreoffice-xsltfilter-4.3.7.2-2.el6_9.1.x86_64.rpm19ba827816002d5e7b2cd989eb5c334530e7dd9b99c7f338845ef5dbf14925b5autocorr-pt-4.3.7.2-2.el6_9.1.noarch.rpm9b89a93a9d29b3701a96029d9193124271ca8bdaf1804d178daa5e96e329317elibreoffice-langpack-kn-4.3.7.2-2.el6_9.1.x86_64.rpmb973143af84fb4f3317be24a2185b784869e4019819734b34a0e5a949093808fautocorr-nl-4.3.7.2-2.el6_9.1.noarch.rpmd403e2cfdabfee3bc9c450bd3267c749cc020137a87b04cf69fb9f3fdecc98c1libreoffice-langpack-dz-4.3.7.2-2.el6_9.1.x86_64.rpm0306f05cbd0f64247ad48be2de54f94bbc480dea453893d5b9f2475c047ac612libreoffice-langpack-tr-4.3.7.2-2.el6_9.1.x86_64.rpm16188943ef3449c18ca32f31f716183454591023248140a5f6db168fbd3fd992libreoffice-bsh-4.3.7.2-2.el6_9.1.x86_64.rpm88fb81e1605b6a96d53fbce4ff2b93f34f116ae53da893f0b833a65546f9cd38libreoffice-langpack-cs-4.3.7.2-2.el6_9.1.x86_64.rpm05b5d57e7dc0b134519d777098e14f4426caa95fe6c9fb2f896ca63608049275autocorr-lb-4.3.7.2-2.el6_9.1.noarch.rpm6018a4afe121ba4d9ea2e037a3e9d0de4f9589c371e4aee331e28ab1d5a34ed9autocorr-mn-4.3.7.2-2.el6_9.1.noarch.rpm9a10d7f1895eca409cd71ad0d0dbf8d841e86742804bd76d9fbe838d228fe850autocorr-da-4.3.7.2-2.el6_9.1.noarch.rpmfab318f93e0d14c5edbd33794e164d8c096cc181e914da77a15133b430fbb897autocorr-tr-4.3.7.2-2.el6_9.1.noarch.rpmce60697f8aaece914e0964d8254f1cfa0f9e6e7c39d0f5a65f5e31c9fbe11e07autocorr-fr-4.3.7.2-2.el6_9.1.noarch.rpma880ddb5e3a6293a08744d314f0bfea84d7cff371733b75b26003139b89f4961libreoffice-langpack-it-4.3.7.2-2.el6_9.1.x86_64.rpm9611af45cfe4668aeef6d5477d36abf1212bd1b87d43a91b4fd9f854bdf39b2blibreoffice-langpack-xh-4.3.7.2-2.el6_9.1.x86_64.rpm09432f069a67613467c9fc7efd93d91fe13e4adb8f8a0dfa1a3c0ee05ebf50a7libreoffice-4.3.7.2-2.el6_9.1.x86_64.rpmb4647d8eb5e24c6c57637115486c98a674211eb11fb1775458e5e9299102871dautocorr-sl-4.3.7.2-2.el6_9.1.noarch.rpm110df20e48f93c1eb7ee281e397c7318dac41bb9b473c4c36fe792af57844fd5libreoffice-gdb-debug-support-4.3.7.2-2.el6_9.1.x86_64.rpm1d1e91d092cbecdfc91761ad331beadf35d9ed0fa50dbefce4097ccfb940ee4elibreoffice-langpack-sk-4.3.7.2-2.el6_9.1.x86_64.rpm555a6dc2e593bf0c50de75f80ab1fa0e13ab65d1d910406dbec773814670eff5autocorr-zh-4.3.7.2-2.el6_9.1.noarch.rpmb4e0ae19e5f630e77f41d06b2681c7475fadfb8fd100b6d36f55b4f17e95f8f3autocorr-sk-4.3.7.2-2.el6_9.1.noarch.rpmce7974e9a0c5ec4f4d10ae2a20493c42945c6d2517bb07e3058c530fff3e923clibreoffice-langpack-st-4.3.7.2-2.el6_9.1.x86_64.rpm832832b5f1d45f2b43bce895ab0a4edb8a45902c7b1a7c92c18062bf0e819250libreoffice-langpack-mr-4.3.7.2-2.el6_9.1.x86_64.rpmae3b7b76e6cfd0d7baa5df117cfe170a91c5fe453acad20081238b29ff24bfc0libreoffice-opensymbol-fonts-4.3.7.2-2.el6_9.1.noarch.rpm1191cc77a91c3df807a36005a7952c3118e995532ad8c13c3bdf9a657bf6c29bautocorr-ga-4.3.7.2-2.el6_9.1.noarch.rpm2826ca3d0def0e03bda200f522eb61eec278b0ae1ab41c08c1c79f8cce9c6d70autocorr-hr-4.3.7.2-2.el6_9.1.noarch.rpm3f2e3896b81581e93ab5df96850e9546c3a4021f047f079ff61d40503fc0575dautocorr-de-4.3.7.2-2.el6_9.1.noarch.rpmd1abca34872ddcfe0084e55d8a3f7a6c4d7ab0878660c13d431e7b79cda60e5blibreoffice-langpack-ga-4.3.7.2-2.el6_9.1.x86_64.rpmb096d3065a5fb3f845f8007343f1538d10a840eb6bd852b534c6622c81265772autocorr-fa-4.3.7.2-2.el6_9.1.noarch.rpm0a1d3714cc91b7fd173dce175de1764c20777f40366f98fd21da67ade7e7b2b5libreoffice-langpack-nso-4.3.7.2-2.el6_9.1.x86_64.rpm22886825ab90c21ab25b6dab48ed221704d316be7d7efad3139989b7565d5ad8libreoffice-langpack-fr-4.3.7.2-2.el6_9.1.x86_64.rpmb3cbc0ffdf99b82daa8d6daa4b80f025f2a7c1b135d731e4eb90f62d80c6fa23libreoffice-langpack-de-4.3.7.2-2.el6_9.1.x86_64.rpm6cfa0db59987dbaa655577988997beb72186db61f66c3b85e7d0854c4a3adb8dlibreoffice-langpack-ko-4.3.7.2-2.el6_9.1.x86_64.rpm92f95c0d5ac263b1e39bde859c180aa35149605e36fec521a2e3ff7fb10e27felibreoffice-langpack-tn-4.3.7.2-2.el6_9.1.x86_64.rpmd28a41d8f0a6029b60d007908cf92ea6f50a19fe889a84663ce71c8b7ed20842libreoffice-langpack-or-4.3.7.2-2.el6_9.1.x86_64.rpm717c9e71ff33151c0f819c9e119a95c99f4672a42f665435e011b0573c715afflibreoffice-ure-4.3.7.2-2.el6_9.1.x86_64.rpmafdeb3dffaa340bb9eec8f815635d156cb3c089fb5538ed4774c8dc3a953fe67autocorr-ru-4.3.7.2-2.el6_9.1.noarch.rpmb49204e083a263ce3d1305c37d2fef050949010ac2cd81c47333a91bd375d659autocorr-en-4.3.7.2-2.el6_9.1.noarch.rpm75a7cd41c017f985b53a1b017955003d50aaa289b431cf8a017ce8e1c5ec441elibreoffice-ogltrans-4.3.7.2-2.el6_9.1.x86_64.rpm59cee9cbd2a5c91e6fe66268887cf77412f2a63328a6a7fc7eb4709c93f57a9alibreoffice-langpack-pa-4.3.7.2-2.el6_9.1.x86_64.rpme445ddddbbb92a91e935679cc5905acf79774a4e9d168a17aa36b4fd10f20c39libreoffice-langpack-en-4.3.7.2-2.el6_9.1.x86_64.rpm5122068eb99a46a7bb2b435fc6f6a2696fc3a7f6d53463b38b2fc412f6f3039blibreoffice-langpack-hr-4.3.7.2-2.el6_9.1.x86_64.rpm7e6bcc14d0f6013188426a6e2758b971c235c8f9bf8ac84ed9fa9b8f6f71923clibreoffice-langpack-th-4.3.7.2-2.el6_9.1.x86_64.rpmc236fd1d36f965ce9141274c8409b50b1b83bd8aee2909cacd28a74d6881d513libreoffice-langpack-ca-4.3.7.2-2.el6_9.1.x86_64.rpm1cf054370ad284e42a958c53033d546b2606e41433fd4bb74b048db60babdcf0libreoffice-langpack-pt-BR-4.3.7.2-2.el6_9.1.x86_64.rpm6f5672a0f118b19635eeb21a0aa42d7a9f638a96edf95b37e6d355e0d140f0b6libreoffice-langpack-hi-4.3.7.2-2.el6_9.1.x86_64.rpm8d5a4afb514b743b731206030c0c4b625d7d1d87ad9fd2081280859c1cfa8d1flibreoffice-calc-4.3.7.2-2.el6_9.1.x86_64.rpm822e672a117b77c4d3df25f8fd0ca9e37a1425625ef8efd69891f0c8b519f5b7libreoffice-rhino-4.3.7.2-2.el6_9.1.x86_64.rpm1345df8e77eef47bde96864f85210617f1d481e1e14d84a9e6c072de4fe1a1f3libreoffice-langpack-cy-4.3.7.2-2.el6_9.1.x86_64.rpmd29473de0b1f9d5fd4a62ba6d719a415d5847f9d33413a5f78fd6fec3390a9dclibreoffice-langpack-gl-4.3.7.2-2.el6_9.1.x86_64.rpm4a5e3b8a4fc5de715b817e8712bbf84ac30b06352f5ea909d379a2ea9a55e357libreoffice-emailmerge-4.3.7.2-2.el6_9.1.x86_64.rpm1f6b032d09c5fb55dc668694cc07a45e8928cb2cf2b392869c3d3c636419530elibreoffice-pdfimport-4.3.7.2-2.el6_9.1.x86_64.rpm88b1e3c35dbbdc5c74f929b89f787d8c87a8629364a1e35f8e613d4effe32b9cautocorr-ja-4.3.7.2-2.el6_9.1.noarch.rpm5a67147b4e9dc4b93db0dbc20d581665ec9afa6c55ea51791afe6746fc4340edautocorr-ko-4.3.7.2-2.el6_9.1.noarch.rpm9e235e3d7432cac5f596e789f12a399a0c5ad997c235e0a87aff692118c8aa29libreoffice-writer-4.3.7.2-2.el6_9.1.x86_64.rpm2837f60456ec329808487a16f7da9a2c0af9a2d957236919a972413350145c8bautocorr-sr-4.3.7.2-2.el6_9.1.noarch.rpm398180ec0adc988cbe0d8151add86acd6c29c8a6db379ef56e20599b72f93164libreoffice-langpack-pt-PT-4.3.7.2-2.el6_9.1.x86_64.rpm788ed46fa2f741a465eb75fa5b2f5fb0e75848e336bc4a9a2dd28fde4325affelibreoffice-sdk-4.3.7.2-2.el6_9.1.x86_64.rpmac92f281359a3a0f61f58639cc9774ba88af0223f394a0539c5a7821dab4c115libreoffice-langpack-af-4.3.7.2-2.el6_9.1.x86_64.rpmf4d51308b414a15a7080c7a3b8a7b5ed58b20f4f6c42af062788480df6cf29d1autocorr-es-4.3.7.2-2.el6_9.1.noarch.rpmad834f03e60d4aa6661daa0f2fc8e7b0de0e6de454712189d687f7ec08f8605dlibreoffice-langpack-zu-4.3.7.2-2.el6_9.1.x86_64.rpm3469cf8dcb32e61de2e7a05ccd77699ea3a809a927e5d0489e575297b1f1af8flibreoffice-langpack-sr-4.3.7.2-2.el6_9.1.x86_64.rpm934016a84d416aeb1cfe4c53cd28ddf09d69a66a08a0b027a753cbc8be14e09elibreoffice-librelogo-4.3.7.2-2.el6_9.1.x86_64.rpmffd9e0747fb966fd869c467594f9cd2e926a9ed215c6e3af411c5526abc9865clibreoffice-langpack-as-4.3.7.2-2.el6_9.1.x86_64.rpmf9a98a6aa6b7249d663fb32da4deb9584f26891dd1d71a684365fee9255cba7dSLSA-2017:1100-1The nss-util packages provide utilities for use with the Network Security Services (NSS) libraries. The following packages have been upgraded to a newer upstream version: nss (3.28.4), nss-util (3.28.4). Security Fix(es): * An out-of-bounds write flaw was found in the way NSS performed certain Base64-decoding operations. An attacker could use this flaw to create a specially crafted certificate which, when parsed by NSS, could cause it to crash or execute arbitrary code, using the permissions of the user running an application compiled against the NSS library. (CVE-2017-5461)criticalScientific Linux FermiScientific Linux Fermi 6nss-pkcs11-devel-3.28.4-1.el6_9.i686.rpm61935696953f1d5b878e854c59245ded87a1bb771c82814cd6b617124c9c7641nss-util-devel-3.28.4-1.el6_9.i686.rpmd2bdde78314d6652a0966773abf7703510bb2f9d4efa53b2b91387d73c61347enss-pkcs11-devel-3.28.4-1.el6_9.x86_64.rpmb1d300a98b97f4b6378582acff7e9846b73fbabe9fd57c4e27f3361e2bd61bccnss-3.28.4-1.el6_9.i686.rpm341424f107605e2efa56ea377f9da8108ae2db0ab0832e49c85ffc8568c9d84fnss-tools-3.28.4-1.el6_9.x86_64.rpma253afef79c41863428e06cc692ba5bc11b5f80f723d7f56684f649249da9943nss-sysinit-3.28.4-1.el6_9.x86_64.rpm33efda80534bb55d132217bc2ff2ed2105e0a9dd86bf6352b6ff2b2eb01fc456nss-3.28.4-1.el6_9.x86_64.rpmbca2f0cf51f1b7b6d87b22369d5b4125e9269d42d6a3b3eb95e30a603c4a4292nss-util-3.28.4-1.el6_9.i686.rpm03323817a4f703171f29d59953383e72e2347a8efdb81079716033b48f2a46dbnss-util-devel-3.28.4-1.el6_9.x86_64.rpmc000cb1426332a1715ebd79276ef42617b7b0072be8742c2dce37c2097a4d9d4nss-util-3.28.4-1.el6_9.x86_64.rpm936591e9b6c22501658066f19d79a1430a28e3f8d5a44181be0aece4e519fa6dnss-devel-3.28.4-1.el6_9.i686.rpm162d85a3cba111cacafb841c6c71583a0e5c191ef3737455bbe74252f607b210nss-devel-3.28.4-1.el6_9.x86_64.rpm46dbfb7ccfd4c7724ded4ec94d5414978348f5d6f3bc9bc3af3be344488ea940SLSA-2017:1104-1This update upgrades Firefox to version 52.1.0 ESR. Security Fix(es): * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2017-5429, CVE-2017-5432, CVE-2017-5433, CVE-2017-5434, CVE-2017-5435, CVE-2017-5436, CVE-2017-5437, CVE-2017-5438, CVE-2017-5439, CVE-2017-5440, CVE-2017-5441, CVE-2017-5442, CVE-2017-5443, CVE-2017-5444, CVE-2017-5445, CVE-2017-5446, CVE-2017-5447, CVE-2017-5448, CVE-2017-5449, CVE-2017-5459, CVE-2017-5460, CVE-2017-5464, CVE-2017-5465, CVE-2017-5469)criticalScientific Linux FermiScientific Linux Fermi 6firefox-52.1.0-2.el6_9.i686.rpm49e7f0ff9785650d857af6d3a14a5975a41fcfaf412be3badebe9c7ee3d717b8firefox-52.1.0-2.el6_9.x86_64.rpmcef4ea0c711af9861d8aa405309d1057471df0aa54f360c4700c111510258900SLSA-2017:1105-1Security Fix(es): * A denial of service flaw was found in the way BIND handled a query response containing CNAME or DNAME resource records in an unusual order. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2017-3137) * A denial of service flaw was found in the way BIND handled query requests when using DNS64 with "break-dnssec yes" option. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS request. (CVE-2017-3136)importantScientific Linux FermiScientific Linux Fermi 6bind-sdb-9.8.2-0.62.rc1.el6_9.1.x86_64.rpm073e4e39152348c8a8bf706383b90118c950fefa14c608f9a1259f69c1d33414bind-libs-9.8.2-0.62.rc1.el6_9.1.i686.rpm86e74bc8ea7ac4c4263bd4acaa823a3c3534eab4b69b09f6ff26a10c0d615473bind-utils-9.8.2-0.62.rc1.el6_9.1.x86_64.rpmc89e00c20c0b163e14dfa4f1dbe51c1ca733deb3c3dbf0165b26616fb3f0867abind-chroot-9.8.2-0.62.rc1.el6_9.1.x86_64.rpm490d2a2bd2f58bce416137c7485371a5c799dcd2fc9253a314dff264996e2ed8bind-devel-9.8.2-0.62.rc1.el6_9.1.x86_64.rpmed8ec1fa16a83f2c41f0f6b919dc8bc8715caa1bdc253a086fc3dc4d9d8695f3bind-9.8.2-0.62.rc1.el6_9.1.x86_64.rpmb219574fac57b83e79d91b06e48e404eb8e27e509754a0b54564fcff26da38adbind-devel-9.8.2-0.62.rc1.el6_9.1.i686.rpm94cded554f19814271e13b43b5bfe065537432243caba3ea5635fc07c67c32d4bind-libs-9.8.2-0.62.rc1.el6_9.1.x86_64.rpm1f4f81f04eff41988a5b25ad80ffc7b3505c9d9e7f4b8d4e80b9a039212174c0SLSA-2017:1109-1Security Fix(es): * An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges. (CVE-2017-3511) * It was found that the JAXP component of OpenJDK failed to correctly enforce parse tree size limits when parsing XML document. An attacker able to make a Java application parse a specially crafted XML document could use this flaw to make it consume an excessive amount of CPU and memory. (CVE-2017-3526) * It was discovered that the HTTP client implementation in the Networking component of OpenJDK could cache and re-use an NTLM authenticated connection in a different security context. A remote attacker could possibly use this flaw to make a Java application perform HTTP requests authenticated with credentials of a different user. (CVE-2017-3509) Note: This update adds support for the "jdk.ntlm.cache" system property which, when set to false, prevents caching of NTLM connections and authentications and hence prevents this issue. However, caching remains enabled by default. * It was discovered that the Security component of OpenJDK did not allow users to restrict the set of algorithms allowed for Jar integrity verification. This flaw could allow an attacker to modify content of the Jar file that used weak signing key or hash algorithm. (CVE-2017-3539) Note: This updates extends the fix for CVE-2016-5542 released as part of the SLSA-2016:2079 erratum to no longer allow the MD5 hash algorithm during the Jar integrity verification by adding it to the jdk.jar.disabledAlgorithms security property. * Newline injection flaws were discovered in FTP and SMTP client implementations in the Networking component in OpenJDK. A remote attacker could possibly use these flaws to manipulate FTP or SMTP connections established by a Java application. (CVE-2017-3533, CVE-2017-3544) Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website.moderateScientific Linux FermiScientific Linux Fermi 6java-1.8.0-openjdk-javadoc-1.8.0.131-0.b11.el6_9.noarch.rpmce541104c6e4a6030f161c2d0ed33e3ff9ab496b53bd53cb24a2b42d1197a437java-1.8.0-openjdk-debug-1.8.0.131-0.b11.el6_9.x86_64.rpmf054a3c73bcbe7b5f25316f84bf1c98e153b5a13d5395562c748537dc6135e9bjava-1.8.0-openjdk-headless-1.8.0.131-0.b11.el6_9.x86_64.rpme0472562e16f99a473e80a7435d887c29482fcb37c3ba3cad6b9952c5390f3cbjava-1.8.0-openjdk-javadoc-debug-1.8.0.131-0.b11.el6_9.noarch.rpm6792d0d9d325b69638e6f32bc56b5c0ba832df1026f52cb848665d423c566ff9java-1.8.0-openjdk-headless-debug-1.8.0.131-0.b11.el6_9.x86_64.rpm4b85f596d9c050dd4821ac9f9fe370e01881527f3fbb3795f96e518c203f2e7cjava-1.8.0-openjdk-devel-1.8.0.131-0.b11.el6_9.x86_64.rpm0ca3c96cc33c8ded22556a2cc250f4b330a20bfe771cc9c8690039453b6e2036java-1.8.0-openjdk-devel-debug-1.8.0.131-0.b11.el6_9.x86_64.rpm7fb250bbfcdb00281ce75deec5eff1f751b4156ec5e5cbb2eb618bf6e334ad02java-1.8.0-openjdk-src-debug-1.8.0.131-0.b11.el6_9.x86_64.rpmaef066b9725bf9c5ab7519617f64f349d0c45e556562d83b435f799b0b6a7614java-1.8.0-openjdk-1.8.0.131-0.b11.el6_9.x86_64.rpm67c1f189aea5dd25e4ff2b492b592c533a949b0ea3a1814399bf0a4548156e1bjava-1.8.0-openjdk-src-1.8.0.131-0.b11.el6_9.x86_64.rpmef1ec2deb8cc65af10f4a88751fb20e8b2d28e766ce07570ff6de55c20b0eee5java-1.8.0-openjdk-demo-1.8.0.131-0.b11.el6_9.x86_64.rpm6eb2ad157c1b69395cd1a6d0c607fb7aab67a4a3400c7a5b91e4f435b020c66ajava-1.8.0-openjdk-demo-debug-1.8.0.131-0.b11.el6_9.x86_64.rpm4a1a47edf237ebf3d5f164f60f82c3094faf4e9b2025ef0555ef626ccbccc595SLSA-2017:1201-1This update upgrades Thunderbird to version 52.1.0. Security Fix(es): * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2017-5429, CVE-2017-5433, CVE-2017-5435, CVE-2017-5436, CVE-2017-5459, CVE-2017-5466, CVE-2017-5432, CVE-2017-5434, CVE-2017-5438, CVE-2017-5439, CVE-2017-5440, CVE-2017-5441, CVE-2017-5442, CVE-2017-5443, CVE-2017-5444, CVE-2017-5446, CVE-2017-5447, CVE-2017-5454, CVE-2017-5460, CVE-2017-5464, CVE-2017-5465, CVE-2017-5469, CVE-2016-10195, CVE-2016-10196, CVE-2017-5445, CVE-2017-5449, CVE-2017-5451, CVE-2017-5467, CVE-2016-10197)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-52.1.0-1.el6_9.x86_64.rpm8322ce4dcebc48f922b9f70f085af3fa0db8f9cefdbdd872d2cd0d38d1e5c9d4SLSA-2017:1202-1Security Fix(es): * A denial of service flaw was found in the way BIND handled DNSSEC validation. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. (CVE-2017-3139) Note: This issue affected only the BIND versions as shipped with EL6.importantScientific Linux FermiScientific Linux Fermi 6bind-devel-9.8.2-0.62.rc1.el6_9.2.x86_64.rpm6f63c9b6c4a109a877926976ff58312efbf1ffe85615142d5b242217be0bed01bind-sdb-9.8.2-0.62.rc1.el6_9.2.x86_64.rpm6a74feaa7a32823cf00e773ac5b2b08c6d399f6a5ca5305fdd4b05c7b8c2ff4abind-9.8.2-0.62.rc1.el6_9.2.x86_64.rpmf3921412b7067329233234e98c27eb27c8c72f82e28a6a786677d2d438d41564bind-libs-9.8.2-0.62.rc1.el6_9.2.x86_64.rpm0c5e1a7d2b186b7094617900111d48e58dbf40651c1fba64517ee6bc1284e34cbind-chroot-9.8.2-0.62.rc1.el6_9.2.x86_64.rpm09a6c72e36ad1647e6329c39c96b7e92153dfd12a7837334e8e81b88a2515e10bind-libs-9.8.2-0.62.rc1.el6_9.2.i686.rpma7ac26544dd1521f8ac8d263f72c4b50a630399195e924bd86a0b4aed772c76cbind-devel-9.8.2-0.62.rc1.el6_9.2.i686.rpm28d60a8c90201a5af60ef07d087ca36b50a201ddcaedbc9d8a2124c1adbec37dbind-utils-9.8.2-0.62.rc1.el6_9.2.x86_64.rpm8bca54bc384b459d177b31e0c11e110282ed4929381eded649e02b9f32a4e32fSLSA-2017:1204-1Security Fix(es): * An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges. (CVE-2017-3511) * It was found that the JAXP component of OpenJDK failed to correctly enforce parse tree size limits when parsing XML document. An attacker able to make a Java application parse a specially crafted XML document could use this flaw to make it consume an excessive amount of CPU and memory. (CVE-2017-3526) * It was discovered that the HTTP client implementation in the Networking component of OpenJDK could cache and re-use an NTLM authenticated connection in a different security context. A remote attacker could possibly use this flaw to make a Java application perform HTTP requests authenticated with credentials of a different user. (CVE-2017-3509) Note: This update adds support for the "jdk.ntlm.cache" system property which, when set to false, prevents caching of NTLM connections and authentications and hence prevents this issue. However, caching remains enabled by default. * It was discovered that the Security component of OpenJDK did not allow users to restrict the set of algorithms allowed for Jar integrity verification. This flaw could allow an attacker to modify content of the Jar file that used weak signing key or hash algorithm. (CVE-2017-3539) Note: This updates extends the fix for CVE-2016-5542 released as part of the SLSA-2016:2658 erratum to no longer allow the MD5 hash algorithm during the Jar integrity verification by adding it to the jdk.jar.disabledAlgorithms security property. * Newline injection flaws were discovered in FTP and SMTP client implementations in the Networking component in OpenJDK. A remote attacker could possibly use these flaws to manipulate FTP or SMTP connections established by a Java application. (CVE-2017-3533, CVE-2017-3544)moderateScientific Linux FermiScientific Linux Fermi 6java-1.7.0-openjdk-devel-1.7.0.141-2.6.10.1.el6_9.x86_64.rpm47f6f0cc9611751746c6a7707d441c551515943d977aa7eb544a8fca9d9377f9java-1.7.0-openjdk-src-1.7.0.141-2.6.10.1.el6_9.x86_64.rpm6f1f2337d4f80436fd4b82bc4f4a0ea8f37cdb07a3b85f2a0ac0781e89736cb5java-1.7.0-openjdk-demo-1.7.0.141-2.6.10.1.el6_9.x86_64.rpm50d0d5db7abacfe83c263d70e166eeaf71606b25df14a05caae060c73ca74025java-1.7.0-openjdk-1.7.0.141-2.6.10.1.el6_9.x86_64.rpm59d06a6fce4f8d5e9ecd46b4b0cb3dcdb5e51516b37cc1ad5998b2fdc6744462java-1.7.0-openjdk-javadoc-1.7.0.141-2.6.10.1.el6_9.noarch.rpma93ef7cabb7ebfbce94b8018fadf4524e08de64d9b6ef3026e1d25e9f3b7a3b5SLSA-2017:1206-1Security Fix(es): * A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process. (CVE-2016-9603) * An out-of-bounds r/w access issue was found in QEMU's Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process. (CVE-2017-7980) * An out-of-bounds memory access issue was found in QEMU's VNC display driver support. The vulnerability could occur while refreshing the VNC display surface area in the 'vnc_refresh_server_surface'. A user/process inside a guest could use this flaw to crash the QEMU process, resulting in a denial of service. (CVE-2017-2633) * An out-of-bounds access issue was found in QEMU's Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in denial of service. (CVE-2017-7718)importantScientific Linux FermiScientific Linux Fermi 6qemu-img-0.12.1.2-2.503.el6_9.3.x86_64.rpmb1454d91afb439651911d45267f238ccad3347c1ca2dae402798ddb44d371865qemu-guest-agent-0.12.1.2-2.503.el6_9.3.x86_64.rpm034c690ee6a2ac1b8a7bec63ba0ae4e14093ba564e1e2376131a208f32d11c84qemu-kvm-0.12.1.2-2.503.el6_9.3.x86_64.rpm30ab722e7422a5efc2076cdc4ac49ec02cf5884221bee78332d6fd328f8a1a2fqemu-kvm-tools-0.12.1.2-2.503.el6_9.3.x86_64.rpm8afe2458413464884e6639dbdff994d3cd04bd9aa2c4bdfc2ea5466e4c0806caSLSA-2017:1208-1Security Fix(es): Multiple flaws were found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code. (CVE-2016-8654, CVE-2016-9560, CVE-2016-10249, CVE-2015-5203, CVE-2015-5221, CVE-2016-1577, CVE-2016-8690, CVE-2016-8693, CVE-2016-8884, CVE-2016-8885, CVE-2016-9262, CVE-2016-9591) Multiple flaws were found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash. (CVE-2016-1867, CVE-2016-2089, CVE-2016-2116, CVE-2016-8691, CVE-2016-8692, CVE-2016-8883, CVE-2016-9387, CVE-2016-9388, CVE-2016-9389, CVE-2016-9390, CVE-2016-9391, CVE-2016-9392, CVE-2016-9393, CVE-2016-9394, CVE-2016-9583, CVE-2016-9600, CVE-2016-10248, CVE-2016-10251)importantScientific Linux FermiScientific Linux Fermi 6jasper-utils-1.900.1-21.el6_9.x86_64.rpm31d8bc483796d04d6b5847ea2a0ac1023bc6fd743c56175881dbface07ea73cbjasper-libs-1.900.1-21.el6_9.i686.rpmc0ee5699ea0363145c3c19a02b99d78b065e0d56a6089038977efc3b78d4d1bdjasper-1.900.1-21.el6_9.x86_64.rpm358acd1220770f3621260a8f8f7796de8717aa7ae6895974c8ecbdcc4fe05bd9jasper-devel-1.900.1-21.el6_9.i686.rpm65b167d8fc691b4a23358e74b4293733a7f713e6f490eb964281358ee83b21a7jasper-libs-1.900.1-21.el6_9.x86_64.rpme4e6075004fbea7d3e098c6f942ae9c9fcbb826f94776b8937e9b43bf3283574jasper-devel-1.900.1-21.el6_9.x86_64.rpm1577f76ef407ed7ff0b8245ab12b861a271ecfe199f6024532c1c6adacadec44SLSA-2017:1230-1Security Fix(es): * It was found that ghostscript did not properly validate the parameters passed to the .rsdparams and .eqproc functions. During its execution, a specially crafted PostScript document could execute code in the context of the ghostscript process, bypassing the -dSAFER protection. (CVE-2017-8291)importantScientific Linux FermiScientific Linux Fermi 6ghostscript-devel-8.70-23.el6_9.2.i686.rpm76c92134d302df9ecbb0d6b39a6d465823ddafbc64c785d4563eb4ded2a5e95aghostscript-doc-8.70-23.el6_9.2.x86_64.rpmdd9ff8e807b1cf27f60d3d011fc0a0a20051cda7f398646ec696a2b570da8d49ghostscript-gtk-8.70-23.el6_9.2.x86_64.rpmc46823f9caabeae96166b5a4abc59acf61566c260e2556be0720392800eb9152ghostscript-8.70-23.el6_9.2.i686.rpmedd23ed3c5c3160501c57a020fb028d50e6d96c10a9e6e99708696d5cd263edcghostscript-8.70-23.el6_9.2.x86_64.rpm18676e8cf4263a9237030d785458b8b6c20b9dd312099894416476fef0ccc358ghostscript-devel-8.70-23.el6_9.2.x86_64.rpma0925b72d06e4fcc103479e685901a3fc941e12bef32c5b0b0cc0a0557e6ad98SLSA-2017:1267-1Security Fix(es): * It was found that due to the way rpcbind uses libtirpc (libntirpc), a memory leak can occur when parsing specially crafted XDR messages. An attacker sending thousands of messages to rpcbind could cause its memory usage to grow without bound, eventually causing it to be terminated by the OOM killer. (CVE-2017-8779)importantScientific Linux FermiScientific Linux Fermi 6rpcbind-0.2.0-13.el6_9.x86_64.rpm5797f1fd0d32ff70d244826604781377830727e521555491414fe626969b3e9fSLSA-2017:1268-1Security Fix(es): * It was found that due to the way rpcbind uses libtirpc (libntirpc), a memory leak can occur when parsing specially crafted XDR messages. An attacker sending thousands of messages to rpcbind could cause its memory usage to grow without bound, eventually causing it to be terminated by the OOM killer. (CVE-2017-8779)importantScientific Linux FermiScientific Linux Fermi 6libtirpc-devel-0.2.1-13.el6_9.x86_64.rpm5848753bbfb108cb49fbfc69637850d722afed50f325b67f5bb5781cfa63e937libtirpc-0.2.1-13.el6_9.x86_64.rpm21374758246fc4eea3c5f2ca6e06a0ded433f1545351870797a80997fc220ed3libtirpc-0.2.1-13.el6_9.i686.rpm673b0dd782da045e1e013bd47f73ad01f66d95aca5118e470dff63ea35c28311libtirpc-devel-0.2.1-13.el6_9.i686.rpm4da519285cdc69064862f451b80aad849653f092b821989e379548946bf293cdSLSA-2017:1270-1Security Fix(es): * A remote code execution flaw was found in Samba. A malicious authenticated samba client, having write access to the samba share, could use this flaw to execute arbitrary code as root. (CVE-2017-7494)importantScientific Linux FermiScientific Linux Fermi 6samba-domainjoin-gui-3.6.23-43.el6_9.x86_64.rpm79e4393aef7f19f54ca376cbb449ba176c99bbc90c7a198553912dbada34d4f2libsmbclient-3.6.23-43.el6_9.i686.rpm36045e2dd5b21702320d4b72e9f0af22ac29c5680250d06c54f192bd486f468esamba-doc-3.6.23-43.el6_9.x86_64.rpm6a0df5ec8323a0d4a1ce0692fd29b47db5abd78f447a9ea84e118481ff5c8be6samba-3.6.23-43.el6_9.x86_64.rpm22be15714b6d058dd486f8ae6561d646d5167c1697867a91d534ea29bff80552samba-winbind-clients-3.6.23-43.el6_9.x86_64.rpm2df707911c1f85f765e03f4cc22e489406661ecc63d9db357fce5f376b0f880esamba-winbind-3.6.23-43.el6_9.x86_64.rpm576bb81a119ba19648767ef80413cc509a14e7287f00b9411bacc279aee6c443samba-client-3.6.23-43.el6_9.x86_64.rpm291e4468a900962938271b7581f0b0cfad43a2ada814e45a563eadfc4e2ff756samba-common-3.6.23-43.el6_9.x86_64.rpmb88d4b21a6fffae92831ae7e56cadb40072f1ce274fb3713acc024caf480b8d4libsmbclient-3.6.23-43.el6_9.x86_64.rpmbc18fa36d504a91e234d37f73de50e4127440ba54d8e3bfaa6a02ae69a08a9fflibsmbclient-devel-3.6.23-43.el6_9.x86_64.rpm350be06ec845e6d052c779a03b7486423feed093f089b7a0980490f4e830ab19samba-winbind-krb5-locator-3.6.23-43.el6_9.x86_64.rpm9710cfd0ac639610045846e75bd434fcade99bf14ae2c77e7e1fc93098898eecsamba-common-3.6.23-43.el6_9.i686.rpm90aa765cb2dace8f239e9c44f1bab699480c37fcf63e55075c41687d8a8b4ccfsamba-winbind-devel-3.6.23-43.el6_9.i686.rpm0c90057193778be53e1312e38c9dae2a58b52be4cd9431bd07c728e398d24901samba-winbind-devel-3.6.23-43.el6_9.x86_64.rpmcd1a83ad197dd8ccde0f462c30471da1951a03a5df5935587b8c64d8273b2cdbsamba-glusterfs-3.6.23-43.el6_9.x86_64.rpm4ff749060bf46a0db928a3110da8d1a2b7d45703c34ab27253825f08fd71f549samba-winbind-clients-3.6.23-43.el6_9.i686.rpmd6511ed0b340ebf232c3281794612d3a49aa910654be491cc3a1f78d5953be08samba-swat-3.6.23-43.el6_9.x86_64.rpm87b7423e134aaed7294bd26854bafd0412eb27eb62e51419fc5203452d468fc8libsmbclient-devel-3.6.23-43.el6_9.i686.rpm86e6d69a152889610144d8448772078da53bc421e15367aa3c36898f59b07fb7SLSA-2017:1271-1Security Fix(es): * A remote code execution flaw was found in Samba. A malicious authenticated samba client, having write access to the samba share, could use this flaw to execute arbitrary code as root. (CVE-2017-7494)importantScientific Linux FermiScientific Linux Fermi 6samba4-dc-libs-4.2.10-10.el6_9.x86_64.rpm0530a0f012a0aa19d8ea322a0990a344a9cf2eac1cccff43ce897077d3c76a96samba4-libs-4.2.10-10.el6_9.x86_64.rpm564d927d79e254e9ddb559043613c2c43007d0c019fbe7210188c458ec66bd9csamba4-devel-4.2.10-10.el6_9.x86_64.rpma99810a37dfdfc1bb80a7add8815e1f81fff2f56ed3278fb03f067162a5b1426samba4-test-4.2.10-10.el6_9.x86_64.rpmb941a5147de2902520b3344d1032a13e40c0093359aa734098f1b0b5f53d0164samba4-pidl-4.2.10-10.el6_9.x86_64.rpm4251bb4934d90dfaf83cc2b904c33af2e47b8bfc3fe6515c1d417c9adeb20e2esamba4-python-4.2.10-10.el6_9.x86_64.rpmd77c0e8c1dc99ec6ecd3d985cb92ef9bc698962deda4d7870fe2b080af58fed1samba4-winbind-clients-4.2.10-10.el6_9.x86_64.rpmb02ca462c41270296b42f0c29f3e378e1768757c9a652b9d4fd2032938e8287esamba4-common-4.2.10-10.el6_9.x86_64.rpm5b73ca8a361df1cd5975da901a2fe223a0e8534a932399b210ef159ea759f18fsamba4-winbind-krb5-locator-4.2.10-10.el6_9.x86_64.rpm87303057ff35f06d594478d94ae08586461b604bfdbf24c952b9aa7ffbc7c516samba4-winbind-4.2.10-10.el6_9.x86_64.rpmd1347a04299b255988f08666b9a49dc3ca8dd8c5c86f93077a961224eb88599fsamba4-client-4.2.10-10.el6_9.x86_64.rpmf69df3fe1c2494a0bd98dae2b2f13c1349e9ae61c41d539554e3d6d024f7958dsamba4-4.2.10-10.el6_9.x86_64.rpmbb0da22e20e04ea1bf0dbb3644988d63c2d71e5442a02453d3085866671773cbsamba4-dc-4.2.10-10.el6_9.x86_64.rpmac16dc6aa30e65bdd2e607c1df33448024821f0ed029ab8d021cdf1076598f3dSLSA-2017:1364-1Security Fix(es): * A null pointer dereference flaw was found in the way NSS handled empty SSLv2 messages. An attacker could use this flaw to crash a server application compiled against the NSS library. (CVE-2017-7502) Bug Fix(es): * The Network Security Services (NSS) code and Certificate Authority (CA) list have been updated to meet the recommendations as published with the latest Mozilla Firefox Extended Support Release (ESR). The updated CA list improves compatibility with the certificates that are used in the Internet Public Key Infrastructure (PKI). To avoid certificate validation refusals, consider installing the updated CA list on June 12, 2017.importantScientific Linux FermiScientific Linux Fermi 6nss-3.28.4-3.el6_9.i686.rpm940c84198fcb3cb475c933f37cde222d15063ac62f6d07ae2755573b1bc52a5anss-devel-3.28.4-3.el6_9.x86_64.rpme6a90545d7a9c80427f0d8229a2791af6adcce0a87de66c1f4a993afe1f36829nss-pkcs11-devel-3.28.4-3.el6_9.x86_64.rpmca75f4a29ce42abe3d729ed980b52144dbd7dfe295a03ce845102244958680c4nss-devel-3.28.4-3.el6_9.i686.rpmb1866c36523619b7f0b6e2d01029b4102c185368fa29fcd9bf9fb5adab41956dnss-pkcs11-devel-3.28.4-3.el6_9.i686.rpm7e7b4c5e7627985d759cda289ab28108389fb43545d4192b9aaf41a3b282e939nss-tools-3.28.4-3.el6_9.x86_64.rpm01a18bb1a846a306caf929e37dc8bef9e492d6ab092794be346ed6930bee5badnss-3.28.4-3.el6_9.x86_64.rpm1c347362013c0ec20560a538bf0599574fdb74f43f6e1c5cf22698780eb8ac3anss-sysinit-3.28.4-3.el6_9.x86_64.rpm965d0c4a746ad84e638a1a4de535167677110b7a8bad7801db2d3b4ce6cbd76eSLSA-2017:1372-1Security Fix(es): * A flaw was found in the Linux kernel's handling of packets with the URG flag. Applications using the splice() and tcp_splice_read() functionality can allow a remote attacker to force the kernel to enter a condition in which it can loop indefinitely. (CVE-2017-6214, Moderate) Bug Fix(es): * When executing certain Hadoop jobs, a kernel panic occasionally occurred on multiple nodes of a cluster. This update fixes the kernel scheduler, and the kernel panic no longer occurs under the described circumstances. * Previously, memory leak of the struct cred data structure and related data structures occasionally occurred. Consequently, system performance was suboptimal with the symptoms of high I/O operations wait and small amount of free memory. This update fixes the reference counter of the struct slab cache to no longer cause imbalance between the calls to the get_cred() function and the put_cred() function. As a result, the memory leak no longer occurs under the described circumstances. * Previously, the be2net driver could not detect the link status properly on IBM Power Systems. Consequently, the link status was always reported as disconnected. With this update, be2net has been fixed, and the Network Interface Cards (NICs) now report the link status correctly. * Previously, the RFF_ID and RFT_ID commands in the lpfc driver were issued in an incorrect order. Consequently, users were not able to access Logical Unit Numbers (LUNs). With this update, lpfc has been fixed to issue RFT_ID before RFF_ID, which is the correct order. As a result, users can now access LUNs as expected. * Previously, the kdump mechanism was trying to get the lock by the vmalloc_sync_all() function during a kernel panic. Consequently, a deadlock occurred, and the crashkernel did not boot. This update fixes the vmalloc_sync_all() function to avoid synchronizing the vmalloc area on the crashing CPU. As a result, the crashkernel parameter now boots as expected, and the kernel dump is collected successfully under the described circumstances.moderateScientific Linux FermiScientific Linux Fermi 6perf-2.6.32-696.3.1.el6.x86_64.rpm5ec91499eb2b65e8b4f6d6808b9c3a0a4a50f904809d09ed50c0d10f7f2330ackernel-debug-devel-2.6.32-696.3.1.el6.i686.rpmacf128c56cf7a31c4fb9e4369501f3ebc1400e5332b0dbf6df235da8cf7bd4bfkernel-abi-whitelists-2.6.32-696.3.1.el6.noarch.rpm683a058363b16779571de85ae065c7c60f5af8624324c1a70bb0f7fccd5f7852kernel-doc-2.6.32-696.3.1.el6.noarch.rpm794b66a512de1cad923e8b0e7a37c67dd111a401da93a3f6b7ececed26226e15kernel-debug-2.6.32-696.3.1.el6.x86_64.rpmfabd88bd90aa44dc65bba150719253fe01e7c7439cabfe173128931e49e3e416kernel-debug-devel-2.6.32-696.3.1.el6.x86_64.rpm6a0356eb6887f6565e2ec17cb740888fab9289ada3994c54b4e7fc82dcb6b752python-perf-2.6.32-696.3.1.el6.x86_64.rpm9b95ae347f85ecfb7a9ea56b3999144a1c195f7a3a8996368282e42f5e4cbcfakernel-headers-2.6.32-696.3.1.el6.x86_64.rpmbd48e209a5d6ed6107c0a90239def4f802cd8a50d2af5e32a198aaf9dad4459ckernel-firmware-2.6.32-696.3.1.el6.noarch.rpmf54db38dee3a387fb1dd12286c3ef1d803d4b04c3aabb8ed933dc8c1cc3bb536kernel-devel-2.6.32-696.3.1.el6.x86_64.rpmbbc7b178d7ba7f7dbc9ca2099d16372d066d3510cab79a22d305571b95b91c76kernel-2.6.32-696.3.1.el6.x86_64.rpmf86dbc5f1360b1d484db2dd964c6b2d5e2dbfb7974feda49350568ab7ce8dfd0SLSA-2017:1382-1Security Fix(es): * A flaw was found in the way sudo parsed tty information from the process status file in the proc filesystem. A local user with privileges to execute commands via sudo could use this flaw to escalate their privileges to root. (CVE-2017-1000367)importantScientific Linux FermiScientific Linux Fermi 6sudo-devel-1.8.6p3-28.el6_9.x86_64.rpm32a7d3788d4b89a0a668ddcc6b70d33fc2071d5d6f4bf25920f9684dabce9b2csudo-1.8.6p3-28.el6_9.x86_64.rpm41bac38beb0b8d598ef03580c1db289e5b25b18265dcc91cb9387c2844ee4ccasudo-devel-1.8.6p3-28.el6_9.i686.rpmd2c6c906d65f024de1d046ca8d7b74bc53dc6db16dd1975bf30eaeb67c08df46SLSA-2017:1440-1This update upgrades Firefox to version 52.2.0 ESR. Security Fix(es): * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2017-5470, CVE-2017-5472, CVE-2017-7749, CVE-2017-7751, CVE-2017-7756, CVE-2017-7771, CVE-2017-7772, CVE-2017-7773, CVE-2017-7774, CVE-2017-7775, CVE-2017-7776, CVE-2017-7777, CVE-2017-7778, CVE-2017-7750, CVE-2017-7752, CVE-2017-7754, CVE-2017-7757, CVE-2017-7758, CVE-2017-7764)criticalScientific Linux FermiScientific Linux Fermi 6firefox-52.2.0-1.el6_9.x86_64.rpm3675ee6553aa5a3f00889ed0613d320e406e81edc129b89c0c9ee93bc0579d28firefox-52.2.0-1.el6_9.i686.rpmabe4597ec5e1d5972051d961c2278f4ca0ace5bd506fe20ab21dcdf7057b080cSLSA-2017:1480-1Security Fix(es): * A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap (or different memory region) and stack memory regions were adjacent to each other, an attacker could use this flaw to jump over the stack guard gap, cause controlled memory corruption on process stack or the adjacent memory region, and thus increase their privileges on the system. This is glibc-side mitigation which blocks processing of LD_LIBRARY_PATH for programs running in secure-execution mode and reduces the number of allocations performed by the processing of LD_AUDIT, LD_PRELOAD, and LD_HWCAP_MASK, making successful exploitation of this issue more difficult. (CVE-2017-1000366)importantScientific Linux FermiScientific Linux Fermi 6glibc-static-2.12-1.209.el6_9.2.x86_64.rpm53d86e8181145e718501feadb0a93e68791c825f2c368e89cc4feaf4cd80c909glibc-2.12-1.209.el6_9.2.i686.rpm2879a6d162ef5ee2ad14c6d2efd95e7bc52cecb037f2d5f49d9f20f61fdd3868glibc-static-2.12-1.209.el6_9.2.i686.rpm5600e76f459cbe3e393ae7a2c65ec1ca71135b4668f2f6245c45d1bf36987c85glibc-devel-2.12-1.209.el6_9.2.x86_64.rpma22ebf96ec23d52dc58ef5bdd58ec568d81d2c3b83a2c715498b939983e5e5b6glibc-devel-2.12-1.209.el6_9.2.i686.rpm649668f2da4e931cc2faedfe0d2ec69dc6ce7ff4c752f74e794f97a8de066bbbglibc-utils-2.12-1.209.el6_9.2.x86_64.rpm710bc752f7003fef8b44b26ee2c48386a9161675c6d00d22fc809f4aee3177banscd-2.12-1.209.el6_9.2.x86_64.rpm83b9c1a5df9eb158c4f8fd2aadb3e4768981cb25370514b0134483c848c9a99fglibc-2.12-1.209.el6_9.2.x86_64.rpmb169831dd220d522db5538e848f9dff7ae4c498dc1927f893741472e29e5ddb3glibc-headers-2.12-1.209.el6_9.2.x86_64.rpm6fe6a635ebaecfcc36f26a0dec926a406f347421b4cf1db8705d41625ee4b9bbglibc-common-2.12-1.209.el6_9.2.x86_64.rpm7a1f0533c84aa9c090fb60a65618267282a836031731402f1be66924b5144dc1SLSA-2017:1486-1Security Fix(es): * A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap (or different memory region) and stack memory regions were adjacent to each other, an attacker could use this flaw to jump over the stack guard gap, cause controlled memory corruption on process stack or the adjacent memory region, and thus increase their privileges on the system. This is a kernel-side mitigation which increases the stack guard gap size from one page to 1 MiB to make successful exploitation of this issue more difficult. (CVE-2017-1000364, Important)importantScientific Linux FermiScientific Linux Fermi 6kernel-doc-2.6.32-696.3.2.el6.noarch.rpmd4278db0a1770006bc79d268bec9eb12a67cde174c4956eb8bd1966f5dee59e0python-perf-2.6.32-696.3.2.el6.x86_64.rpm4ef7ded449dd41d5180877d5c4622cd8116f4e803a1ae2ef631dfa0748dd551dkernel-devel-2.6.32-696.3.2.el6.x86_64.rpmb4122ca466f38c72fe4dd8d3baa16b28603443250d084763c8f1e62d8428ac5aperf-2.6.32-696.3.2.el6.x86_64.rpm11fadaec5369bfd9fa3b0c45cb3792626d340752f5bb9c7146c8820025b979f0kernel-abi-whitelists-2.6.32-696.3.2.el6.noarch.rpm3567a866bc5265483c14065a7f3d0b67dff9989351f1040f3c2ac4ed752324fdkernel-debug-devel-2.6.32-696.3.2.el6.x86_64.rpmc3a280df754bc3680ad8cab88ec3694ecf12e691829b8b5420099557d798783fkernel-headers-2.6.32-696.3.2.el6.x86_64.rpm0a56b143e64c05cc3cfb1a25d5a7f14ab2a06655528f0aa081f79c3dc7769bb3kernel-debug-devel-2.6.32-696.3.2.el6.i686.rpmc1ad349d10953758e9718cffacad19c3653ce42f0aaa8e0dc6b18c612d63a51ckernel-2.6.32-696.3.2.el6.x86_64.rpma5b23b1b8538f73723677876aa632dc79f94de30fcbf001eb6b2dab6eb0c86f6kernel-firmware-2.6.32-696.3.2.el6.noarch.rpmdfc8a64b1f5db453560506f2fc67d398d837cd5b8c46c9faaeb3d2762547ff6bkernel-debug-2.6.32-696.3.2.el6.x86_64.rpmbb0ba1e08436b2a9ef38f68119466f941fc7dd93e438fb36547921eab0590b71SLSA-2017:1561-1This update upgrades Thunderbird to version 52.2.0. Security Fix(es): * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2017-5470, CVE-2017-5472, CVE-2017-7749, CVE-2017-7750, CVE-2017-7751, CVE-2017-7756, CVE-2017-7771, CVE-2017-7772, CVE-2017-7773, CVE-2017-7774, CVE-2017-7775, CVE-2017-7776, CVE-2017-7777, CVE-2017-7778, CVE-2017-7752, CVE-2017-7754, CVE-2017-7757, CVE-2017-7758, CVE-2017-7764)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-52.2.0-1.el6_9.x86_64.rpm366cb3e9de88037c77f2e2444dd57df66160f6695224694d8fb117ae1e8d5c7eSLSA-2017:1574-1Security Fix(es): * It was found that the original fix for CVE-2017-1000367 was incomplete. A flaw was found in the way sudo parsed tty information from the process status file in the proc filesystem. A local user with privileges to execute commands via sudo could use this flaw to escalate their privileges to root. (CVE-2017-1000368)moderateScientific Linux FermiScientific Linux Fermi 6sudo-1.8.6p3-29.el6_9.x86_64.rpm88cc9cc9e5c3aacf934f90e78562c749310ee6114bd69b25e7eb1aec28386460sudo-devel-1.8.6p3-29.el6_9.i686.rpmefe6b03ba8feb43d659f2d2941094ee653b38a0014e0342c0e23f95a26c55594sudo-devel-1.8.6p3-29.el6_9.x86_64.rpm05d7a3d2fedcfca7dd80c4243cf0f688ae9e85fb84e44285cf5186223696be5bSLSA-2017:1576-1Security Fix(es): * A flaw was found in the way "hg serve --stdio" command in Mercurial handled command-line options. A remote, authenticated attacker could use this flaw to execute arbitrary code on the Mercurial server by using specially crafted command-line options. (CVE-2017-9462)importantScientific Linux FermiScientific Linux Fermi 6mercurial-1.4-5.el6_9.x86_64.rpm2525a59f18d894548e8bc571aab08e74a7b87c5f8b78a0883db9f7cda586bdccmercurial-hgk-1.4-5.el6_9.x86_64.rpmc068a76bf8bb55350fbdd76312ee50bde4b2b761773eb364f780cba09c6505c7emacs-mercurial-el-1.4-5.el6_9.x86_64.rpm27bf5a95d9ce6440298a0bbce2eea1eb47b279f3e869446cb93d6cceab818ea7emacs-mercurial-1.4-5.el6_9.x86_64.rpme77710754ce14935c953bdd1db945bb363d53d96ed1bd44441aa7ad665544e0fSLSA-2017:1679-1Security Fix(es): * A flaw was found in the way BIND handled TSIG authentication for dynamic updates. A remote attacker able to communicate with an authoritative BIND server could use this flaw to manipulate the contents of a zone, by forging a valid TSIG or SIG(0) signature for a dynamic update request. (CVE-2017-3143) * A flaw was found in the way BIND handled TSIG authentication of AXFR requests. A remote attacker, able to communicate with an authoritative BIND server, could use this flaw to view the entire contents of a zone by sending a specially constructed request packet. (CVE-2017-3142) Bug Fix(es): * ICANN is planning to perform a Root Zone DNSSEC Key Signing Key (KSK) rollover during October 2017. Maintaining an up-to-date KSK, by adding the new root zone KSK, is essential for ensuring that validating DNS resolvers continue to function following the rollover.importantScientific Linux FermiScientific Linux Fermi 6bind-sdb-9.8.2-0.62.rc1.el6_9.4.x86_64.rpma1baa68e61665963fcd4a1e729c16c360dc398f082947b5995cdd4748d035a56bind-libs-9.8.2-0.62.rc1.el6_9.4.i686.rpm2454c0d0285180ad8ca8372e62b55b07481136101654fda9188eeee5f0ec8873bind-chroot-9.8.2-0.62.rc1.el6_9.4.x86_64.rpmd4d21d70411345dac79f0c39a6fe7f8d3e7189b8be7c866f9e9c5ea37d668e82bind-libs-9.8.2-0.62.rc1.el6_9.4.x86_64.rpm6b84dbe84794bef39ab8628d5a0887d03d8b3ae8d6a2a9d15ac3d74678ae8d07bind-9.8.2-0.62.rc1.el6_9.4.x86_64.rpm51f87c1808461187998b7b4a17ebedb0599a40bccd5eb1388e5d1f5b13177cd7bind-utils-9.8.2-0.62.rc1.el6_9.4.x86_64.rpm3003c03266608f748eee9d7570f491890bb85251b5dae5cff46acd33eb8c3179bind-devel-9.8.2-0.62.rc1.el6_9.4.x86_64.rpmadc1a5e462373f2886e026aa81ce453f53f66faba487a9cdb48f10c03050cd22bind-devel-9.8.2-0.62.rc1.el6_9.4.i686.rpm82626875853d1935405e18ae07d07485c4c79eb7697f58bd76ecf02246e30e42SLSA-2017:1721-1Security Fix(es): * It was discovered that the HTTP parser in httpd incorrectly allowed certain characters not permitted by the HTTP protocol specification to appear unencoded in HTTP request headers. If httpd was used in conjunction with a proxy or backend server that interpreted those characters differently, a remote attacker could possibly use this flaw to inject data into HTTP responses, resulting in proxy cache poisoning. (CVE-2016-8743) Note: The fix for the CVE-2016-8743 issue causes httpd to return "400 Bad Request" error to HTTP clients which do not strictly follow HTTP protocol specification. A newly introduced configuration directive "HttpProtocolOptions Unsafe" can be used to re-enable the old less strict parsing. However, such setting also re-introduces the CVE-2016-8743 issue. Bug Fix(es): * Previously, httpd was unable to correctly check a boundary of an array, and in rare cases it attempted to access an element of an array that was out of bounds. Consequently, httpd terminated unexpectedly with a segmentation fault at proxy_util.c. With this update, bounds checking has been fixed, and httpd no longer crashes.moderateScientific Linux FermiScientific Linux Fermi 6httpd-devel-2.2.15-60.sl6.4.i686.rpm03fa344fe3f011171803b6c899275a6f4e6b232b8dd4a78f346361a34ce90651httpd-devel-2.2.15-60.sl6.4.x86_64.rpm3e8d7833d156dbb17d7121b1228430799011869ea85b9b35b2b2d95323f79036httpd-2.2.15-60.sl6.4.x86_64.rpm0fd3a0f06d047606778ac7b19333e32d94ed5f0ff07111bd905ee4f026de6993mod_ssl-2.2.15-60.sl6.4.x86_64.rpm88680a0c7835c3c9a1f44db0ba5521906a73470c5d6698de19199033cdd1d8a1httpd-manual-2.2.15-60.sl6.4.noarch.rpm7b92fb6e1e3f4c3c243d028da0aa8412d23b4dfcadc2c3ce6dc8b2aa328ff0dfhttpd-tools-2.2.15-60.sl6.4.x86_64.rpm838dfe7b46090bac44123def99f7cb9b554614b5fc799f5740c9f302dafca5daSLSA-2017:1723-1Security Fix(es): * The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lacked certain checks for the end of a buffer. A remote attacker could trigger a pointer-arithmetic error or possibly cause other unspecified impacts using crafted requests related to fs/nfsd/nfs3xdr.c and fs/nfsd/nfsxdr.c. (CVE-2017-7895, Important) Bug Fix(es): * If several file operations were started after a mounted NFS share had got idle and its Transmission Control Protocol (TCP) connection had therefore been terminated, these operations could cause multiple TCP SYN packets coming from the NFS client instead of one. With this update, the reconnection logic has been fixed, and only one TCP SYN packet is now sent in the described situation. * When the ixgbe driver was loaded for a backplane-connected network card, a kernel panic could occur, because the ops.setup_fc function pointer was used before the initialization. With this update, ops.setup_fc is initialized earlier. As a result, ixgbe no longer panics on load. * When setting an Access Control List (ACL) with 190 and more Access Control Entries (ACEs) on a NFSv4 directory, a kernel crash could previously occur. This update fixes the nfs4_getfacl() function, and the kernel no longer crashes under the described circumstances. * When upgrading to kernel with the fix for stack guard flaw, a crash could occur in Java Virtual Machine (JVM) environments, which attempted to implement their own stack guard page. With this update, the underlying source code has been fixed to consider the PROT_NONE mapping as a part of the stack, and the crash in JVM no longer occurs under the described circumstances. * When a program receives IPv6 packets using the raw socket, the ioctl(FIONREAD) and ioctl(SIOCINQ) functions can incorrectly return zero waiting bytes. This update fixes the ip6_input_finish() function to check the raw payload size properly. As a result, the ioctl() function now returns bytes waiting in the raw socket correctly. * Previously, listing a directory on a non-standard XFS filesystem (with non-default multi-fsb directory blocks) could lead to a soft lock up due to array index overrun in the xfs_dir2_leaf_readbuf() function. This update fixes xfs_dir2_leaf_readbuf(), and the soft lock up no longer occurs under the described circumstances. * Previously, aborts from the array after the Storage Area Network (SAN) fabric back-pressure led to premature reuse of still valid sequence with the same OX_ID. Consequently, an error message and data corruption could occur. This update fixes the libfc driver to isolate the timed out OX_IDs, thus fixing this bug. * Previously, a kernel panic occurred when the mcelog daemon executed a huge page memory offline. This update fixes the HugeTLB feature of the Linux kernel to check for the Page Table Entry (PTE) NULL pointer in the page_check_address() function. As a result, the kernel panic no longer occurs under the described circumstances.importantScientific Linux FermiScientific Linux Fermi 6kernel-doc-2.6.32-696.6.3.el6.noarch.rpm019f193d68652c61bc6b27688c42ea3351e25697123e80177f92d53d6205bb88python-perf-2.6.32-696.6.3.el6.x86_64.rpmeb72737767f7bc7674cb01a399c3fa831329fc62b44cb5387cc03419d1e74272kernel-debug-devel-2.6.32-696.6.3.el6.x86_64.rpmd5a477639e214a775f98298352c5d52f732bbaa781cfaa731d160ad37082d1c6kernel-abi-whitelists-2.6.32-696.6.3.el6.noarch.rpm59740baee481bd15f0d3a56065838dee04694822d164aeacb8e941b2070ce96dkernel-debug-2.6.32-696.6.3.el6.x86_64.rpmbb058ab36c933de7785965b74079d28d6e56aa6cfe1c1732a33942fa0b7fe4d6perf-2.6.32-696.6.3.el6.x86_64.rpm03af5752105d9fae8167c5a0ec7036f1de75c2c8ec9edf5bcb22c2ddaa913f68kernel-debug-devel-2.6.32-696.6.3.el6.i686.rpme365b975854fa172e36c48af77f3f1b1fb6bbcf67672b304b9d2b828fb1767f2kernel-firmware-2.6.32-696.6.3.el6.noarch.rpm9b8bfe574c3d0ab35c79b62c1f70699b0e98d3e99f57bc15527ca8007bdae1dfkernel-headers-2.6.32-696.6.3.el6.x86_64.rpm9bfffb75565bd90ff7feb75e5f0121ce4054e85aa827104057267e07b51282a2kernel-devel-2.6.32-696.6.3.el6.x86_64.rpm780ff32321e5806799f765d814eeb703fee476f14e04121c92bb3798ed5ab67dkernel-2.6.32-696.6.3.el6.x86_64.rpme4f070873c78f8e0126aecce7a36cc0d466b1c5846aa2afef2d8fd8616e77ce6SLSA-2017:1759-1Security Fix(es): * An out-of-bounds write flaw was found in the way FreeRADIUS server handled certain attributes in request packets. A remote attacker could use this flaw to crash the FreeRADIUS server or to execute arbitrary code in the context of the FreeRADIUS server process by sending a specially crafted request packet. (CVE-2017-10979) * An out-of-bounds read and write flaw was found in the way FreeRADIUS server handled RADIUS packets. A remote attacker could use this flaw to crash the FreeRADIUS server by sending a specially crafted RADIUS packet. (CVE-2017-10978) * Multiple memory leak flaws were found in the way FreeRADIUS server handled decoding of DHCP packets. A remote attacker could use these flaws to cause the FreeRADIUS server to consume an increasing amount of memory resources over time, possibly leading to a crash due to memory exhaustion, by sending specially crafted DHCP packets. (CVE-2017-10980, CVE-2017-10981) * Multiple out-of-bounds read flaws were found in the way FreeRADIUS server handled decoding of DHCP packets. A remote attacker could use these flaws to crash the FreeRADIUS server by sending a specially crafted DHCP request. (CVE-2017-10982, CVE-2017-10983)importantScientific Linux FermiScientific Linux Fermi 6freeradius-mysql-2.2.6-7.el6_9.x86_64.rpm01ef8fd471b85c58ae6b56d0e1e3ca1fb2b62529e3a652e3784c19e2cda150e2freeradius-krb5-2.2.6-7.el6_9.x86_64.rpm28f737fe61833aa7d983540fdcce5859002dc3620afe00b865a0b6197b677489freeradius-ldap-2.2.6-7.el6_9.x86_64.rpm1eb961cf44f93d211123a9271390a801c24ae534acbbd48547d12407bed421cefreeradius-2.2.6-7.el6_9.x86_64.rpmabcc95e5053330ae9fb91d24eac9623146501d38ced38d44caeaca70ef6df75cfreeradius-python-2.2.6-7.el6_9.x86_64.rpme1aff379a2230b82ff5e2a19653f360cafc275b69d800a73a3f265c8d56485cdfreeradius-utils-2.2.6-7.el6_9.x86_64.rpm033b3f06d08a751bf677edad737f5de379a6d1910c54878d5c9d2b4b74e1f33efreeradius-postgresql-2.2.6-7.el6_9.x86_64.rpm975d5cb799149bfbcb7ae83beab48c363b7e0c02124cd806db71f3d505491ed7freeradius-unixODBC-2.2.6-7.el6_9.x86_64.rpmabe332f75e432c2c796319f8b3b2dfde67352f85521d3cc20dbbd4f02fac5369freeradius-perl-2.2.6-7.el6_9.x86_64.rpme82e7bddfce542702b04f8968ce0483fa7a9c60a66a5d3e5a9537661bae24411SLSA-2017:1789-1Security Fix(es): * It was discovered that the DCG implementation in the RMI component of OpenJDK failed to correctly handle references. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of RMI registry or a Java RMI application. (CVE-2017-10102) * Multiple flaws were discovered in the RMI, JAXP, ImageIO, Libraries, AWT, Hotspot, and Security components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions. (CVE-2017-10107, CVE-2017-10096, CVE-2017-10101, CVE-2017-10089, CVE-2017-10090, CVE-2017-10087, CVE-2017-10111, CVE-2017-10110, CVE-2017-10074, CVE-2017-10067) * It was discovered that the LDAPCertStore class in the Security component of OpenJDK followed LDAP referrals to arbitrary URLs. A specially crafted LDAP referral URL could cause LDAPCertStore to communicate with non-LDAP servers. (CVE-2017-10116) * It was discovered that the Nashorn JavaScript engine in the Scripting component of OpenJDK could allow scripts to access Java APIs even when access to Java APIs was disabled. An untrusted JavaScript executed by Nashorn could use this flaw to bypass intended restrictions. (CVE-2017-10078) * It was discovered that the Security component of OpenJDK could fail to properly enforce restrictions defined for processing of X.509 certificate chains. A remote attacker could possibly use this flaw to make Java accept certificate using one of the disabled algorithms. (CVE-2017-10198) * A covert timing channel flaw was found in the DSA implementation in the JCE component of OpenJDK. A remote attacker able to make a Java application generate DSA signatures on demand could possibly use this flaw to extract certain information about the used key via a timing side channel. (CVE-2017-10115) * A covert timing channel flaw was found in the PKCS#8 implementation in the JCE component of OpenJDK. A remote attacker able to make a Java application repeatedly compare PKCS#8 key against an attacker controlled value could possibly use this flaw to determine the key via a timing side channel. (CVE-2017-10135) * It was discovered that the BasicAttribute and CodeSource classes in OpenJDK did not limit the amount of memory allocated when creating object instances from a serialized form. A specially crafted serialized input stream could cause Java to consume an excessive amount of memory. (CVE-2017-10108, CVE-2017-10109) * Multiple flaws were found in the Hotspot and Security components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2017-10081, CVE-2017-10193) * It was discovered that the JPEGImageReader implementation in the 2D component of OpenJDK would, in certain cases, read all image data even if it was not used later. A specially crafted image could cause a Java application to temporarily use an excessive amount of CPU and memory. (CVE-2017-10053) Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website.criticalScientific Linux FermiScientific Linux Fermi 6java-1.8.0-openjdk-1.8.0.141-2.b16.el6_9.x86_64.rpm21e725c57feb16c2a83201f41a325191b77cc92d62c5a5dc6143b0c030469e14java-1.8.0-openjdk-headless-debug-1.8.0.141-2.b16.el6_9.x86_64.rpm29813d80a2cf45773b09fb180a4a69232b62cb1256b167033cedc77f0ed1fd79java-1.8.0-openjdk-src-1.8.0.141-2.b16.el6_9.x86_64.rpma0a142f4fc20c91a28b92675865bd8f963700c510a9bcf4bb671b9d221fbb284java-1.8.0-openjdk-demo-1.8.0.141-2.b16.el6_9.x86_64.rpm903e8cd19c1dfb85f23e93907fd18f1f509d298dff217ecf664c00de18254ed1java-1.8.0-openjdk-debug-1.8.0.141-2.b16.el6_9.x86_64.rpm0ab6541ee7ba2255656234ca37c7e653ab0a2f5513fc3299685919ccad881530java-1.8.0-openjdk-demo-debug-1.8.0.141-2.b16.el6_9.x86_64.rpm9de30e5a42d8d2ab84d03203d1fcd1c511ea5c40c3889d3def40c55933497cf5java-1.8.0-openjdk-devel-debug-1.8.0.141-2.b16.el6_9.x86_64.rpm61019a0a484e19b483db129f1c5ece7f0927c5eaa1905f23e12bee3b51aebd5fjava-1.8.0-openjdk-javadoc-debug-1.8.0.141-2.b16.el6_9.noarch.rpm794ba7f05c7b6d58f930c97c5b28eaba76d889e7492726ce452fbc77fbcac6efjava-1.8.0-openjdk-src-debug-1.8.0.141-2.b16.el6_9.x86_64.rpm08fbf256be7f38dcdc10a6677261eb92b4c05cededc03f1608b1120cea0868d3java-1.8.0-openjdk-javadoc-1.8.0.141-2.b16.el6_9.noarch.rpmf5276bae78af56c2eadfde442ab3f5f2859aac229815e8e7c507b381517a8eacjava-1.8.0-openjdk-devel-1.8.0.141-2.b16.el6_9.x86_64.rpmec0df78d0e2b036a4c74db5d8dbb93156cde5a2ded040c42b61fbb51859ff996java-1.8.0-openjdk-headless-1.8.0.141-2.b16.el6_9.x86_64.rpm49315ac410c972715ae23d6f33229536760b3bbcc2630930a8d02660fd204f30SLSA-2017:2424-1Security Fix(es): * It was discovered that the DCG implementation in the RMI component of OpenJDK failed to correctly handle references. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of RMI registry or a Java RMI application. (CVE-2017-10102) * Multiple flaws were discovered in the RMI, JAXP, ImageIO, Libraries, AWT, Hotspot, and Security components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions. (CVE-2017-10107, CVE-2017-10096, CVE-2017-10101, CVE-2017-10089, CVE-2017-10090, CVE-2017-10087, CVE-2017-10110, CVE-2017-10074, CVE-2017-10067) * It was discovered that the LDAPCertStore class in the Security component of OpenJDK followed LDAP referrals to arbitrary URLs. A specially crafted LDAP referral URL could cause LDAPCertStore to communicate with non-LDAP servers. (CVE-2017-10116) * It was discovered that the wsdlimport tool in the JAX-WS component of OpenJDK did not use secure XML parser settings when parsing WSDL XML documents. A specially crafted WSDL document could cause wsdlimport to use an excessive amount of CPU and memory, open connections to other hosts, or leak information. (CVE-2017-10243) * A covert timing channel flaw was found in the DSA implementation in the JCE component of OpenJDK. A remote attacker able to make a Java application generate DSA signatures on demand could possibly use this flaw to extract certain information about the used key via a timing side channel. (CVE-2017-10115) * A covert timing channel flaw was found in the PKCS#8 implementation in the JCE component of OpenJDK. A remote attacker able to make a Java application repeatedly compare PKCS#8 key against an attacker controlled value could possibly use this flaw to determine the key via a timing side channel. (CVE-2017-10135) * It was discovered that the BasicAttribute and CodeSource classes in OpenJDK did not limit the amount of memory allocated when creating object instances from a serialized form. A specially crafted serialized input stream could cause Java to consume an excessive amount of memory. (CVE-2017-10108, CVE-2017-10109) * A flaw was found in the Hotspot component in OpenJDK. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. (CVE-2017-10081) * It was discovered that the JPEGImageReader implementation in the 2D component of OpenJDK would, in certain cases, read all image data even if it was not used later. A specially crafted image could cause a Java application to temporarily use an excessive amount of CPU and memory. (CVE-2017-10053)criticalScientific Linux FermiScientific Linux Fermi 6java-1.7.0-openjdk-src-1.7.0.151-2.6.11.0.el6_9.x86_64.rpme879707abd8c8b5a4720c21dddd736a94934a81376e346be7969db2e7c7c295djava-1.7.0-openjdk-javadoc-1.7.0.151-2.6.11.0.el6_9.noarch.rpmd4d32441041b1eac71510bd2b9ad86ca681654ff613c2adfac682744786f4f18java-1.7.0-openjdk-1.7.0.151-2.6.11.0.el6_9.x86_64.rpm6eda53fe606b203b47b03159cba3a295bf1b90f614297fdcba568c47c3a4e454java-1.7.0-openjdk-devel-1.7.0.151-2.6.11.0.el6_9.x86_64.rpm47b9e486461c12bcef023640f39b0f4c2c4bf22a5b292d96e357edf4168df182java-1.7.0-openjdk-demo-1.7.0.151-2.6.11.0.el6_9.x86_64.rpm7a7524c372da19150c83c559d6bd52b6ecfaef458b3820e7423c1693ada54364SLSA-2017:2456-1This update upgrades Firefox to version 52.3.0 ESR. Security Fix(es): * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2017-7779, CVE-2017-7798, CVE-2017-7800, CVE-2017-7801, CVE-2017-7753, CVE-2017-7784, CVE-2017-7785, CVE-2017-7786, CVE-2017-7787, CVE-2017-7792, CVE-2017-7802, CVE-2017-7807, CVE-2017-7809, CVE-2017-7791, CVE-2017-7803)criticalScientific Linux FermiScientific Linux Fermi 6firefox-52.3.0-3.el6_9.x86_64.rpmd507be75db5cec2db21aa112cf1e2d4a727b668be66ad9dc8941d1e549656e8bfirefox-52.3.0-3.el6_9.i686.rpm08a111757cf923ec9a076cb91eddfa426e65197f4c7dc5878906ae04c2231008SLSA-2017:2478-1Security Fix(es): * It was discovered that the httpd's mod_auth_digest module did not properly initialize memory before using it when processing certain headers related to digest authentication. A remote attacker could possibly use this flaw to disclose potentially sensitive information or cause httpd child process to crash by sending specially crafted requests to a server. (CVE-2017-9788) * It was discovered that the use of httpd's ap_get_basic_auth_pw() API function outside of the authentication phase could lead to authentication bypass. A remote attacker could possibly use this flaw to bypass required authentication if the API was used incorrectly by one of the modules used by httpd. (CVE-2017-3167) * A NULL pointer dereference flaw was found in the httpd's mod_ssl module. A remote attacker could use this flaw to cause an httpd child process to crash if another module used by httpd called a certain API function during the processing of an HTTPS request. (CVE-2017-3169) * A buffer over-read flaw was found in the httpd's mod_mime module. A user permitted to modify httpd's MIME configuration could use this flaw to cause httpd child process to crash. (CVE-2017-7679)importantScientific Linux FermiScientific Linux Fermi 6httpd-tools-2.2.15-60.sl6.5.x86_64.rpm77085caf6c98063d4e8c8fc2af9ba152914c0e937a1b588c846b6fef272c5f7chttpd-2.2.15-60.sl6.5.x86_64.rpm778506534edbc2cf7454bc0a533f688d96b86d34d297123ec0e711c8aa4c3ce0httpd-manual-2.2.15-60.sl6.5.noarch.rpmd03ca4fc6e03e40ea424387af2958d6ad01ef200f9436a9b5477c955c2caebc0httpd-devel-2.2.15-60.sl6.5.x86_64.rpmfd1d67b5269a7c8de0bda51cef4182214abf9e260dd6100f1dcba9d9f3c7d781httpd-devel-2.2.15-60.sl6.5.i686.rpm137c1093c87f3de665495ed007f85252257201e99dc9ebb20f62c3f0ae11cc51mod_ssl-2.2.15-60.sl6.5.x86_64.rpm8c87d9a32002987377788f5a5d81ada2de39af3d34c8fbd97367c7323c4e9eebSLSA-2017:2485-1Security Fix(es): * A shell command injection flaw related to the handling of "ssh" URLs has been discovered in Git. An attacker could use this flaw to execute shell commands with the privileges of the user running the Git client, for example, when performing a "clone" action on a malicious repository or a legitimate repository containing a malicious commit. (CVE-2017-1000117)importantScientific Linux FermiScientific Linux Fermi 6gitweb-1.7.1-9.el6_9.noarch.rpm156ee25ee26379f29336ae5169ac2eb6325953c7c644daaac89be7995925059cgitk-1.7.1-9.el6_9.noarch.rpm0816ee686d718b9a5c815cb3c562d16912734e395cdcfb1bc3cc05bfa30f065dgit-gui-1.7.1-9.el6_9.noarch.rpmff376cf7dc5f042c35046d308767d7454f2e146741eb7a5e1c4add5600ffc1f3git-daemon-1.7.1-9.el6_9.x86_64.rpm38315710f0573b3155c4ffe2dcaab85af6b3df5e56a91ed28737f35e8760d142perl-Git-1.7.1-9.el6_9.noarch.rpmafced2cc89763349fe540271abef9c11c526e6816c379c684dfbedec70a334f5git-svn-1.7.1-9.el6_9.noarch.rpm0ba3f49eabcf16e124bdec19b0744826068ef26b4f28fab8725551ed564c0745git-cvs-1.7.1-9.el6_9.noarch.rpm7d523d7dae6efd912fbe112c2fb6c626db4c7de003e8385b2fcee10b64927288git-1.7.1-9.el6_9.x86_64.rpme61c2dd25ebfa46bc8995f0ffd0359eba1ee34943759ef46661ccc6d138a3948git-email-1.7.1-9.el6_9.noarch.rpm2f44f1162208c93efa13ca52caef5d27a33d3b5b022b02500983ed475831fa52emacs-git-el-1.7.1-9.el6_9.noarch.rpmd353cea62b28beb6d3cf2a1510b11c0d5be2c2f36a3cc42b7c1d7af8608a7caeemacs-git-1.7.1-9.el6_9.noarch.rpm6d0468a0928c6487bc078044232e1371c9c049b8e52ea992dce3f8c53a494528git-all-1.7.1-9.el6_9.noarch.rpmf57299c2664c0f172ac8c60ab6bb031f94aa4f0182a8597b997090fa5478ae4fSLSA-2017:2534-1This update upgrades Thunderbird to version 52.3.0. Security Fix(es): * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2017-7779, CVE-2017-7800, CVE-2017-7801, CVE-2017-7753, CVE-2017-7784, CVE-2017-7785, CVE-2017-7786, CVE-2017-7787, CVE-2017-7792, CVE-2017-7802, CVE-2017-7807, CVE-2017-7809, CVE-2017-7791, CVE-2017-7803)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-52.3.0-1.el6_9.x86_64.rpm3d0426e94c7b83f89a42c888a469adc6d99c4b381b9496a55afbfff245ba560bSLSA-2017:2550-1Security Fix(es): * An integer overflow leading to heap-based buffer overflow was found in the poppler library. An attacker could create a malicious PDF file that would cause applications that use poppler (such as Evince) to crash, or potentially execute arbitrary code when opened. (CVE-2017-9776)moderateScientific Linux FermiScientific Linux Fermi 6poppler-qt4-devel-0.12.4-12.el6_9.i686.rpm484d59e0a9c448def0bf3855c845ceaa5c77b2c7b59cf1892305c3b6109124fbpoppler-qt4-0.12.4-12.el6_9.i686.rpmd2a4ffc5c89465dbe868e7f5965bdc62db441cd9ad7fa4afd058e6fbff0517a0poppler-0.12.4-12.el6_9.i686.rpm668c1d99c9731bc89b25f720a9047dc476e4e631606ffca9a6ca674fa39d5c04poppler-0.12.4-12.el6_9.x86_64.rpm4bd152db726737c66355dd524c7af5f0de22822186ccb8feff611ed1398af897poppler-qt-0.12.4-12.el6_9.x86_64.rpmdca134843dcb80a9dad489b93f73f9d290eb88aaf394d8c5f50ea8b336e2cbe5poppler-qt4-devel-0.12.4-12.el6_9.x86_64.rpmee8b5e98292b9da01d24c3d5d28369dc71ca90c10639c44f14d1f6f11729eb11poppler-utils-0.12.4-12.el6_9.x86_64.rpm66989fd08aa0e42e9da8890d915ea695f613d12176de13a2476694eb6ff92200poppler-devel-0.12.4-12.el6_9.x86_64.rpm82ad39c573ea1801cafc8f1a22694e53e4acf2db88630e8b971b46b5b6bff0c3poppler-qt-devel-0.12.4-12.el6_9.x86_64.rpm90cb83e2aacf1dac049fe1277fce7a8693c0636f2c1ccc1bdd468c65398b20bdpoppler-glib-0.12.4-12.el6_9.x86_64.rpm703e1e5083228a5b8fe6897dba5e89cb75f7f616761778099c9f5a8982014162poppler-qt-devel-0.12.4-12.el6_9.i686.rpm6d4ac572510baa6b3efdb9f38e402da73bcfb84dfca4f68f4f6c1468d68b53bepoppler-glib-devel-0.12.4-12.el6_9.i686.rpm4b4ef472476fe5217c4fba49a60863914da0574aa881af681c89dec67002e371poppler-qt-0.12.4-12.el6_9.i686.rpm769553248ebd397368a8fe20322e95eac43403518c389abf8578b958dfc0bb64poppler-glib-devel-0.12.4-12.el6_9.x86_64.rpmd14f4ccaa85692e2086e783338963b0bc80e3f12d0a01d8b88cfe1195bb2afe9poppler-glib-0.12.4-12.el6_9.i686.rpm9957e273c5f421fd6b765380af4f7bd4a657f8765365ed5acfcf7b87e67f1ca9poppler-devel-0.12.4-12.el6_9.i686.rpm4f4a0fad120358511b53a193d59ef9050645f3385e283e2fbbac621a583c263apoppler-qt4-0.12.4-12.el6_9.x86_64.rpm7d7438155da183e33c4f448e22909454786a41b4bb7ec506fe721cd84eb8e4e1SLSA-2017:2563-1Security Fix(es): * A covert timing channel flaw was found in the way OpenSSH handled authentication of non-existent users. A remote unauthenticated attacker could possibly use this flaw to determine valid user names by measuring the timing of server responses. (CVE-2016-6210)moderateScientific Linux FermiScientific Linux Fermi 6openssh-ldap-5.3p1-123.el6_9.x86_64.rpm83f4fcaff751c8bf0c487d7b8a7638840f6175dff1406cd3c1022e1e5900f29apam_ssh_agent_auth-0.9.3-123.el6_9.x86_64.rpm9b5e75c7763fe25827e5deb19de3da628e71aae9f148e6f4149e0db22923943bopenssh-5.3p1-123.el6_9.x86_64.rpme52d6a25b833663ba9becbc63ed638e9da15bd7ef53743c7b264adc1281a417copenssh-clients-5.3p1-123.el6_9.x86_64.rpm89e3b5d2f3606b6965e1c9cfef465cce58b4210f7fceb5555290e5ff1f8b4a88openssh-server-5.3p1-123.el6_9.x86_64.rpmc611c454ad3c1095c3ad4beb8d18d0685b8573484e83576157c48ff70cf3e308openssh-askpass-5.3p1-123.el6_9.x86_64.rpm903c3cc3e1fe5e7cdb1c4559d0ef9dc8305a8f5b3f4e3bd7d6f2a2628afef108pam_ssh_agent_auth-0.9.3-123.el6_9.i686.rpm0d3b4f07827f28ab885f94552df147e81a91bf37a07e4c2068b95146c1df6cf9SLSA-2017:2681-1Security Fix(es): * A stack buffer overflow flaw was found in the way the Bluetooth subsystem of the Linux kernel processed pending L2CAP configuration responses from a client. On systems with the stack protection feature enabled in the kernel (CONFIG_CC_STACKPROTECTOR=y, which is enabled on all architectures other than s390x and ppc64[le]), an unauthenticated attacker able to initiate a connection to a system via Bluetooth could use this flaw to crash the system. Due to the nature of the stack protection feature, code execution cannot be fully ruled out, although we believe it is unlikely. On systems without the stack protection feature (ppc64[le]; the Bluetooth modules are not built on s390x), an unauthenticated attacker able to initiate a connection to a system via Bluetooth could use this flaw to remotely execute arbitrary code on the system with ring 0 (kernel) privileges. (CVE-2017-1000251, Important)importantScientific Linux FermiScientific Linux Fermi 6kernel-2.6.32-696.10.2.el6.x86_64.rpmc4c51727cff7bb860b185e75fbe6f5cad01a845ad73f444bd4146b314005822ekernel-debug-devel-2.6.32-696.10.2.el6.x86_64.rpm08c0f39a12f6e0d3f8231b64aaa8fec7d8ae1720383c92a10b4d0c1681e8dfb5kernel-doc-2.6.32-696.10.2.el6.noarch.rpm8ba9a17c87744ab3b5edd58b5a827b280655e1feb60f0c3eaf8298dc9774515dpython-perf-2.6.32-696.10.2.el6.x86_64.rpm962ccb7fc13d9752a6552f00fb3e9da272cc2e4e7f59121a54facd28cceb6d34kernel-devel-2.6.32-696.10.2.el6.x86_64.rpm4a7a8f857f2898bc288b4d2864bbf5c2dda171634d2494549931a3e123a88952kernel-debug-2.6.32-696.10.2.el6.x86_64.rpm8efafc9de5da80fc9c38b74706147583a3e8145d1447a68e10dba6ce5cb977b8kernel-abi-whitelists-2.6.32-696.10.2.el6.noarch.rpm611b9a684051af5e4cced48c671c88d2ea4df4a2470bfe2731e16436ef5c15bekernel-debug-devel-2.6.32-696.10.2.el6.i686.rpmb1270330476a39f015b90ca3f9766c5e06bf84385f307974f19d9c9dd4ac2bf1kernel-firmware-2.6.32-696.10.2.el6.noarch.rpm9594c4e6cc6c4d4945adf98516408763aac60dc405d8544f3b426cc0b9e7980eperf-2.6.32-696.10.2.el6.x86_64.rpm5e2b0fc5f2c4c8b0f780fa12700d9a70ee3adb80141d5bff00f09e72d22fc2b7kernel-headers-2.6.32-696.10.2.el6.x86_64.rpm6a9da1fde2911a942a74b456a54af8e1d3b9303b6022e37810f9a09000c28503SLSA-2017:2685-1Security Fix(es): * An information-disclosure flaw was found in the bluetoothd implementation of the Service Discovery Protocol (SDP). A specially crafted Bluetooth device could, without prior pairing or user interaction, retrieve portions of the bluetoothd process memory, including potentially sensitive information such as Bluetooth encryption keys. (CVE-2017-1000250)moderateScientific Linux FermiScientific Linux Fermi 6bluez-alsa-4.66-2.el6_9.x86_64.rpm685bded55ccb125ead44d8e9efd7082e685f4e007bd3f42ef831d0d167901685bluez-gstreamer-4.66-2.el6_9.i686.rpm40c417ebb3ee9e5367e06a606d0cad2ae5135297b04085d0916bd87964d3dfaebluez-alsa-4.66-2.el6_9.i686.rpm9ee76fcc7239a5ddbeb04c312ea0febb1c66bfac89fb041ffe87b481f3218f18bluez-4.66-2.el6_9.x86_64.rpm8d43530d1be6b1760715bf8aba9b6f8db4f5ac686fd3166c7b218909258ad2a1bluez-libs-devel-4.66-2.el6_9.i686.rpma4b907bab21cfb79ecba7c5c8bb54eaf57d5e16a4672f7ca36124e724bdc26c8bluez-libs-4.66-2.el6_9.i686.rpm7bcac087a22a9f93c8768c7001d23a15381831c3d2e61a666180f537f1294c46bluez-gstreamer-4.66-2.el6_9.x86_64.rpm4b0e7d49bafc0d0c2d5a34e86d0ebb7f0fb45c96725aff98d7e3e18b9d2fa1a7bluez-compat-4.66-2.el6_9.x86_64.rpm905541f4720864bf7c1fde0307c20577c9238673d82183adcd13a9c83f6d8e12bluez-cups-4.66-2.el6_9.x86_64.rpm0bf3e5ea90d0c1ddeb61ec638b381297f077647ab7411bdeb9f4307832162f92bluez-libs-4.66-2.el6_9.x86_64.rpmbc7fd88651091079a38dd3014a2e20d03be40eac206ef4c29ed0af5dea279fbfbluez-libs-devel-4.66-2.el6_9.x86_64.rpm91b235ff964ee562279707d0de2c2242458ffccf39f54e33dddbd5c64341ff2fSLSA-2017:2789-1Security Fix(es): * A race condition was found in samba server. A malicious samba client could use this flaw to access files and directories in areas of the server file system not exported under the share definitions. (CVE-2017-2619) * It was found that samba did not enforce "SMB signing" when certain configuration options were enabled. A remote attacker could launch a man- in-the-middle attack and retrieve information in plain-text. (CVE-2017-12150) * An information leak flaw was found in the way SMB1 protocol was implemented by Samba. A malicious client could use this flaw to dump server memory contents to a file on the samba share or to a shared printer, though the exact area of server memory cannot be controlled by the attacker. (CVE-2017-12163)moderateScientific Linux FermiScientific Linux Fermi 6samba-domainjoin-gui-3.6.23-45.el6_9.x86_64.rpma335e482fe91ebe7d78b42a77b5cbd93bcc3c50df93e8c23247003d9245d8d92libsmbclient-3.6.23-45.el6_9.i686.rpm9317c294344b61baeb5c01ab76b2c758ac63d957965a9734f31e72dad4c30fd9libsmbclient-3.6.23-45.el6_9.x86_64.rpm580c690b30daf2bf875321a6f6b0f159539ee16155c7344660c334c5cc2fe59dsamba-winbind-clients-3.6.23-45.el6_9.i686.rpm3598f4b0b89b863899ad5b262022f60cdd811fe7dbb6c44400c1c8ef4362caf7samba-winbind-krb5-locator-3.6.23-45.el6_9.x86_64.rpm9c4ef5e053f2b64d818489114e52af0ce878f4cfbaf7ad6b3481320d19d4862bsamba-winbind-devel-3.6.23-45.el6_9.x86_64.rpm414e49eba44ca9fd79e963f84102961ad20a1ec9f81fbf5e5456b407c8eb19d0libsmbclient-devel-3.6.23-45.el6_9.i686.rpmec930cec2f3b8b4eecda96b461ac66c07f9104bb93695d286c7f493cf1b87ca6samba-winbind-devel-3.6.23-45.el6_9.i686.rpmdcbb0d8e0b1d6c3615aefd477c766189799bfe3739777c3b310c281d8c54d4absamba-winbind-3.6.23-45.el6_9.x86_64.rpm628c5c4f6f1c9c1e82da34e07c7770b5c4d59da309487f396daeb814d64bda35samba-common-3.6.23-45.el6_9.i686.rpm7246b1ba5729bc259b17e6a40cf5341ff442ab140bfa0944caa209fa77ef09a6libsmbclient-devel-3.6.23-45.el6_9.x86_64.rpm863a9e7c3da29e9ef77f405ce17ce8097dbe6f2bf562a07985b7271e4c4d0559samba-winbind-clients-3.6.23-45.el6_9.x86_64.rpm9d350fb1c8c8f6dad679d54b741e94e828975961b26381355cbc18b585919d24samba-3.6.23-45.el6_9.x86_64.rpm856a573b3cad6f1fc9368c69d1f3f61c762753fa0200d2644fc000cbc58a0ddesamba-doc-3.6.23-45.el6_9.x86_64.rpm88c3afbe9777dd254735c9b716868de7366233b5fae7457ff3471ada77fa18dfsamba-swat-3.6.23-45.el6_9.x86_64.rpm275bc3f2fc7596441ad8d4bef1fb8bfaad41e3534c41e380f7f2ee4de0dd6b69samba-common-3.6.23-45.el6_9.x86_64.rpm3a6e08ccf4c2e87618b3a7ec5a8ca46f9f1eb22a8d4295f10f6879332e204fb1samba-glusterfs-3.6.23-45.el6_9.x86_64.rpm4c0832bc00ec67ed6b2d2a0fa0c7677786f7f7135ccfb743dde49cd9c91ff2cfsamba-client-3.6.23-45.el6_9.x86_64.rpmc0310959115be09f7f5f752c16c7fe1e4428d6d83f1f428f46006cbf6e628b34SLSA-2017:2791-1Security Fix(es): * It was found that samba did not enforce "SMB signing" when certain configuration options were enabled. A remote attacker could launch a man- in-the-middle attack and retrieve information in plain-text. (CVE-2017-12150) * An information leak flaw was found in the way SMB1 protocol was implemented by Samba. A malicious client could use this flaw to dump server memory contents to a file on the samba share or to a shared printer, though the exact area of server memory cannot be controlled by the attacker. (CVE-2017-12163)moderateScientific Linux FermiScientific Linux Fermi 6samba4-winbind-4.2.10-11.el6_9.x86_64.rpm98e09b6d2872b172d6a6e0f8fc26eeb00121607bada6ac15d6a66c976818f1c6samba4-winbind-krb5-locator-4.2.10-11.el6_9.x86_64.rpm03dd98f7ec52c58d8af044bde2ad7eba87df886bfbb409912fe0039ad47f2eabsamba4-devel-4.2.10-11.el6_9.x86_64.rpmde299c75e70f9c2afff044955b989fef600c6e18a29f1ed34dae8ab8dbbf8d3esamba4-winbind-clients-4.2.10-11.el6_9.x86_64.rpm6fe1dcc154243db90dd4cf278272d38befb978e529714f1e212d1724989e0fe0samba4-libs-4.2.10-11.el6_9.x86_64.rpm8c42dede0f929d3fa975e1282f3f62d183d7da1055822c3dd6538fa312382586samba4-python-4.2.10-11.el6_9.x86_64.rpm45759e9030c2e07e49663e8196a307fbd7249fffb5df30096498780a99040ed8samba4-4.2.10-11.el6_9.x86_64.rpm2ca4cfb6d18562fe00c36fab4e3c8e234bed5c695b11ab2b76e929daa060e3ccsamba4-dc-4.2.10-11.el6_9.x86_64.rpm569c90779b345cb5978f73bd6b1cc7377bba378875c1fbf29757de17b142cba2samba4-client-4.2.10-11.el6_9.x86_64.rpm9cd2e6b407cde3dfe673da31a366cf01b3e78d428fb988b2861e5deeb4362752samba4-test-4.2.10-11.el6_9.x86_64.rpm63df6e2f3e8ee5b9f56a660926c0dbe1150d635b7423e3a0be237ce20a191bd9samba4-pidl-4.2.10-11.el6_9.x86_64.rpm23a4738c8d6bb981115f5a6b03e3eb1dc51385042f61cf1abfebe841177283e8samba4-common-4.2.10-11.el6_9.x86_64.rpm29b1ec0ebb2378db67066e43aa9ef6788a0045a8b142a369afe13e0a00cc8176samba4-dc-libs-4.2.10-11.el6_9.x86_64.rpm06eccfeef2dfc85a2e6c8cc6c11e081c556997f8b89c4f39032bad74781b1e4bSLSA-2017:2795-1Security Fix(es): * A flaw was found in the way the Linux kernel loaded ELF executables. Provided that an application was built as Position Independent Executable (PIE), the loader could allow part of that application's data segment to map over the memory area reserved for its stack, potentially resulting in memory corruption. An unprivileged local user with access to SUID (or otherwise privileged) PIE binary could use this flaw to escalate their privileges on the system. (CVE-2017-1000253, Important)importantScientific Linux FermiScientific Linux Fermi 6kernel-debug-2.6.32-696.10.3.el6.x86_64.rpm88466ad5e66c397a7039bb1c7bb83b9ab57765b5d88dca2813c2fafc93307c4ckernel-doc-2.6.32-696.10.3.el6.noarch.rpm60886710a0f0435284b4c641f536b5d8cc3600966355a67c88c7ddeb594c814fkernel-firmware-2.6.32-696.10.3.el6.noarch.rpma371ac93bb7655a3a4772cf1b19c4c83a10c261516039d28d008b0383871ca49kernel-2.6.32-696.10.3.el6.x86_64.rpmb5b01320b20cf54f92a5ab485b6b69488e8eba979bf4480e424bf0c14cadc56dkernel-debug-devel-2.6.32-696.10.3.el6.x86_64.rpm7f0d2fe374422ea9d650f2df4ad5a90e155936a9ca22c323be6c835c8b647f35perf-2.6.32-696.10.3.el6.x86_64.rpm58d86c641afc79675dbd28cff590c2468117be826fa935e1fa3a821daf8360e3kernel-debug-devel-2.6.32-696.10.3.el6.i686.rpmca92d408a34683677e2f8ce7ec4639179a7786098705ad809aa090854516c9cdkernel-devel-2.6.32-696.10.3.el6.x86_64.rpmfb6e6e9a2540c50486e6a286f896e8451a0eeac2cb29750c8c2dce8a325e5685python-perf-2.6.32-696.10.3.el6.x86_64.rpmf8f02a98074dc27005e4c3712d269e27bff0c3db1d3a661f898adbcef17eac23kernel-abi-whitelists-2.6.32-696.10.3.el6.noarch.rpme34a595d77f857d0a722d324b850c209f41491244a41def1408ae4866dea6db4kernel-headers-2.6.32-696.10.3.el6.x86_64.rpm4aed8c65a559ac256a1899aa32a2195b7a445e0bc61fea46bfc2a6bc0196a896SLSA-2017:2831-1This update upgrades Firefox to version 52.4.0 ESR. Security Fix(es): * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2017-7810, CVE-2017-7793, CVE-2017-7818, CVE-2017-7819, CVE-2017-7824, CVE-2017-7814, CVE-2017-7823)criticalScientific Linux FermiScientific Linux Fermi 6firefox-52.4.0-1.el6_9.i686.rpm6c8fe24f282e69deb493b438a7825f73e523c9b4ad8a0ba39a1efc7d60702065firefox-52.4.0-1.el6_9.x86_64.rpmcd88d4455e307cd771975f9837e3f1a49d6494c9f40c32dc71af4568d7990dd4SLSA-2017:2832-1Security Fix(es): * A use-after-free flaw was found in the TLS 1.2 implementation in the NSS library when client authentication was used. A malicious client could use this flaw to cause an application compiled against NSS to crash or, potentially, execute arbitrary code with the permission of the user running the application. (CVE-2017-7805)importantScientific Linux FermiScientific Linux Fermi 6nss-pkcs11-devel-3.28.4-4.el6_9.x86_64.rpm3eb7e49f3c6d180fe4316201b65f89ad3d42c5e82859675938c52df607fba8c1nss-devel-3.28.4-4.el6_9.i686.rpm953584e75a9b917aa31170dd53aee2f08fdcf6e780ed443943db8c923eb4fe9enss-sysinit-3.28.4-4.el6_9.x86_64.rpmb0f9cacdb3b731c4141df6f6c86512c94a185b969d29fabea5260d533af822f1nss-tools-3.28.4-4.el6_9.x86_64.rpm1b68c4e4a258d5c90452dc756be84753bce93f0884fa8718f364da57ca0058dfnss-3.28.4-4.el6_9.i686.rpme2fa4797d2e8604936ee0cd028f74d80384fbbd2c33e1655aa39110c70fb212cnss-3.28.4-4.el6_9.x86_64.rpm7154d5e1091383d1c8431ddecfd40c3389ae1409a0f04289c45f6f26f486a6f8nss-devel-3.28.4-4.el6_9.x86_64.rpmde5d978e8682db961d501fb1ea7982907d76a3040aca22efdc65d14ff894ca79nss-pkcs11-devel-3.28.4-4.el6_9.i686.rpm42e593d054692a06568abb413b86d6fa3fa686520cd215efc4cc820bcbcf1df6SLSA-2017:2838-1Security Fix(es): * A heap buffer overflow was found in dnsmasq in the code responsible for building DNS replies. An attacker could send crafted DNS packets to dnsmasq which would cause it to crash or, potentially, execute arbitrary code. (CVE-2017-14491)criticalScientific Linux FermiScientific Linux Fermi 6dnsmasq-2.48-18.el6_9.x86_64.rpmf4a31c19fdc8883d346054fa7a01c1b2621aa94f15271111e7852eb7cd616629dnsmasq-utils-2.48-18.el6_9.x86_64.rpmc448200eac936625d4c09e69f113be358a253f370632d60c29f0318d1d14e5caSLSA-2017:2860-1Security Fix(es): * It was found that authenticating to a PostgreSQL database account with an empty password was possible despite libpq's refusal to send an empty password. A remote attacker could potentially use this flaw to gain access to database accounts with empty passwords. (CVE-2017-7546)moderateScientific Linux FermiScientific Linux Fermi 6postgresql-pltcl-8.4.20-8.el6_9.x86_64.rpm673d6aa73c5caf0766c3202e96c388027e77687ce39e1626bd4fdc6b52f5e898postgresql-plpython-8.4.20-8.el6_9.x86_64.rpm741092232c7958dfe47f34d6d0a5610bd3c0d06efd9c8929dff57ac730af2c99postgresql-contrib-8.4.20-8.el6_9.x86_64.rpma0a23ec00812db748594c12dfcfaaf0162801292dd157de2059f1f043ac3b305postgresql-8.4.20-8.el6_9.i686.rpmbeef0ce70fa1450cdf658ec058a1b0393cde05b98729ae5b0d81abc528c85317postgresql-docs-8.4.20-8.el6_9.x86_64.rpm029cff6e6b145223e13a39fbdf7d907f05b4d4ed4c1401563cf7cede493c4ba4postgresql-devel-8.4.20-8.el6_9.i686.rpm1cf596c4e3319289c9aed8a47cbe224ed4e14450fbbd2ccdcef6f64e45d292b6postgresql-8.4.20-8.el6_9.x86_64.rpmb8cc36f2875ce0ff031b47ac9f751e184dc4e5b5ff6fb035b743b34ab0ba613fpostgresql-devel-8.4.20-8.el6_9.x86_64.rpm63fd13af37d885da749f2c7be5437140ea884e9a84dd232511e06f9d48ac3ab2postgresql-server-8.4.20-8.el6_9.x86_64.rpmf9b26f2640711100d52f0a72305d0e4c8aef580595f0389c7f4dc5c1060a4796postgresql-libs-8.4.20-8.el6_9.i686.rpmd3f2be0ffc5a570cc7a08eea2c18edc89b8864bda4721d4ad4cba9db1322d6b7postgresql-plperl-8.4.20-8.el6_9.x86_64.rpm021f22da75c58f49ec986633db2f9a05dbbde224502e689eb130ba70b9b3dd61postgresql-libs-8.4.20-8.el6_9.x86_64.rpmb28d435f4667072494439407f613fb84d3220c5a6ea0215f3f802b1ae8989c04postgresql-test-8.4.20-8.el6_9.x86_64.rpm4944e54fd501283f504edac9b944d7031361fd54ab68718fa53a98787cf226baSLSA-2017:2863-1Security Fix(es): * Kernel memory corruption due to a buffer overflow was found in brcmf_cfg80211_mgmt_tx() function in Linux kernels from v3.9-rc1 to v4.13-rc1. The vulnerability can be triggered by sending a crafted NL80211_CMD_FRAME packet via netlink. This flaw is unlikely to be triggered remotely as certain userspace code is needed for this. An unprivileged local user could use this flaw to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although it is unlikely. (CVE-2017-7541, Moderate) Bug Fix(es): * Previously, removal of a rport during ISCSI target scanning could cause a kernel panic. This was happening because addition of STARGET_REMOVE to the rport state introduced a race condition to the SCSI code. This update adds the STARGET_CREATED_REMOVE state as a possible state of the rport and appropriate handling of that state, thus fixing the bug. As a result, the kernel panic no longer occurs under the described circumstances. * Previously, GFS2 contained multiple bugs where the wrong inode was assigned to GFS2 cluster-wide locks (glocks), or the assigned inode was cleared incorrectly. Consequently, kernel panic could occur when using GFS2. With this update, GFS2 has been fixed, and the kernel no longer panics due to those bugs. * Previously, VMs with memory larger than 64GB running on Hyper-V with Windows Server hosts reported potential memory size of 4TB and more, but could not use more than 64GB. This was happening because the Memory Type Range Register (MTRR) for memory above 64GB was omitted. With this update, the /proc/mtrr file has been fixed to show correct base/size if they are more than 44 bit wide. As a result, the whole size of memory is now available as expected under the described circumstances.moderateScientific Linux FermiScientific Linux Fermi 6kernel-headers-2.6.32-696.13.2.el6.x86_64.rpm92de60bfc26b152c19c89024cdacf5d64280deb17debaa02dd6aeb48a6027b41kernel-doc-2.6.32-696.13.2.el6.noarch.rpm50a672a034c33c8f2c70b5260c034c684df6e9138f0caf37d12ee517f654b001kernel-debug-devel-2.6.32-696.13.2.el6.i686.rpmf668a3121357d0228fb667495ce7618c2a204a9703856b81e55c6334519226cfperf-2.6.32-696.13.2.el6.x86_64.rpm6e00858f6bbb3c1e5865c4cd9e748ca2f138dbcd6b5c170b717d1119574916e3kernel-debug-devel-2.6.32-696.13.2.el6.x86_64.rpmf3b64c46a235993cbd61d8d5e4f3f648a3c7763b6d24b25958d9fe910a578c89kernel-debug-2.6.32-696.13.2.el6.x86_64.rpmc8408dae41345f3aa38e26590533c071ad52978d0bc9afaa59a1b3079508cc73kernel-devel-2.6.32-696.13.2.el6.x86_64.rpm3e10f6a4a1ba55355ca9a75296367bb0ce99a37817959b36d0dab83c763a6b63python-perf-2.6.32-696.13.2.el6.x86_64.rpm1decf968c9998aae01311e6edfc87930005d7888a29238832b670074d0405b69kernel-abi-whitelists-2.6.32-696.13.2.el6.noarch.rpmc94591d676e929fac6d314ff61c2c90146696b40ab75ba3ecd230d798daaa2f3kernel-firmware-2.6.32-696.13.2.el6.noarch.rpm4aafa206050bfcd23af7a4e16e482a52c2e87dd3720204d08e8d1fd75e3d37f7kernel-2.6.32-696.13.2.el6.x86_64.rpmd105bdf2ce3453c2a3447fd80cb7748a0e119c30ec7a147799e9a0b713b2f2bfSLSA-2017:2885-1This update upgrades Thunderbird to version 52.4.0. Security Fix(es): * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2017-7810, CVE-2017-7793, CVE-2017-7818, CVE-2017-7819, CVE-2017-7824, CVE-2017-7814, CVE-2017-7823)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-52.4.0-2.el6_9.x86_64.rpm4cc05b63ab8b533d7d225c350a1d88d93d4e5c81ce2618ab8c7a6cb2c7139b75SLSA-2017:2911-1Security Fix(es): * A new exploitation technique called key reinstallation attacks (KRACK) affecting WPA2 has been discovered. A remote attacker within Wi-Fi range could exploit these attacks to decrypt Wi-Fi traffic or possibly inject forged Wi-Fi packets by manipulating cryptographic handshakes used by the WPA2 protocol. (CVE-2017-13077, CVE-2017-13078, CVE-2017-13080, CVE-2017-13087)importantScientific Linux FermiScientific Linux Fermi 6wpa_supplicant-0.7.3-9.el6_9.2.x86_64.rpm4391ccca7a1283c40152048fa9924eca708d29a5da62f0ce88407ad8d369ad2eSLSA-2017:2972-1Security Fix(es): * A use-after-free flaw was found in the way httpd handled invalid and previously unregistered HTTP methods specified in the Limit directive used in an .htaccess file. A remote attacker could possibly use this flaw to disclose portions of the server memory, or cause httpd child process to crash. (CVE-2017-9798) * A regression was found in the Scientific Linux 6.9 version of httpd, causing comments in the "Allow" and "Deny" configuration lines to be parsed incorrectly. A web administrator could unintentionally allow any client to access a restricted HTTP resource. (CVE-2017-12171)moderateScientific Linux FermiScientific Linux Fermi 6httpd-devel-2.2.15-60.sl6.6.x86_64.rpm66b0fd35a16410b211f16a98bbf4a9b1a790758ba49a4fc61ef856a54d26ebcbmod_ssl-2.2.15-60.sl6.6.x86_64.rpm25fee440063edbf2275d668258d2f93fb1fdb8aeeb96d609045f6bc65842a6c4httpd-tools-2.2.15-60.sl6.6.x86_64.rpmc088e6b04c8faed91c4304afba87342b18e19e8a4f2fb17d17d7a969b029f4e3httpd-devel-2.2.15-60.sl6.6.i686.rpma941364a85c9e9019cd612d4a201a9673ffc1102d71195db9cb7c4a22db27654httpd-2.2.15-60.sl6.6.x86_64.rpmd78e807790a3502508b347057935bd0e88aab6d4f7067e365dfa82a29a0cf2f0httpd-manual-2.2.15-60.sl6.6.noarch.rpmf6a98b36d518261d39834d10f98d2d9b8c712ddeab2254d101807779104914a7SLSA-2017:2998-1Security Fix(es): * Multiple flaws were discovered in the RMI and Hotspot components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions. (CVE-2017-10285, CVE-2017-10346) * It was discovered that the Kerberos client implementation in the Libraries component of OpenJDK used the sname field from the plain text part rather than encrypted part of the KDC reply message. A man-in-the- middle attacker could possibly use this flaw to impersonate Kerberos services to Java applications acting as Kerberos clients. (CVE-2017-10388) * It was discovered that the Security component of OpenJDK generated weak password-based encryption keys used to protect private keys stored in key stores. This made it easier to perform password guessing attacks to decrypt stored keys if an attacker could gain access to a key store. (CVE-2017-10356) * A flaw was found in the Smart Card IO component in OpenJDK. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. (CVE-2017-10274) * It was found that the FtpClient implementation in the Networking component of OpenJDK did not set connect and read timeouts by default. A malicious FTP server or a man-in-the-middle attacker could use this flaw to block execution of a Java application connecting to an FTP server. (CVE-2017-10355) * It was found that the HttpURLConnection and HttpsURLConnection classes in the Networking component of OpenJDK failed to check for newline characters embedded in URLs. An attacker able to make a Java application perform an HTTP request using an attacker provided URL could possibly inject additional headers into the request. (CVE-2017-10295) * It was discovered that multiple classes in the JAXP, Serialization, Libraries, and JAX-WS components of OpenJDK did not limit the amount of memory allocated when creating object instances from the serialized form. A specially-crafted input could cause a Java application to use an excessive amount of memory when deserialized. (CVE-2017-10349, CVE-2017-10357, CVE-2017-10347, CVE-2017-10281, CVE-2017-10345, CVE-2017-10348, CVE-2017-10350) Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website.criticalScientific Linux FermiScientific Linux Fermi 6java-1.8.0-openjdk-javadoc-debug-1.8.0.151-1.b12.el6_9.noarch.rpmcded3938597dd71d3b8447cd66192496c952a91d12b8422daa5973a25c69f5ccjava-1.8.0-openjdk-headless-1.8.0.151-1.b12.el6_9.x86_64.rpm6516c1bb6f3ec602ca4b6ff8d271fe02af5d0f4f587ceac69fc3c1f214d02440java-1.8.0-openjdk-javadoc-1.8.0.151-1.b12.el6_9.noarch.rpm8db9cf01a9cf2b418d088b04ea6a5077a3be113b7cd1c4e77e6caf34c5e599e1java-1.8.0-openjdk-src-1.8.0.151-1.b12.el6_9.x86_64.rpma73ea68937daecb9338aa0fec3569b746da8891ba1572598c1f2147123293a56java-1.8.0-openjdk-1.8.0.151-1.b12.el6_9.x86_64.rpmfc8aae29244d01aca3ec3099bee76e79c98146f03b5ea4620de97133c8458cf2java-1.8.0-openjdk-src-debug-1.8.0.151-1.b12.el6_9.x86_64.rpmbc401003c005593603990d54889084dcf4def4910ef357d94c1272544b3a1d60java-1.8.0-openjdk-devel-debug-1.8.0.151-1.b12.el6_9.x86_64.rpm6a0f2f7cafe70eaf649a6e2971b6ace5a3ed9e47b69ea3d6e81dc6fc1e355252java-1.8.0-openjdk-devel-1.8.0.151-1.b12.el6_9.x86_64.rpm0db528d8212a85e1bbb5bc41ca04df424a325fc6e4780f2477d3fc813bb8620cjava-1.8.0-openjdk-headless-debug-1.8.0.151-1.b12.el6_9.x86_64.rpm2e3bd7d1958ed2042abca4c6b1e5ce63021a5737bec921d05fdbf2f61ac1df82java-1.8.0-openjdk-demo-debug-1.8.0.151-1.b12.el6_9.x86_64.rpmb2d3e1eaa2906ff9b6222a2d29e74fd73ad7ea9b2f0ba0ad6345b3044e76d013java-1.8.0-openjdk-debug-1.8.0.151-1.b12.el6_9.x86_64.rpm9f018de9a38cc160f6f30fc0def2054c6f552daabfb8d5b5a4b00ced538e64abjava-1.8.0-openjdk-demo-1.8.0.151-1.b12.el6_9.x86_64.rpm133bf839775c7cd8ca20674654bd8778efc7895c7066686a5a3cbdf1854092f3SLSA-2017:3071-1Security Fix(es): * Two vulnerabilities were discovered in the NTP server's parsing of configuration directives. A remote, authenticated attacker could cause ntpd to crash by sending a crafted message. (CVE-2017-6463, CVE-2017-6464) * A vulnerability was found in NTP, in the parsing of packets from the /dev/datum device. A malicious device could send crafted messages, causing ntpd to crash. (CVE-2017-6462)moderateScientific Linux FermiScientific Linux Fermi 6ntp-perl-4.2.6p5-12.el6_9.1.x86_64.rpmb8316133064eb15e07c1efb471e3866d8cf097540fc891544a6f013049a0ca37ntpdate-4.2.6p5-12.el6_9.1.x86_64.rpm6562dc8d1ecb9710c02c45fd4e60958cbc6c46575ef3f606b557667a3c4d725entp-doc-4.2.6p5-12.el6_9.1.noarch.rpmc25d5ae9eb12cd8f5903eab7de6b201d70035b4343ddeaf5c3c6575899d780e9ntp-4.2.6p5-12.el6_9.1.x86_64.rpmaaebc7bbb3fbfa93012b57fe375cd77ef0d08bb68e05e12aae5f05ce63ecd0c1SLSA-2017:3080-1Security Fix(es): * A vulnerability was discovered in Tomcat's handling of pipelined requests when "Sendfile" was used. If sendfile processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could lead to invalid responses or information disclosure. (CVE-2017-5647) * A vulnerability was discovered in the error page mechanism in Tomcat's DefaultServlet implementation. A crafted HTTP request could cause undesired side effects, possibly including the removal or replacement of the custom error page. (CVE-2017-5664) * Two vulnerabilities were discovered in Tomcat where if a servlet context was configured with readonly=false and HTTP PUT requests were allowed, an attacker could upload a JSP file to that context and achieve code execution. (CVE-2017-12615, CVE-2017-12617)importantScientific Linux FermiScientific Linux Fermi 6tomcat6-el-2.1-api-6.0.24-111.el6_9.noarch.rpma242e04823176bb9a30a1932b0e9aa0f534faf13bdb9155fe66f2deebd27d227tomcat6-javadoc-6.0.24-111.el6_9.noarch.rpmd92cd24c3791076fe5d4220d3db6eec296de2fb0501e9935c0b672fc535bf7fctomcat6-lib-6.0.24-111.el6_9.noarch.rpm70df8a6bfa699bce9f5d0c0c61a70e9e862ffdca4465ecdb0da239bc54c43fa7tomcat6-docs-webapp-6.0.24-111.el6_9.noarch.rpm4801abedcb8a8aead259080473f95ce08a49dda6b960c1a66deeb17b7ad1c243tomcat6-servlet-2.5-api-6.0.24-111.el6_9.noarch.rpm4a24723c75d4f6e6db258de8fd76ed277395ed575fe955f6145da0f295a03dddtomcat6-webapps-6.0.24-111.el6_9.noarch.rpm9ebf33fcc9990522d5a4d32dbaa116cedbac8b40c04d01ff2922e9fd23e95750tomcat6-6.0.24-111.el6_9.noarch.rpmc26fdc8896543d7817670148450f37c6cfc3c25908a29dd8a794a38b423f7ae2tomcat6-admin-webapps-6.0.24-111.el6_9.noarch.rpm8708517cbfe8ee1077fb7ac81870a410274b8d6e94b4369a230186ec5255fcd2tomcat6-jsp-2.1-api-6.0.24-111.el6_9.noarch.rpm2cb699feacba802bd8b22e797994513874296ea630c508ce2efc3f3284641404SLSA-2017:3200-1Security Fix(es): * A race condition issue leading to a use-after-free flaw was found in the way the raw packet sockets are implemented in the Linux kernel networking subsystem handling synchronization. A local user able to open a raw packet socket (requires the CAP_NET_RAW capability) could use this flaw to elevate their privileges on the system. (CVE-2017-1000111, Important) * An exploitable memory corruption flaw was found in the Linux kernel. The append path can be erroneously switched from UFO to non-UFO in ip_ufo_append_data() when building an UFO packet with MSG_MORE option. If unprivileged user namespaces are available, this flaw can be exploited to gain root privileges. (CVE-2017-1000112, Important) * A divide-by-zero vulnerability was found in the __tcp_select_window function in the Linux kernel. This can result in a kernel panic causing a local denial of service. (CVE-2017-14106, Moderate) Bug Fix(es): * When the operating system was booted with RHEV/oVirt, and the eh_deadline sysfs parameter was set to 10s, the Storage Area Network (SAN) issues caused eh_deadline to trigger with no handler. Consequently, a kernel panic occurred. This update fixes the lpfc driver, thus preventing the kernel panic under described circumstances. * When an NFS server returned the NFS4ERR_BAD_SEQID error to an OPEN request, the open-owner was removed from the state_owners rbtree. Consequently, NFS4 client infinite loop that required a reboot to recover occurred. This update changes NFS4ERR_BAD_SEQID handling to leave the open-owner in the state_owners rbtree by updating the create_time parameter so that it looks like a new open-owner. As a result, an NFS4 client is now able to recover without falling into the infinite recovery loop after receiving NFS4ERR_BAD_SEQID. * If an NFS client attempted to mount NFSv3 shares from an NFS server exported directly to the client's IP address, and this NFS client had already mounted other shares that originated from the same server but were exported to the subnetwork which this client was part of, the auth.unix.ip cache expiration was not handled correctly. Consequently, the client received the 'stale file handle' errors when trying to mount the share. This update fixes handling of the cache expiration, and the NFSv3 shares now mount as expected without producing the 'stale file handle' errors. * When running a script that raised the tx ring count to its maximum value supported by the Solarflare Network Interface Controller (NIC) driver, the EF10 family NICs allowed the settings exceeding the hardware's capability. Consequently, the Solarflare hardware became unusable with Scientific Linux 6. This update fixes the sfc driver, so that the tx ring can have maximum 2048 entries for all EF10 NICs. As a result, the Solarflare hardware no longer becomes unusable.importantScientific Linux FermiScientific Linux Fermi 6kernel-abi-whitelists-2.6.32-696.16.1.el6.noarch.rpm0af4b1ab5e56d14bd8d74131ac1e4a6014b577980ae7741af5f70544354792f0kernel-debug-2.6.32-696.16.1.el6.x86_64.rpm56afae0140242483b45787b910117bf6e1c2ff2fd460f96b6f27e10966515fcfkernel-debug-devel-2.6.32-696.16.1.el6.x86_64.rpmc1587130feef352a52c94496fdb661ba0318a84bae4151d55712b575b238d456kernel-2.6.32-696.16.1.el6.x86_64.rpm52d525c763fd649fb1adbf9f0a1e63159cb46cae72fbd6ba571f8775fe63ff58kernel-firmware-2.6.32-696.16.1.el6.noarch.rpm282cf7cf8d7501c367bda3adc1a4e44b35848ed17c9c1eb2eff1a63c946a13aakernel-devel-2.6.32-696.16.1.el6.x86_64.rpm9d42c082718011984c2fac0c1e24ff00322a7488759e069fb9dbcaf324dc76f9python-perf-2.6.32-696.16.1.el6.x86_64.rpm6af5e87d98fa8e086ec8e87f0f3b05fc9b647ee067f37608c0db3b50f0bd8803kernel-doc-2.6.32-696.16.1.el6.noarch.rpm1f4f2c2a62a42d515e7ae0255c3f9a2a7d44a1751f93a4f93aacbd57c80eead0perf-2.6.32-696.16.1.el6.x86_64.rpmb632ff17103219152738ef2d4fa0ac6f80468e698853d3385f7ffe481e49ba40kernel-headers-2.6.32-696.16.1.el6.x86_64.rpm08f0fbd96cd9593cec69ad4e3774d97e6d5eeab3d1e7296e58e3a85767a47c94kernel-debug-devel-2.6.32-696.16.1.el6.i686.rpm12fce8b6da30a42427117e9b2cc36160cfba0ac2fcbc7b2744bac9dc5e33f81bSLSA-2017:3247-1This update upgrades Firefox to version 52.5.0 ESR. Security Fix(es): * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2017-7826, CVE-2017-7828, CVE-2017-7830)criticalScientific Linux FermiScientific Linux Fermi 6firefox-52.5.0-1.el6_9.x86_64.rpmc477ea4ae93b8cecda79df0598015a6bb6002a359e83abb2570470a6763dfc3efirefox-52.5.0-1.el6_9.i686.rpm0f6f5df535b0a99473466e27223d8e6acd0cb38be4b7ca5d5dea7230168438e9SLSA-2017:3270-1Security Fix(es): * An out-of-bounds array dereference was found in apr_time_exp_get(). An attacker could abuse an unvalidated usage of this function to cause a denial of service or potentially lead to data leak. (CVE-2017-12613)importantScientific Linux FermiScientific Linux Fermi 6apr-devel-1.3.9-5.el6_9.1.i686.rpma9c97028a603580d611bb9017851234fc3fe7e13f205dba3ec79b1360004c6f4apr-1.3.9-5.el6_9.1.i686.rpmac520e8990617bfb66ac8eeb6d0eb4def426d90f5d722b7e61ef811083775d29apr-devel-1.3.9-5.el6_9.1.x86_64.rpm45fcd0885e71519e4d820b5ed01727effc622abc922b2a3f3bb945bfb91e2a27apr-1.3.9-5.el6_9.1.x86_64.rpma9ae85030d5c0638adf9411de2d021aea673602b034d006008b65e03a76cbe85SLSA-2017:3278-1Security Fix(es): * A use-after-free flaw was found in the way samba servers handled certain SMB1 requests. An unauthenticated attacker could send specially-crafted SMB1 requests to cause the server to crash or execute arbitrary code. (CVE-2017-14746) * A memory disclosure flaw was found in samba. An attacker could retrieve parts of server memory, which could contain potentially sensitive data, by sending specially-crafted requests to the samba server. (CVE-2017-15275)importantScientific Linux FermiScientific Linux Fermi 6samba4-client-4.2.10-12.el6_9.x86_64.rpm7b183f6fe6eb725dbbd5943f31a55d7668f9ef067081926cadd76d1a21a893e9samba4-pidl-4.2.10-12.el6_9.x86_64.rpma3d0b87c1798e26c4f9636c86a6b55aa9d6b3f1d90fad4cce647f0b3ad50fad2samba4-libs-4.2.10-12.el6_9.x86_64.rpm8b7f086507f47597a42a6d4a5ff2c1ebb11faa42f178da5f305f9a37df0e02bbsamba4-dc-libs-4.2.10-12.el6_9.x86_64.rpm4968f038452791c26bbd57ca050f04c46c1335d303d4c3fd643855d116ff8f84samba4-winbind-4.2.10-12.el6_9.x86_64.rpm54f796c3496a8a6dda5b5da8c283ce50c82b71cfd9457a04559310dbd197c6e6samba4-test-4.2.10-12.el6_9.x86_64.rpmdd954d069272761f3afbf606043112999e0eb403827163912ffda29f50dd6517samba4-python-4.2.10-12.el6_9.x86_64.rpm48f918bb679041fbe8bd22ab0a7d15544dad446c44e68a306e8785e01b79496esamba4-winbind-clients-4.2.10-12.el6_9.x86_64.rpmf8b351d6fbe8e5ec5891de8ad58acc13c0422e45e8c9fce8df483625e260156csamba4-common-4.2.10-12.el6_9.x86_64.rpm27571fce0a169f39a0b0facc053cf672868402d3a06d8ec82dbedab5eb1bfaecsamba4-winbind-krb5-locator-4.2.10-12.el6_9.x86_64.rpmd903b9f9a53b076fae24f0a370750d65e43ed2937c8e59a384e274d5f782a7d8samba4-dc-4.2.10-12.el6_9.x86_64.rpmfc35f7a4a83a5fdb4ee5c0801baf00db5d87c01b972f7d49ff53ac8f2970c3d9samba4-4.2.10-12.el6_9.x86_64.rpm335a00b192e63715a76a85e2e4962092283db76c33a9af6f9f405240ad3ddb76samba4-devel-4.2.10-12.el6_9.x86_64.rpm3c9b5814e956b30c4b8a47aafa5ecefdf82568131dc4cc836466d849a0e93228SLSA-2017:3372-1This update upgrades Thunderbird to version 52.5.0. Security Fix(es): * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2017-7826, CVE-2017-7828, CVE-2017-7830)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-52.5.0-1.el6_9.x86_64.rpmf68c286a22a6b878b8b4a52f97be464797a07bed7da712e9c21cadac9bcb0004SLSA-2017:3382-1This update upgrades Firefox to version 52.5.1 ESR. Security Fix(es): * A privacy flaw was discovered in Firefox. In Private Browsing mode, a web worker could write persistent data to IndexedDB, which was not cleared when exiting and would persist across multiple sessions. A malicious website could exploit the flaw to bypass private-browsing protections and uniquely fingerprint visitors. (CVE-2017-7843)importantScientific Linux FermiScientific Linux Fermi 6firefox-52.5.1-1.el6_9.i686.rpm9e71dc27fea2298deb8b2d4d285f2221def7abf3772c7c3993da937037251d5dfirefox-52.5.1-1.el6_9.x86_64.rpm6051ed256b7086dc705ffa9c8f61f06a3ae4660cb45ab1190d9650a50c95f458SLSA-2017:3392-1Security Fix(es): * Multiple flaws were discovered in the RMI and Hotspot components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions. (CVE-2017-10285, CVE-2017-10346) * It was discovered that the Kerberos client implementation in the Libraries component of OpenJDK used the sname field from the plain text part rather than encrypted part of the KDC reply message. A man-in-the- middle attacker could possibly use this flaw to impersonate Kerberos services to Java applications acting as Kerberos clients. (CVE-2017-10388) * It was discovered that the Security component of OpenJDK generated weak password-based encryption keys used to protect private keys stored in key stores. This made it easier to perform password guessing attacks to decrypt stored keys if an attacker could gain access to a key store. (CVE-2017-10356) * Multiple flaws were found in the Smart Card IO and Security components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2017-10274, CVE-2017-10193) * It was found that the FtpClient implementation in the Networking component of OpenJDK did not set connect and read timeouts by default. A malicious FTP server or a man-in-the-middle attacker could use this flaw to block execution of a Java application connecting to an FTP server. (CVE-2017-10355) * It was found that the HttpURLConnection and HttpsURLConnection classes in the Networking component of OpenJDK failed to check for newline characters embedded in URLs. An attacker able to make a Java application perform an HTTP request using an attacker provided URL could possibly inject additional headers into the request. (CVE-2017-10295) * It was discovered that the Security component of OpenJDK could fail to properly enforce restrictions defined for processing of X.509 certificate chains. A remote attacker could possibly use this flaw to make Java accept certificate using one of the disabled algorithms. (CVE-2017-10198) * It was discovered that multiple classes in the JAXP, Serialization, Libraries, and JAX-WS components of OpenJDK did not limit the amount of memory allocated when creating object instances from the serialized form. A specially-crafted input could cause a Java application to use an excessive amount of memory when deserialized. (CVE-2017-10349, CVE-2017-10357, CVE-2017-10347, CVE-2017-10281, CVE-2017-10345, CVE-2017-10348, CVE-2017-10350) Bug Fix(es): * Previously, OpenJDK could not handle situations when the kernel blocked on a read even when polling the socket indicated that a read is possible. As a consequence, OpenJDK could hang indefinitely. With this update, OpenJDK polls with a timeout and performs a non-blocking read on success, and it no longer hangs in these situations.importantScientific Linux FermiScientific Linux Fermi 6java-1.7.0-openjdk-src-1.7.0.161-2.6.12.0.el6_9.x86_64.rpm567e63008ceae46cb86fa859b565c7c8cff04c77c4536a1aa9bfdd8d39124407java-1.7.0-openjdk-demo-1.7.0.161-2.6.12.0.el6_9.x86_64.rpm1b395d3860959a10db5177637a6d589473c7d15020358f1dd2bb8eed3e7803fejava-1.7.0-openjdk-javadoc-1.7.0.161-2.6.12.0.el6_9.noarch.rpm0546099399c7a1e7f1a31e39884d901b09a424aa4cfe1c778714a9e6e527e7b2java-1.7.0-openjdk-devel-1.7.0.161-2.6.12.0.el6_9.x86_64.rpm1f359e3f2fa729a42ed0bab200d24ac73d45408f95aa635b3e99173021271e18java-1.7.0-openjdk-1.7.0.161-2.6.12.0.el6_9.x86_64.rpm12feeb29976247aab21af38064c6bb41865b84b959bf7f0023fe80a877fce566SLSA-2018:0008-1Security Fix(es): An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimization). There are three primary variants of the issue which differ in the way the speculative execution can be exploited. Note: This issue is present in hardware and cannot be fully fixed via software update. The updated kernel packages provide software mitigation for this hardware issue at a cost of potential performance penalty. The performance impact of these patches may vary considerably based on workload and hardware configuration. In this update mitigations for x86-64 architecture are provided. Variant CVE-2017-5753 triggers the speculative execution by performing a bounds-check bypass. It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory accesses may cause allocation into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to cross the syscall boundary and read privileged memory by conducting targeted cache side-channel attacks. (CVE-2017-5753, Important) Variant CVE-2017-5715 triggers the speculative execution by utilizing branch target injection. It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory accesses may cause allocation into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to cross the syscall and guest/host boundaries and read privileged memory by conducting targeted cache side-channel attacks. (CVE-2017-5715, Important) Variant CVE-2017-5754 relies on the fact that, on impacted microprocessors, during speculative execution of instruction permission faults, exception generation triggered by a faulting access is suppressed until the retirement of the whole instruction block. In a combination with the fact that memory accesses may populate the cache even when the block is being dropped and never committed (executed), an unprivileged local attacker could use this flaw to read privileged (kernel space) memory by conducting targeted cache side-channel attacks. (CVE-2017-5754, Important) Note: CVE-2017-5754 affects Intel x86-64 microprocessors. AMD x86-64 microprocessors are not affected by this issue.importantScientific Linux FermiScientific Linux Fermi 6kernel-debug-2.6.32-696.18.7.el6.x86_64.rpm8f6f62e5c3ac9c6ab5e120145ab63cbe17f5744e4f8974a605b1f411752ced87kernel-headers-2.6.32-696.18.7.el6.x86_64.rpmef983206c6529426b2425d5381008565e5f00fae491fe321dcce39038f9ffdc6kernel-debug-devel-2.6.32-696.18.7.el6.i686.rpm960a36ac27e122c13b8571ad7752ffd6b830592219f1a2826155c1c8aac26f78kernel-devel-2.6.32-696.18.7.el6.x86_64.rpm4a46825a86bf8bdbef957d7ef13bfd82e3b83805fd18c736818a213a2e8ef637python-perf-2.6.32-696.18.7.el6.x86_64.rpm862f2d0c97e3d1fe5a996dfbb01865e160b8ab78d3ef3b5ed5280c1cac5a1d64kernel-doc-2.6.32-696.18.7.el6.noarch.rpm38165086edde4ebb7d2022909e3e4173c327f9870a69e788cb3e5cb54e6c2068kernel-debug-devel-2.6.32-696.18.7.el6.x86_64.rpm7ef5346641d744e0e5e8be206c1e424130685101ed08ed29178546b66fac0143kernel-2.6.32-696.18.7.el6.x86_64.rpm7192cd5472a5e49d7ae87dc506f06e2120b8c94c3718d92ea41df07cf0616981perf-2.6.32-696.18.7.el6.x86_64.rpm902a21cb4a514d610cbdf20cdf2b505670d3680bcd05c5b86d3c0c250b32f964kernel-firmware-2.6.32-696.18.7.el6.noarch.rpmf6a846095d12822036604909ee078ed1de46aa50ce5038e93335a868b331cc4akernel-abi-whitelists-2.6.32-696.18.7.el6.noarch.rpmea8f54717c1b946365f59c6c7dd52181bd0e9ec7328e4cb2a75454053e7c4d19SLSA-2018:0013-1Security Fix(es): * An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimization). There are three primary variants of the issue which differ in the way the speculative execution can be exploited. Variant CVE-2017-5715 triggers the speculative execution by utilizing branch target injection. It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory accesses may cause allocation into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to cross the syscall and guest/host boundaries and read privileged memory by conducting targeted cache side-channel attacks. (CVE-2017-5715) Note: This is the microcode counterpart of the CVE-2017-5715 kernel mitigation.importantScientific Linux FermiScientific Linux Fermi 6microcode_ctl-1.17-25.2.el6_9.x86_64.rpmb2f168095934368cf4a32ea164deef10ef5e243c4ec3d361a68f5dab7e124feeSLSA-2018:0024-1Security Fix(es): * An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimization). There are three primary variants of the issue which differ in the way the speculative execution can be exploited. Variant CVE-2017-5715 triggers the speculative execution by utilizing branch target injection. It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory accesses may cause allocation into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to cross the syscall and guest/host boundaries and read privileged memory by conducting targeted cache side-channel attacks. (CVE-2017-5715) Note: This is the qemu-kvm side of the CVE-2017-5715 mitigation.importantScientific Linux FermiScientific Linux Fermi 6qemu-kvm-0.12.1.2-2.503.el6_9.4.x86_64.rpmb9111f615ed00b16598ed70b6886ead500a77fadac0c3bdabf76f614d72996b5qemu-guest-agent-0.12.1.2-2.503.el6_9.4.x86_64.rpma4fd19f22e361db3aa4704cde5616aa6de26880a5c54789599ae1aeabdd3b166qemu-kvm-tools-0.12.1.2-2.503.el6_9.4.x86_64.rpm621c289c07e9f4ecd79ecd2b2e3cfe83e5ec62fa81399f19dad22fd9a9d4fd0cqemu-img-0.12.1.2-2.503.el6_9.4.x86_64.rpm3376af6b24b2fa3e954e229cf91b17aba866044273ec6fa9b8bcfa003fdcde8bSLSA-2018:0030-1Security Fix(es): * An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimization). There are three primary variants of the issue which differ in the way the speculative execution can be exploited. Variant CVE-2017-5715 triggers the speculative execution by utilizing branch target injection. It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory accesses may cause allocation into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to cross the syscall and guest/host boundaries and read privileged memory by conducting targeted cache side-channel attacks. (CVE-2017-5715) Note: This is the libvirt side of the CVE-2017-5715 mitigation.importantScientific Linux FermiScientific Linux Fermi 6libvirt-lock-sanlock-0.10.2-62.el6_9.1.x86_64.rpm8c3075e664ed1ee4613909e3bcdf40ac106481b8623a068a82b6b98c1448e938libvirt-0.10.2-62.el6_9.1.x86_64.rpm6319a5930c7bf6082ba81c1d082d56feacb4df0cba573cc7e0a13d3da73d9cc3libvirt-client-0.10.2-62.el6_9.1.i686.rpm0c214f9dc23f74366e7b81ec6a83481470a248fd63856b733fb3683515a4406blibvirt-devel-0.10.2-62.el6_9.1.i686.rpm2c8093d006167a5a5603b0a421cd0c04fdac1f373a41396a829e1af085e95805libvirt-client-0.10.2-62.el6_9.1.x86_64.rpm1ab9d21e80aaf6f840478316c2dc88d38a45b65a8286440c0eb3a4c560a1c8balibvirt-python-0.10.2-62.el6_9.1.x86_64.rpm18b8f079ef7a1d98ccdda1f63632166670755a44a9926b12584cf11cf8f18d20libvirt-devel-0.10.2-62.el6_9.1.x86_64.rpma0f029afd8833b80d4b283ffb3c08419fd9d85fe09ce348f123d5c58b4b59672SLSA-2018:0061-1This update upgrades Thunderbird to version 52.5.2. Security Fix(es): * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2017-7846, CVE-2017-7847, CVE-2017-7848, CVE-2017-7829)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-52.5.2-1.el6_9.x86_64.rpmb3b6adfae0f9749847863bb8f344a21cf07fedecfc5b2a3148072ed653bd9062SLSA-2018:0093-1This update supersedes the previous microcode update provided with the CVE-2017-5715 (Spectre) CPU branch injection vulnerability mitigation. Further testing has uncovered problems with the microcode provided along with the Spectre mitigation that could lead to system instabilities. As a result, this microcode update reverts to the last known good microcode version dated before 03 January 2018. You should contact your hardware provider for the latest microcode updates. IMPORTANT: If you are using Intel Skylake-, Broadwell-, and Haswell-based platforms, obtain and install updated microcode from your hardware vendor immediately. The "Spectre" mitigation requires both an updated kernel and updated microcode from your hardware vendor.importantScientific Linux FermiScientific Linux Fermi 6microcode_ctl-1.17-25.4.el6_9.x86_64.rpm4adde7e3694a811a1ae42a94d4d8eb65ed5aac28261393c493c04a98e513aa96SLSA-2018:0095-1Security Fix(es): * Multiple flaws were found in the Hotspot and AWT components of OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2018-2582, CVE-2018-2641) * It was discovered that the LDAPCertStore class in the JNDI component of OpenJDK failed to securely handle LDAP referrals. An attacker could possibly use this flaw to make it fetch attacker controlled certificate data. (CVE-2018-2633) * The JGSS component of OpenJDK ignores the value of the javax.security.auth.useSubjectCredsOnly property when using HTTP/SPNEGO authentication and always uses global credentials. It was discovered that this could cause global credentials to be unexpectedly used by an untrusted Java application. (CVE-2018-2634) * It was discovered that the JMX component of OpenJDK failed to properly set the deserialization filter for the SingleEntryRegistry in certain cases. A remote attacker could possibly use this flaw to bypass intended deserialization restrictions. (CVE-2018-2637) * It was discovered that the LDAP component of OpenJDK failed to properly encode special characters in user names when adding them to an LDAP search query. A remote attacker could possibly use this flaw to manipulate LDAP queries performed by the LdapLoginModule class. (CVE-2018-2588) * It was discovered that the DNS client implementation in the JNDI component of OpenJDK did not use random source ports when sending out DNS queries. This could make it easier for a remote attacker to spoof responses to those queries. (CVE-2018-2599) * It was discovered that the I18n component of OpenJDK could use an untrusted search path when loading resource bundle classes. A local attacker could possibly use this flaw to execute arbitrary code as another local user by making their Java application load an attacker controlled class file. (CVE-2018-2602) * It was discovered that the Libraries component of OpenJDK failed to sufficiently limit the amount of memory allocated when reading DER encoded input. A remote attacker could possibly use this flaw to make a Java application use an excessive amount of memory if it parsed attacker supplied DER encoded input. (CVE-2018-2603) * It was discovered that the key agreement implementations in the JCE component of OpenJDK did not guarantee sufficient strength of used keys to adequately protect generated shared secret. This could make it easier to break data encryption by attacking key agreement rather than the encryption using the negotiated secret. (CVE-2018-2618) * It was discovered that the JGSS component of OpenJDK failed to properly handle GSS context in the native GSS library wrapper in certain cases. A remote attacker could possibly make a Java application using JGSS to use a previously freed context. (CVE-2018-2629) * It was discovered that multiple classes in the Libraries, AWT, and JNDI components of OpenJDK did not sufficiently validate input when creating object instances from the serialized form. A specially-crafted input could cause a Java application to create objects with an inconsistent state or use an excessive amount of memory when deserialized. (CVE-2018-2663, CVE-2018-2677, CVE-2018-2678) * It was discovered that multiple encryption key classes in the Libraries component of OpenJDK did not properly synchronize access to their internal data. This could possibly cause a multi-threaded Java application to apply weak encryption to data because of the use of a key that was zeroed out. (CVE-2018-2579) Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website.importantScientific Linux FermiScientific Linux Fermi 6java-1.8.0-openjdk-src-1.8.0.161-3.b14.el6_9.x86_64.rpm6f8ae3f75f04f7dbc1b4200280c21149e3ed8a2d499fc7141405e2edbefe2ae6java-1.8.0-openjdk-headless-debug-1.8.0.161-3.b14.el6_9.x86_64.rpm49e15e91fa11b1e22a8701ff969ba274d90114db38a063ad3ade21223de8f949java-1.8.0-openjdk-devel-debug-1.8.0.161-3.b14.el6_9.x86_64.rpm9e14100dad0d72ddb0f8b10935aac4c78d44c58cf835311f52fe0cdb634ac5a9java-1.8.0-openjdk-javadoc-1.8.0.161-3.b14.el6_9.noarch.rpmfcd6546b6a231dc626409c62df1f3ae0c9342ae9429f77162e7feb191b5f445cjava-1.8.0-openjdk-debug-1.8.0.161-3.b14.el6_9.x86_64.rpmfbb8cf7c9bc8a29dde3069cc766265c5f50ad87fa3bf6d6a85a0eac7ee41de11java-1.8.0-openjdk-demo-debug-1.8.0.161-3.b14.el6_9.x86_64.rpmb4621e839c2dbf27034caebbe9b4899c98c267a68153cdbc81cd12589d61fad2java-1.8.0-openjdk-devel-1.8.0.161-3.b14.el6_9.x86_64.rpm51b3ddf9887f13019e8572dd3c089bf6e84503ef8a936ab0fe77da23dc79e42cjava-1.8.0-openjdk-src-debug-1.8.0.161-3.b14.el6_9.x86_64.rpm1e05e172b10ee9ab06c56ac6874b7fc51e274c5bf920aa1690ef690dcc8ccfb7java-1.8.0-openjdk-headless-1.8.0.161-3.b14.el6_9.x86_64.rpm47f1437c1c5b2847d176bc1c01ad940d3b77aeab7b2c9ae1278497196611b1f7java-1.8.0-openjdk-javadoc-debug-1.8.0.161-3.b14.el6_9.noarch.rpmc9a147b638abf5482928cb63bd2951ea59ba835e9952131bb37687043e9741f2java-1.8.0-openjdk-1.8.0.161-3.b14.el6_9.x86_64.rpm337e753688d5fdbd7fca5ec441f3d8e1e3c9f5e386e20842a26c21de9658dea2java-1.8.0-openjdk-demo-1.8.0.161-3.b14.el6_9.x86_64.rpm62a97d6eeffeb65d03c171a889ae9b91bdc609ef2edc6e6e6efcdcc392286cb0SLSA-2018:0101-1Security Fix(es): * A use-after-free flaw leading to denial of service was found in the way BIND internally handled cleanup operations on upstream recursion fetch contexts. A remote attacker could potentially use this flaw to make named, acting as a DNSSEC validating resolver, exit unexpectedly with an assertion failure via a specially crafted DNS request. (CVE-2017-3145)importantScientific Linux FermiScientific Linux Fermi 6bind-libs-9.8.2-0.62.rc1.el6_9.5.i686.rpmb7adb73279c3161ea0cbcfbeb610fc17f115f56026c35c0768f68a0598cec7a0bind-9.8.2-0.62.rc1.el6_9.5.x86_64.rpm5eeb04ba9e59811ff036b6bf4f5cdf393e08f97870a877e04b5dce75a9ad66ddbind-chroot-9.8.2-0.62.rc1.el6_9.5.x86_64.rpmbeaf524822333f9b128c4f8ae76820988454cab5956cf9abf5d17cf3be35ad33bind-utils-9.8.2-0.62.rc1.el6_9.5.x86_64.rpm2d0f49ae0bf052b9fb82d98b3f75a179344c5485d20527ebb840a08831609235bind-sdb-9.8.2-0.62.rc1.el6_9.5.x86_64.rpmc0bd04c88a59c0a666cacc29f4ce965d84a6f3bb271c427c4b5a52697744e928bind-libs-9.8.2-0.62.rc1.el6_9.5.x86_64.rpmc2b2c6216eef03b745eac668a4f3ff06b5bde9858d41fbdb562e31dcad0fcc8ebind-devel-9.8.2-0.62.rc1.el6_9.5.x86_64.rpmc04eb327e12cd569a5e9f57526c22146e3e100e4778b5a9a3a57e23b85f42236bind-devel-9.8.2-0.62.rc1.el6_9.5.i686.rpm9058d8aee3ab3f6558003d95fdb7fb54591e32e45845d816e4564714c3991457SLSA-2018:0122-1This update upgrades Firefox to version 52.6.0 ESR. Security Fix(es): * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2018-5089, CVE-2018-5091, CVE-2018-5095, CVE-2018-5096, CVE-2018-5097, CVE-2018-5098, CVE-2018-5099, CVE-2018-5102, CVE-2018-5103, CVE-2018-5104, CVE-2018-5117) * To mitigate timing-based side-channel attacks similar to "Spectre" and "Meltdown", the resolution of performance.now() has been reduced from 5s to 20s.criticalScientific Linux FermiScientific Linux Fermi 6firefox-52.6.0-1.el6_9.i686.rpm5eaee715e80a9dd15bc26733071cca07e4eb56786c5ddc7853c3f33f6ed536ddfirefox-52.6.0-1.el6_9.x86_64.rpmb5d7dadaaa68f55ef0e225bf087c3aeccc2e230e71e889ef4681738d2a20ce7bSLSA-2018:0169-1Security Fix(es): * An integer overflow vulnerability in ip6_find_1stfragopt() function was found. A local attacker that has privileges (of CAP_NET_RAW) to open raw socket can cause an infinite loop inside the ip6_find_1stfragopt() function. (CVE-2017-7542, Moderate) * The IPv6 fragmentation implementation in the Linux kernel does not consider that the nexthdr field may be associated with an invalid option, which allows local users to cause a denial of service (out-of-bounds read and BUG) or possibly have unspecified other impact via crafted socket and send system calls. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely. (CVE-2017-9074, Moderate) * A use-after-free flaw was found in the Netlink functionality of the Linux kernel networking subsystem. Due to the insufficient cleanup in the mq_notify function, a local attacker could potentially use this flaw to escalate their privileges on the system. (CVE-2017-11176, Moderate) Bug Fix(es): * Previously, the default timeout and retry settings in the VMBus driver were insufficient in some cases, for example when a Hyper-V host was under a significant load. Consequently, in Windows Server 2016, Hyper-V Server 2016, and Windows Azure Platform, when running a Scientific Linux Guest on the Hyper-V hypervisor, the guest failed to boot or booted with certain Hyper-V devices missing. This update alters the timeout and retry settings in VMBus, and Scientific Linux guests now boot as expected under the described conditions. * Previously, an incorrect external declaration in the be2iscsi driver caused a kernel panic when using the systool utility. With this update, the external declaration in be2iscsi has been fixed, and the kernel no longer panics when using systool. * Under high usage of the NFSD file system and memory pressure, if many tasks in the Linux kernel attempted to obtain the global spinlock to clean the Duplicate Reply Cache (DRC), these tasks stayed in an active wait in the nfsd_reply_cache_shrink() function for up to 99% of time. Consequently, a high load average occurred. This update fixes the bug by separating the DRC in several parts, each with an independent spinlock. As a result, the load and CPU utilization is no longer excessive under the described circumstances. * When attempting to attach multiple SCSI devices simultaneously, Scientific Linux 6.9 on IBM z Systems sometimes became unresponsive. This update fixes the zfcp device driver, and attaching multiple SCSI devices simultaneously now works as expected in the described scenario. * On IBM z Systems, the tiqdio_call_inq_handlers() function in the Linux kernel incorrectly cleared the device state change indicator (DSCI) for the af_iucv devices using the HiperSockets transport with multiple input queues. Consequently, queue stalls on such devices occasionally occurred. With this update, tiqdio_call_inq_handlers() has been fixed to clear the DSCI only once, prior to scanning the queues. As a result, queue stalls for af_iucv devices using the HiperSockets transport no longer occur under the described circumstances. * Previously, small data chunks caused the Stream Control Transmission Protocol (SCTP) to account the receiver_window (rwnd) values incorrectly when recovering from a "zero-window situation". As a consequence, window updates were not sent to the peer, and an artificial growth of rwnd could lead to packet drops. This update properly accounts such small data chunks and ignores the rwnd pressure values when reopening a window. As a result, window updates are now sent, and the announced rwnd reflects better the real state of the receive buffer.importantScientific Linux FermiScientific Linux Fermi 6kernel-firmware-2.6.32-696.20.1.el6.noarch.rpm98ebd887b572ae5f9cb3c3ce9459836e59fbacde6bfa2cc21ea0c874c00dce7aperf-2.6.32-696.20.1.el6.x86_64.rpmfa172fccba132d280e1267ba3f8674b50ed4f6527c9b50e9794e11a5069cbb87kernel-debug-devel-2.6.32-696.20.1.el6.i686.rpmd7a56b2c86d150d20d3d149e0311bd675585062a572a8290c2ed9e8eae3966f2kernel-headers-2.6.32-696.20.1.el6.x86_64.rpm4b8ec2b9f5f9fed44fb651018ccf2e25d77d14d5477d828ca7a714293972ac91kernel-doc-2.6.32-696.20.1.el6.noarch.rpm98dcda697b4a49fa6e429456dc1f7cb4d66e4e9afeb255dda140d714073163dckernel-debug-2.6.32-696.20.1.el6.x86_64.rpm87d4e4450e6081e254e90d1d1a7300d41ad8d45a8c9c087b77924ef2b23f2e55kernel-abi-whitelists-2.6.32-696.20.1.el6.noarch.rpmebae57cf0e3745f917ff6c403181cd9f995ff43e0a46e4a8f70a1e000f2ad87akernel-2.6.32-696.20.1.el6.x86_64.rpm9f3d3b3e4e06c34b89dd4633d1729b03ccdb5f0ea5e39db2359750b193607261python-perf-2.6.32-696.20.1.el6.x86_64.rpm3c279ea8cd16f262f73b04828d55e423a05d1768889c3b5117d431381d379cb4kernel-devel-2.6.32-696.20.1.el6.x86_64.rpm281274af423f3b616e5155a0c9b90df22ea2f872e57416f00e67089679f8cab9kernel-debug-devel-2.6.32-696.20.1.el6.x86_64.rpm415303b93e346d02d85a2a600fcefdb30d8e623403aa9413ebb4fb87298a7b32SLSA-2018:0262-1This update upgrades Thunderbird to version 52.6.0. Security Fix(es): * Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2018-5089, CVE-2018-5095, CVE-2018-5096, CVE-2018-5097, CVE-2018-5098, CVE-2018-5099, CVE-2018-5102, CVE-2018-5103, CVE-2018-5104, CVE-2018-5117)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-52.6.0-1.el6_9.x86_64.rpm2c8c21d0b9a18f782deeb63bd80f9a7db32c01755f7792a35e4954132bf50192SLSA-2018:0349-1Security Fix(es): * A flaw was found in the AWT component of OpenJDK. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. (CVE-2018-2641) * It was discovered that the LDAPCertStore class in the JNDI component of OpenJDK failed to securely handle LDAP referrals. An attacker could possibly use this flaw to make it fetch attacker controlled certificate data. (CVE-2018-2633) * The JGSS component of OpenJDK ignores the value of the javax.security.auth.useSubjectCredsOnly property when using HTTP/SPNEGO authentication and always uses global credentials. It was discovered that this could cause global credentials to be unexpectedly used by an untrusted Java application. (CVE-2018-2634) * It was discovered that the JMX component of OpenJDK failed to properly set the deserialization filter for the SingleEntryRegistry in certain cases. A remote attacker could possibly use this flaw to bypass intended deserialization restrictions. (CVE-2018-2637) * It was discovered that the LDAP component of OpenJDK failed to properly encode special characters in user names when adding them to an LDAP search query. A remote attacker could possibly use this flaw to manipulate LDAP queries performed by the LdapLoginModule class. (CVE-2018-2588) * It was discovered that the DNS client implementation in the JNDI component of OpenJDK did not use random source ports when sending out DNS queries. This could make it easier for a remote attacker to spoof responses to those queries. (CVE-2018-2599) * It was discovered that the I18n component of OpenJDK could use an untrusted search path when loading resource bundle classes. A local attacker could possibly use this flaw to execute arbitrary code as another local user by making their Java application load an attacker controlled class file. (CVE-2018-2602) * It was discovered that the Libraries component of OpenJDK failed to sufficiently limit the amount of memory allocated when reading DER encoded input. A remote attacker could possibly use this flaw to make a Java application use an excessive amount of memory if it parsed attacker supplied DER encoded input. (CVE-2018-2603) * It was discovered that the key agreement implementations in the JCE component of OpenJDK did not guarantee sufficient strength of used keys to adequately protect generated shared secret. This could make it easier to break data encryption by attacking key agreement rather than the encryption using the negotiated secret. (CVE-2018-2618) * It was discovered that the JGSS component of OpenJDK failed to properly handle GSS context in the native GSS library wrapper in certain cases. A remote attacker could possibly make a Java application using JGSS to use a previously freed context. (CVE-2018-2629) * It was discovered that multiple classes in the Libraries, AWT, and JNDI components of OpenJDK did not sufficiently validate input when creating object instances from the serialized form. A specially-crafted input could cause a Java application to create objects with an inconsistent state or use an excessive amount of memory when deserialized. (CVE-2018-2663, CVE-2018-2677, CVE-2018-2678) * It was discovered that multiple encryption key classes in the Libraries component of OpenJDK did not properly synchronize access to their internal data. This could possibly cause a multi-threaded Java application to apply weak encryption to data because of the use of a key that was zeroed out. (CVE-2018-2579)importantScientific Linux FermiScientific Linux Fermi 6java-1.7.0-openjdk-src-1.7.0.171-2.6.13.0.el6_9.x86_64.rpm3c3a19325378d567133430f0d0f6bb75122ad2928a552298b8f15ce1ef4b237fjava-1.7.0-openjdk-demo-1.7.0.171-2.6.13.0.el6_9.x86_64.rpm567941aabb6d7af5184834681a5092d0ce1a8e6d0a6b14a0b1bb418da4bc933ejava-1.7.0-openjdk-javadoc-1.7.0.171-2.6.13.0.el6_9.noarch.rpm5c27343a2890e6dec0a67673878033699d26c2463f0b0cc8012219c70256ff31java-1.7.0-openjdk-devel-1.7.0.171-2.6.13.0.el6_9.x86_64.rpm6d003bb2557ae91259178085eaecc4ec5c6a99a5b21d9a7c0bb6820e84c2c754java-1.7.0-openjdk-1.7.0.171-2.6.13.0.el6_9.x86_64.rpmdee91c2d675bd7321bd1ea7152ac0e92b9afcbeaf8fb0462a456f95af1d7a0a9SLSA-2018:0469-1Security Fix(es): * dhcp: Buffer overflow in dhclient possibly allowing code execution triggered by malicious server (CVE-2018-5732) * dhcp: Reference count overflow in dhcpd allows denial of service (CVE-2018-5733)importantScientific Linux FermiScientific Linux Fermi 6dhcp-common-4.1.1-53.P1.el6_9.3.x86_64.rpm6a70e3310b2351f52c9d0c22746f83518bf00429c0080a66e2e82baf4176ce2adhclient-4.1.1-53.P1.el6_9.3.x86_64.rpma163b120f4bacfbccdc3829b2f8a0c69fc020fed8151264d54ae231a7f932d65dhcp-devel-4.1.1-53.P1.el6_9.3.i686.rpm3a3ad35eef197bdb31d2155b6ed114088448c6e7ce63b6ef40124c2e1b81fbeadhcp-devel-4.1.1-53.P1.el6_9.3.x86_64.rpmb723d791eb0d6d30a697dccba2b176470e3e74df50f5fa5a7a52416d1ca33aabdhcp-4.1.1-53.P1.el6_9.3.x86_64.rpm1dea3966265e9dc514d1e1f82a2655b9703a8d23a9eff50f928f0869ae05b059SLSA-2018:0504-1Security Fix(es): * mailman: Cross-site scripting (XSS) vulnerability in web UI (CVE-2018-5950)moderateScientific Linux FermiScientific Linux Fermi 6mailman-2.1.12-26.el6_9.3.x86_64.rpm8a2b12497c92e879dd6672b6b661b0e26938780fabce95443030515744d59e34SLSA-2018:0512-1Security Fix(es): * hw: cpu: speculative execution branch target injection (s390-only) (CVE-2017-5715, Important) * hw: cpu: speculative execution bounds-check bypass (s390 and powerpc) (CVE-2017-5753, Important) * hw: cpu: speculative execution permission faults handling (powerpc-only) (CVE-2017-5754) Bug Fixes: * If a fibre channel (FC) switch was powered down and then powered on again, the SCSI device driver stopped permanently the SCSI device's request queue. Consequently, the FC port login failed, leaving the port state as "Bypassed" instead of "Online", and users had to reboot the operating system. This update fixes the driver to avoid the permanent stop of the request queue. As a result, SCSI device now continues working as expected after power cycling the FC switch. * Previously, on final close or unlink of a file, the find_get_pages() function in the memory management sometimes found no pages even if there were some pages left to save. Consequently, a kernel crash occurred when attempting to enter the unlink() function. This update fixes the find_get_pages() function in the memory management code to not return 0 too early. As a result, the kernel no longer crashes due to this behavior. * Using IPsec connections under a heavy load could previously lead to a network performance degradation, especially when using the aesni-intel module. This update fixes the issue by making the cryptd queue length configurable so that it can be increased to prevent an overflow and packet drop. As a result, using IPsec under a heavy load no longer reduces network performance. * Previously, a deadlock in the bnx2fc driver caused all adapters to block and the SCSI error handler to become unresponsive. As a result, data transferring through the adapter was sometimes blocked. This update fixes bnx2fc, and data transferring through the adapter is no longer blocked due to this behavior. * If an NFSv3 client mounted a subdirectory of an exported file system, a directory entry to the mount hosting the export was incorrectly held even after clearing the cache. Consequently, attempts to unmount the subdirectory with the umount command failed with the EBUSY error. With this update, the underlying source code has been fixed, and the unmount operation now succeeds as expected in the described situation. The system must be rebooted for this update to take effect.importantScientific Linux FermitrueScientific Linux Fermi 6kernel-doc-2.6.32-696.23.1.el6.noarch.rpma83b458e5aab21dc60e2b8d864343aa78eb60f7eedb1325a08c932ca825e6a1ckernel-2.6.32-696.23.1.el6.x86_64.rpm0464ecd1d2621b151ba1e88fcd0eeb4201ef056df3560aae9ea8da4a84d1051bkernel-debug-devel-2.6.32-696.23.1.el6.i686.rpmfde2f0cc19ac1cccfcdf15aad251c519b0e25ad3fb1b138bd5c02da24dad8452kernel-debug-devel-2.6.32-696.23.1.el6.x86_64.rpm9324a1852941616c29e93b2cdf1fa9a171cf1fffa0e48ddd36b79fc0b8f23658kernel-devel-2.6.32-696.23.1.el6.x86_64.rpm0ce53338fda2a32768e1a76ce5f435c8b8b18f6c69c1b14700535329acb7373dpython-perf-2.6.32-696.23.1.el6.x86_64.rpm6e450110528df6a66aa46738e485e282a3b61167809e61f5a42b1cafb6fec8aakernel-firmware-2.6.32-696.23.1.el6.noarch.rpm3b84545e6af8f07a12faf5f1655d90f9a92ffc91184849d0401a8eb586c216c3perf-2.6.32-696.23.1.el6.x86_64.rpm58eceb78a58eab4d5c5f76c381c7e817ce535c31e26ad974d01b83a9780690f8kernel-headers-2.6.32-696.23.1.el6.x86_64.rpm00f9402eb1db11077a060725b1da7c2383bac212b31f63d97f97047f5b7336b6kernel-debug-2.6.32-696.23.1.el6.x86_64.rpm57974079a85dbe44fb364ccdadf5809946416a736779f90beb709a3f9c2743c5kernel-abi-whitelists-2.6.32-696.23.1.el6.noarch.rpm37b3ae0497a465b631ccd3984a2a3e9cc798728ed94591faddb5a2a5154e75a3SLSA-2018:0515-1Security Fix(es): * 389-ds-base: remote Denial of Service (DoS) via search filters in SetUnicodeStringFromUTF_8 in collate.c (CVE-2018-1054) * 389-ds-base: Authentication bypass due to lack of size check in slapi_ct_memcmp function in ch_malloc.c (CVE-2017-15135)importantScientific Linux FermiScientific Linux Fermi 6389-ds-base-1.2.11.15-94.el6_9.x86_64.rpm20caeebb3b8c53ec47b3523adf59e59c65568d2383a421bb0dfc523c4a2fe4cf389-ds-base-libs-1.2.11.15-94.el6_9.i686.rpme821576eb92d2d0421b1ce1d07a901ee4eab4f2b13b8c79da6b288eb2d70d686389-ds-base-devel-1.2.11.15-94.el6_9.i686.rpma870a25f0129f999de2c4038ff747b36272bcc38273ec4adf33f55f189b2c4c7389-ds-base-libs-1.2.11.15-94.el6_9.x86_64.rpm86d1f077b831cfe08cd7fd9a8b026476b9a967d9dd9138497b40579d79695637389-ds-base-devel-1.2.11.15-94.el6_9.x86_64.rpm67d0f4c1077604fde86f4d6f7ab3632a0b43eaa56121cda29c647d670941bf3cSLSA-2018:0516-1Security Fix(es): * Qemu: cirrus: OOB access issue in mode4and5 write functions (CVE-2017-15289)moderateScientific Linux FermiScientific Linux Fermi 6qemu-img-0.12.1.2-2.503.el6_9.5.x86_64.rpm347bae3226b80cbb25cb315f14f95c9c1c9bc7d32f4079dc028d023f2e074d49qemu-kvm-0.12.1.2-2.503.el6_9.5.x86_64.rpm6f99f27c902118d0681cd097616f163da4ba32ccd781a70bb3cb5c7e6f5ddad6qemu-kvm-tools-0.12.1.2-2.503.el6_9.5.x86_64.rpmff98e2c4b887a94a8d7124f5799c8003c360f24518fce776298c88386357736eqemu-guest-agent-0.12.1.2-2.503.el6_9.5.x86_64.rpmf1a2d7e30ec93f72fe44ac93e0ab364731aca9dd7c6df8e28adf464e6e237e2aSLSA-2018:0517-1Security Fix(es): * libreoffice: Remote arbitrary file disclosure vulnerability via WEBSERVICE formula (CVE-2018-6871)moderateScientific Linux FermiScientific Linux Fermi 6libreoffice-langpack-ur-4.3.7.2-2.el6_9.2.x86_64.rpm0b53b7319158281cb39a68e6a24d5c956dbcc55cff33ac10b041e18b014ed7b6libreoffice-wiki-publisher-4.3.7.2-2.el6_9.2.x86_64.rpm2a4f9f082c6c9a50d3a10d7aa3bb5f2a2eda6eeee33f4d4e8a5de61ec3826f91libreoffice-pdfimport-4.3.7.2-2.el6_9.2.x86_64.rpm6443c97cff42dcbd6a6c2e46481f804a30e7df19e4b1967cc33e5639ce6ccb48libreoffice-core-4.3.7.2-2.el6_9.2.x86_64.rpm47dde7a5367bb8033407ea32bde4573e5810d58f1f8572665ef412bf19506a9elibreoffice-langpack-el-4.3.7.2-2.el6_9.2.x86_64.rpm48fc9da74e8bd049d04e1526d5e1e361d75bbac27bf6f95a538cb398f959d2d0libreoffice-langpack-zh-Hans-4.3.7.2-2.el6_9.2.x86_64.rpm0b7c629750ac746cdd4ba9aa9bf3996da57e9cdffe5eac904f082cf76dbce0d0libreoffice-langpack-as-4.3.7.2-2.el6_9.2.x86_64.rpm116f58c75ad789f0c10c217bf57710a81f56a793dec45ff71b44f06c55a95674libreoffice-langpack-de-4.3.7.2-2.el6_9.2.x86_64.rpm6779b0b0d27dd4a3f07f8d808cd8d8fd40cd091752f8bb425f84dcfc1c9e2657libreoffice-impress-4.3.7.2-2.el6_9.2.x86_64.rpmdae957cac7942eea2c6636219f96bf6066d3e748b41d907c225585c5526ec3d9autocorr-sv-4.3.7.2-2.el6_9.2.noarch.rpm00e3eb4af210f5cc15bac4cdea98b586180608f10d9cfd7fb31fab14360f8cdflibreoffice-sdk-doc-4.3.7.2-2.el6_9.2.x86_64.rpm29d99a221d3cccf618d751e7ae8ede110c6bb675d0856ccfda85681d1f208a8elibreoffice-langpack-te-4.3.7.2-2.el6_9.2.x86_64.rpm090aab56cb8cb1528e18a7d77ad92c6f4bb6bce7376cc27cbb91da71ba6ad33alibreoffice-langpack-th-4.3.7.2-2.el6_9.2.x86_64.rpmad8c597d8b8aeede9610b8e876d934e28e3db4ac62460d4b9cd55c4a19762c6fautocorr-da-4.3.7.2-2.el6_9.2.noarch.rpmf28eddacdd774794afabc519000d144813a26dbf2c369060b74dab097e3c0a23libreoffice-langpack-ve-4.3.7.2-2.el6_9.2.x86_64.rpm523a8d23b755a13fb968fb90e4ad8c5fc2d3de44fd1ae5d0866918c57c5345f0libreoffice-pyuno-4.3.7.2-2.el6_9.2.x86_64.rpm77e50080a9d13110394c245c9e644d647dad8db73e2d65675125c41069e633d4libreoffice-langpack-ms-4.3.7.2-2.el6_9.2.x86_64.rpm238c4a0574112eaa0d43233625432750933b65b8351058b08be528e16f914aeflibreoffice-langpack-ja-4.3.7.2-2.el6_9.2.x86_64.rpm27cda1421e1aa155d31bc3b4b0091f34bb9592f3292120345e70b2eba756239eautocorr-sr-4.3.7.2-2.el6_9.2.noarch.rpm9f7dfca069fb4910d291bcef31817de150c33c4411319bead5a0109bb65ee31fautocorr-sl-4.3.7.2-2.el6_9.2.noarch.rpm3212c04e361fa5ea8766337dfecae30c980db089b83ff8a30b0ffc2472fa01d8libreoffice-langpack-ca-4.3.7.2-2.el6_9.2.x86_64.rpmc75219a8d6f2ebc766178b11ca48497b505db8b6a48ee125ff39143e4100f1e7libreoffice-langpack-ml-4.3.7.2-2.el6_9.2.x86_64.rpme5fcb8dc206d5de8bed7bf7ca79389bd537736db32542fc00c69cc360977d54flibreoffice-xsltfilter-4.3.7.2-2.el6_9.2.x86_64.rpmf23cbdf6ec389920321137cb39a639c450bfe64426b9d5cdb077fcf5934e9fb1autocorr-zh-4.3.7.2-2.el6_9.2.noarch.rpmfa2d9941d28e6cb34e5a0bb598e8d641c6e9671a9e7d3b1080c29d487590dd45autocorr-en-4.3.7.2-2.el6_9.2.noarch.rpm5e8b3d4c8c4ecbb091b52384ef443c157d01b80375355017f98945af1a17cb1blibreoffice-langpack-gl-4.3.7.2-2.el6_9.2.x86_64.rpm021c041c5dd93648f766cf5dc2d71f3c12743cd122f2ad711facbdf452dd4c8blibreoffice-langpack-nso-4.3.7.2-2.el6_9.2.x86_64.rpme0473f843632f65982c9d5e8141f3c975414f711e7f16a3bc4de5453b7f15e6dlibreoffice-gdb-debug-support-4.3.7.2-2.el6_9.2.x86_64.rpmd257164b79445aed4046010a6da4fd19507c036e83fc23ca9a2d67c03b35b7e3libreoffice-opensymbol-fonts-4.3.7.2-2.el6_9.2.noarch.rpm02e0a9c46fa554aa4ef70ee9575008af88152c8fb9726eb6eafa92e44240bc34libreoffice-filters-4.3.7.2-2.el6_9.2.x86_64.rpm72bdded8b58d72cbc518083162902974259a9cc77c3084112036ac2f8179471fautocorr-ja-4.3.7.2-2.el6_9.2.noarch.rpmc5f940e92cb5cf5bd6a95aa33ae30984916d2d28d58ce1b26850c66bd400d4c5autocorr-ca-4.3.7.2-2.el6_9.2.noarch.rpm8a1e8d9bbd091699026e11ec9549b5d1c0a12c5d158c78e095c7092165c2436alibreoffice-langpack-bn-4.3.7.2-2.el6_9.2.x86_64.rpm0bb9ae24acf77f29be9e69abcbc56b67590f24e2789244d8f470d97caeba37e3libreoffice-langpack-es-4.3.7.2-2.el6_9.2.x86_64.rpmf92931e1c40a79e9353dd183a21a5ccc6c18303d4d581e1ba7f0b41ae12ce975libreoffice-langpack-hi-4.3.7.2-2.el6_9.2.x86_64.rpm91ba2b276baaada72b631112582ba69b6bba542936ea7aea2c3e27f6e03addb4libreoffice-langpack-pt-BR-4.3.7.2-2.el6_9.2.x86_64.rpmacb8a7e0417f63b537dfe55b200925fcc22628ecaa14283b12a2ff5bad8547d4autocorr-hr-4.3.7.2-2.el6_9.2.noarch.rpm966c01897c9f59773e12e949df00f6931e4fc1c322f57ab0f0db43321168304clibreoffice-glade-4.3.7.2-2.el6_9.2.x86_64.rpma8358a0f21132255d833263e398f0ccbfc733f6acdff04c0aea6446e1ff2fe0dlibreoffice-langpack-uk-4.3.7.2-2.el6_9.2.x86_64.rpmd0ff1ef369fbb414bd40a20fbebc3ca86fbd75a52a71d92081c42a047d455777libreoffice-langpack-sl-4.3.7.2-2.el6_9.2.x86_64.rpmd1b06a0b0f59a8a89da3262806ec2f970479d52df720e94a2034737f41782e90libreoffice-langpack-lt-4.3.7.2-2.el6_9.2.x86_64.rpmdbf371a17db800bacf08a1e0ac0abcffa959c8f4af7434558eff61417069707blibreoffice-langpack-en-4.3.7.2-2.el6_9.2.x86_64.rpmbee77b4492e988c1a7ff3d2b67d00dbcdd65cada1fe9d2e5f3a7d2728ece466clibreoffice-ure-4.3.7.2-2.el6_9.2.x86_64.rpmbcc48daf4057ed3bfb9ffbab0188a4036982ae8352be4468b0fbd2f935f0f4e6autocorr-sk-4.3.7.2-2.el6_9.2.noarch.rpm2435c49dfacae726996d7cb99ae65ae58ca2a9799aa669fddd105c89d36af4a1autocorr-fa-4.3.7.2-2.el6_9.2.noarch.rpm0866460539d922b1b78168ab2fc3ce40a44fbb2740445811017741cdc41828c4autocorr-es-4.3.7.2-2.el6_9.2.noarch.rpm2cd0b0ffebe54ad00994e75d4119d006d2418fa103466b460a53888867764573libreoffice-gdb-debug-support-4.3.7.2-2.el6_9.2.i686.rpmbfb1bc193f33dd22c13450c5e948a53560880519420198b9c326ae1112c49248libreoffice-langpack-nl-4.3.7.2-2.el6_9.2.x86_64.rpm3be5658570cc8314e0abe651e4fac8148f8cf6cccf23fded835cd836bc1428eclibreoffice-langpack-ta-4.3.7.2-2.el6_9.2.x86_64.rpmb0d8f0c973b782ef48ff4c7fa650ef9522f42c8aded8c1bff55c5acae02a68d9autocorr-mn-4.3.7.2-2.el6_9.2.noarch.rpm1e89ce10c05e0ef3bf34984e0b1a8b6848a586f91c0df2b185f36165c348ea66libreoffice-bsh-4.3.7.2-2.el6_9.2.x86_64.rpm98d7e2a341c886e481782f224429da4a118352a803f149bb9bd7e6a91ec344e9libreoffice-langpack-pt-PT-4.3.7.2-2.el6_9.2.x86_64.rpm136c3427255a62287113d18fbac69d24d009f8c4d76a575aadb629b0e1291c3cautocorr-af-4.3.7.2-2.el6_9.2.noarch.rpm1779f02445472502c8dd0aba04c1f045c6fef5bbad42a191811ec0d059e5def4autocorr-ga-4.3.7.2-2.el6_9.2.noarch.rpm93b019125f117ab97b371211177f4c9cb9b8344abfff5f3fe79b5a2ae9987fb0autocorr-tr-4.3.7.2-2.el6_9.2.noarch.rpmce0648ee5cb5156b6ed08d63fa1bce12e41c667db9e718e25b7300b17f9ac8eblibreoffice-langpack-ro-4.3.7.2-2.el6_9.2.x86_64.rpm146664c68c2f95cd2a731781e582ea8a765edb21775985d3358499b4fbb13355libreoffice-graphicfilter-4.3.7.2-2.el6_9.2.x86_64.rpm487e43c0a70407fb394b63869ea1bb0d54894a503de2afba3796842ad95a0c58libreoffice-langpack-or-4.3.7.2-2.el6_9.2.x86_64.rpm10899ad3fc6f26e94767651efb970bd94907c64581005bf1d04c16d599459879autocorr-ro-4.3.7.2-2.el6_9.2.noarch.rpm3ec716faa7e738d98a9317ec32c9d6b5825dee13f4072918cb18f3b3f39b7596libreoffice-sdk-4.3.7.2-2.el6_9.2.x86_64.rpm1e0d268d939b7d30647770cf8437c17b979ab87fdade964acec1f427947cc171autocorr-de-4.3.7.2-2.el6_9.2.noarch.rpm8bbe98676251c1133100612384b5379108ceec52e64f0080f116baafbeb70d79libreoffice-langpack-ts-4.3.7.2-2.el6_9.2.x86_64.rpm48bb95999817124df1134e46cfb5795ba2b32e607c07f65d5aa1331602bb27b5libreoffice-langpack-tr-4.3.7.2-2.el6_9.2.x86_64.rpm5c6748f628d9add0afb07506f2398d2aabcb0aab3454b434cd6135148b7ea0aclibreoffice-langpack-hr-4.3.7.2-2.el6_9.2.x86_64.rpm6d7a4f04e7dd913f7f0b49191e5e26902e5a7dedd94315556e5f69ec278de026libreoffice-headless-4.3.7.2-2.el6_9.2.x86_64.rpm1b2601dad447ccc25d57b82ec6df61c35f1d44706cb27be7b49a1a524a381825libreoffice-langpack-eu-4.3.7.2-2.el6_9.2.x86_64.rpm78ede41ecf5b1395e99b41a3362bd3b76caba8210b75fb7f253365ecdef5280cautocorr-fi-4.3.7.2-2.el6_9.2.noarch.rpm5c77988f644c65ccabc585552a5bce739a7e2e4d878231eda221f6682added82libreoffice-langpack-nn-4.3.7.2-2.el6_9.2.x86_64.rpm869d6589f026f13d374ad4882d8072a5a8d52ef525b7d381a0c3a3ddd0c4b359libreoffice-langpack-zh-Hant-4.3.7.2-2.el6_9.2.x86_64.rpmb416155d976bfd324d4ffea1ad42bdfaa219974d41dff1b91f96395b02dc094dlibreoffice-langpack-dz-4.3.7.2-2.el6_9.2.x86_64.rpm1cad4e4e2b2d42cb826117ba9d8c7e52b805cafe57002c9218b0e4dc6aaa3320autocorr-cs-4.3.7.2-2.el6_9.2.noarch.rpm899318dab871b62869f0545ad4b623e7705c4d5050bdd936ba67e3c7f623c01elibreoffice-langpack-sv-4.3.7.2-2.el6_9.2.x86_64.rpme85c30f0233b988bf1f9e9ec211acf5719e7cb00a7335f80e229634335064c78autocorr-nl-4.3.7.2-2.el6_9.2.noarch.rpmb9cd37beae376871174296dfca9fa1e5fdd1a27eef92357e6e2092fb919c1a2elibreoffice-4.3.7.2-2.el6_9.2.x86_64.rpm86d66e000678f88cc954d61413430fb494178a4686a5c47bc6b1685691860f9clibreoffice-langpack-mr-4.3.7.2-2.el6_9.2.x86_64.rpm4baf65674ead37226fde0bdebfb0b20f7d0c8dd3e9c1506cfd1fac5f2cbe3209libreoffice-rhino-4.3.7.2-2.el6_9.2.x86_64.rpm606f334cf348fbf4590fa3b7c4a81011a91716fe43895bd6ac91fa689a0d96f2libreoffice-writer-4.3.7.2-2.el6_9.2.x86_64.rpmb544ed9c0b4427a937504c25fa447eb3f1cf7d97817ad2eda8e45c76c0f34a79libreoffice-math-4.3.7.2-2.el6_9.2.x86_64.rpm92b9eb40a7f8bceb3730a1818be89d2e9a39cad0c63a6adf724ad8a0ad51293dautocorr-pl-4.3.7.2-2.el6_9.2.noarch.rpm87e5ca390955a352a38f4987a80419577ad6cbda41a434daf836093b0e70e7bclibreoffice-langpack-tn-4.3.7.2-2.el6_9.2.x86_64.rpmefeaf5cbf739200420b8409547cde426876f226e53b9f5ca196795903f21d3adautocorr-ko-4.3.7.2-2.el6_9.2.noarch.rpmcdf61029bbdcca5094c5edcf105d5904e606e05c0d7acccd29b1e79da9714561libreoffice-langpack-cs-4.3.7.2-2.el6_9.2.x86_64.rpmf4ef59f9659b61d63c90c1ff2205c0e3070423446aa54bd379dc2f18c78736dflibreoffice-officebean-4.3.7.2-2.el6_9.2.x86_64.rpmf0e389c18bb79714afb21983f4af9a487528843180829581fcc951b9b830ba20autocorr-lt-4.3.7.2-2.el6_9.2.noarch.rpmca4a92227919a5711fff6b6db4a1d378d5fe7582e37fb945c4bfe65ab712b8e8autocorr-bg-4.3.7.2-2.el6_9.2.noarch.rpm92db82a8e8c950155b8571cbc7ebd26d0348972eaf7f4725b366201ad89d304blibreoffice-langpack-pa-4.3.7.2-2.el6_9.2.x86_64.rpm038ef5902bde75fc9ebbef6a811b7dad03c8366fb8f7a2621c2ce5442a319c59libreoffice-langpack-ru-4.3.7.2-2.el6_9.2.x86_64.rpm9f35feab30290188624cd38b61c006e116f133187f20f9d19e7b3341e2930c90autocorr-hu-4.3.7.2-2.el6_9.2.noarch.rpmfc3459db7defd86d9b3746aff76c5d03fd74202c732b0b9e4803bfa43e24f1edautocorr-pt-4.3.7.2-2.el6_9.2.noarch.rpm0edb19bf9e8fb5c204fb417db185de2e01d6a8bdef07976cd612407d81b3564elibreoffice-langpack-fr-4.3.7.2-2.el6_9.2.x86_64.rpm90fd16f043a2f40ffc9ff6a35f7b3f8afdc59f8c97f66a9fcc1c9f50aa967f48libreoffice-langpack-hu-4.3.7.2-2.el6_9.2.x86_64.rpm74b5ef6cce45e98448e5597e90ffb92ca3e3a178ab0d75ec12d7b3e40d001c48libreoffice-langpack-et-4.3.7.2-2.el6_9.2.x86_64.rpm4e5c23092e6965bd3f21116eda4766a0dd0f8433505479be1d2a5c89679b7bf0autocorr-is-4.3.7.2-2.el6_9.2.noarch.rpm771a4ce81d0cc1cd9c098e7cb4c9a19982f305d75a9032ad6c8dafe0cae08ee7libreoffice-langpack-kn-4.3.7.2-2.el6_9.2.x86_64.rpmd5c195f2ec37037e7a6d75c990066184670d8150de61381b96c290c5bd2dcb5dlibreoffice-base-4.3.7.2-2.el6_9.2.x86_64.rpm724cffbf811130bbf2e9df699e96624d40813bb76058b1282cad58a215b97120libreoffice-langpack-ar-4.3.7.2-2.el6_9.2.x86_64.rpmcabe7e5a06cba1e2d5ca5740b2019cd31ff09e03ecfa0d2d294fa6fae5a1899clibreoffice-langpack-pl-4.3.7.2-2.el6_9.2.x86_64.rpmc90dafc255e688bb733b263955628c79e12a361a83dd566157d4afaf054f84falibreoffice-ogltrans-4.3.7.2-2.el6_9.2.x86_64.rpm6c90804e8d86df80ae6834eced582b00079027c810b9c7ac7f05cff7eba00f22autocorr-vi-4.3.7.2-2.el6_9.2.noarch.rpme61e6e0bfa61c1660b319ba2cad568580874ecd1fd205cc7b4d9e4d36c0a539dlibreoffice-draw-4.3.7.2-2.el6_9.2.x86_64.rpm3d1361daf7f5c72eeb5c12eb9f570c705295c9e1dd23bb6d5debb5296f19ee7dlibreoffice-langpack-sk-4.3.7.2-2.el6_9.2.x86_64.rpm3ffee3bbaec3774d7d8d26e46d80406bbc74af2df52ddb61fb15980cd63517delibreoffice-langpack-xh-4.3.7.2-2.el6_9.2.x86_64.rpm8edd05da9eadcaf884a18da5b0f434d512f275a9dfb57d6241774ca907d1f518autocorr-ru-4.3.7.2-2.el6_9.2.noarch.rpm5a9268a8d11cc4fab8c7354cbc0f259fbff7a7e4a54049d09d514d41c62e0f48libreoffice-emailmerge-4.3.7.2-2.el6_9.2.x86_64.rpm3a562dc40ef3d1bdb3f958272156a4864a2d6d9c6ee9fc1920a7ea0b72409793libreoffice-nlpsolver-4.3.7.2-2.el6_9.2.x86_64.rpm2fbb6e29a496e80eb17229f8dd33dd3ee0838f0e9414ad57dca190d972040417libreoffice-langpack-af-4.3.7.2-2.el6_9.2.x86_64.rpm83fa6077661bfeec4d36ac3fb0291874a4281c13e460bc391f45b466e6e17141autocorr-lb-4.3.7.2-2.el6_9.2.noarch.rpme882fabad6bd7f861272db588eca579f183d33a4168c74d2f47543b7a3662462autocorr-it-4.3.7.2-2.el6_9.2.noarch.rpm9f3ec06d354e14d8a2abc5c9f701257791d90e2a2c87728d3fb103b46f937e00libreoffice-langpack-sr-4.3.7.2-2.el6_9.2.x86_64.rpm00d6b752600b20818fefc1d2e74760210ffbcc9f4f923e6d508f06344e3d349clibreoffice-calc-4.3.7.2-2.el6_9.2.x86_64.rpmd598b2cd21831f42fb13c94b2547670b1c3de65fc4a4035d131028086af16b27libreoffice-langpack-st-4.3.7.2-2.el6_9.2.x86_64.rpm51681ca2fbd0449f6133a99174c483d5e6fddd57ac8b602e09715cf2d9ec9691libreoffice-langpack-he-4.3.7.2-2.el6_9.2.x86_64.rpm6937a108a8d0a098bbcf950086fce5a4f8b3b41987883a9c02e1ceea6ab60442libreoffice-langpack-nr-4.3.7.2-2.el6_9.2.x86_64.rpmaab9485ce0675e6d8e30cf007b99826b5c818db7aa4540750617ad6e00c0e929libreoffice-langpack-fi-4.3.7.2-2.el6_9.2.x86_64.rpm7aa2ba3248756a85d71f56c729baae638749da57407d00d49c9a8c7c38aa07f3libreoffice-langpack-cy-4.3.7.2-2.el6_9.2.x86_64.rpm476fef15e077f7699024feb2c39b5ed773721c09576985207317463de83135a7autocorr-fr-4.3.7.2-2.el6_9.2.noarch.rpm5b3338887a92651835381ae29f0f3b6bd7d4ddd97c73ff91ed8be0e1e7aeb975libreoffice-langpack-ko-4.3.7.2-2.el6_9.2.x86_64.rpmc8a41a009fcbfe9fdf7fa0221f64fa4b8345b07826cb852936d4687da3de459flibreoffice-langpack-zu-4.3.7.2-2.el6_9.2.x86_64.rpmca53a14d2e8afb284525d239996f0cf6e5bad97e96aa4460ee29b44c723582f1libreoffice-langpack-mai-4.3.7.2-2.el6_9.2.x86_64.rpm46134f0a34bd1e8dd3f23b0f36aafb6b28dc20899004f0b794aebfd178990d97libreoffice-librelogo-4.3.7.2-2.el6_9.2.x86_64.rpm41bb6fdb7afa5d13b2dfaeee00f8548ce9682fa1b8d0bcfe66f60eb18e6ebfbblibreoffice-langpack-nb-4.3.7.2-2.el6_9.2.x86_64.rpme1f518bafe5eb07d051f1ec5fa2ad31c2a282a783cb7c8587b637cf08d25d79clibreoffice-langpack-gu-4.3.7.2-2.el6_9.2.x86_64.rpm2ba301e04876cfe067006ccf350186bb374461e5b2e1323ec10cac946a3e0faalibreoffice-langpack-it-4.3.7.2-2.el6_9.2.x86_64.rpmbaa5eeb101474ff96e61e9f995ff36cc3356b806c2d01995f0ebe479230b6274libreoffice-langpack-ga-4.3.7.2-2.el6_9.2.x86_64.rpm2d5564f7eee12c6e2668aad40323717623b5eb5be67f61e8e7967544297a7222libreoffice-langpack-da-4.3.7.2-2.el6_9.2.x86_64.rpm4427283473adff0f7b3b166810ae37cefeb74a90e501c1cbde68d10a3ea44147libreoffice-langpack-bg-4.3.7.2-2.el6_9.2.x86_64.rpm308f55c997aceb415f559465ead90963ac1f29f208423af88cc54b188d1758f3libreoffice-langpack-ss-4.3.7.2-2.el6_9.2.x86_64.rpmd1f2f930385219790675aee45a59798d416df498044cedc06525508aabca411cSLSA-2018:0526-1This update upgrades Firefox to version 52.7.0 ESR. Security Fix(es): * Mozilla: Memory safety bugs fixed in Firefox 59 and Firefox ESR 52.7 (MFSA 2018-07) (CVE-2018-5125) * Mozilla: Buffer overflow manipulating SVG animatedPathSegList (MFSA 2018-07) (CVE-2018-5127) * Mozilla: Out-of-bounds write with malformed IPC messages (MFSA 2018-07) (CVE-2018-5129) * Mozilla: Mismatched RTP payload type can trigger memory corruption (MFSA 2018-07) (CVE-2018-5130) * Mozilla: Fetch API improperly returns cached copies of no-store/no-cache resources (MFSA 2018-07) (CVE-2018-5131) * Mozilla: Integer overflow during Unicode conversion (MFSA 2018-07) (CVE-2018-5144) * Mozilla: Memory safety bugs fixed in Firefox ESR 52.7 (MFSA 2018-07) (CVE-2018-5145)criticalScientific Linux FermiScientific Linux Fermi 6firefox-52.7.0-1.el6_9.i686.rpm4201d53f3c1a865a056ce4dafaea019acf711a771912664fb02ea4a350fddc60firefox-52.7.0-1.el6_9.x86_64.rpmc015e0579feacd95e22743170daea120486955bd925027e61a37a56328b31113SLSA-2018:0549-1This update upgrades Firefox to version 52.7.2 ESR. Security Fix(es): * Mozilla: Vorbis audio processing out of bounds write (MFSA 2018-08) (CVE-2018-5146)criticalScientific Linux FermiScientific Linux Fermi 6firefox-52.7.2-1.el6_9.x86_64.rpme4192d6c84a53def245a16e1a8fbafbddecd5aa7ce69341c349a14e3cae2da84firefox-52.7.2-1.el6_9.i686.rpmfc5b3d8818d9055493251c433d07946942e3c7cd9ad2b604ed70172833bf7864SLSA-2018:0647-1This update upgrades Thunderbird to version 52.7.0. Security Fix(es): * Mozilla: Memory safety bugs fixed in Firefox 59 and Firefox ESR 52.7 (MFSA 2018-07) (CVE-2018-5125) * Mozilla: Memory safety bugs fixed in Firefox ESR 52.7 (MFSA 2018-07) (CVE-2018-5145) * Mozilla: Vorbis audio processing out of bounds write (MFSA 2018-08) (CVE-2018-5146) * Mozilla: Buffer overflow manipulating SVG animatedPathSegList (MFSA 2018-07) (CVE-2018-5127) * Mozilla: Out-of-bounds write with malformed IPC messages (MFSA 2018-07) (CVE-2018-5129) * Mozilla: Integer overflow during Unicode conversion (MFSA 2018-07) (CVE-2018-5144)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-52.7.0-1.el6_9.x86_64.rpmc2560db5647cb5f9c9067d0170b4e56672f01502958940b7fa2a1e0537d072b8SLSA-2018:0649-1Security Fix(es): * Mozilla: Vorbis audio processing out of bounds write (MFSA 2018-08) (CVE-2018-5146)importantScientific Linux FermiScientific Linux Fermi 6libvorbis-devel-1.2.3-5.el6_9.1.x86_64.rpme5c442b6eef3ca9c525eba53110d70ac1fb5e61fbd591d7abdc0e882d6a2fe76libvorbis-1.2.3-5.el6_9.1.x86_64.rpm3572c0f516d971e1a698f23274edfe03e968ba3c1f140e99ab56357a3dee5a60libvorbis-1.2.3-5.el6_9.1.i686.rpm6bae94f8d08ae08fb3da67090ee61204e786c79ef6ea6425e22425ea31b424c6libvorbis-devel-docs-1.2.3-5.el6_9.1.noarch.rpme933d99a851c5f2e5b684c348d8c6d9936c3cf4bcb0a6b8feefaaafe2746e2a1libvorbis-devel-1.2.3-5.el6_9.1.i686.rpm800568f1205d4d9954c1b2fe6abf010836dc4482cd691dcf59da2c756bcb5664SLSA-2018:1098-1This update upgrades Firefox to version 52.7.3 ESR. Security Fix(es): * firefox: Use-after-free in compositor potentially allows code execution (CVE-2018-5148)importantScientific Linux FermiScientific Linux Fermi 6firefox-52.7.3-1.el6_9.i686.rpma09fca73677c6fe4c2b12be583ba6c92c7dba6a04d0ddf55b82d8247731509a9firefox-52.7.3-1.el6_9.x86_64.rpmeebaba950771df2cf4277a5bab6880018d724f19d8a3a2dac76f1d85774f1017SLSA-2018:1124-1Security Fix(es): * python-paramiko: Authentication bypass in transport.py (CVE-2018-7750)criticalScientific Linux FermiScientific Linux Fermi 6python-paramiko-1.7.5-4.el6_9.noarch.rpm12b0d3f739598adc24cc4c8f3da4a5cd0e86de68fd66c22507a500a789df4690SLSA-2018:1188-1Security Fix(es): * OpenJDK: incorrect handling of Reference clones can lead to sandbox bypass (Hotspot, 8192025) (CVE-2018-2814) * OpenJDK: unrestricted deserialization of data from JCEKS key stores (Security, 8189997) (CVE-2018-2794) * OpenJDK: insufficient consistency checks in deserialization of multiple classes (Security, 8189977) (CVE-2018-2795) * OpenJDK: unbounded memory allocation during deserialization in PriorityBlockingQueue (Concurrency, 8189981) (CVE-2018-2796) * OpenJDK: unbounded memory allocation during deserialization in TabularDataSupport (JMX, 8189985) (CVE-2018-2797) * OpenJDK: unbounded memory allocation during deserialization in Container (AWT, 8189989) (CVE-2018-2798) * OpenJDK: unbounded memory allocation during deserialization in NamedNodeMapImpl (JAXP, 8189993) (CVE-2018-2799) * OpenJDK: RMI HTTP transport enabled by default (RMI, 8193833) (CVE-2018-2800) * OpenJDK: unbounded memory allocation during deserialization in StubIORImpl (Serialization, 8192757) (CVE-2018-2815) * OpenJDK: incorrect merging of sections in the JAR manifest (Security, 8189969) (CVE-2018-2790) Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website.criticalScientific Linux FermiScientific Linux Fermi 6java-1.8.0-openjdk-demo-debug-1.8.0.171-3.b10.el6_9.x86_64.rpm2930c9a23fca719fd84b2d384e653f7a5dee7bf3695d49c3c31a97a6a4b70b09java-1.8.0-openjdk-devel-debug-1.8.0.171-3.b10.el6_9.x86_64.rpm8563d2e3a0d1c7080764aaea46920dc862a20aede643d186dd2fea8ba5d3d8ecjava-1.8.0-openjdk-src-1.8.0.171-3.b10.el6_9.x86_64.rpm8242c51f35c62cfb1c9a214bf3dc6df81952f3f8e202a1d1d367c862c88d24f2java-1.8.0-openjdk-headless-1.8.0.171-3.b10.el6_9.x86_64.rpm43f8a1ca1e0260600a7e41309ee0c17020bf2d7aecdc589ee79bf2a27a23e843java-1.8.0-openjdk-src-debug-1.8.0.171-3.b10.el6_9.x86_64.rpme329c85e1f6b30d8a080e9d115bf24da9f7b0fe278861066bf2508731fd01884java-1.8.0-openjdk-javadoc-debug-1.8.0.171-3.b10.el6_9.noarch.rpm26836c5f40cf4d75552ded8f602f0e3da735ae21c0ad6c31536f9f28d921cfbdjava-1.8.0-openjdk-headless-debug-1.8.0.171-3.b10.el6_9.x86_64.rpm6b80307e3cbba27e1960d85d8a0e8e3028ad5eca47c5b98d81b6d618edf1dba2java-1.8.0-openjdk-javadoc-1.8.0.171-3.b10.el6_9.noarch.rpm24b3f44d102792a3d5e5da9911924e5260175376124f67e6a2824271e01159d6java-1.8.0-openjdk-1.8.0.171-3.b10.el6_9.x86_64.rpm9614ab4b5a2a7106d8d17c2f134e6f8e9588871ef463d47975adf9e6177bac58java-1.8.0-openjdk-demo-1.8.0.171-3.b10.el6_9.x86_64.rpma630f95c63508cd2f6a6f4b3b40115b5f52f286eecc4da27746a8c8338332badjava-1.8.0-openjdk-devel-1.8.0.171-3.b10.el6_9.x86_64.rpm6434067ff9bd9c0b6392ca825521b7c222f75baa3c9c9bea310b15a070cd11c8java-1.8.0-openjdk-debug-1.8.0.171-3.b10.el6_9.x86_64.rpmb80f6b7825a6a1ddb17100021e2987130717dc5637c81919c5ea172a77f0cdf2SLSA-2018:1199-1Patch should be installed because it is a common way of upgrading applications. Security Fix(es): * patch: Malicious patch files cause ed to execute arbitrary commands (CVE-2018-1000156)importantScientific Linux FermiScientific Linux Fermi 6patch-2.6-8.el6_9.x86_64.rpma7a172af3b79c6e569efa06e2fd34838474415b39c263e2608787e13328c988dSLSA-2018:1225-1Security Fix(es): * librelp: Stack-based buffer overflow in relpTcpChkPeerName function in src/tcp.c (CVE-2018-1000140)criticalScientific Linux FermiScientific Linux Fermi 6librelp-devel-1.2.7-3.el6_9.1.i686.rpm9acda4ddbc02530ecfbc5e7a779fbf429b2fd0ea3ae728f8a85561e2d3fcff12librelp-devel-1.2.7-3.el6_9.1.x86_64.rpm274271a69d4436cb2d7c3f57739653b4d1373590ac370a96060e21be24e8f607librelp-1.2.7-3.el6_9.1.x86_64.rpmd8dba2cfc6ca8165f4723e09c83851f94a8c6ff34c735a9ffc77f22377d78068librelp-1.2.7-3.el6_9.1.i686.rpmf010f33f7c239107289afc57ba1a727114df6ac8f0fcf11136ef9a0de49b19afSLSA-2018:1270-1Security Fix(es): * OpenJDK: incorrect handling of Reference clones can lead to sandbox bypass (Hotspot, 8192025) (CVE-2018-2814) * OpenJDK: unrestricted deserialization of data from JCEKS key stores (Security, 8189997) (CVE-2018-2794) * OpenJDK: insufficient consistency checks in deserialization of multiple classes (Security, 8189977) (CVE-2018-2795) * OpenJDK: unbounded memory allocation during deserialization in PriorityBlockingQueue (Concurrency, 8189981) (CVE-2018-2796) * OpenJDK: unbounded memory allocation during deserialization in TabularDataSupport (JMX, 8189985) (CVE-2018-2797) * OpenJDK: unbounded memory allocation during deserialization in Container (AWT, 8189989) (CVE-2018-2798) * OpenJDK: unbounded memory allocation during deserialization in NamedNodeMapImpl (JAXP, 8189993) (CVE-2018-2799) * OpenJDK: RMI HTTP transport enabled by default (RMI, 8193833) (CVE-2018-2800) * OpenJDK: unbounded memory allocation during deserialization in StubIORImpl (Serialization, 8192757) (CVE-2018-2815) * OpenJDK: incorrect merging of sections in the JAR manifest (Security, 8189969) (CVE-2018-2790)importantScientific Linux FermiScientific Linux Fermi 6java-1.7.0-openjdk-devel-1.7.0.181-2.6.14.1.el6_9.x86_64.rpm0344a003993ac0736dc60f6b411fffddd2c188fb763f092f407a413fb9a09ad7java-1.7.0-openjdk-javadoc-1.7.0.181-2.6.14.1.el6_9.noarch.rpma6fc3f473c1ba129b72cb00bfcd1763fe1ffa88a14cc68f030a8d1ab3bed5684java-1.7.0-openjdk-demo-1.7.0.181-2.6.14.1.el6_9.x86_64.rpm7904a54a4471cf6cc22ab497b9902fb3702d096094ef6adc3ffc180684b4ebeajava-1.7.0-openjdk-1.7.0.181-2.6.14.1.el6_9.x86_64.rpma01d75037611581d26d5e468da2aeffde1aee6fd5751242a295074ae98e41d4cjava-1.7.0-openjdk-src-1.7.0.181-2.6.14.1.el6_9.x86_64.rpm93d293bc34d804a215797ac9e9d939429a22fd7632a76ad532e24d047b6f39dcSLSA-2018:1319-1Security Fix(es): * hw: cpu: speculative execution permission faults handling (CVE-2017-5754) * Kernel: error in exception handling leads to DoS (CVE-2018-8897) * kernel: nfsd: Incorrect handling of long RPC replies (CVE-2017-7645) * kernel: Use-after-free vulnerability in DCCP socket (CVE-2017-8824) * kernel: v4l2: disabled memory access protection mechanism allowing privilege escalation (CVE-2017-13166) * kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c (CVE-2017-18017) * kernel: Stack information leak in the EFS element (CVE-2017-1000410)importantScientific Linux FermiScientific Linux Fermi 6kernel-2.6.32-696.28.1.el6.x86_64.rpm64be88f8a9b003b6146091c5656f13608fcab44e396d8a9fc077baca7e5ae5c3kernel-doc-2.6.32-696.28.1.el6.noarch.rpm003c50cde22c363878d37d01366349a19d4acaa164be8a6d1146db6716312965perf-2.6.32-696.28.1.el6.x86_64.rpmea928f295a07e9a34e8321acb4cd1eb1c1fbbb19c80261b9fb83a8724ae6241akernel-headers-2.6.32-696.28.1.el6.x86_64.rpm890cee9a36658a4fde7374ca088f0c0711e2af2ab76ac04971f761a348fcb280kernel-debug-2.6.32-696.28.1.el6.x86_64.rpm7fe3d478358fcac0493ba3e0ce758f1c9fa3ec80e9cd081ab89732fa6a2ebcd1kernel-abi-whitelists-2.6.32-696.28.1.el6.noarch.rpmb87cc02e2060ed38c25bc43969183e3a1280510a55bff57d9adaa9847a7f426cpython-perf-2.6.32-696.28.1.el6.x86_64.rpme060534b8f2ee11a0be5548eb078c2f744585cb9a9c3538ca1801224ffc01f20kernel-devel-2.6.32-696.28.1.el6.x86_64.rpm089719939c8f9c1eadaf89fd6e84acd4d718b3a873dcce4bc15ccce795b97f88kernel-debug-devel-2.6.32-696.28.1.el6.x86_64.rpma0299aa22b2be57361ff34b6485622b4dc0d228ce3db528bada7a836b0082be4kernel-firmware-2.6.32-696.28.1.el6.noarch.rpm9fc57ca05209098a97c89b731751d8cd2b1bce16397550c932bb3d07b222611ckernel-debug-devel-2.6.32-696.28.1.el6.i686.rpmd114698c004b569573741b86e6ce507f9d102383d71e35e05aa201411455aa74SLSA-2018:1364-1Security Fix(es): * 389-ds-base: ns-slapd crash via large filter value in ldapsearch (CVE-2018-1089)importantScientific Linux FermiScientific Linux Fermi 6389-ds-base-1.2.11.15-95.el6_9.x86_64.rpm1303279cb28487c5a04c088f6780a1483f6631891b588ba7b01f8adde19fbc33389-ds-base-devel-1.2.11.15-95.el6_9.x86_64.rpm5fd616727b853f8388fc383a356e6d3503a92bcdcec96508951bef5c8291f4f0389-ds-base-libs-1.2.11.15-95.el6_9.x86_64.rpm514db51249d46e8a4f65ea2408dcf0085f9bef1c372bdf0b521b7f060e69a98b389-ds-base-devel-1.2.11.15-95.el6_9.i686.rpmc0cd6119beb9aa7e9846a5f34a021707f6eecd94ac7ce4416658e08c443e973d389-ds-base-libs-1.2.11.15-95.el6_9.i686.rpm8ba998d1ded9611278827da587eee7aa6bd26f943998ff7a476cc32d4b50980cSLSA-2018:1414-1This update upgrades Firefox to version 52.8.0 ESR. Security Fix(es): * Mozilla: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8 (CVE-2018-5150) * Mozilla: Backport critical security fixes in Skia (CVE-2018-5183) * Mozilla: Use-after-free with SVG animations and clip paths (CVE-2018-5154) * Mozilla: Use-after-free with SVG animations and text paths (CVE-2018-5155) * Mozilla: Same-origin bypass of PDF Viewer to view protected PDF files (CVE-2018-5157) * Mozilla: Malicious PDF can inject JavaScript into PDF Viewer (CVE-2018-5158) * Mozilla: Integer overflow and out-of-bounds write in Skia (CVE-2018-5159) * Mozilla: Lightweight themes can be installed without user interaction (CVE-2018-5168) * Mozilla: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension (CVE-2018-5178)criticalScientific Linux FermiScientific Linux Fermi 6firefox-52.8.0-1.el6_9.i686.rpmb75131c0c26b4e995d2c4784f009bdb10e98f74fa1ccdfcfcd2d191f10b54e0cfirefox-52.8.0-1.el6_9.x86_64.rpm72507e7ea1ee12f566056de17f6638cde0484d151a9d4b51d795c999c4564e08SLSA-2018:1454-1Security Fix(es): * A command injection flaw was found in the NetworkManager integration script included in the DHCP client packages in Scientific Linux. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol. (CVE-2018-1111)criticalScientific Linux FermiScientific Linux Fermi 6dhcp-4.1.1-53.P1.el6_9.4.x86_64.rpm305d1bd16149443526b339cb977fc9e05221b2daf4a4a70b47395b420e9b959edhcp-devel-4.1.1-53.P1.el6_9.4.i686.rpm10a54c59ebfe3895bc787bb77829e875a0cbfab53bd61f118f6793b0a17e6f7cdhclient-4.1.1-53.P1.el6_9.4.x86_64.rpm59466e5cce78cee1ff8eb54d6e715c0eea370a06e5c9a6388727f108dbd54414dhcp-common-4.1.1-53.P1.el6_9.4.x86_64.rpmc9dce1f9f9c830a47294a8fab9738e36a5d9c3910ee0284504baa8220554c167dhcp-devel-4.1.1-53.P1.el6_9.4.x86_64.rpm1288100fe6f4776b8243a35106e69fd941903b57199987082cefb7bf74511e4eSLSA-2018:1647-1Security Fix(es): * An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization). It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to read privileged memory by conducting targeted cache side-channel attacks. (CVE-2018-3639) Note: This is the OpenJDK side of the CVE-2018-3639 mitigation.importantScientific Linux FermiScientific Linux Fermi 6java-1.7.0-openjdk-src-1.7.0.181-2.6.14.8.el6_9.x86_64.rpmb5b14e6c45eb411f47b38eeca31d76fb707ae2013e84092aa92dc657e7e01eacjava-1.7.0-openjdk-demo-1.7.0.181-2.6.14.8.el6_9.x86_64.rpm03ee8578192ea0cb8c794bdaf5f1f5da68e2b927cda3f591ec979b19a38083d1java-1.7.0-openjdk-1.7.0.181-2.6.14.8.el6_9.x86_64.rpm73083d0c2b3a717ec2630f780aaa4a6d4d9185b4c4876cabf644af3f082cafb2java-1.7.0-openjdk-devel-1.7.0.181-2.6.14.8.el6_9.x86_64.rpmbb93475e390863b4b42db7cbd601c79faab60c236cabbbeece0385a116e93072java-1.7.0-openjdk-javadoc-1.7.0.181-2.6.14.8.el6_9.noarch.rpmd618206ce0642907785f6d04977208dfc0ddf89ce50e08f2a1dc8d4171de651aSLSA-2018:1650-1Security Fix(es): * An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization). It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to read privileged memory by conducting targeted cache side-channel attacks. (CVE-2018-3639) Note: This is the OpenJDK side of the CVE-2018-3639 mitigation.importantScientific Linux FermiScientific Linux Fermi 6java-1.8.0-openjdk-headless-1.8.0.171-8.b10.el6_9.x86_64.rpmbae5ec4d0b94d00e6ef7ed65734712d24f94bc8abc1d51e7715a1c10ba25e077java-1.8.0-openjdk-headless-debug-1.8.0.171-8.b10.el6_9.x86_64.rpmc204696e7bdcd2d3e58b5a59f3ea22a3d33e6d370951055b831f7013d7fd5658java-1.8.0-openjdk-demo-1.8.0.171-8.b10.el6_9.x86_64.rpm8baf02be106e1d5a052c39cdb7c878b0ec66d8cfe7c1923b9d72370006d0f2b8java-1.8.0-openjdk-devel-debug-1.8.0.171-8.b10.el6_9.x86_64.rpm1dd5a651cbf2b514378cacdd56a07976c012e14124aaa48eed76aec53d0775c8java-1.8.0-openjdk-javadoc-1.8.0.171-8.b10.el6_9.noarch.rpmb4635c1643c713287a9f1402e2a49489414ac01cb9114f8395e5636e9709499ajava-1.8.0-openjdk-debug-1.8.0.171-8.b10.el6_9.x86_64.rpma96b81fb732383e7393d2115f55cd2f6e4ceede6e015875cd0ad5ce891292443java-1.8.0-openjdk-src-1.8.0.171-8.b10.el6_9.x86_64.rpm400c22e69ca8f655db9eec462988ea7cdf3b75f0e9a74c5673bb74f50899f053java-1.8.0-openjdk-javadoc-debug-1.8.0.171-8.b10.el6_9.noarch.rpmd1c6cccbc93d9665b0cb82acfea1a3a0ac6bc07365e5332b63b89bc1aea35113java-1.8.0-openjdk-src-debug-1.8.0.171-8.b10.el6_9.x86_64.rpmdb0c243af007a35c70d7eb048ee1453ecb691c101ddd71dc96a863adec6ca7eejava-1.8.0-openjdk-demo-debug-1.8.0.171-8.b10.el6_9.x86_64.rpm7f455409dea29fa59753fb47b2f094643c59f56d8cab2fdeb9237ea00e6c1135java-1.8.0-openjdk-devel-1.8.0.171-8.b10.el6_9.x86_64.rpmd1effb8e4eefdc1a8aecf1b343ce0e32c30f59c3dceb8a70178d3afc27c11598java-1.8.0-openjdk-1.8.0.171-8.b10.el6_9.x86_64.rpm2f6988162e2badab8b27f38d660c5ea217eacef02be9f1b6de30ff82348a97caSLSA-2018:1651-1Security Fix(es): * An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization). It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to read privileged memory by conducting targeted cache side-channel attacks. (CVE-2018-3639) Note: This issue is present in hardware and cannot be fully fixed via software update. The updated kernel packages provide software side of the mitigation for this hardware issue. To be fully functional, up-to-date CPU microcode applied on the system is required. In this update mitigations for x86 (both 32 and 64 bit) architecture are provided. Bug Fix(es): * Previously, an erroneous code in the x86 kexec system call path caused a memory corruption. As a consequence, the system became unresponsive with the following kernel stack trace: 'WARNING: CPU: 13 PID: 36409 at lib/list_debug.c:59 __list_del_entry+0xa1/0xd0 list_del corruption. prev->next should be ffffdd03fddeeca0, but was (null)' This update ensures that the code does not corrupt memory. As a result, the operating system no longer hangs.importantScientific Linux FermiScientific Linux Fermi 6kernel-firmware-2.6.32-696.30.1.el6.noarch.rpme1e041051fd43c93d0ceea9d42b32ddf16016f7062b6c34bf7fa497780a0e92fkernel-doc-2.6.32-696.30.1.el6.noarch.rpm035109327ad79de0d63188a9f5fedd072e2901be667e75c609240155bea334dekernel-debug-devel-2.6.32-696.30.1.el6.x86_64.rpmca662933fae2447051e1f38702c313b21cb8309525cca3eb8d645dbb1c16bbc8kernel-debug-2.6.32-696.30.1.el6.x86_64.rpm13a7521d0bed7e6395e728d04a2b1ddb222d9d93480be6836f1e28d89bd64829kernel-debug-devel-2.6.32-696.30.1.el6.i686.rpm8d8fdb858b3f4cc2c9c580aa96a24eef82a4bfa77716468148791e3286256812kernel-devel-2.6.32-696.30.1.el6.x86_64.rpmae8d9ae35f533794b4d57f00815f0684a09e27817e024353e1f3727382e56747python-perf-2.6.32-696.30.1.el6.x86_64.rpm83ca89194d7c202d037cbe8c7b7aebc1f2af1179355c2b816f9e11d3788162a5kernel-2.6.32-696.30.1.el6.x86_64.rpmb62406c83632f9456150a4c2ca593879e82108aa3f2faf52e402bce7b30f59faperf-2.6.32-696.30.1.el6.x86_64.rpm1471a03f2f6194a461676acb185efb2e833486cbe87745143894daba4719c473kernel-headers-2.6.32-696.30.1.el6.x86_64.rpm17e3936b34392d1fb7fce9605dd8094aa3418504a1909ac072636d359eb376cdkernel-abi-whitelists-2.6.32-696.30.1.el6.noarch.rpm03931ad87cd7a18b1f355ea0b9865a6e6aa9f0a98756a15e95965ae86f2c07c9SLSA-2018:1660-1Security Fix(es): * An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization). It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to read privileged memory by conducting targeted cache side-channel attacks. (CVE-2018-3639) Note: This is the qemu-kvm side of the CVE-2018-3639 mitigation.importantScientific Linux FermiScientific Linux Fermi 6qemu-kvm-tools-0.12.1.2-2.503.el6_9.6.x86_64.rpme634e8bedb98bbbebdd8bb7a712c6c9ee0bdc1cf51eab668096e30d54af4142cqemu-guest-agent-0.12.1.2-2.503.el6_9.6.x86_64.rpm7317fc5bf3d91e56118b00f87668f7f4cb4c147078ba02b1e98094aae8932cc2qemu-kvm-0.12.1.2-2.503.el6_9.6.x86_64.rpm1005e5dbb2d97b8706d4f0212aeb77d2f3efe74ea4ea7ff8e9ae211074c6d510qemu-img-0.12.1.2-2.503.el6_9.6.x86_64.rpmdc143a8c04c3046361c453b819c63ccada3089c1b6235280c619114d4acb78e7SLSA-2018:1669-1Security Fix(es): * An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization). It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to read privileged memory by conducting targeted cache side-channel attacks. (CVE-2018-3639) Note: This is the libvirt side of the CVE-2018-3639 mitigation.importantScientific Linux FermiScientific Linux Fermi 6libvirt-lock-sanlock-0.10.2-62.el6_9.2.x86_64.rpm307e5691c7650989aa8a3eb43c8f1f3a42f27ab0a8f1070d22c160c4aecc7670libvirt-python-0.10.2-62.el6_9.2.x86_64.rpmdae94a89d38ddb0ac2db7b123e6066ca739b0c26b0781e22a1091cdd7f5a0704libvirt-devel-0.10.2-62.el6_9.2.x86_64.rpm16f0f9a035d7164625e758087f71df68629c67377e0a2feb10a18583e0b863a3libvirt-client-0.10.2-62.el6_9.2.i686.rpm1c16b142cefa444632757eb3c83d9a1e0b58e0ecf0e25c85a8537c15afb040b4libvirt-devel-0.10.2-62.el6_9.2.i686.rpm383835676f08a1c3f7027d2e9f0e353724670baf70e920c34255ad9e48d94b3dlibvirt-0.10.2-62.el6_9.2.x86_64.rpm1afdc13c967a4d16052c5684eef1a70f663fb8fa2ae866d78e3dc2158f651c9dlibvirt-client-0.10.2-62.el6_9.2.x86_64.rpma20035c53fb3f29725d90f143fa8ba0b5570930981f90038c157bb566871d5cbSLSA-2018:1726-1This update upgrades Thunderbird to version 52.8.0. Security Fix(es): * Mozilla: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8 (CVE-2018-5150) * Mozilla: Backport critical security fixes in Skia (CVE-2018-5183) * Mozilla: Use-after-free with SVG animations and clip paths (CVE-2018-5154) * Mozilla: Use-after-free with SVG animations and text paths (CVE-2018-5155) * Mozilla: Integer overflow and out-of-bounds write in Skia (CVE-2018-5159) * Mozilla: Full plaintext recovery in S/MIME via chosen-ciphertext attack (CVE-2018-5184) * Mozilla: Hang via malformed headers (CVE-2018-5161) * Mozilla: Encrypted mail leaks plaintext through src attribute (CVE-2018-5162) * Mozilla: Lightweight themes can be installed without user interaction (CVE-2018-5168) * Mozilla: Filename spoofing for external attachments (CVE-2018-5170) * Mozilla: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension (CVE-2018-5178) * Mozilla: Leaking plaintext through HTML forms (CVE-2018-5185)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-52.8.0-2.el6_9.x86_64.rpm0870134dcd4ee8a693125bc136c0bc0a5f484ce365d999e0fed56f6f452cdc7bSLSA-2018:1777-1Security Fix(es): * procps-ng, procps: Integer overflows leading to heap overflow in file2strvec (CVE-2018-1124) * procps-ng, procps: incorrect integer size in proc/alloc.* leading to truncation / integer overflow issues (CVE-2018-1126)importantScientific Linux FermiScientific Linux Fermi 6procps-3.2.8-45.el6_9.3.i686.rpmb88c8138f44cf91edff2d1ea09b2f5de6bb73694d607ab3b84ca12b4ff0dc710procps-devel-3.2.8-45.el6_9.3.i686.rpm309227022a473b7ab01f647a7375eca48fe7e92650193b3cff540830cd652242procps-devel-3.2.8-45.el6_9.3.x86_64.rpmb0c754b5a7efb38982a41fb2279b8fb7c6315129141b80a4feb5ba3f9337c6dfprocps-3.2.8-45.el6_9.3.x86_64.rpmb8716545b938e138f7dae4d30fcd9f4d486a44d6eed3c426b5d05f737d1569e4SLSA-2018:1779-1Security Fix(es): * xmlrpc: Deserialization of untrusted Java object through <ex:serializable> tag (CVE-2016-5003)importantScientific Linux FermiScientific Linux Fermi 6xmlrpc3-javadoc-3.0-4.17.el6_9.noarch.rpm92394cf322f88556706316499fe137f282aa67a31252745d600d6eaae6413dfexmlrpc3-client-devel-3.0-4.17.el6_9.noarch.rpmfad43ed14d17c02069b65e51ce40fdbaf6ce4333cb659542d48f6a0b67f71cb9xmlrpc3-server-3.0-4.17.el6_9.noarch.rpm7134f5d218f3ee8468fd3224ec373172c78cf0051fb15b32329d7b25650066f0xmlrpc3-client-3.0-4.17.el6_9.noarch.rpm78813af9513e91f82e540b35f15d85ddd266daf6b9a02a0d5656d3c8d5984fcaxmlrpc3-common-3.0-4.17.el6_9.noarch.rpm5ab2504dae5743662d03fdb824cf5947aca23424a667951b1e0236eb7f1c3777xmlrpc3-common-devel-3.0-4.17.el6_9.noarch.rpma6a4631645e71b66da9d849fbe454a721fbb1cee550b624158b3c3ecdfac58a5xmlrpc3-server-devel-3.0-4.17.el6_9.noarch.rpmeb836512ef5a81cc550d7e8642663c429e7e049c06af9b6d7f4cfd7c2e8b7aeaSLSA-2018:1854-1Security Fix(es): * An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization). It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to read privileged memory by conducting targeted cache side-channel attacks. (CVE-2018-3639, PowerPC) * kernel: net/packet: overflow in check for priv area size (CVE-2017-7308) * kernel: AIO interface didn't use rw_verify_area() for checking mandatory locking on files and size of access (CVE-2012-6701) * kernel: AIO write triggers integer overflow in some protocols (CVE-2015-8830) * kernel: Null pointer dereference via keyctl (CVE-2016-8650) * kernel: ping socket / AF_LLC connect() sin_family race (CVE-2017-2671) * kernel: Race condition between multiple sys_perf_event_open() calls (CVE-2017-6001) * kernel: Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c (CVE-2017-7616) * kernel: mm subsystem does not properly enforce the CONFIG_STRICT_DEVMEM protection mechanism (CVE-2017-7889) * kernel: Double free in the inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c (CVE-2017-8890) * kernel: net: sctp_v6_create_accept_sk function mishandles inheritance (CVE-2017-9075) * kernel: net: IPv6 DCCP implementation mishandles inheritance (CVE-2017-9076) * kernel: net: tcp_v6_syn_recv_sock function mishandles inheritance (CVE-2017-9077) * kernel: memory leak when merging buffers in SCSI IO vectors (CVE-2017-12190) * kernel: vfs: BUG in truncate_inode_pages_range() and fuse client (CVE-2017-15121) * kernel: Race condition in drivers/md/dm.c:dm_get_from_kobject() allows local users to cause a denial of service (CVE-2017-18203) * kernel: a null pointer dereference in net/dccp/output.c:dccp_write_xmit() leads to a system crash (CVE-2018-1130) * kernel: Missing length check of payload in net/sctp/sm_make_chunk.c:_sctp_make_chunk() function allows denial of service (CVE-2018-5803)importantScientific Linux FermitrueScientific Linux Fermi 6kernel-devel-2.6.32-754.el6.x86_64.rpmddcb594fc8fe595d065e53100c32750b9366eb9f91362f330bce61f986bde546kernel-headers-2.6.32-754.el6.x86_64.rpm843e7b90bbcc962f5ce389cfee255c2e7a2acf7dfa777a67588f54129f399827perf-2.6.32-754.el6.x86_64.rpmbcc6d4f319540fffa3b477974dc7fc09fc9fbdf3527842cbaa35b9a492f23d66kernel-abi-whitelists-2.6.32-754.el6.noarch.rpmd17fc0ef81add36966c5ad1a52e1ac12d36f7779b6df5d691cc0a59a61415abepython-perf-2.6.32-754.el6.x86_64.rpmfd8848d9408ef1e08c1c051f040fb1cdfcf307c8c8d48f20e44860c89f57f169kernel-firmware-2.6.32-754.el6.noarch.rpm7a17694fb784fd788cd409fd6cd60db8997f9977b902d1262403f61b797a7250kernel-debug-devel-2.6.32-754.el6.i686.rpmb6a454d1ace13f3472144a435b0cd76cdfe9e4724138cbef947085af70b77003kernel-debug-2.6.32-754.el6.x86_64.rpmd942facb8030ccea418d38309a0e7a59e1aff9c83e71a7b228bcc477214b6497kernel-debug-devel-2.6.32-754.el6.x86_64.rpmd368cec4df6faf2dc8e37013023a9c5c86b184e7811d6a98be518e81c64f6ea3kernel-doc-2.6.32-754.el6.noarch.rpmbcab6f050c1497c8639cff2e9864bcb1fb473d29ce480038cc4c713ee447b8b3kernel-2.6.32-754.el6.x86_64.rpmb7afe12b8f0374340a51636372ced152b9f3e155ef23e1029f0f9ef8fea94d89SLSA-2018:1860-1Security Fix(es): * samba: Null pointer indirection in printer server process (CVE-2018-1050)lowScientific Linux FermiScientific Linux Fermi 6samba-client-3.6.23-51.el6.x86_64.rpm52182fee761ce3c98bcf35263df52347f6d9602c379c69d77a7b9d15f03741e0libsmbclient-devel-3.6.23-51.el6.i686.rpmce2339c8bdb1b8d766c28a20286859134d906dbd8c337ede594227f78c5fc624samba-3.6.23-51.el6.x86_64.rpm131f0c23da72b2def8c4f034a13f4c47bd3772abe4d8fc1b0828e8ef73af9d77samba-swat-3.6.23-51.el6.x86_64.rpmad20f7c122b1308b6f361d604e18fa4c097b23a644d23d037128008b0b5c0286libsmbclient-3.6.23-51.el6.i686.rpm67c3f47bb100258ea8f95f5e2d10aeb2e2debab02712eeaa5835835a580a8b14samba-glusterfs-3.6.23-51.el6.x86_64.rpmfba99f64d2873f69d9f782f33992cde203bc3416721c2b43f9e0666dc8a7db43samba-winbind-krb5-locator-3.6.23-51.el6.x86_64.rpm1de2643cb969998b355f2826e2684da595ba50e82779baacd2cc76db2b3f4cacsamba-winbind-clients-3.6.23-51.el6.i686.rpmdfdb41aede3e4d11b49ccf2ab720152da659e2f3c4c077230466a4729decf721libsmbclient-devel-3.6.23-51.el6.x86_64.rpm898871af1b1fa701077e33578a6a8068739e25ce62140bade1f52ee7467347c4samba-common-3.6.23-51.el6.x86_64.rpmb837587af8571ed17d6f1a1cc3ced2924225b0f64fc2f5ef0388f42f8f9aaf1bsamba-doc-3.6.23-51.el6.x86_64.rpm7d5b8b7196b274f0316aa34cf3693023a69ab1866826de14a5cc00b8a356def3samba-winbind-devel-3.6.23-51.el6.x86_64.rpm8d294a28b82730f6e686ac21e0fb874fb902b555d2b47cb4d10817f209735b5fsamba-winbind-3.6.23-51.el6.x86_64.rpm0b843aff3ddc055688f123495e4498968ffe8d07ad2fd35c9e768ccde1453759libsmbclient-3.6.23-51.el6.x86_64.rpm05efb00c3564ce8068ec5cb0e6e7ccc9c8f322cea2895142ef526e76248eb2ccsamba-winbind-clients-3.6.23-51.el6.x86_64.rpm225d5d96edbff089def73ebd0e2ab71482c471224385a0677ff2a4c8670b2a1dsamba-winbind-devel-3.6.23-51.el6.i686.rpme6bc473335acd0f7504939501ea8ee12219cc3114291da2dad44db70b03b663csamba-domainjoin-gui-3.6.23-51.el6.x86_64.rpm61ec4d9fd6bc6c73994e8049f001878eee895660a66fc968d0aa0c86fccf6666samba-common-3.6.23-51.el6.i686.rpmd69ce3ed23a672d751699e73b4f6d41a0f062771a5622a5eee8bd989f7d20359SLSA-2018:1877-1The ding-libs packages contain a set of libraries used by the System Security Services Daemon (SSSD) as well as other projects, and provide functions to manipulate file system path names (libpath_utils), a hash table to manage storage and access time properties (libdhash), a data type to collect data in a hierarchical structure (libcollection), a dynamically growing, reference-counted array (libref_array), and a library to process configuration files in initialization format (INI) into a library collection data structure (libini_config). Security Fix(es): * sssd: unsanitized input when searching in local cache database (CVE-2017-12173)moderateScientific Linux FermiScientific Linux Fermi 6libcollection-devel-0.6.2-13.el6.x86_64.rpmb9e5e08db1bd9cefa113a107c4925d1310b81102306eb414b42577d612a9a0b5libbasicobjects-devel-0.1.1-13.el6.x86_64.rpm5278a4712846c29c32a57bbfeee32f76988a2ad7fa5a39b3ea8b64ec4d8bb34clibbasicobjects-0.1.1-13.el6.x86_64.rpm5eeecf2bf4e0fb52ce1790714d0a63a69701aaa4d46c430dfd5f4c96dab96149libref_array-0.1.4-13.el6.x86_64.rpmc09e06997fc2966267f7d8ff9332b51271715d515dc04458e23aa72b18cde524python-sss-1.13.3-60.el6.x86_64.rpm9c47d08a657a99b31aefd37a01768e8d76569a940405dedb48943c716f261ed0sssd-krb5-1.13.3-60.el6.x86_64.rpmaa0290fe33e9cc6b8b4f7db56f6664df83d3fa7ad1c7068b63794988ef46e87elibref_array-0.1.4-13.el6.i686.rpmd71021432eb17e2ef574e7cb0590d839d20d79087658c114dbf8b7067cffa2b1libdhash-devel-0.4.3-13.el6.x86_64.rpm0853bf7863cf66958af5a2b8da405b5d7ffebd7b86679df8e774f3d4651b77e6libsss_idmap-devel-1.13.3-60.el6.i686.rpmf5228b6ebacd741b0a3332e5342172611ebd46e86a40463548de537c6235919elibini_config-1.1.0-13.el6.x86_64.rpm1f5fddb91ae76107c4fbecb80746e61a2f492cf930976400771cd5e1523d553alibini_config-1.1.0-13.el6.i686.rpm01cef74903ff483de6c4500b261f04a95713f0c0d2bfa1bc22703ba6c76c272elibsss_idmap-1.13.3-60.el6.i686.rpmcdc10f09e6f423127d9488075ff911ba1b5003d9df1e8f7a642220697257edf0libcollection-0.6.2-13.el6.i686.rpmf08224d5daa0b4954a4859f875943889a12ce17510efd1106b452c3198a1cf2alibini_config-devel-1.1.0-13.el6.x86_64.rpm27f3b0a7c7b8c8a530973b46081698916d54577b7309a352d098c9ae39e06cdesssd-common-1.13.3-60.el6.i686.rpmb8eb00d6d2943e6fca6c9d1c5c280c2e2f187d877e602329e0aabdea3e7c4228libipa_hbac-devel-1.13.3-60.el6.x86_64.rpme8b65b3d4385e1e6159969d6979db9b3ef772781fd2622b0a73dee603731bd78sssd-common-pac-1.13.3-60.el6.x86_64.rpm255c41c94d5aead4c4a736318bd66a1efeead83e9b11af0c7aec85b4b038f2d9libsss_idmap-devel-1.13.3-60.el6.x86_64.rpmd343059e80712ec3abb1bf5d9e3f3c7b06f102da1e3fa05232739e64bfb63c85libsss_simpleifp-1.13.3-60.el6.x86_64.rpm01fcaa0f8e3f496b969a79547236d181c4f52d9f98f7d62d5a462a47350aa0fesssd-dbus-1.13.3-60.el6.x86_64.rpm73a53f63186a2dd5f9ddb203032085608aee09fd1e94a321069f6c464d52234esssd-tools-1.13.3-60.el6.x86_64.rpm7dae00cbcceff9d4c2c0623d8c3d07a9c44b25b9d02b787a80d4758212aa7a03libsss_nss_idmap-1.13.3-60.el6.i686.rpmc5f12552619f7f16738987ea98eec9f98950df9efbe6f3e1ef36638c647b6965sssd-client-1.13.3-60.el6.x86_64.rpmba0615ef7074e1cc531abcc8f3cff19411e3e7747d5f79d9342660a1924cce1flibini_config-devel-1.1.0-13.el6.i686.rpm768cab28447cc0e6b09607f85bb9d3ec386b76cd70112a4a3df10495c8922323libpath_utils-0.2.1-13.el6.x86_64.rpmb157a6e66bda75b439d424d9e481c607a97b3803a670e7c9759458307d7de96dsssd-1.13.3-60.el6.x86_64.rpm0c61f96960cfb64e20f204a123e604d7618567801e8a901c1932c16abf3cfebdlibsss_nss_idmap-devel-1.13.3-60.el6.i686.rpm7f4e769c220302573f0da9d326735ed8442241035778e4f776191d782f9f2a31libref_array-devel-0.1.4-13.el6.x86_64.rpmff08e2b391c81ce15e1d530afb70577c75673b2a9ebbe71b381d30a4fa551648sssd-ldap-1.13.3-60.el6.x86_64.rpm28782fa83692c0a19265e3e0dd44f1aa51e5f23cc2b6c0ac27472e7655197919python-libsss_nss_idmap-1.13.3-60.el6.x86_64.rpm3e6d5535e68a43464c262e11624e9691ed8d8706224c933eb4498a7c0514e3bflibdhash-0.4.3-13.el6.x86_64.rpm6e3fb6ed1f41c6f8e6fb7b2b600e2ea6c176ae75661883cc046ccc53d05618f0sssd-proxy-1.13.3-60.el6.x86_64.rpm6659ec07175920701eaf89a2bff46d5be2c0129177cb190ffdafba9edebc291asssd-ad-1.13.3-60.el6.x86_64.rpm9008ddc9bbbb0689acabfe07c8832948a633dd2e8d2ee08a0713d22a6706ab7dlibcollection-devel-0.6.2-13.el6.i686.rpm50d721a6318f8d3f60d56700a2a7166d1ac3e3b96500ab77c09f3acc61fddec0python-libipa_hbac-1.13.3-60.el6.x86_64.rpm5318752c43ed9e06aa47dd37257dd06e4398cac4e5c6d434c3c6cacb8b6fafddlibsss_simpleifp-devel-1.13.3-60.el6.x86_64.rpm516d9c664f1ab8b2bf02a3b00131f1e3d0d5a6cc8e1421b4675b88b5a591a440sssd-common-1.13.3-60.el6.x86_64.rpmb1485042d6b84caf12c8c764ee540c0ce4609262deea049dcaf04a04467089ablibsss_nss_idmap-devel-1.13.3-60.el6.x86_64.rpm1b06ffd8e51a6d6b6c00bbdad484f42a575fb4195f23b191352f7527ee546c02sssd-client-1.13.3-60.el6.i686.rpmeff75ce817bc89f6867bc1a1f74e401a15b3bc9702b72e890ce9544d116df78flibbasicobjects-devel-0.1.1-13.el6.i686.rpm5ebd0accaaac4bdb4152afb870fadac8d4f9c9f1a9bd7cffb5b9e0ff15903596libpath_utils-devel-0.2.1-13.el6.x86_64.rpm8c8e9cabdaf80fb83dae2b0b9c1e5c97d6be7857b4b4ae77e55d32e1c717eb73libpath_utils-0.2.1-13.el6.i686.rpm72b48cfdcda7f1099ec1cc389bc25de0b447180d842933ead9c26fc0a9b45f92libdhash-devel-0.4.3-13.el6.i686.rpmaf8bc0fad701bbf1c52b18aaabe7cb47ded7d5fb465b7a00921f15480b287413libsss_simpleifp-devel-1.13.3-60.el6.i686.rpm3606b9513e98189a575f0635e749688b1b558b9a475802531b359514c993442blibipa_hbac-1.13.3-60.el6.x86_64.rpm04268c9f1ff7eb65c228a8530b96d74357717b517e192c18f15c4409d93c6223libbasicobjects-0.1.1-13.el6.i686.rpmfee246e907116b83200a9581793848a9fbfd868413c345e03bc491bd8dc7a060libipa_hbac-devel-1.13.3-60.el6.i686.rpme7addd4a7e53765d1a51539fc7cd2d74ab19a36567a892b16f1fcf86db60f701libsss_nss_idmap-1.13.3-60.el6.x86_64.rpm2ab99e958512d2c308f6fa00917abeff08d82ed4526dd42c345563ee983b86a9sssd-krb5-common-1.13.3-60.el6.x86_64.rpm120cbec1a2512b25a764182d0be784f42a4b28c1a678bd3bb351e4341c50d8e6python-sssdconfig-1.13.3-60.el6.noarch.rpm79638968776b02d9dc79e64fb23da603d9bdc4c868d8f8d658c60d74d5171d36python-sss-murmur-1.13.3-60.el6.x86_64.rpm73c7895406d3b455e8894d6cbc0c0b676f71cb90da80efa8929364f97c3bfa40libipa_hbac-1.13.3-60.el6.i686.rpmb2ea9419477416c827a1455ddf43b38cfc856557241fe08e740f1831b3cdf329libpath_utils-devel-0.2.1-13.el6.i686.rpm4f1f22ca45e0cb670ff892f0404086918ffea02ccc4624b95845ed226af56d50libcollection-0.6.2-13.el6.x86_64.rpmaa9fd47f04114c67d25260a9c2448c4a246cca0b726ee33cf5aab409dc7f6df9libsss_idmap-1.13.3-60.el6.x86_64.rpm1d9d8afcdf9f365c2c79b36ac72f1e9483bf972d6585a8c0ef3f9e30a3638f00libdhash-0.4.3-13.el6.i686.rpmede915479152cf110a58d829c14cb9b91d3c575fedaba1bdbb9e5879ce17401blibref_array-devel-0.1.4-13.el6.i686.rpm5aef64408024aee64de86cf459f7a6b18b054f90140844252116e5655fadb7e8libsss_simpleifp-1.13.3-60.el6.i686.rpmcd147312cd12904812e7bb40c1bbaf80efecb403675a55728b4b0a76171cfc26sssd-ipa-1.13.3-60.el6.x86_64.rpmfad5dd9371c9ed5fedd68f9c5b659f2f007d4f6981ddefce1ffb46f60ee449c6SLSA-2018:1879-1Security Fix(es): * glibc: Buffer overflow in glob with GLOB_TILDE (CVE-2017-15670) * glibc: Buffer overflow during unescaping of user names with the ~ operator (CVE-2017-15804)moderateScientific Linux FermitrueScientific Linux Fermi 6nscd-2.12-1.212.el6.x86_64.rpm2328b2e2e56ab345a0fc14235632e526e5c996bf00f65700e5bad35750749946glibc-static-2.12-1.212.el6.i686.rpm8ff061c5b0f08f533149e6b5865b3e4c757937bb2ca452cd5a442e1ff8ea746cglibc-common-2.12-1.212.el6.x86_64.rpm8cbc6faf0fc0e8cac35827f1fbff2d6559625ff5ed319bc7ae20dfe93d2d5064glibc-2.12-1.212.el6.x86_64.rpmdd360d904c8415ec6950dbf57e8be5a42cb1e6c2d3adbeb6cc317cd5bbc614aaglibc-2.12-1.212.el6.i686.rpmb3a917a07554eeecfdba21b178d1065641520d2344fe959531764f4dd7c6b212glibc-utils-2.12-1.212.el6.x86_64.rpm9424078757046b1066373cbc8c7c3793af01ce8b0e8c82b141dc08c011412d98glibc-devel-2.12-1.212.el6.x86_64.rpmcb1867aef5a8d08d8eadcb70c4813e3046b0c679cc3faa1091aea35ffb814e7aglibc-static-2.12-1.212.el6.x86_64.rpm02597aab5933bc6ae87de29115242bb0b9a9e1367bf48c33c9c159e9e931e900glibc-headers-2.12-1.212.el6.x86_64.rpm9950c8bffb8b23bf4650712f1003344ba6464be1d9cad560f89c9c333b5b6d03glibc-devel-2.12-1.212.el6.i686.rpmddce190c61321dd829b9ebd171d1c1da4ac0302162de96c44853ca793b48aaa7SLSA-2018:1883-1Security Fix(es): * samba: Null pointer indirection in printer server process (CVE-2018-1050)lowScientific Linux FermiScientific Linux Fermi 6samba4-winbind-krb5-locator-4.2.10-15.el6.x86_64.rpm07f9de467ed8c03080a09e2a80616d411210aa1bb3f0deb9ebf81bc86d3905f3samba4-common-4.2.10-15.el6.x86_64.rpm1bc5ba344373d71eb6054ff1c917cdd4cb397b6a1ee039a2c62e661bf1125325samba4-test-4.2.10-15.el6.x86_64.rpm3a171a3e02e71b10ea9b69c5c05f66162a9f4ed4b9fcf280f928dcb97987cf86samba4-dc-4.2.10-15.el6.x86_64.rpm8d9b6bf08d6198ec57c9a471c600a902a06fbd2f87ce4a32d005b6f4f65c8cfesamba4-dc-libs-4.2.10-15.el6.x86_64.rpmf2e6d1a2b950ba6dd090b28f35e89e47896f2defbc97feb9fd70b40ef2ead2c0samba4-4.2.10-15.el6.x86_64.rpmdaa75130f0607b45310b77c7bfef8588c6c1dd0f9612ef408ff21f5dc150bf11samba4-pidl-4.2.10-15.el6.x86_64.rpm7bddb75130a140ff3ee43971c075e16dc0a8fdfc163fda2b716a0fee63f4ff99samba4-winbind-clients-4.2.10-15.el6.x86_64.rpme613ce912da16f91842d7180fd4a31b79a0f379773ba23cfcf4e9a5ea394c0b9samba4-devel-4.2.10-15.el6.x86_64.rpm10425d9852e2d12759e46b48773b3444e3f438e431d645ae53362465d417dd7asamba4-client-4.2.10-15.el6.x86_64.rpm606c209994e0772467d78d56d4173f6e278737b7f829331b2dab9f3ce6bed881samba4-winbind-4.2.10-15.el6.x86_64.rpm10c65c2f0b2687f0f1d8b53318f1dd840e9b296ada55cf752dfdc7080ee2e557samba4-libs-4.2.10-15.el6.x86_64.rpm178a7602d2884c60be56aa6fa96d3678ceaf3a39e4f475561eaa3250521b4e2dsamba4-python-4.2.10-15.el6.x86_64.rpmd74b1b25eebb43d9d3762513a8a4eb3323be49769ccbef517f41b68698660ca0SLSA-2018:1927-1Security Fix(es): * pcs: Debug parameter removal bypass, allowing information disclosure (CVE-2018-1086)moderateScientific Linux FermiScientific Linux Fermi 6pcs-0.9.155-3.el6.x86_64.rpm74e181e6c1bb959bce50988a24c08f6fdbc0de1e591bdf53ded1eb651424c0e0SLSA-2018:1929-1Security Fix(es): * libvirt: Resource exhaustion via qemuMonitorIORead() method (CVE-2018-5748) * libvirt: Incomplete fix for CVE-2018-5748 triggered by QEMU guest agent (CVE-2018-1064)lowScientific Linux FermiScientific Linux Fermi 6libvirt-0.10.2-64.el6.x86_64.rpm0c7ee7b6208ff70e109af0cc5a7e27e054f312ec61dd558808ff52496f33c708libvirt-lock-sanlock-0.10.2-64.el6.x86_64.rpmf5a8aec0a0640e790e73c95fd81f1c16461e8d0fea1655c9bdfafc88fdfb33edlibvirt-devel-0.10.2-64.el6.x86_64.rpm2384affaf55cbf0f10a2c4cef3e9dfbd7eaa096736a8494f23e205e1b155419flibvirt-python-0.10.2-64.el6.x86_64.rpmd9660e5f1a601e73537dae027246767e915614b1fb632b77961ed141a7af00b1libvirt-client-0.10.2-64.el6.x86_64.rpmb7e020bcc90058305dadf9a8fa3a1dfec9380cf8c746d87d9d32e61682800535libvirt-devel-0.10.2-64.el6.i686.rpm267f287954964264c2736ab4d4b8a78f812c05af4b3cfe3ca374f230bb0e225clibvirt-client-0.10.2-64.el6.i686.rpm49866f2a628c34692feb0d8a43aad8ccb92aa31fdc5b296ffabc73e4afe3e63aSLSA-2018:1932-1Security Fix(es): * zsh: Stack-based buffer overflow in gen_matches_files() at compctl.c (CVE-2018-1083) * zsh: buffer overflow when scanning very long directory paths for symbolic links (CVE-2014-10072) * zsh: buffer overrun in symlinks (CVE-2017-18206) * zsh: buffer overflow in utils.c:checkmailpath() can lead to local arbitrary code execution (CVE-2018-1100)moderateScientific Linux FermiScientific Linux Fermi 6zsh-4.3.11-8.el6.x86_64.rpm08f2ae804ba11d4e0bf5464bef376b3e5bea3fcdba1ea51e0f17d8d3d8af6b36zsh-html-4.3.11-8.el6.x86_64.rpmf8c4919da4d0b9d82b3975713af2081a0d8fcb246e14a93e6d046b517f149c0cSLSA-2018:2112-1This update upgrades Firefox to version 60.1.0 ESR. Many older firefox extensions must be updated to work with this new release. Security Fix(es): * Mozilla: Memory safety bugs fixed in Firefox 61, Firefox ESR 60.1, and Firefox ESR 52.9 (CVE-2018-5188) * Mozilla: Buffer overflow using computed size of canvas element (CVE-2018-12359) * Mozilla: Use-after-free using focus() (CVE-2018-12360) * Mozilla: Media recorder segmentation fault when track type is changed during capture (CVE-2018-5156) * Skia: Heap buffer overflow rasterizing paths in SVG (CVE-2018-6126) * Mozilla: Integer overflow in SSSE3 scaler (CVE-2018-12362) * Mozilla: Use-after-free when appending DOM nodes (CVE-2018-12363) * Mozilla: CSRF attacks through 307 redirects and NPAPI plugins (CVE-2018-12364) * Mozilla: address bar username and password spoofing in reader mode (CVE-2017-7762) * Mozilla: Compromised IPC child process can list local filenames (CVE-2018-12365) * Mozilla: Invalid data handling during QCMS transformations (CVE-2018-12366)criticalScientific Linux FermiScientific Linux Fermi 6sl-indexhtml-6-10.sl6.noarch.rpm0f82668f4f3c98b676cee0160a8cc705afac62e804119a22f492639b351ae5e3firefox-60.1.0-5.el6.i686.rpm52352fe1da4c80f585189ac6340a75ddc8cda3cb01ccc5767690c8d1f93604c4firefox-60.1.0-5.el6.x86_64.rpm78b6cc1cd9de013f8ff351ff6bc096c58f402dfe233b8851ed4dd2ce28c448e4SLSA-2018:2162-1Security Fix(es): * An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization). It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to read privileged memory by conducting targeted cache side-channel attacks. (CVE-2018-3639) Note: This is the qemu-kvm side of the CVE-2018-3639 mitigation. * QEMU: cirrus: OOB access when updating VGA display (CVE-2018-7858) * QEMU: vga: OOB read access during display update (CVE-2017-13672) * Qemu: Out-of-bounds read in vga_draw_text routine (CVE-2018-5683)importantScientific Linux FermiScientific Linux Fermi 6qemu-img-0.12.1.2-2.506.el6_10.1.x86_64.rpm3a4cf3e149a747a4464dfe61cf9c34c853e0f2de95aa061e1ffa50c4d44e463fqemu-kvm-tools-0.12.1.2-2.506.el6_10.1.x86_64.rpm5ac367817427426407bab1603875f38fff238afb96cb33013c8f8367c35db3b7qemu-guest-agent-0.12.1.2-2.506.el6_10.1.x86_64.rpma97a2d1e366e7b920dba687a09b4e70646f56d163976d7a4b2eabe924931728eqemu-kvm-0.12.1.2-2.506.el6_10.1.x86_64.rpm2c73126b7f633b62b2990d749ba449a7debbbe70c752051ca35c2aa0ce3ab360SLSA-2018:2164-1Security Fix(es): * An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization). It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to read privileged memory by conducting targeted cache side-channel attacks. (CVE-2018-3639, x86 AMD) * kernel: Use-after-free vulnerability in mm/mempolicy.c:do_get_mempolicy function allows local denial of service or other unspecified impact (CVE-2018-10675) * Kernel: FPU state information leakage via lazy FPU restore (CVE-2018-3665) * kernel: error in exception handling leads to DoS (CVE-2018-8897 regression) (CVE-2018-10872) Bug Fix(es): * Previously, microcode updates on 32 and 64-bit AMD and Intel architectures were not synchronized. As a consequence, it was not possible to apply the microcode updates. This fix adds the synchronization to the microcode updates so that processors of the stated architectures receive updates at the same time. As a result, microcode updates are now synchronized.importantScientific Linux FermiScientific Linux Fermi 6kernel-firmware-2.6.32-754.2.1.el6.noarch.rpm6f98f13f8960365ad13a81c46a408d7c40089e966c557c0ee8261ca2b27356e5kernel-abi-whitelists-2.6.32-754.2.1.el6.noarch.rpmfdc54d149663e61aca9ddf3d71cc911c62f56856622efa647788d5344231de07perf-2.6.32-754.2.1.el6.x86_64.rpm5af6b973ee645f37c07f71e09498f736b940d458a214646e3571b710fceb66d9kernel-2.6.32-754.2.1.el6.x86_64.rpm2b3f8fa1f5defa180886a9c1cba2a251fe84d003932a19390117b7003928d6f1kernel-debug-devel-2.6.32-754.2.1.el6.i686.rpm821b5d489d85af46b0385712904182a1012cdf892b079e77767c5c74150ea5adkernel-devel-2.6.32-754.2.1.el6.x86_64.rpmf1bb4a841cf0ea4424ca109ef3b5ada0ddddaea6261ce443b87d5d8f2ee513c8python-perf-2.6.32-754.2.1.el6.x86_64.rpm7360a07e71cde6680c4791414e5412f84d768c800e2c9f4fd25fabf89dd85d0ekernel-headers-2.6.32-754.2.1.el6.x86_64.rpm8610ae061af63510629e221d5847c08b65af95076d0f41ea851f7e064e24f046kernel-debug-devel-2.6.32-754.2.1.el6.x86_64.rpm9b96e28ef090e38151db7cab0aaec62a52d5037665bfc99727935f999c1588afkernel-debug-2.6.32-754.2.1.el6.x86_64.rpm21ae885152f3e1b27d3a4e544b7232681e609b51da7679af4952314de30ac3c2kernel-doc-2.6.32-754.2.1.el6.noarch.rpme29f995b78509d2d04f34728442ebb8c7ba9dc1f6a99b3c35086f2039082b75fSLSA-2018:2180-1Security Fix(es): * gnupg2: Improper sanitization of filenames allows for the display of fake status messages and the bypass of signature verification (CVE-2018-12020)importantScientific Linux FermiScientific Linux Fermi 6gnupg2-smime-2.0.14-9.el6_10.x86_64.rpm33ad34ad370f24a36ad9b5bfcaaad85e800bbc5fb0613a1ae40e7805f6eca2d5gnupg2-2.0.14-9.el6_10.x86_64.rpmaa359b0609cc8ca4efe000156ee36f83cd543eb2aee1b6cce359450627eb736fSLSA-2018:2241-1Security Fix(es): * OpenJDK: insufficient index validation in PatternSyntaxException getMessage() (Concurrency, 8199547) (CVE-2018-2952)moderateScientific Linux FermiScientific Linux Fermi 6java-1.8.0-openjdk-debug-1.8.0.181-3.b13.el6_10.x86_64.rpm537ec6960444885662b16b7e2f1c67f366a77ccc26f4f0b95dec188ef01827eejava-1.8.0-openjdk-headless-debug-1.8.0.181-3.b13.el6_10.x86_64.rpmc4175f77615227e44bc4db494cff16abefc1025a02bdfb4edbe94321e75fcde3java-1.8.0-openjdk-src-debug-1.8.0.181-3.b13.el6_10.x86_64.rpm5b7a7af03c3969c262a11502c69c38649ac6e3e4fcd0e5fdf4a99f6ee3fb53b8java-1.8.0-openjdk-demo-1.8.0.181-3.b13.el6_10.x86_64.rpm715e67847fb90b59857d555516fef7872f519d2a8eadd64896f8e03d817be4acjava-1.8.0-openjdk-src-1.8.0.181-3.b13.el6_10.x86_64.rpm895f6af65922cbcf542a0e3bc16a2c0672fcd7e7cb7e1802f1f4c3c28cdb4b99java-1.8.0-openjdk-devel-1.8.0.181-3.b13.el6_10.x86_64.rpm67877dbb6a0ef9e45e4c99cb4b825e23a9209433df0e53442112840a9a75b5c2java-1.8.0-openjdk-javadoc-1.8.0.181-3.b13.el6_10.noarch.rpm62b560057b715e4ce12cf994734a899432bbc8cfc32a1f9f015c2c7777c38ad9java-1.8.0-openjdk-headless-1.8.0.181-3.b13.el6_10.x86_64.rpmf4b9ec708d180cbee338bfa1bdfc7cbb5d6716ae85a8a1fd0f7990f966b06d50java-1.8.0-openjdk-javadoc-debug-1.8.0.181-3.b13.el6_10.noarch.rpm2691bd4f9a84b729590e87d8b2c30540cefefd7b7e41908a4abb1b2c9b2a5702java-1.8.0-openjdk-demo-debug-1.8.0.181-3.b13.el6_10.x86_64.rpm78f95416d6c5f0adb9b758404f9762400a5ac627952ca3715512743c3f4ad51cjava-1.8.0-openjdk-devel-debug-1.8.0.181-3.b13.el6_10.x86_64.rpm304007f8b36b0cb9ff426080dee80fbf94712a093cd81ca25b9d04b63dcfbdf0java-1.8.0-openjdk-1.8.0.181-3.b13.el6_10.x86_64.rpm237fba255dea7de8fd25c51a911f388b64ddb28e8ffb7fd7b4a4033491f5429cSLSA-2018:2251-1This update upgrades Thunderbird to version 52.9.1. Security Fix(es): * Mozilla: Memory safety bugs fixed in Firefox 61, Firefox ESR 60.1, and Firefox ESR 52.9 (CVE-2018-5188) * Mozilla: Buffer overflow using computed size of canvas element (CVE-2018-12359) * Mozilla: Use-after-free using focus() (CVE-2018-12360) * Mozilla: Integer overflow in SSSE3 scaler (CVE-2018-12362) * Mozilla: Use-after-free when appending DOM nodes (CVE-2018-12363) * Mozilla: CSRF attacks through 307 redirects and NPAPI plugins (CVE-2018-12364) * thunderbird: S/MIME and PGP decryption oracles can be built with HTML emails (CVE-2018-12372) * thunderbird: S/MIME plaintext can be leaked through HTML reply/forward (CVE-2018-12373) * Mozilla: Compromised IPC child process can list local filenames (CVE-2018-12365) * Mozilla: Invalid data handling during QCMS transformations (CVE-2018-12366) * thunderbird: Using form to exfiltrate encrypted mail part by pressing enter in form field (CVE-2018-12374)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-52.9.1-1.el6.x86_64.rpme2046c829910549880bc2b05d25453f23186c9f3ddef01110f96014d3b98536eSLSA-2018:2283-1Security Fix(es): * OpenJDK: insufficient index validation in PatternSyntaxException getMessage() (Concurrency, 8199547) (CVE-2018-2952)moderateScientific Linux FermiScientific Linux Fermi 6java-1.7.0-openjdk-src-1.7.0.191-2.6.15.4.el6_10.x86_64.rpm04fe87af0fb65b2125472f2d3d87adea5d8a4c4e73411925cc41ccaa8f4442a7java-1.7.0-openjdk-1.7.0.191-2.6.15.4.el6_10.x86_64.rpmd31014b96830853291293a6c81f2f03a5b0e31d49aea392d2abbb3f16be48f2bjava-1.7.0-openjdk-demo-1.7.0.191-2.6.15.4.el6_10.x86_64.rpm277900ba0706f072b7dbf4cff360d60447164a33bca673a78a6fc0989cf657b9java-1.7.0-openjdk-javadoc-1.7.0.191-2.6.15.4.el6_10.noarch.rpm1413de66858fffd7be69dd4f496177c1ee21b8875cc20df1bcf3a99c75a5c83ajava-1.7.0-openjdk-devel-1.7.0.191-2.6.15.4.el6_10.x86_64.rpm0184f001f089e3fa8ddaceb92a0187789d704988fcb6b5d221ee34955eb28b25SLSA-2018:2284-1Security Fix(es): * yum-utils: reposync: improper path validation may lead to directory traversal (CVE-2018-10897)importantScientific Linux FermiScientific Linux Fermi 6yum-plugin-show-leaves-1.1.30-42.el6_10.noarch.rpm4d6e9b1612c1a8a46b4024fdcd055cd17c3f6b727989bdaadac1a36a3c877845yum-plugin-rpm-warm-cache-1.1.30-42.el6_10.noarch.rpm204c3746eeb040ef109e09b076d07100c42f458a7297faed226effda8e9b441fyum-plugin-tmprepo-1.1.30-42.el6_10.noarch.rpme99f7e126faa01a980cada21f07895e5bd5d33784469e6fe9cd34bbd9cd932e3yum-plugin-verify-1.1.30-42.el6_10.noarch.rpm3594f07f96de23e75358d99dbed6b8ca651c3a2b17e263b177713874665ca69ayum-utils-1.1.30-42.el6_10.noarch.rpm18964c5dd295e7517a568d1ace3e4b04e9ce7fbb6edff47875a516137ed1017fyum-plugin-post-transaction-actions-1.1.30-42.el6_10.noarch.rpm0021690dfd14c3f7467073e75a1f3a819e7096facd6e31d52bfc3745e91461fdyum-plugin-list-data-1.1.30-42.el6_10.noarch.rpmadc02f3944c0b94cd4d6aae3317cb6bc768e57377b127c3e925946c1e4e8025dyum-plugin-fastestmirror-1.1.30-42.el6_10.noarch.rpm6035740076674b34195a8a0b8541cf3d6a8d05bd3f3b091cbe5558d753c6041dyum-plugin-aliases-1.1.30-42.el6_10.noarch.rpm23c0431eb9c10d6232b1a1d403ef164c46e86591565c6d0bc69f07178dccb3f4yum-plugin-ovl-1.1.30-42.el6_10.noarch.rpm945e680bb51d2c9613a3fa5917bc23de86a5185b24ca1d192440577f7244aa0eyum-plugin-tsflags-1.1.30-42.el6_10.noarch.rpmd88ad93aa065d7d0801b05d47667a6480a02b8150babb245d2d81276aeea1bf1yum-plugin-local-1.1.30-42.el6_10.noarch.rpm5438236b802e01a19009fc09e8fca032e8c18fbabfd5ec531e95f844360fc301yum-plugin-versionlock-1.1.30-42.el6_10.noarch.rpmd5c89381cb35629175ca08ae3d9967109f67d8ace618a63da20448aef577245eyum-plugin-fs-snapshot-1.1.30-42.el6_10.noarch.rpmca64823750caeae7b80c25c339523a3cea8884fadb895d717888be1ef731bde9yum-NetworkManager-dispatcher-1.1.30-42.el6_10.noarch.rpmab14ca9d1d021286724d0690feb09a42d10824510d27e1c3b9956189739b8f37yum-plugin-security-1.1.30-42.el6_10.noarch.rpm536069961e8b456087d562ee5cd1ce95b948bd2194e8e27ee9b41a109941eb60yum-plugin-protectbase-1.1.30-42.el6_10.noarch.rpm840a8471f6157337b1eb3d5263f5c4723b189f56cdac886d5077775ba2b1dc76yum-plugin-auto-update-debug-info-1.1.30-42.el6_10.noarch.rpm461825b165262e31b7ac3cc738089bdf3b722fbea899e1350232cebb4fbea934yum-plugin-priorities-1.1.30-42.el6_10.noarch.rpm837d4a10ca94d64886123262f0b7f7d434ea42119c1203b2df0f8067ac0b81d6yum-plugin-ps-1.1.30-42.el6_10.noarch.rpm384f6815b3d7299017f9fcf07a7a6a96ffb18e66d414385548fc808342e0a472yum-plugin-changelog-1.1.30-42.el6_10.noarch.rpm88bdf6618ba1041b898fafd1a92a23dada85a1f912e211ac81f9ea983f2281f7yum-plugin-remove-with-leaves-1.1.30-42.el6_10.noarch.rpm8445db17196626778735605a35ad2feaead7a76acef3f5d118bae40fde566dceyum-updateonboot-1.1.30-42.el6_10.noarch.rpm744439503c7cdd6fabcba5c8b3659c211493fcdc37200d43a378eeb7da68511ayum-plugin-upgrade-helper-1.1.30-42.el6_10.noarch.rpm14eb4dcd3bfe045e929c6a10d1540acc1857b5c1bed834079683d13d021770c5yum-plugin-merge-conf-1.1.30-42.el6_10.noarch.rpm7df9ba9a494a6fe20519be5845cbd5d60d05276737171caaa1a95a92a50a360cyum-plugin-filter-data-1.1.30-42.el6_10.noarch.rpm20b47fc4d9cde1c35fdd3555b7cd4737fa865e9ad0f4edeb53a391c083c31f39yum-plugin-keys-1.1.30-42.el6_10.noarch.rpm76b09d70a6e94ca3d894d2f8c4c97eee95fe118df28fd9a5f9d0598c593ddb9dSLSA-2018:2308-1Security Fix(es): * openslp: Heap memory corruption in slpd/slpd_process.c allows denial of service or potentially code execution (CVE-2017-17833)importantScientific Linux FermiScientific Linux Fermi 6openslp-2.0.0-3.el6.i686.rpm1e9cc6032c5455e42fb331cee2d74c8c458b74194292f926bb5baf6173c15181openslp-server-2.0.0-3.el6.x86_64.rpm9c7007f3bd14abe5eb6a75348a03221ac5d23a8b6fd7178ad236f2e2b8fcc1b8openslp-devel-2.0.0-3.el6.i686.rpmcad2281b0054d0180d87e9187643325f0bd1bc8e5695dbb1281f25c01049dea2openslp-devel-2.0.0-3.el6.x86_64.rpmbef068007850f78d595a7a228fef89016e9f0e7d58d1ea0d270506408365c15aopenslp-2.0.0-3.el6.x86_64.rpm039f6d295b3f3f493ef618f73437ff3783eb647ae5ef5c754f71133d19cb9836SLSA-2018:2390-1Security Fix(es): * Modern operating systems implement virtualization of physical memory to efficiently use available system resources and provide inter-domain protection through access control and isolation. The L1TF issue was found in the way the x86 microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimisation) in combination with handling of page-faults caused by terminated virtual to physical address resolving process. As a result, an unprivileged attacker could use this flaw to read privileged memory of the kernel or other processes and/or cross guest/host boundaries to read host memory by conducting targeted cache side-channel attacks. (CVE-2018-3620, CVE-2018-3646) * An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions past bounds check. The flaw relies on the presence of a precisely-defined instruction sequence in the privileged code and the fact that memory writes occur to an address which depends on the untrusted value. Such writes cause an update into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to influence speculative execution and/or read privileged memory by conducting targeted cache side- channel attacks. (CVE-2018-3693) * kernel: kvm: vmx: host GDT limit corruption (CVE-2018-10901) * kernel: Use-after-free in snd_pcm_info function in ALSA subsystem potentially leads to privilege escalation (CVE-2017-0861) * kernel: Use-after-free in snd_seq_ioctl_create_port() (CVE-2017-15265) * kernel: race condition in snd_seq_write() may lead to UAF or OOB-access (CVE-2018-7566) * kernel: Race condition in sound system can lead to denial of service (CVE-2018-1000004) Bug Fix(es): * The Least recently used (LRU) operations are batched by caching pages in per-cpu page vectors to prevent contention of the heavily used lru_lock spinlock. The page vectors can hold even the compound pages. Previously, the page vectors were cleared only if they were full. Subsequently, the amount of memory held in page vectors, which is not reclaimable, was sometimes too high. Consequently the page reclamation started the Out of Memory (OOM) killing processes. With this update, the underlying source code has been fixed to clear LRU page vectors each time when a compound page is added to them. As a result, OOM killing processes due to high amounts of memory held in page vectors no longer occur.importantScientific Linux FermiScientific Linux Fermi 6kernel-debug-devel-2.6.32-754.3.5.el6.x86_64.rpm4c2d90b5c62123121c28c88eae5c8c9533d7789cf0c3b9919eb11ed492c0816akernel-doc-2.6.32-754.3.5.el6.noarch.rpm2d1d37b8b04c2b61f0c281324a1443f485fb142c57e294571ba002db7dc579e2python-perf-2.6.32-754.3.5.el6.x86_64.rpm925f9ed690fad6eca53ebf7116a50f93e0905186e68ae05dd7dfe6158471b7bdkernel-devel-2.6.32-754.3.5.el6.x86_64.rpm539b998a2f7e7fa4ea0200fa101c635aabb8b285b269cfe4d01b11337e30d90akernel-headers-2.6.32-754.3.5.el6.x86_64.rpm4bc4cd93aea722c8864ed151f62d57779a2abfef021dd56290402d4b7cf9598fkernel-2.6.32-754.3.5.el6.x86_64.rpm0f29163741889d87f463e528f951816afd8241c9f6737fa99a323169e66a8437kernel-firmware-2.6.32-754.3.5.el6.noarch.rpmea0a5bf9299f4878da671349438e1e1bcc90eeb8e49a93994345b5e7a9add988kernel-debug-devel-2.6.32-754.3.5.el6.i686.rpm2645c0d03833a757032aaed00226b95613411d8e48bfb9ec0b169afde88e85e3kernel-debug-2.6.32-754.3.5.el6.x86_64.rpmcb3356bb0be1ce7e4329b5e7ef3093d6b710866286d4f3a4bbf8418b3f434861perf-2.6.32-754.3.5.el6.x86_64.rpmaf7e3d794268e9d5d0ff99d938ef17ea79bf1004cff5a2252bceca1621a98c59kernel-abi-whitelists-2.6.32-754.3.5.el6.noarch.rpm3caaa45863cdd17ad054c15fe8bd32c7b1dae1a82bb3f7c7e95ec8ebc61b5e07SLSA-2018:2526-1Security Fix(es): * mutt: Remote code injection vulnerability to an IMAP mailbox (CVE-2018-14354) * mutt: Remote Code Execution via backquote characters (CVE-2018-14357) * mutt: POP body caching path traversal vulnerability (CVE-2018-14362)importantScientific Linux FermiScientific Linux Fermi 6mutt-1.5.20-9.20091214hg736b6a.el6.x86_64.rpmfa902145c18aefb81117cbf466f54bd9079a539fbd92da11cdab0840c868516aSLSA-2018:2571-1Security Fix(es): * bind: processing of certain records when "deny-answer-aliases" is in use may trigger an assert leading to a denial of service (CVE-2018-5740)importantScientific Linux FermiScientific Linux Fermi 6bind-sdb-9.8.2-0.68.rc1.el6_10.1.x86_64.rpmd0d0b46f15278e4c5a7b85763a9068b5b7ebcc185c4f37dd0de6ca376c59cc95bind-utils-9.8.2-0.68.rc1.el6_10.1.x86_64.rpm30d6f78ef1a742d40bd973ebe4e4c974dae0f7c08d3fe91287ce50d042a67157bind-libs-9.8.2-0.68.rc1.el6_10.1.x86_64.rpme2ab23a24ad97f1b2b9c668eb029f429612ed3ac89103d7e0aa511abc918e862bind-devel-9.8.2-0.68.rc1.el6_10.1.x86_64.rpm2c0234bf1d22cd721f1ad4972f38767c736e95ed031d3f2b0de0b4122e95387abind-9.8.2-0.68.rc1.el6_10.1.x86_64.rpmceee9f4b1da65dfc49721f936064f1681ccf5edcd106a612f14ea7b44986ca81bind-libs-9.8.2-0.68.rc1.el6_10.1.i686.rpm20c898d58c1d3548fe3fc6e1401e5d3ed4354f0cbf1f8870afd6320fa8764562bind-devel-9.8.2-0.68.rc1.el6_10.1.i686.rpm8ce80c47c82c6fce7ca1492c1d901606ed4384cfc5a4e446e86ab5d2c4a60c55bind-chroot-9.8.2-0.68.rc1.el6_10.1.x86_64.rpmca4535e8a75afed686936359e558abcb55c25dff9411d964ece5fa4a70690f2fSLSA-2018:2693-1This update upgrades Firefox to version 60.2.0 ESR. Security Fix(es): * Mozilla: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2 (CVE-2018-12376) * Mozilla: Use-after-free in driver timers (CVE-2018-12377) * Mozilla: Use-after-free in IndexedDB (CVE-2018-12378) * Mozilla: Proxy bypass using automount and autofs (CVE-2017-16541) * Mozilla: Out-of-bounds write with malicious MAR file (CVE-2018-12379)criticalScientific Linux FermiScientific Linux Fermi 6firefox-60.2.0-1.el6.i686.rpmfc7e928e9c453e79c09e798b2caac48e04658f30ce9e92dbf677d37f223b5b1ffirefox-60.2.0-1.el6.x86_64.rpm2a0886d149b8957bd7e551786054e11ade817c7e9598bf13941396a11e25499dSLSA-2018:2732-1The spice-gtk packages provide a GIMP Toolkit (GTK+) widget for Simple Protocol for Independent Computing Environments (SPICE) clients. Both Virtual Machine Manager and Virtual Machine Viewer can make use of this widget to access virtual machines using the SPICE protocol. Security Fix(es): * spice: Missing check in demarshal.py:write_validate_array_item() allows for buffer overflow and denial of service (CVE-2018-10873) This issue was discovered by Frediano Ziglio (Red Hat).importantScientific Linux FermiScientific Linux Fermi 6spice-server-devel-0.12.4-16.el6_10.1.x86_64.rpm601dda98ecea4aea380323be6fad5e1abfd3c779d04a2ab63ab69613d3826b74spice-gtk-0.26-8.el6_10.1.i686.rpmf498ddff72f578e1f08d7f17a2920c61e628788b155890025e873091d083dbc4spice-glib-0.26-8.el6_10.1.i686.rpm11d26abf0cf2fb5589e1ee5a6a30d906ddfb559245e27792ac88a0f2852f7b7cspice-gtk-tools-0.26-8.el6_10.1.x86_64.rpmf06c93303d063e4e81215887e94d7d401b248f06cb5231848f67fe51cd5c64e3spice-server-0.12.4-16.el6_10.1.x86_64.rpm5434ce66a5077483c9c0a7dc783724c61ecff9d6eeac821a9e06215235a41116spice-gtk-python-0.26-8.el6_10.1.x86_64.rpm79cc4b09520c1f8f0b84a7a4deee12f25988c588c488e5bc6b2236763dbfdfe7spice-glib-devel-0.26-8.el6_10.1.x86_64.rpmdf26d91344b0eba6efbe9649edb5344b29ae21cc477d36ec1f099062c36c13c4spice-gtk-devel-0.26-8.el6_10.1.i686.rpm25694d9d13130b79f690f404deb9fdcedf976d0fea0735640398901b93ad8055spice-glib-devel-0.26-8.el6_10.1.i686.rpmd4c82853d9281db4f2e00e222c7ca23abe1d6f6ddee41ebc8b7280fa40ec3f10spice-gtk-devel-0.26-8.el6_10.1.x86_64.rpm0fa235912aaf80c86071776519540710d4db1402fe402e31e7f10f291de846ffspice-gtk-0.26-8.el6_10.1.x86_64.rpm56c2e74eeb3a989df472eb0d6bb1a606558a616532911b485070b429b88158e7spice-glib-0.26-8.el6_10.1.x86_64.rpm5d967d41a6c33a0cf93c14aa02240619296b6ddf9ef9238263926d3aaba9182dSLSA-2018:2737-1Security Fix(es): * mod_perl: arbitrary Perl code execution in the context of the user account via a user-owned .htaccess (CVE-2011-2767)importantScientific Linux FermiScientific Linux Fermi 6mod_perl-devel-2.0.4-12.el6_10.x86_64.rpmfa2b8d0025a777ad7ed6fd285d84e7d209f388064fb27fd26e7515e2231fd0b1mod_perl-devel-2.0.4-12.el6_10.i686.rpm998c1f690955ed5f658eff6d8d2da9c4b49b1684ca58a4096641a1bd30c920e7mod_perl-2.0.4-12.el6_10.x86_64.rpmdca1577c553e85b47bffbd728b4592bea2845aca8667d3d21b5d065ac4f6f685SLSA-2018:2834-1This update upgrades Firefox to version 60.2.1 ESR. Security Fix(es): * Mozilla: Crash in TransportSecurityInfo due to cached data (CVE-2018-12385) * Mozilla: Setting a master password post-Firefox 58 does not delete unencrypted previously stored passwords (CVE-2018-12383)moderateScientific Linux FermiScientific Linux Fermi 6firefox-60.2.1-1.el6.i686.rpm5a70c501ef2c715ba42dfd476980bd937d8ed361b3bf82350ec58c9dae40c048firefox-60.2.1-1.el6.x86_64.rpm2fed6a0264f9c02c956299c5fd204d46c9cda7ca4b6e69a30d35ed87e36647c8SLSA-2018:2846-1Security Fix(es): * A flaw named FragmentSmack was found in the way the Linux kernel handled reassembly of fragmented IPv4 and IPv6 packets. A remote attacker could use this flaw to trigger time and calculation expensive fragment reassembly algorithm by sending specially crafted packets which could lead to a CPU saturation and hence a denial of service on the system. (CVE-2018-5391) * kernel: Integer overflow in Linux's create_elf_tables function (CVE-2018-14634)importantScientific Linux FermiScientific Linux Fermi 6kernel-doc-2.6.32-754.6.3.el6.noarch.rpm182217b470b386612c394ee7b2a7a50a8431b8d552728b89ad0ae1bcd7d7d2e2kernel-2.6.32-754.6.3.el6.x86_64.rpm97fa6f7609b1f85b760e78ec6bd7d20be8ab90d60078fec511104f0a4378c406kernel-debug-devel-2.6.32-754.6.3.el6.x86_64.rpm823ada3a0ba5a42608a0ccfb18033783a3527daee5ed35b042075cd6c26aba8bpython-perf-2.6.32-754.6.3.el6.x86_64.rpm8a2354afc4ab457d8b8050a54c39f591b8a6de09aa6f60fe428c20e3446e0cc7kernel-abi-whitelists-2.6.32-754.6.3.el6.noarch.rpm5587939ade25cd387c7990abf181594c3f39b44be7e296cb0ec1a216d2b7ae6akernel-firmware-2.6.32-754.6.3.el6.noarch.rpme05690d00b11e3e32c33a30a04d257becd8c0c616f57233eb27840f3ae8b02fbkernel-debug-2.6.32-754.6.3.el6.x86_64.rpm439e540c64eacda2b5c2fce3e14c58159ccb7c5df59314e6501e4431d9d473bekernel-debug-devel-2.6.32-754.6.3.el6.i686.rpm112065ba5c38cd113c9e5bbadccb95de839b11f00317bfa78039cb2bbc088c62kernel-devel-2.6.32-754.6.3.el6.x86_64.rpmec5ead4ce1fa28ebb1d9a30044938a0a58d11001a4ee0e139c7494b9bcb87541perf-2.6.32-754.6.3.el6.x86_64.rpme0ea8ee4ab8abae3fd7eaae1766d1b705620949f6e290d465c49454f6ed3469ckernel-headers-2.6.32-754.6.3.el6.x86_64.rpm46f1d686e85e878b2ecab874470e20b8b6e7a585cc719f853ca5a336e6e52698SLSA-2018:2881-1This update upgrades Firefox to version 60.2.2 ESR. Security Fix(es): * Mozilla: type confusion in JavaScript (CVE-2018-12386) * Mozilla: stack out-of-bounds read in Array.prototype.push (CVE-2018-12387)criticalScientific Linux FermiScientific Linux Fermi 6firefox-60.2.2-1.el6.x86_64.rpm5daf21c6b811127b7810e996581ec66cf9197c4a466283c3bf403de36781658ffirefox-60.2.2-1.el6.i686.rpm1411366e742c9d32691a57851fac7eae3416623c65060256b2215f43fb56eb78SLSA-2018:2892-1The glusterfs packages have been upgraded to upstream version 3.12.2, which provides a number of bug fixes over the previous version. Security Fix(es): * glusterfs: Improper deserialization in dict.c:dict_unserialize() can allow attackers to read arbitrary memory (CVE-2018-10911)moderateScientific Linux FermiScientific Linux Fermi 6glusterfs-rdma-3.12.2-18.el6.x86_64.rpmf08b4a88ea1de4986d54dc708f623346a208a4c8f53acfc1555d04892a1bb690glusterfs-geo-replication-3.12.2-18.el6.x86_64.rpm9367c51cf6ab886b9fdd00c32d29783710e463fcaa124fc7ff44f3bfedffa22eglusterfs-resource-agents-3.12.2-18.el6.noarch.rpmff311f800b71530e8a787d20200ef3274dac73f1cf5491d0b718b3bd0acff238glusterfs-server-3.12.2-18.el6.x86_64.rpmec8307725118282dff8ba900e706d18ed54e4bb6b57ded2238e76c9ca8b9b21bglusterfs-api-devel-3.12.2-18.el6.x86_64.rpma6ee4556d073f030db73bcffd5a8873d4102c62c0496aaaf43514d7a1499d8a0glusterfs-devel-3.12.2-18.el6.x86_64.rpmaf04636fa8a93230bbe384e3ac11817d27fde619516827cf547b25aafe5a2da9glusterfs-cli-3.12.2-18.el6.x86_64.rpm29dc8506ead36061bbf40ff670c297fa8f0690e0d82debf3c6ab21bffecfc5a9glusterfs-libs-3.12.2-18.el6.x86_64.rpm91338b4fb9e47a9fec2c994fcad01de824640e72195134cfc7fa5c085f16af8cglusterfs-events-3.12.2-18.el6.x86_64.rpmdb698040ad937ad4549fff73f3f55201e46a088608091bc7e7ef2354cf11423bglusterfs-ganesha-3.12.2-18.el6.x86_64.rpm017e4aa77ee157b80502dd18a5ec99812da7633c9972b7eaf075d173512d49e0glusterfs-3.12.2-18.el6.x86_64.rpm0264edf30f023d21f3072aa7c7b3c1530b4804e3d4621601b8f085c55ffed399glusterfs-api-3.12.2-18.el6.x86_64.rpm429c18196c6a5461673a892b4610ec49afbdb29409f4b9d1ad742f27b1737aabpython2-gluster-3.12.2-18.el6.x86_64.rpm1dfa20bb008a479a0c45078997a976aed8cdab54396f9e973420d343549c6247glusterfs-fuse-3.12.2-18.el6.x86_64.rpmaf15e43c5fac9982e2e98cfa917b2e8a17f46c26918fb6073350c87243341be9glusterfs-client-xlators-3.12.2-18.el6.x86_64.rpm4ac2513297579f7392efea34d483b169001fc14affde2f7a0e98da277cc88833SLSA-2018:2898-1Security Fix(es): * nss: ServerHello.random is all zeros when handling a v2-compatible ClientHello (CVE-2018-12384)moderateScientific Linux FermiScientific Linux Fermi 6nss-devel-3.36.0-9.el6_10.i686.rpm8a0df9c1531aeccfb5512a9380b92512e4d267f4af0f49e87015027b9b928758nss-sysinit-3.36.0-9.el6_10.x86_64.rpm8302e0c9023a39f6809f6790437c56c1094d97e58ad5ca55897f97076e9c6428nss-pkcs11-devel-3.36.0-9.el6_10.i686.rpm3955ebf933c501f7a77618de261c00ee4bff49630be140505a1914ab5cd7f869nss-pkcs11-devel-3.36.0-9.el6_10.x86_64.rpmc85e37ea75a89d657760adac7eb9af26fff13c23a860447f92bfc15f605ef62fnss-devel-3.36.0-9.el6_10.x86_64.rpme85065a01e1fb4c825589b04369db6876b296c9d05625da0096aa28625002d3cnss-3.36.0-9.el6_10.x86_64.rpm6ac4e372276e34df71c107a12c35dc1f5742483ed8a1713d9c74d5bfabe2e0canss-tools-3.36.0-9.el6_10.x86_64.rpm84def6c5413733e74b410f689d9d6651a0e1505b8426327a1672aa0a18e2aa8anss-3.36.0-9.el6_10.i686.rpm7653e2279deb2dca7db6a62952c1008fc94f45b10823b0f4f645c6b986e62d97SLSA-2018:2943-1Security Fix(es): * OpenJDK: Improper field access checks (Hotspot, 8199226) (CVE-2018-3169) * OpenJDK: Unrestricted access to scripting engine (Scripting, 8202936) (CVE-2018-3183) * OpenJDK: Incomplete enforcement of the trustURLCodebase restriction (JNDI, 8199177) (CVE-2018-3149) * OpenJDK: Incorrect handling of unsigned attributes in singed Jar manifests (Security, 8194534) (CVE-2018-3136) * OpenJDK: Leak of sensitive header data via HTTP redirect (Networking, 8196902) (CVE-2018-3139) * OpenJDK: Missing endpoint identification algorithm check during TLS session resumption (JSSE, 8202613) (CVE-2018-3180) * OpenJDK: Infinite loop in RIFF format reader (Sound, 8205361) (CVE-2018-3214)criticalScientific Linux FermiScientific Linux Fermi 6java-1.8.0-openjdk-debug-1.8.0.191.b12-0.el6_10.x86_64.rpm1feb04fb2601fe3b72eacd8176e880ee422a7d65ed94ef276ce72e10bbab957djava-1.8.0-openjdk-demo-1.8.0.191.b12-0.el6_10.x86_64.rpma6daf0b8a30aa663fa957eb3e1f65e589e1edfab9375c9dddc45bde520b0436djava-1.8.0-openjdk-javadoc-debug-1.8.0.191.b12-0.el6_10.noarch.rpmaf8a7b0dc3e8686e78fd3f011c1214989d10cc3a1be001ba28a674f4565c3f95java-1.8.0-openjdk-devel-debug-1.8.0.191.b12-0.el6_10.x86_64.rpm0b4ab499d27602abd97e5f1065a7014cfb8af84393940974445310997a311e43java-1.8.0-openjdk-src-1.8.0.191.b12-0.el6_10.x86_64.rpmad5fbe27aff694e894165615e743db650779e52cbd2d4d4b7667dee994a162f9java-1.8.0-openjdk-headless-1.8.0.191.b12-0.el6_10.x86_64.rpm37bf151842a0b96621a9e8f4328a12c66008f1369ba29d81a82e4d229f258c2ejava-1.8.0-openjdk-javadoc-1.8.0.191.b12-0.el6_10.noarch.rpmb07a7e71ec39b7739030e24ab6ca6fae8f952e55307db94146ce31b6da7ccfeajava-1.8.0-openjdk-1.8.0.191.b12-0.el6_10.x86_64.rpm3ab5b12b29f79d516500e6d132b33491dd0bfa6e070e8a792ee429d898fdb949java-1.8.0-openjdk-headless-debug-1.8.0.191.b12-0.el6_10.x86_64.rpma536cdca5037d46f69c8100e40bcda55016a6a8e9cd137544401414f121f27c6java-1.8.0-openjdk-demo-debug-1.8.0.191.b12-0.el6_10.x86_64.rpm3723ce1849e0689db3d49595c35d653346607b0c5a61706d4a028455975ada62java-1.8.0-openjdk-devel-1.8.0.191.b12-0.el6_10.x86_64.rpme240dea22481cbf0ee4afb3bea9594df0aee8de87fdb7795d59c2667e6bdb169java-1.8.0-openjdk-src-debug-1.8.0.191.b12-0.el6_10.x86_64.rpm6f158d85d7eb852e83b06984fec7cc060e4dcf30ace97eb5ba784d5921fefd2dSLSA-2018:3006-1This update upgrades Firefox to version 60.3.0 ESR. Security Fix(es): * Mozilla: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3 (CVE-2018-12390) * Mozilla: Crash with nested event loops (CVE-2018-12392) * Mozilla: Integer overflow during Unicode conversion while loading JavaScript (CVE-2018-12393) * Mozilla: WebExtension bypass of domain restrictions through header rewriting (CVE-2018-12395) * Mozilla: WebExtension content scripts can execute in disallowed contexts (CVE-2018-12396) * Mozilla: WebExtension local file permission check bypass (CVE-2018-12397) * Mozilla: Memory safety bugs fixed in Firefox ESR 60.3 (CVE-2018-12389)criticalScientific Linux FermiScientific Linux Fermi 6firefox-60.3.0-1.el6.x86_64.rpmde03c0ab404e2af5a29bd1e574cf425f7c07486091083949eaea88242c36182ffirefox-60.3.0-1.el6.i686.rpmede778eb071ce9650c5042c641e0759b5d32660591eb490b128a86fe88ee6db8SLSA-2018:3403-1This update upgrades Thunderbird to version 60.2.1. Security Fix(es): * Mozilla: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2 (CVE-2018-12376) * Mozilla: Use-after-free in driver timers (CVE-2018-12377) * Mozilla: Use-after-free in IndexedDB (CVE-2018-12378) * Mozilla: Proxy bypass using automount and autofs (CVE-2017-16541) * Mozilla: Out-of-bounds write with malicious MAR file (CVE-2018-12379) * Mozilla: Crash in TransportSecurityInfo due to cached data (CVE-2018-12385) * Mozilla: Setting a master password post-Firefox 58 does not delete unencrypted previously stored passwords (CVE-2018-12383) Note: All of the above issues cannot be exploited in Thunderbird by a specially crafted HTML mail, as JavaScript is disabled for mail messages and cannot be enabled. They could be exploited another way in Thunderbird, for example, when viewing the remote content of an RSS feed.importantScientific Linux FermiScientific Linux Fermi 6thunderbird-60.2.1-5.el6.x86_64.rpm5c39ed21b5310b7d7f7ca6ba9836ab7f4c7155e9c21489f20a590b967420f164SLSA-2018:3406-1Security Fix(es): * python-paramiko: Authentication bypass in auth_handler.py (CVE-2018-1000805)criticalScientific Linux FermiScientific Linux Fermi 6python-paramiko-1.7.5-5.el6_10.noarch.rpm2e9f7c86a90e9f28294513a3fd9189703ff0597aa1014af580528606a2938f30SLSA-2018:3409-1Security Fix(es): * OpenJDK: Improper field access checks (Hotspot, 8199226) (CVE-2018-3169) * OpenJDK: Incomplete enforcement of the trustURLCodebase restriction (JNDI, 8199177) (CVE-2018-3149) * OpenJDK: Incorrect handling of unsigned attributes in signed Jar manifests (Security, 8194534) (CVE-2018-3136) * OpenJDK: Leak of sensitive header data via HTTP redirect (Networking, 8196902) (CVE-2018-3139) * OpenJDK: Missing endpoint identification algorithm check during TLS session resumption (JSSE, 8202613) (CVE-2018-3180) * OpenJDK: Infinite loop in RIFF format reader (Sound, 8205361) (CVE-2018-3214)importantScientific Linux FermiScientific Linux Fermi 6java-1.7.0-openjdk-devel-1.7.0.201-2.6.16.0.el6_10.x86_64.rpm65ae6a0f0079bf463145c73f50c5f80ab115cc585324d2c3fd80f9f5d16e54f4java-1.7.0-openjdk-1.7.0.201-2.6.16.0.el6_10.x86_64.rpmdbfea160b883af781ab701a7b435603a87a004f491070d3d99e4453347c447c9java-1.7.0-openjdk-javadoc-1.7.0.201-2.6.16.0.el6_10.noarch.rpm3a7a1024d765008366cde1ecbd58089d9d79f3bbe478ee161bf79d239f7f0cd4java-1.7.0-openjdk-src-1.7.0.201-2.6.16.0.el6_10.x86_64.rpm01f070eff92d06d3b221ce6f5efcb5a62654f3c491519311ee16543d5d378a87java-1.7.0-openjdk-demo-1.7.0.201-2.6.16.0.el6_10.x86_64.rpm1e40563cd0ba9c5a697e027b5b4abd2d525ce2e7cc36bbddb44e5c140371cfe5SLSA-2018:3522-1Security Fix(es): * spice: Possible buffer overflow via invalid monitor configurations (CVE-2017-7506)importantScientific Linux FermiScientific Linux Fermi 6spice-server-devel-0.12.4-16.el6_10.2.x86_64.rpmaf07d4973132e31e3742334677f8a2520d5dc7bc40fd7a22f18f2dbb1f99d952spice-server-0.12.4-16.el6_10.2.x86_64.rpme9133830a9b291592c2f5cbac459a3986bbcea4db3e396a9655620a9a579cb13SLSA-2018:3531-1This update upgrades Thunderbird to version 60.3.0. Security Fix(es): * Mozilla: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3 (CVE-2018-12390) * Mozilla: Crash with nested event loops (CVE-2018-12392) * Mozilla: Integer overflow during Unicode conversion while loading JavaScript (CVE-2018-12393) * Mozilla: Memory safety bugs fixed in Firefox ESR 60.3 (CVE-2018-12389)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-60.3.0-1.el6.x86_64.rpma0251fca81c575827ec28631f058bac04a66757f363bcd14063ef0db5b881951SLSA-2018:3760-1Security Fix(es): * It was discovered that the ghostscript /invalidaccess checks fail under certain conditions. An attacker could possibly exploit this to bypass the - -dSAFER protection and, for example, execute arbitrary shell commands via a specially crafted PostScript document. (CVE-2018-16509)importantScientific Linux FermiScientific Linux Fermi 6ghostscript-devel-8.70-24.el6_10.2.x86_64.rpmff93d6e9e1d9a79285ed2f052de7c38e975816a8081ed2beb48087228c8dd5c3ghostscript-devel-8.70-24.el6_10.2.i686.rpme6d50f05d18c2768306b1daa02c4639bff52828e0954b9b359d92e8aa0771390ghostscript-8.70-24.el6_10.2.x86_64.rpm6c002e4b07af5581a989d6adce9bf0bd9893788e3febdd6bbe991f59b26b815fghostscript-doc-8.70-24.el6_10.2.x86_64.rpmcfcda1c11d0d7f13c7dcdc795235267266cbb47d8436f7e23238b3ed07ee50e8ghostscript-gtk-8.70-24.el6_10.2.x86_64.rpm6b0516475f254ce2782c8f234eeb3749bafda61a75a19751712d59d58bc2cbcfghostscript-8.70-24.el6_10.2.i686.rpm19129067bd969ead4890e0d7385f09a971b91ca103df9f06c6250cfe105a0347SLSA-2018:3831-1This update upgrades Firefox to version 60.4.0 ESR. Security Fix(es): * Mozilla: Memory safety bugs fixed in Firefox 64 and Firefox ESR 60.4 (CVE-2018-12405) * Mozilla: Memory corruption in Angle (CVE-2018-17466) * Mozilla: Use-after-free with select element (CVE-2018-18492) * Mozilla: Buffer overflow in accelerated 2D canvas with Skia (CVE-2018-18493) * Mozilla: Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin URLs (CVE-2018-18494) * Mozilla: Integer overflow when calculating buffer sizes for images (CVE-2018-18498)criticalScientific Linux FermiScientific Linux Fermi 6firefox-60.4.0-1.el6.x86_64.rpmbde0990b4494c747c48a248844a72402eb9381400dc175b38aa8ca431be0c3edfirefox-60.4.0-1.el6.i686.rpm7e6a8856fa03774af2ede19dbb0e0e2ca404150ac76ce5cfec37b42bd0131003SLSA-2018:3854-1Security Fix(es): * ntp: Stack-based buffer overflow in ntpq and ntpdc allows denial of service or code execution (CVE-2018-12327)lowScientific Linux FermiScientific Linux Fermi 6ntp-perl-4.2.6p5-15.el6_10.x86_64.rpm0f775f51e349b63d4888472bf574cfbdcc77b7a32c06812707da4158da3c67b3ntpdate-4.2.6p5-15.el6_10.x86_64.rpm9d7821b33af7d4bf8d0a2637552e442ebdf9f04c290a479eddb26fa9efbc1ddfntp-doc-4.2.6p5-15.el6_10.noarch.rpmc82ee0772e881ec69ac19e51fb9e2360f223af9f4237a25309f13eed8ffae94dntp-4.2.6p5-15.el6_10.x86_64.rpm7968b98835763a81367618f4e8fe7d1ab7da7bc5b23c1743ac510f6850a1077aSLSA-2019:0159-1This update upgrades Thunderbird to version 60.4.0. Security Fix(es): * Mozilla: Memory safety bugs fixed in Firefox 64 and Firefox ESR 60.4 (CVE-2018-12405) * chromium-browser, firefox: Memory corruption in Angle (CVE-2018-17466) * Mozilla: Use-after-free with select element (CVE-2018-18492) * Mozilla: Buffer overflow in accelerated 2D canvas with Skia (CVE-2018-18493) * Mozilla: Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin URLs (CVE-2018-18494) * Mozilla: Integer overflow when calculating buffer sizes for images (CVE-2018-18498)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-60.4.0-1.el6.x86_64.rpm237b801770cf613cdca06c2e959a0e2e9243c476916515546c9a7aa0446f5ce2SLSA-2019:0218-1This update upgrades Firefox to version 60.5.0 ESR. Security Fix(es): * Mozilla: Use-after-free parsing HTML5 stream (CVE-2018-18500) * Mozilla: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5 (CVE-2018-18501) * Mozilla: Privilege escalation through IPC channel messages (CVE-2018-18505)criticalScientific Linux FermiScientific Linux Fermi 6firefox-60.5.0-2.el6.i686.rpmc249145e8254b9f684b3ad1c923e23d371deb91ce64390a5a4a8a73a997c30e6firefox-60.5.0-2.el6.x86_64.rpm2c4542c403e1c64eb2eb3df3a3181f60a43ca99d2e87dd78a6ddd6fdf899bedcSLSA-2019:0232-1Security Fix(es): * spice: Off-by-one error in array access in spice/server/memslot.c (CVE-2019-3813)importantScientific Linux FermiScientific Linux Fermi 6spice-server-devel-0.12.4-16.el6_10.3.x86_64.rpmb17aff06c5035ea336ddafba63036ff1e9eafd036e49f0028defc276826a0db4spice-server-0.12.4-16.el6_10.3.x86_64.rpm6f6758bdcd6ff7db3a74366dc8b4fcd777481819a738f58aa7ac6f07ee30ba67SLSA-2019:0269-1This update upgrades Thunderbird to version 60.5.0. Security Fix(es): * Mozilla: Use-after-free parsing HTML5 stream (CVE-2018-18500) * Mozilla: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5 (CVE-2018-18501) * Mozilla: Privilege escalation through IPC channel messages (CVE-2018-18505) * libical: Multiple use-after-free vulnerabilities (CVE-2016-5824)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-60.5.0-1.el6_10.x86_64.rpm94671acaf2a4eb803304f1f3a806190dcc2d3ce620a0590c0a6d692c1287d8abSLSA-2019:0373-1This update upgrades Firefox to version 60.5.1 ESR. Security Fix(es): * chromium-browser, mozilla: Use after free in Skia (CVE-2018-18356) * mozilla: Integer overflow in Skia (CVE-2019-5785)importantScientific Linux FermiScientific Linux Fermi 6firefox-60.5.1-1.el6_10.x86_64.rpmde59a5952e479376b5bc8a6741674809694e503d22e2236f7d3036d2dcec0034firefox-60.5.1-1.el6_10.i686.rpm8bfd2157ce8a1ab01f51be795ec16e763cf09b3b56142705e67cf0ddd0a01d9cSLSA-2019:0415-1Security Fix(es): * kernel: MIDI driver race condition leads to a double-free (CVE-2018-10902) Bug Fix(es): * Previously backported upstream patch caused a change in the behavior of page fault handler. As a consequence, applications compiled through GNU Compiler Collection (GCC) version 4.4.7 sometimes generated stack access exceeding the 64K limit. Running such applications subsequently triggered a segmentation fault. With this update, the 64k limit check in the page fault handler has been removed. As a result, running the affected applications no longer triggers the segmentation fault in the described scenario. Note that removing the limit check does not impact the integrity of the kernel itself.importantScientific Linux FermiScientific Linux Fermi 6kernel-abi-whitelists-2.6.32-754.11.1.el6.noarch.rpm6da6a9ef8b3191e30759860513dca99e2fc644f59c9afd6027e603e4aa905583kernel-doc-2.6.32-754.11.1.el6.noarch.rpmd9cd89b5755552488aa295527afcdfafb0f25d456b87a9200463a95bb864aa91kernel-headers-2.6.32-754.11.1.el6.x86_64.rpmd8dca60393c63951f2badecb1f564ef0cf82bd54d55af55b15172e93159b9c0ekernel-debug-2.6.32-754.11.1.el6.x86_64.rpm988219a2d9856015390ab37ac8d527c72d34e32711aaab297edc415ed2a11f01kernel-debug-devel-2.6.32-754.11.1.el6.i686.rpmda396184e8a0aedfc08fe4f9243afaea08ad5f54c1660dee3a073b6492166704perf-2.6.32-754.11.1.el6.x86_64.rpmb6b5daaf78c761a48a940aeeef1c4356f95617c5236d03a2b604bbc225e7c683kernel-devel-2.6.32-754.11.1.el6.x86_64.rpm604a497eb81084392ae179de4bbbd5752be018baa2691ad3cab4d55b6b5f5ea8python-perf-2.6.32-754.11.1.el6.x86_64.rpm29e92254961657bac92d6d3a0ca5f14443ed276a42f3687fa79d9e45afe60b27kernel-debug-devel-2.6.32-754.11.1.el6.x86_64.rpm4e93c2ce6c56c13e638585b8773717feadf0b632b7e6cd2bf28dd2bd86e1cf82kernel-firmware-2.6.32-754.11.1.el6.noarch.rpm80afe0e5dbe79721c10b46ba211e4b4738b6af7cbe3834fff0f9ab456f91d044kernel-2.6.32-754.11.1.el6.x86_64.rpm9c7731903788f1f512bad504024a48ccec7e60d1eae57116856406ef91b692b5SLSA-2019:0416-1Security Fix(es): * OpenJDK: memory disclosure in FileChannelImpl (Libraries, 8206290) (CVE-2019-2422)moderateScientific Linux FermiScientific Linux Fermi 6java-1.8.0-openjdk-demo-1.8.0.201.b09-1.el6_10.x86_64.rpm998c32fec0cb15833509793528d0e7b7f880f5c160048e90782b1c05c2121f68java-1.8.0-openjdk-debug-1.8.0.201.b09-1.el6_10.x86_64.rpm3d69ff8ffaa1e3f8c6789e21ad9c67b8a940386f26ce9124c1821d4931817d94java-1.8.0-openjdk-src-1.8.0.201.b09-1.el6_10.x86_64.rpm756703ba23691b9a7490c987805a7e9d5bbfb9465ec972eaace6432c1e219381java-1.8.0-openjdk-headless-debug-1.8.0.201.b09-1.el6_10.x86_64.rpm875f2873996fc351e22ebdb32aad727c3addfe6fc2d38156caa94295473251a6java-1.8.0-openjdk-1.8.0.201.b09-1.el6_10.x86_64.rpmce3dc933d6e16a3acbcf7db7fc2ff7e8099d4375128423129d7fd9b5ba5edc18java-1.8.0-openjdk-devel-1.8.0.201.b09-1.el6_10.x86_64.rpm041024be9a806e0ba1547c2c6546fea56558b6c8e38d71e0d92b935a36111b9djava-1.8.0-openjdk-javadoc-1.8.0.201.b09-1.el6_10.noarch.rpmb8a63a9bfb16fdf95ea239b84718079685034acb094344208834a3920928c079java-1.8.0-openjdk-headless-1.8.0.201.b09-1.el6_10.x86_64.rpm7e9f189a40835e96d58973ab8cf6317a4b651946e8c9acc47e11f91d24aa0581java-1.8.0-openjdk-devel-debug-1.8.0.201.b09-1.el6_10.x86_64.rpm49d82df37d2344ad9940c36c49275a175438d6a26c9f6005a63ccb252463a9dejava-1.8.0-openjdk-demo-debug-1.8.0.201.b09-1.el6_10.x86_64.rpm8440867c3978d9847b96687f8442e290eb73d6d8b2f626d0e035913b873a9c83java-1.8.0-openjdk-src-debug-1.8.0.201.b09-1.el6_10.x86_64.rpm056d71b7deac0a3791f456e6ee303b9b5db2874670cc4e153a8de990dd942dc5java-1.8.0-openjdk-javadoc-debug-1.8.0.201.b09-1.el6_10.noarch.rpm686fe9f40b9b7974ae00e73a7f9a08dcb962961d815734f2567ccf87889d0018SLSA-2019:0420-1Security Fix(es): * polkit: Temporary auth hijacking via PID reuse and non-atomic fork (CVE-2019-6133)importantScientific Linux FermiScientific Linux Fermi 6polkit-devel-0.96-11.el6_10.1.i686.rpmed349855c2dc321bc9394ddfa3a5ddfeb4d32ec04c6cbcd0f0e7e8eae36575e7polkit-docs-0.96-11.el6_10.1.x86_64.rpme8016913ed89ea1cf1a60d9f838154416eadaf8bad0624d0a5365b337bdfc3dapolkit-0.96-11.el6_10.1.i686.rpm569f6e45bd66cc5d945a5dca4b8fcfff70032e44c7a937a416fe38d2778e7141polkit-desktop-policy-0.96-11.el6_10.1.noarch.rpm509556641a226de36aa3bd79158e79e8e14588a42a5c568566c0b959785fb2d4polkit-devel-0.96-11.el6_10.1.x86_64.rpm52fefe0cbcbbaf6f4820feade3ab457604b8827e584e508311a5514ab751f3e1polkit-0.96-11.el6_10.1.x86_64.rpm326a1efbbce9796afda94b805a1c4540a98a2ddd39f1d5b110f0851b34e4ff32SLSA-2019:0462-1Security Fix(es): * OpenJDK: memory disclosure in FileChannelImpl (Libraries, 8206290) (CVE-2019-2422)moderateScientific Linux FermiScientific Linux Fermi 6java-1.7.0-openjdk-1.7.0.211-2.6.17.1.el6_10.x86_64.rpm14edca4b36c17e64423a996b5548ecb90ebf9b72155c795c27829498baad2f45java-1.7.0-openjdk-devel-1.7.0.211-2.6.17.1.el6_10.x86_64.rpmdf99e24892ca82d28b2e766f0b3cf9435a95d06557b3a1bd4de5e1e23b9fbd89java-1.7.0-openjdk-src-1.7.0.211-2.6.17.1.el6_10.x86_64.rpmaad9933e49a88515f80d0d95a0c92c79da0b017e9c3cd3fb3599ae6fc6103f06java-1.7.0-openjdk-demo-1.7.0.211-2.6.17.1.el6_10.x86_64.rpm2bc6b110eaae80521330188f70a336bdf921b8a936fb29c00a740d5b1faf3228java-1.7.0-openjdk-javadoc-1.7.0.211-2.6.17.1.el6_10.noarch.rpm0d7fc07ee894fd26c35ae8e74cc26708df8cf01a326b86efd7806193b8a60f67SLSA-2019:0623-1This update upgrades Firefox to version 60.6.0 ESR. Security Fix(es): * Mozilla: Memory safety bugs fixed in Firefox 66 and Firefox ESR 60.6 (CVE-2019-9788) * Mozilla: Use-after-free when removing in-use DOM elements (CVE-2019-9790) * Mozilla: Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey (CVE-2019-9791) * Mozilla: IonMonkey leaks JS_OPTIMIZED_OUT magic value to script (CVE-2019-9792) * Mozilla: Improper bounds checks when Spectre mitigations are disabled (CVE-2019-9793) * Mozilla: Type-confusion in IonMonkey JIT compiler (CVE-2019-9795) * Mozilla: Use-after-free with SMIL animation controller (CVE-2019-9796) * Mozilla: Proxy Auto-Configuration file can define localhost access to be proxied (CVE-2018-18506)criticalScientific Linux FermiScientific Linux Fermi 6firefox-60.6.0-3.el6_10.x86_64.rpma13cffaabfe7117ee8dbecc5a1913d0d9e37d4ead209d910c370a33eb05dd525firefox-60.6.0-3.el6_10.i686.rpm6e7308e77335ae44c84d98147143d202fbfcffadbfa662aed531acf62f0f4db3SLSA-2019:0672-1This update upgrades Firefox to version 60.6.1 ESR. Security Fix(es): * Mozilla: IonMonkey MArraySlice has incorrect alias information (CVE-2019-9810) * Mozilla: Ionmonkey type confusion with __proto__ mutations (CVE-2019-9813)criticalScientific Linux FermiScientific Linux Fermi 6firefox-60.6.1-1.el6_10.x86_64.rpm1b978a9d016cd74c5b207d031c6336f34980fd2478f7ba4bedfb999a19f2632dfirefox-60.6.1-1.el6_10.i686.rpm34a5d43d2f9fd082108b1f6e5494390bae27763b4bf1d27300d81a43265e5736SLSA-2019:0680-1Security Fix(es): * Mozilla: Memory safety bugs fixed in Firefox 66 and Firefox ESR 60.6 (CVE-2019-9788) * Mozilla: Use-after-free when removing in-use DOM elements (CVE-2019-9790) * Mozilla: Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey (CVE-2019-9791) * Mozilla: IonMonkey leaks JS_OPTIMIZED_OUT magic value to script (CVE-2019-9792) * Mozilla: IonMonkey MArraySlice has incorrect alias information (CVE-2019-9810) * Mozilla: Ionmonkey type confusion with __proto__ mutations (CVE-2019-9813) * Mozilla: Improper bounds checks when Spectre mitigations are disabled (CVE-2019-9793) * Mozilla: Type-confusion in IonMonkey JIT compiler (CVE-2019-9795) * Mozilla: Use-after-free with SMIL animation controller (CVE-2019-9796) * Mozilla: Proxy Auto-Configuration file can define localhost access to be proxied (CVE-2018-18506)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-60.6.1-1.el6_10.x86_64.rpmfd03b0f0c41d902ee6dce831622726e791285740b9dacc6cdbe14cdfecedeb10SLSA-2019:0711-1Security Fix(es): * openssh: User enumeration via malformed packets in authentication requests (CVE-2018-15473)lowScientific Linux FermiScientific Linux Fermi 6openssh-askpass-5.3p1-124.el6_10.x86_64.rpm120a5084e41eb8dd93322b6385ea8997a6d2d70b181b7ad7b2f8878b4d157a6epam_ssh_agent_auth-0.9.3-124.el6_10.i686.rpmc5a4a171ed4c435001e686aa8986e8d9609c60c7e898524a2431e16b735a730dpam_ssh_agent_auth-0.9.3-124.el6_10.x86_64.rpm90b4af6110c1ec419aa7273a6a8d61b3f36507a76e5e621c345fcc807d765301openssh-ldap-5.3p1-124.el6_10.x86_64.rpm3e4e3a51da469cdbb1790fcb415112d472ad7544c66090e223f164893a60795bopenssh-clients-5.3p1-124.el6_10.x86_64.rpm6100cf837b568f8ce86c7320448db3af58a36a40f21113996fa6a46956a8e698openssh-5.3p1-124.el6_10.x86_64.rpmf2ccecfdc823a918c60717b38bd57357336ff2e8fc50581276da584731539f47openssh-server-5.3p1-124.el6_10.x86_64.rpm4b8c136b73964b1ae712a476c691babf49f1d95b88e5e6c88fb5ec71ddacd56cSLSA-2019:0717-1Security Fix(es): * kernel: Missing check in fs/inode.c:inode_init_owner() does not clear SGID bit on non-directories for non-members (CVE-2018-13405)importantScientific Linux FermiScientific Linux Fermi 6kernel-debug-devel-2.6.32-754.12.1.el6.i686.rpm32dc06f0f09f8fc2ff4f92063a276c883c01d83a5b68f04c168d129cc9c82b0dkernel-headers-2.6.32-754.12.1.el6.x86_64.rpm2446b7dc71b2dd09f59510c802e193cfca4b932db338a6a84315a82f0e8f0f22perf-2.6.32-754.12.1.el6.x86_64.rpma81980dd62af375ad7980b2929c7e91baf93c90f3a9baa6497f8cfbd42f17cebkernel-debug-devel-2.6.32-754.12.1.el6.x86_64.rpm2328cd09cc999c36ef74525e5f3a4f9dbcb56cc43646ec75c888100cc2f76271kernel-2.6.32-754.12.1.el6.x86_64.rpm73e1cd3905ed92b01585fdfa3cb41770fbc3e94f20a09d6b6698691eea7e1566kernel-firmware-2.6.32-754.12.1.el6.noarch.rpmee86cd43a1dd0122b2e726d8fe7f004c17c33156993e7fbfdc95e5ab8c231ae5kernel-doc-2.6.32-754.12.1.el6.noarch.rpma06acfb19b7f582876446695b744f6f1921ef89a21033acd79d355a5bb3dfb63kernel-debug-2.6.32-754.12.1.el6.x86_64.rpmfae686c4840b1caf15af6432fa01c10b278c298a98bb05e6b4120be2fd266187kernel-devel-2.6.32-754.12.1.el6.x86_64.rpm8ae19246ba4e807b59d1ae89fc3eda9a9895c18083c92e3f7efde504ee4d4eb7python-perf-2.6.32-754.12.1.el6.x86_64.rpm95ebbea14e01e2e970a97a879e218786ca4a1571998bf65a330ce515f73d2a16kernel-abi-whitelists-2.6.32-754.12.1.el6.noarch.rpmdc23144ede380cce63aac7b9a4e1d2d003a6a4461db292ec0e27b80cec4ea6f4SLSA-2019:0774-1Security Fix(es): * OpenJDK: Font layout engine out of bounds access setCurrGlyphID() (2D, 8219022) (CVE-2019-2698) * OpenJDK: Slow conversion of BigDecimal to long (Libraries, 8211936) (CVE-2019-2602) * OpenJDK: Incorrect skeleton selection in RMI registry server-side dispatch handling (RMI, 8218453) (CVE-2019-2684) Bug Fix(es): * assert failure in coalesce.cpp: attempted to spill a non-spillable itemimportantScientific Linux FermiScientific Linux Fermi 6java-1.8.0-openjdk-src-1.8.0.212.b04-0.el6_10.x86_64.rpm1fd61ad01957668292d63ec545536d7f1aaa26409d2046d1051b0c78926d46cbjava-1.8.0-openjdk-src-debug-1.8.0.212.b04-0.el6_10.x86_64.rpmc5b18d643a2fdaf284308966b1e1f9283b8bb18d4df2fe5aeeba2eed85e71bedjava-1.8.0-openjdk-1.8.0.212.b04-0.el6_10.x86_64.rpma4baf68abeab41bd5cd757671f0bfe3c3b1fad496dcc736057bb45e57c81dd0cjava-1.8.0-openjdk-javadoc-1.8.0.212.b04-0.el6_10.noarch.rpmb9e34add24aa6012a59e8fa5445fc73fb62574efe902c3f2be44db65af51e39djava-1.8.0-openjdk-devel-debug-1.8.0.212.b04-0.el6_10.x86_64.rpmc3c36239d601fa4e502ea6b5bba53c3294c673ab36842d1c4ed88eb7a27d756fjava-1.8.0-openjdk-demo-1.8.0.212.b04-0.el6_10.x86_64.rpm4f11c48a07f43f144de22958c4637ead3f6d71d0618ce848aa2ccf4b2e3db6c5java-1.8.0-openjdk-javadoc-debug-1.8.0.212.b04-0.el6_10.noarch.rpmce2c81654331538cd7001842aebb8e0511f3ba871ed7ed27f3e4533510f652ebjava-1.8.0-openjdk-demo-debug-1.8.0.212.b04-0.el6_10.x86_64.rpmbde812187a5af4bc2d27fb2bcf76367a225eb36d549a081fdf85040558da669ejava-1.8.0-openjdk-headless-1.8.0.212.b04-0.el6_10.x86_64.rpm59b6cac9620e10327f8592ad7d0464d678cfc665a9732595402adc6f3882c57cjava-1.8.0-openjdk-headless-debug-1.8.0.212.b04-0.el6_10.x86_64.rpm7b7fe8f5f1a5062e6852e59697bd9b0f04727d538112381740844af34881d2fajava-1.8.0-openjdk-debug-1.8.0.212.b04-0.el6_10.x86_64.rpmc7cce7d3e964001d2954b4e616b01e48f2fa18aa9d34799fea04eaac297a4032java-1.8.0-openjdk-devel-1.8.0.212.b04-0.el6_10.x86_64.rpm4fca220ab706ffa96ff01dfe3a9a84a3e40f52ae3ace712120f9cffe9922a2a3SLSA-2019:0790-1Security Fix(es): * OpenJDK: Font layout engine out of bounds access setCurrGlyphID() (2D, 8219022) (CVE-2019-2698) * OpenJDK: Slow conversion of BigDecimal to long (Libraries, 8211936) (CVE-2019-2602) * OpenJDK: Incorrect skeleton selection in RMI registry server-side dispatch handling (RMI, 8218453) (CVE-2019-2684)importantScientific Linux FermiScientific Linux Fermi 6java-1.7.0-openjdk-demo-1.7.0.221-2.6.18.0.el6_10.x86_64.rpmf7a97b8c75c457060c39c90c3a502fefa86f0f388623e5a96418601d985a58f9java-1.7.0-openjdk-javadoc-1.7.0.221-2.6.18.0.el6_10.noarch.rpmf1a9617fd9bfb764a9f48d351d70fe472c97c42d4bca1f9708466c2fc5302605java-1.7.0-openjdk-src-1.7.0.221-2.6.18.0.el6_10.x86_64.rpmfe405cd709b817fbac9b4218b2e303f0fb2f7f674f4ea8b68b52f60f812932cdjava-1.7.0-openjdk-devel-1.7.0.221-2.6.18.0.el6_10.x86_64.rpm6f3206947c283d31a6d2ac34119753258e6cce026a7acda482c36e550fdff009java-1.7.0-openjdk-1.7.0.221-2.6.18.0.el6_10.x86_64.rpmb8ba57479da96cc8ae7bb47e0ca46a054d01cdafb5bc4164ecdb18a936e1632cSLSA-2019:1169-1Security Fix(es): * A flaw was found in the implementation of the "fill buffer", a mechanism used by modern CPUs when a cache-miss is made on L1 CPU cache. If an attacker can generate a load operation that would create a page fault, the execution will continue speculatively with incorrect data from the fill buffer while the data is fetched from higher level caches. This response time can be measured to infer data in the fill buffer. (CVE-2018-12130) * Modern Intel microprocessors implement hardware-level micro- optimizations to improve the performance of writing data back to CPU caches. The write operation is split into STA (STore Address) and STD (STore Data) sub-operations. These sub-operations allow the processor to hand-off address generation logic into these sub-operations for optimized writes. Both of these sub-operations write to a shared distributed processor structure called the 'processor store buffer'. As a result, an unprivileged attacker could use this flaw to read private data resident within the CPU's processor store buffer. (CVE-2018-12126) * Microprocessors use a load port subcomponent to perform load operations from memory or IO. During a load operation, the load port receives data from the memory or IO subsystem and then provides the data to the CPU registers and operations in the CPUs pipelines. Stale load operations results are stored in the 'load port' table until overwritten by newer operations. Certain load-port operations triggered by an attacker can be used to reveal data about previous stale requests leaking data back to the attacker via a timing side-channel. (CVE-2018-12127) * Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. (CVE-2019-11091) Bug Fix(es): * aio O_DIRECT writes to non-page-aligned file locations on ext4 can result in the overlapped portion of the page containing zeros * Tolerate new s390x crypto hardware for migrationimportantScientific Linux FermitrueScientific Linux Fermi 6kernel-devel-2.6.32-754.14.2.el6.x86_64.rpmd33dd4979e07ee14cce2baa01c3f2e81279bc4a73d29047153076f66c1269b83python-perf-2.6.32-754.14.2.el6.x86_64.rpm2653544e0477530586ab1d138e6772cb3c9063ea2c3d12b2540995687dcd8b4ckernel-headers-2.6.32-754.14.2.el6.x86_64.rpm120fc6f401a78f3b2599943eb3187b91c81b7be50fe8cfee5faa621487e0cca9kernel-doc-2.6.32-754.14.2.el6.noarch.rpm9195910ccd4222d609c3ba9b0408915876688f2649237f41161c9824a7484f72kernel-2.6.32-754.14.2.el6.x86_64.rpm78b34ad5ce130a8a51a1bd0b0812aa57c2b8106568cd9e0f37ced3ba4fee1c78perf-2.6.32-754.14.2.el6.x86_64.rpmec27cbde9b2aee702104b7f8533029305a649716f0bd5d0e8bae86e8fd2e61a1kernel-debug-2.6.32-754.14.2.el6.x86_64.rpm11ac09285566f0bb5510c8741ecd7d008600202ca623153585eb92bcf424d189kernel-debug-devel-2.6.32-754.14.2.el6.x86_64.rpme20641082c9486699e5bb7908a32e54acfffe9f31a3565105127f67a5b64b231kernel-debug-devel-2.6.32-754.14.2.el6.i686.rpm30029142d7213320a92ccf28d348669ded539d9a5e361c9ac95f4c8ab9f029f7kernel-firmware-2.6.32-754.14.2.el6.noarch.rpm95f00d7149fadae050b00249aea12b631ec171ca2c0cc8bff24a315623a627b7kernel-abi-whitelists-2.6.32-754.14.2.el6.noarch.rpm0bcc855f096a25fd1e07c9e070496a15965acc391856870436dc4d3c8d525960SLSA-2019:1180-1Security Fix(es): * A flaw was found in the implementation of the "fill buffer", a mechanism used by modern CPUs when a cache-miss is made on L1 CPU cache. If an attacker can generate a load operation that would create a page fault, the execution will continue speculatively with incorrect data from the fill buffer while the data is fetched from higher level caches. This response time can be measured to infer data in the fill buffer. (CVE-2018-12130) * Modern Intel microprocessors implement hardware-level micro- optimizations to improve the performance of writing data back to CPU caches. The write operation is split into STA (STore Address) and STD (STore Data) sub-operations. These sub-operations allow the processor to hand-off address generation logic into these sub-operations for optimized writes. Both of these sub-operations write to a shared distributed processor structure called the 'processor store buffer'. As a result, an unprivileged attacker could use this flaw to read private data resident within the CPU's processor store buffer. (CVE-2018-12126) * Microprocessors use a load port subcomponent to perform load operations from memory or IO. During a load operation, the load port receives data from the memory or IO subsystem and then provides the data to the CPU registers and operations in the CPUs pipelines. Stale load operations results are stored in the 'load port' table until overwritten by newer operations. Certain load-port operations triggered by an attacker can be used to reveal data about previous stale requests leaking data back to the attacker via a timing side-channel. (CVE-2018-12127) * Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. (CVE-2019-11091)importantScientific Linux FermiScientific Linux Fermi 6libvirt-client-0.10.2-64.el6_10.1.x86_64.rpm02c01c5e114e72c0ccd1f2c979a951ca2d6e7a260b135d34cfe61df935466ba9libvirt-devel-0.10.2-64.el6_10.1.x86_64.rpmf829029c7b7a2ef579df550bdfb832300ba52460f86129cd9ae4ecedd5d61ce1libvirt-lock-sanlock-0.10.2-64.el6_10.1.x86_64.rpmbfdb950e2c2bfdb18011ec0c592ca56caa69f5a2050ec0968c4f2668deac1e5elibvirt-devel-0.10.2-64.el6_10.1.i686.rpm52a0b76a3c42f4f89feb1774130ba9c24c1b2586d708e52f6e93c9b7544c8415libvirt-python-0.10.2-64.el6_10.1.x86_64.rpmb09321a2b2f590a2d77aee9293d494e531e775d46065c010cdc657eb5429fa40libvirt-0.10.2-64.el6_10.1.x86_64.rpm09f52705f081cd668a197f29902b768b4a1545a58a11c6f23a9f61c8f32f0efelibvirt-client-0.10.2-64.el6_10.1.i686.rpm2db665f301963c18e699bf6de58d71d46d9b58615941f95892aaffd80705d476SLSA-2019:1181-1Security Fix(es): * A flaw was found in the implementation of the "fill buffer", a mechanism used by modern CPUs when a cache-miss is made on L1 CPU cache. If an attacker can generate a load operation that would create a page fault, the execution will continue speculatively with incorrect data from the fill buffer while the data is fetched from higher level caches. This response time can be measured to infer data in the fill buffer. (CVE-2018-12130) * Modern Intel microprocessors implement hardware-level micro- optimizations to improve the performance of writing data back to CPU caches. The write operation is split into STA (STore Address) and STD (STore Data) sub-operations. These sub-operations allow the processor to hand-off address generation logic into these sub-operations for optimized writes. Both of these sub-operations write to a shared distributed processor structure called the 'processor store buffer'. As a result, an unprivileged attacker could use this flaw to read private data resident within the CPU's processor store buffer. (CVE-2018-12126) * Microprocessors use a load port subcomponent to perform load operations from memory or IO. During a load operation, the load port receives data from the memory or IO subsystem and then provides the data to the CPU registers and operations in the CPUs pipelines. Stale load operations results are stored in the 'load port' table until overwritten by newer operations. Certain load-port operations triggered by an attacker can be used to reveal data about previous stale requests leaking data back to the attacker via a timing side-channel. (CVE-2018-12127) * Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. (CVE-2019-11091)importantScientific Linux FermiScientific Linux Fermi 6qemu-kvm-0.12.1.2-2.506.el6_10.3.x86_64.rpm686bc35d4c0cf2d475e362472b8e2266a81d480c936aa13f8345d719f3e0cacbqemu-img-0.12.1.2-2.506.el6_10.3.x86_64.rpma7dbe66028e1330476004d5c9b8849ee5c335dbf45240aeb45cf2e7336555c3cqemu-guest-agent-0.12.1.2-2.506.el6_10.3.x86_64.rpm32312e8c8f9f845daf401d64cd8c962ddc854cb52663c4e574811f6bc2b5e21cqemu-kvm-tools-0.12.1.2-2.506.el6_10.3.x86_64.rpm02c1d4c24d77628a89316b69800ce2da12aa7a2618fe7c3a5342ec9dcf2c9cfbSLSA-2019:1267-1Security Fix(es): * Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800) * Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797) * Mozilla: Type confusion with object groups and UnboxedObjects (CVE-2019-9816) * Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817) * Mozilla: Compartment mismatch with fetch API (CVE-2019-9819) * Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820) * Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691) * Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692) * Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693) * mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511) * chromium-browser: Out of bounds read in Skia (CVE-2019-5798) * Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698) * libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)criticalScientific Linux FermiScientific Linux Fermi 6firefox-60.7.0-1.el6_10.i686.rpmf9b6070513611a29f87cbaee4f54f91eb13ca6ed35c086d2896078e056b46c0cfirefox-60.7.0-1.el6_10.x86_64.rpm61d59fb2f6d9cc2a10c17a5d13732bae2beba8094a2f8838e72319ebc7cebdc5SLSA-2019:1310-1Security Fix(es): * Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800) * Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797) * Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817) * Mozilla: Compartment mismatch with fetch API (CVE-2019-9819) * Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820) * Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691) * Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692) * Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693) * mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511) * chromium-browser: Out of bounds read in Skia (CVE-2019-5798) * Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698) * libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-60.7.0-1.el6_10.x86_64.rpm40874a273d1dbb5d572234059b0f1972e556e6cc17b4737e773d6617d6b2486eSLSA-2019:1467-1Security Fix(es): * python: Information Disclosure due to urlsplit improper NFKC normalization (CVE-2019-9636)importantScientific Linux FermiScientific Linux Fermi 6python-tools-2.6.6-68.el6_10.x86_64.rpmae60a0a67b28649fdfccf47e82cf7a1478ef4366470b7ba7e2ef6d66d4e476b0python-libs-2.6.6-68.el6_10.x86_64.rpm4bd26b0459506c5af78a160e863f483039a9aa5006de65793ff5c619815acf55python-2.6.6-68.el6_10.i686.rpm2d4f74517c2184a4b67e00d75c93c273542f429a4658807dfec57f69c94cc6e3python-libs-2.6.6-68.el6_10.i686.rpm31002791d54f57f740486204cb5198c111cb893ba0b7745a995e32c48f59619fpython-test-2.6.6-68.el6_10.x86_64.rpm0d34dfc1b5ae9bbf61946e72020e078b1233e846a6a623be7d2c09837ab4f8d1python-devel-2.6.6-68.el6_10.i686.rpm72c2b019f40d91a9280ca52c10eac6fc8b2b6fd040e8e1c1b453f6bccccd530ctkinter-2.6.6-68.el6_10.x86_64.rpm9481c91914d979e50cee319c720fe7d055d904497da5e34ad9580f7aa7d13675python-2.6.6-68.el6_10.x86_64.rpmb76f77316cc83c52486a8ef2e2f2d8b7fd42e003237ccedd3d8e1e5435faf470python-devel-2.6.6-68.el6_10.x86_64.rpma2c91f917bd4cf7443bdaa0ef4bf803bcd046a890af7cbac41343233afaca74eSLSA-2019:1488-1Security Fix(es): * An integer overflow flaw was found in the way the Linux kernel's networking subsystem processed TCP Selective Acknowledgment (SACK) segments. While processing SACK segments, the Linux kernel's socket buffer (SKB) data structure becomes fragmented. Each fragment is about TCP maximum segment size (MSS) bytes. To efficiently process SACK blocks, the Linux kernel merges multiple fragmented SKBs into one, potentially overflowing the variable holding the number of segments. A remote attacker could use this flaw to crash the Linux kernel by sending a crafted sequence of SACK segments on a TCP connection with small value of TCP MSS, resulting in a denial of service (DoS). (CVE-2019-11477) * kernel: Double free in lib/idr.c (CVE-2019-3896) * Kernel: tcp: excessive resource consumption while processing SACK blocks allows remote denial of service (CVE-2019-11478) * Kernel: tcp: excessive resource consumption for TCP connections with low MSS allows remote denial of service (CVE-2019-11479) Bug Fix(es): * MDS mitigations not enabled on Intel Skylake CPUs * kernel does not disable SMT with mds=full,nosmt * md_clear flag missing from /proc/cpuinfoimportantScientific Linux FermiScientific Linux Fermi 6kernel-doc-2.6.32-754.15.3.el6.noarch.rpmebc1974ea07e5755fbff09deae0fe3511b2e96901867d6021b82e0570b3ca9a6kernel-debug-devel-2.6.32-754.15.3.el6.x86_64.rpmdc009ba34c389d2f25c344021fff92af1b816b9ac78b57da6a28b2253477951cperf-2.6.32-754.15.3.el6.x86_64.rpmd47bdb6212850ddaad8cb59bbaf3ce2a842b81704cee9eb890bd6fbb01a9c52akernel-abi-whitelists-2.6.32-754.15.3.el6.noarch.rpma6bd088a6af90b68ba2988cb9577c87fd8f3c8e70587cff1a947bd9cb463c346kernel-debug-2.6.32-754.15.3.el6.x86_64.rpm26ec5d33e15f4f104ef01350deb8a07263e53bb9ad50af100ba97f50ee8f63fakernel-devel-2.6.32-754.15.3.el6.x86_64.rpm839e341ec09a85dcb82922d83eba238616715458d782203557cc6faec107333cpython-perf-2.6.32-754.15.3.el6.x86_64.rpm634933fc2a2088408fd6256e65c2d3c24cafb47bbf869957ce3f272aa46d7888kernel-headers-2.6.32-754.15.3.el6.x86_64.rpm73fd68abc73b0e3f1635da32a222ad0f307a01aa0ae0fd8e395c76f4f5bba99ekernel-firmware-2.6.32-754.15.3.el6.noarch.rpm6881f3ef3f48f6dfea8966f8b9c718ae4977ad23147944724c96415ba17ac068kernel-2.6.32-754.15.3.el6.x86_64.rpmd69e5f5287f5036eca22f731c7774acaaa00c33c33039b7745645876c1ebae66kernel-debug-devel-2.6.32-754.15.3.el6.i686.rpmc2784c078288ec70c7e7c53b7e95b49e439fe6ab903231d09a223d345ed381c9SLSA-2019:1492-1Security Fix(es): * bind: Limiting simultaneous TCP clients is ineffective (CVE-2018-5743)importantScientific Linux FermiScientific Linux Fermi 6bind-libs-9.8.2-0.68.rc1.el6_10.3.x86_64.rpm506dfbc7fe56aea41a049c3463c1e47a082cbc7436a64706df1e471188914a61bind-devel-9.8.2-0.68.rc1.el6_10.3.x86_64.rpmce02fc6b94a2476b19a7e746f47dcbde8eb46a91a49851ba40f328601b304282bind-utils-9.8.2-0.68.rc1.el6_10.3.x86_64.rpm68003ee824b304d31f04a4a2f621cf52e8dcbb803eebc3c25cb428f1aa7c69debind-devel-9.8.2-0.68.rc1.el6_10.3.i686.rpm81e8d339af4aee612849cbe1a162857657db5094cbfd905e339d3b621f835caabind-9.8.2-0.68.rc1.el6_10.3.x86_64.rpmb064ccc680761c37ac3514b87ed91c0bb4ad73bf5ba1668c3fe2206b170179d2bind-libs-9.8.2-0.68.rc1.el6_10.3.i686.rpmb2bc7d8dd364662b9c9ec772603791be17092ecb3bcbbba8dd4d3088a967c928bind-chroot-9.8.2-0.68.rc1.el6_10.3.x86_64.rpma53de58950130026b5ab35fb9e385a4c41b00e528ab6e54796a08cc91e525bccbind-sdb-9.8.2-0.68.rc1.el6_10.3.x86_64.rpm0d6bb2816ca766866af7ccae2ad2bfee9ad3e2a5b77def20c7c244f13b95493aSLSA-2019:1578-1Security Fix(es): * libvirt: arbitrary file read/exec via virDomainSaveImageGetXMLDesc API (CVE-2019-10161) * libvirt: virDomainManagedSaveDefineXML API exposed to readonly clients (CVE-2019-10166) * libvirt: arbitrary command execution via virConnectGetDomainCapabilities API (CVE-2019-10167) * libvirt: arbitrary command execution via virConnectBaselineHypervisorCPU and virConnectCompareHypervisorCPU APIs (CVE-2019-10168)moderateScientific Linux FermiScientific Linux Fermi 6libvirt-0.10.2-64.el6_10.2.x86_64.rpma781e7ebb345513661f7df2a7f623cb28ec1120f09a1870e67ef5af6f36a7600libvirt-python-0.10.2-64.el6_10.2.x86_64.rpm159f03f0fb66e57445d82f0d6e42f0db9b0a0be9969f6f7908c587d9b261717dlibvirt-devel-0.10.2-64.el6_10.2.i686.rpm7bae2df5101efc072b5dbe4af4e4f92796e251ca6be203da6416bedddab07232libvirt-lock-sanlock-0.10.2-64.el6_10.2.x86_64.rpm71864aba08db302e4feccecd2fd5c1f852a1a2874e7e98aa0136fbc4e0fd0e0clibvirt-client-0.10.2-64.el6_10.2.x86_64.rpm0e95566e997ae431ac79c2137b600f5ed506938393be2c046e4a5c5d58b29604libvirt-devel-0.10.2-64.el6_10.2.x86_64.rpmf25616b793dd3a94b53d8434d303adefff1968d4f10106461f0dbabf942f232alibvirt-client-0.10.2-64.el6_10.2.i686.rpm615765410c7a433b2bcca369eb4185b0bcbca4778ab1cf17badd1437f92f329eSLSA-2019:1604-1Security Fix(es): * Mozilla: Type confusion in Array.pop (CVE-2019-11707) * Mozilla: Sandbox escape using Prompt:Open (CVE-2019-11708)criticalScientific Linux FermiScientific Linux Fermi 6firefox-60.7.2-1.el6_10.i686.rpm5762907e1106ae6354abc19222c247d1aedf8819e1e65e692af50549da91050afirefox-60.7.2-1.el6_10.x86_64.rpmff88b66d8d50de2216877ea630e00d564e9ca2cf7720d9f1297ea3e47423c40dSLSA-2019:1624-1Security Fix(es): * Mozilla: Type confusion in Array.pop (CVE-2019-11707) * thunderbird: Stack buffer overflow in icalrecur_add_bydayrules in icalrecur.c (CVE-2019-11705) * Mozilla: Sandbox escape using Prompt:Open (CVE-2019-11708) * thunderbird: Heap buffer over read in icalparser.c parser_get_next_char (CVE-2019-11703) * thunderbird: Heap buffer overflow in icalmemory_strdup_and_dequote function in icalvalue.c (CVE-2019-11704) * thunderbird: Type confusion in icaltimezone_get_vtimezone_properties function in icalproperty.c (CVE-2019-11706)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-60.7.2-2.el6_10.x86_64.rpm7d4917505c5b40eec30c965fc4ee23580efb9d89d781c648932ccd01b0749c78SLSA-2019:1650-1Security Fix(es): * QEMU: Slirp: information leakage in tcp_emu() due to uninitialized stack variables (CVE-2019-9824)lowScientific Linux FermiScientific Linux Fermi 6qemu-guest-agent-0.12.1.2-2.506.el6_10.4.x86_64.rpmbf9a60570b2d7824a26f8c1d271a116c9f5845a2c220b96c3eadccf2982f64d6qemu-kvm-0.12.1.2-2.506.el6_10.4.x86_64.rpme2ee69717810444b8c91026a0d476a465e8f675c3bc0aefd3c215be0f7901ebeqemu-img-0.12.1.2-2.506.el6_10.4.x86_64.rpm8a6a1d17ed974161e7f061c5264e381f054e5a0afd1da09b2832d9088cc40265qemu-kvm-tools-0.12.1.2-2.506.el6_10.4.x86_64.rpm54a43dc9b8c2d8a1f9119e0ee7b2e080f9c1bb999db733ea7aecac7b0cdf7bf4SLSA-2019:1652-1Security Fix(es): * libssh2: Integer overflow in transport read resulting in out of bounds write (CVE-2019-3855) * libssh2: Integer overflow in keyboard interactive handling resulting in out of bounds write (CVE-2019-3856) * libssh2: Integer overflow in SSH packet processing channel resulting in out of bounds write (CVE-2019-3857) * libssh2: Integer overflow in user authenticate keyboard interactive allows out-of-bounds writes (CVE-2019-3863)importantScientific Linux FermiScientific Linux Fermi 6libssh2-1.4.2-3.el6_10.1.x86_64.rpm4096002e60ef612762224a3746f8561e89aa32734c7a4bde4cfe0e55f61637eflibssh2-devel-1.4.2-3.el6_10.1.i686.rpmc24fbf4975007cbc746bf3617fff9ef4f142f50a62f7b4d47da518835c79a1aelibssh2-1.4.2-3.el6_10.1.i686.rpm237279527bd8da3b53a126e327aa5491f29e1ac8b0cd8f6ac37bbc1017ae4b63libssh2-devel-1.4.2-3.el6_10.1.x86_64.rpm9760bf3d1d273631d59429c84387bbd6061141f7a3be5ba855c355d7b548c3b6libssh2-docs-1.4.2-3.el6_10.1.x86_64.rpmaf206f05e767c410b161c58779ba4bbc48b5e49fd1eda537d1046d173dba468cSLSA-2019:1726-1Security Fix(es): * dbus: DBusServer DBUS_COOKIE_SHA1 authentication bypass (CVE-2019-12749)importantScientific Linux FermiScientific Linux Fermi 6dbus-1.2.24-11.el6_10.x86_64.rpmf78ceed0bff4f65df92e5ac388f6be9277105fe4d0a324b302f6818e4311f248dbus-devel-1.2.24-11.el6_10.i686.rpmbb36e8baa228989d49c3fda19d44307151a34cbf14fedca4db2b0f266411a95fdbus-x11-1.2.24-11.el6_10.x86_64.rpm1950b835c40212a8eefac26115586a6283625d2004afb1937221317a7bd6b89ddbus-devel-1.2.24-11.el6_10.x86_64.rpmd020eb3f8dbec1a15a69299966f45a67fa55e931190ade4496db2bf5401db70fdbus-libs-1.2.24-11.el6_10.x86_64.rpmbba6d7011a2ff160668972c5f30153c9e86f55f63b5221c29ba8d0b906b54b78dbus-libs-1.2.24-11.el6_10.i686.rpm27c22a404a473302373f7dcc4da626e06c39ca936278d9812a20631eb9e7048adbus-doc-1.2.24-11.el6_10.noarch.rpm7e9688be22663b7e530f0c2a1771ee68259e26b3844abb638b7b01cd0b9bf396SLSA-2019:1765-1This update upgrades Firefox to version 60.8.0 ESR. Security Fix(es): * Mozilla: Memory safety bugs fixed in Firefox 68 and Firefox ESR 60.8 (CVE-2019-11709) * Mozilla: Sandbox escape via installation of malicious language pack (CVE-2019-9811) * Mozilla: Script injection within domain through inner window reuse (CVE-2019-11711) * Mozilla: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects (CVE-2019-11712) * Mozilla: Use-after-free with HTTP/2 cached stream (CVE-2019-11713) * Mozilla: HTML parsing error can contribute to content XSS (CVE-2019-11715) * Mozilla: Caret character improperly escaped in origins (CVE-2019-11717) * Mozilla: Same-origin policy treats all files in a directory as having the same-origin (CVE-2019-11730)criticalScientific Linux FermiScientific Linux Fermi 6firefox-60.8.0-1.el6_10.x86_64.rpmec778924fc40f29cd2d196fbcb1ccd841da212e901e88ceb214837353119d732firefox-60.8.0-1.el6_10.i686.rpm2ab292bd861025002d2e6cf98cc65bec3154d5654cc07b18be7f005d43d6a3acSLSA-2019:1774-1Security Fix(es): * vim/neovim: ':source!' command allows arbitrary command execution via modelines (CVE-2019-12735)importantScientific Linux FermiScientific Linux Fermi 6vim-common-7.4.629-5.el6_10.2.x86_64.rpmd940d207c4306479b8fd5b62cbe610d304916f976c02024880c1287c1a7b5e09vim-filesystem-7.4.629-5.el6_10.2.x86_64.rpmd2af667c8a90ec7ee4b5bfc7c9452275c4f569ec01e4bb94a4e2b5b4ba14ead8vim-minimal-7.4.629-5.el6_10.2.x86_64.rpm3a1414cb65d4c8e42b08cbe7237436712167cd772fb3a3b4ecab178a0edc2250vim-X11-7.4.629-5.el6_10.2.x86_64.rpm8b215eeca633e3baf0450e2c3f27f98af032a568d75e286cc7ed91cde98c26eevim-enhanced-7.4.629-5.el6_10.2.x86_64.rpmb529967e49d68a3381c4a1f30953d9357284c175b7bfe40a0c039f128f3b6af8SLSA-2019:1777-1This update upgrades Thunderbird to version 60.8.0. Security Fix(es): * Mozilla: Memory safety bugs fixed in Firefox 68 and Firefox ESR 60.8 (CVE-2019-11709) * Mozilla: Sandbox escape via installation of malicious language pack (CVE-2019-9811) * Mozilla: Script injection within domain through inner window reuse (CVE-2019-11711) * Mozilla: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects (CVE-2019-11712) * Mozilla: Use-after-free with HTTP/2 cached stream (CVE-2019-11713) * Mozilla: HTML parsing error can contribute to content XSS (CVE-2019-11715) * Mozilla: Caret character improperly escaped in origins (CVE-2019-11717) * Mozilla: Same-origin policy treats all files in a directory as having the same-origin (CVE-2019-11730)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-60.8.0-1.el6_10.x86_64.rpmc4628a4fc17acc8f2f970e279da872eb08fa96b89f29ab49868beb7fe09559eeSLSA-2019:1811-1Security Fix(es): * OpenJDK: Side-channel attack risks in Elliptic Curve (EC) cryptography (Security, 8208698) (CVE-2019-2745) * OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328) (CVE-2019-2762) * OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432) (CVE-2019-2769) * OpenJDK: Missing URL format validation (Networking, 8221518) (CVE-2019-2816) * OpenJDK: Missing array bounds check in crypto providers (JCE, 8223511) (CVE-2019-2842) * OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381) (CVE-2019-2786)moderateScientific Linux FermiScientific Linux Fermi 6java-1.8.0-openjdk-javadoc-debug-1.8.0.222.b10-0.el6_10.noarch.rpm7fcf1eab81210329d4ec323669b49cbb86320a0315e6fe9f00846ac538081cd2java-1.8.0-openjdk-headless-debug-1.8.0.222.b10-0.el6_10.x86_64.rpma2e1aa563812a1246136453e85437d786a732c4bce3e6fd09456f8820b160af6java-1.8.0-openjdk-headless-1.8.0.222.b10-0.el6_10.x86_64.rpm3d8fc8a15c2759a7a2a1b2b378d5fcbc1e496b9e8a4427f579c011db7bb7670ajava-1.8.0-openjdk-demo-1.8.0.222.b10-0.el6_10.x86_64.rpme3661e9e32b1d091bcddfaf05b91384383c7a1e9b713466d57868db34adc9fccjava-1.8.0-openjdk-javadoc-1.8.0.222.b10-0.el6_10.noarch.rpmfedb7e6431bb0d13c67dfc05556ad81b3a96f3df5baa7ee90f2cd87b474e042djava-1.8.0-openjdk-src-1.8.0.222.b10-0.el6_10.x86_64.rpm6c7a9ce19acccabd719ff1d4f463832a509ddaf1df3884edd23e186827558689java-1.8.0-openjdk-debug-1.8.0.222.b10-0.el6_10.x86_64.rpma0ff1ac5da218cf670beebd3b9b2e546b22791df37801c0a24a70c4f131aaa16java-1.8.0-openjdk-demo-debug-1.8.0.222.b10-0.el6_10.x86_64.rpm80c5d825f04dcb17a8e42f7548df416905fdabb2aec5626a432f09350918e465java-1.8.0-openjdk-devel-debug-1.8.0.222.b10-0.el6_10.x86_64.rpmd55c6c07d6edaf525730f8993464277168922dc698e01dffaecec1202111c26djava-1.8.0-openjdk-src-debug-1.8.0.222.b10-0.el6_10.x86_64.rpm8ef3b55312b835ca5df831827320181642cdb26ec2a0954cd0ac4dc039bf8114java-1.8.0-openjdk-devel-1.8.0.222.b10-0.el6_10.x86_64.rpmed88351bc763f814525fb4b342d6886cfc826cf927b17c861fa56d053db41957java-1.8.0-openjdk-1.8.0.222.b10-0.el6_10.x86_64.rpm2f6b6bcb52eeff83c026b70b25493fcbd9c85d8e54f62b605293bc5377f8c540SLSA-2019:1840-1Security Fix(es): * OpenJDK: Side-channel attack risks in Elliptic Curve (EC) cryptography (Security, 8208698) (CVE-2019-2745) * OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328) (CVE-2019-2762) * OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432) (CVE-2019-2769) * OpenJDK: Missing URL format validation (Networking, 8221518) (CVE-2019-2816) * OpenJDK: Missing array bounds check in crypto providers (JCE, 8223511) (CVE-2019-2842) * OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381) (CVE-2019-2786)moderateScientific Linux FermiScientific Linux Fermi 6java-1.7.0-openjdk-demo-1.7.0.231-2.6.19.1.el6_10.x86_64.rpm3b8e64e17ecc820b4e503be60a56415e80ad1dba7751a862931611b385722cf5java-1.7.0-openjdk-src-1.7.0.231-2.6.19.1.el6_10.x86_64.rpm404880502c6ceb4d0143cec2f79477e4ff836f26d385ccf9e458e452b7f2e564java-1.7.0-openjdk-1.7.0.231-2.6.19.1.el6_10.x86_64.rpme0099a7709997d1956a246e24f12ce71b9cef9b9e879f8686b0dfc0d3c12faf8java-1.7.0-openjdk-devel-1.7.0.231-2.6.19.1.el6_10.x86_64.rpm07fe7c07c8a5b78b01c7fe65afead6ce48bf8293fc1dad5208414e503e1797a8java-1.7.0-openjdk-javadoc-1.7.0.231-2.6.19.1.el6_10.noarch.rpm1deac5b3b6d3b2b55bdcb848981c61d8f4196eb01b23fdb2de3e5ee47e7a10f5SLSA-2019:2471-1Security Fix(es): * openssl: 0-byte record padding oracle (CVE-2019-1559) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE moderateScientific Linux FermiScientific Linux Fermi 6openssl-1.0.1e-58.el6_10.i686.rpmf72d77100dd96a17ebac2a4f1c9dfebe87ddb6058c9c53ec5e0159a7563c0039openssl-devel-1.0.1e-58.el6_10.x86_64.rpmcf5b36712c10e435f4126e8a2fcfba86c2bf5067f44e2f2eae9e552b43213b57openssl-static-1.0.1e-58.el6_10.x86_64.rpmc41035964a649103c08f4ffdf7cc250a510e4e3c2e36608815cd9a0e3ae08355openssl-devel-1.0.1e-58.el6_10.i686.rpmd96d5fd130f2ef9e60e1959f2913cf9c1b77059ff37edd1b17afb10ad4ca1a7aopenssl-perl-1.0.1e-58.el6_10.x86_64.rpmd56a24c0d129c1e224230124e1e1ca9e3e8e918e6a1c453aafb4da5a38f5dd4copenssl-1.0.1e-58.el6_10.x86_64.rpm862bceed662e0b09478d130137d5ffb82a5d3cd560a0580c4493f8173b337640SLSA-2019:2473-1Security Fix(es): * Kernel: page cache side channel attacks (CVE-2019-5489) * kernel: Salsa20 encryption algorithm does not correctly handle zero-length inputs allowing local attackers to cause denial-of-service (CVE-2017-17805) * kernel: Unprivileged users able to inspect kernel stacks of arbitrary tasks (CVE-2018-17972) * kernel: hw: Spectre SWAPGS gadget vulnerability (CVE-2019-1125) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE Bug Fix(es): * OOPS with Null Pointer exception in v4l2_ctrl_query_menu when second arg of function is NULL * Another SL 6 hang in congestion_wait() * kernel crash after running user space script * SL-6.10: Don't report the use of retpoline on Skylake as vulnerable * Bad pagetable: 000f “*pdpt = 0000000000000000 *pde = 0000000000000000” SL 6 32bit * fs/binfmt_misc.c: do not allow offset overflow [6.10.z] * Wrong spectre backport causing linux headers to break compilation of 3rd party packagesimportantScientific Linux FermiScientific Linux Fermi 6kernel-abi-whitelists-2.6.32-754.18.2.el6.noarch.rpm40f7bc1add242616107d74280208eb47229e5b1cff19a8501290290d24201872kernel-debug-2.6.32-754.18.2.el6.x86_64.rpmf4deb38d1f4777e01f3cc72348ac151406437e33aaa6764839884532b01e21eakernel-devel-2.6.32-754.18.2.el6.x86_64.rpm3b6a12fe8f337ae43eafc06339ac5c9133d7f8fe3a465290db43ba28a18ef5b9python-perf-2.6.32-754.18.2.el6.x86_64.rpm68ed3febf5aebb422b4997c864681fbdba7813aa4e6bf3a1a6242bdfad642e29kernel-headers-2.6.32-754.18.2.el6.x86_64.rpmcc6d12ad6883585432e80a8fa5d142388086a4aeff815969f6b6dedfb4f7101fperf-2.6.32-754.18.2.el6.x86_64.rpm923d34203dacc0959948dd4072fe1f9bb37aa2bb77c23d3c03690b031d183dbckernel-debug-devel-2.6.32-754.18.2.el6.i686.rpmf76919575011397b851f03fb1e220b0ff25da5766707255f5c7de9fcacfb2f80kernel-doc-2.6.32-754.18.2.el6.noarch.rpm8c87207a6731978c78d7cb69b184947d8e529594b3a2992a7c1569e930693d04kernel-firmware-2.6.32-754.18.2.el6.noarch.rpmb4249a50dc5aff45878a137f33c62879f22ff8466f84d3efe29106adb5725164kernel-debug-devel-2.6.32-754.18.2.el6.x86_64.rpm894f4169c4374a634687643f035483a964698d5d0156898d47d61b5ba935f7c2kernel-2.6.32-754.18.2.el6.x86_64.rpmb28e5bd36aa4a50c08e1ce16852afbd0e95f151bb5e52cbbe9d2176a4c2adca1SLSA-2019:2694-1Security Fix(es): * Mozilla: Sandbox escape through Firefox Sync (CVE-2019-9812) * Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 (CVE-2019-11740) * Mozilla: Same-origin policy violation with SVG filters and canvas to steal cross-origin images (CVE-2019-11742) * Mozilla: XSS by breaking out of title and textarea elements using innerHTML (CVE-2019-11744) * Mozilla: Use-after-free while manipulating video (CVE-2019-11746) * Mozilla: Use-after-free while extracting a key value in IndexedDB (CVE-2019-11752) * firefox: stored passwords in 'Saved Logins' can be copied without master password entry (CVE-2019-11733) * Mozilla: Cross-origin access to unload event attributes (CVE-2019-11743)criticalScientific Linux FermiScientific Linux Fermi 6firefox-60.9.0-1.el6_10.i686.rpm18b7756ef97146864408131e251fc019c3d636f163f0a6abd317d9e5ae088605firefox-60.9.0-1.el6_10.x86_64.rpmd3dff21bcb67ae834d94a3bdf5912a37c1c251dedca0903a8571854ddf3ecfbfSLSA-2019:2736-1Security Fix(es): * kernel: Memory corruption due to incorrect socket cloning (CVE-2018-9568) * kernel: a NULL pointer dereference in drivers/scsi/megaraid/megaraid_sas_base.c leading to DoS (CVE-2019-11810) Bug Fix(es): * fragmented packets timing out * Backport TCP follow-up for small buffersimportantScientific Linux FermiScientific Linux Fermi 6kernel-devel-2.6.32-754.22.1.el6.x86_64.rpm02143d476dd70b09abe2ba61f783a129760dc5e33cfca3eb5f7fb7cceb4642e7python-perf-2.6.32-754.22.1.el6.x86_64.rpmce939d3c187014ef3b8d40eaae8913142e0020d8f0908d3a5be12c156d05f8a9kernel-doc-2.6.32-754.22.1.el6.noarch.rpmf6e8d330c588d48a1aea904943f917501bdad44202571e24def6df88cdde299ckernel-headers-2.6.32-754.22.1.el6.x86_64.rpm0c218121c4a29e072b9a9d30a372bb56f1765e29e10fb059832381132a8114cekernel-debug-devel-2.6.32-754.22.1.el6.i686.rpm2ed5c02faaf280d97208fb8a5782976c9969eff337539a58d8ddf2da02107724kernel-debug-devel-2.6.32-754.22.1.el6.x86_64.rpmdef0d2cad76b852b93bdc84ac97ff7345203a4f65fa1a6c9970b6d89d58a94d1kernel-debug-2.6.32-754.22.1.el6.x86_64.rpm3a6ec1d45fe1c050ccd670fce5a07912ab1eb97eb994bb738159c4ad8e7e8644kernel-abi-whitelists-2.6.32-754.22.1.el6.noarch.rpm28a86a186d10f19e5545509ced59f132c75fc6e984ce77dcd7737d129d6b6264kernel-2.6.32-754.22.1.el6.x86_64.rpm47c1d7cfe351fe3263eb2cfe30a345f73bcd9f8d78440ba18bfb88472525446dperf-2.6.32-754.22.1.el6.x86_64.rpm83840421f0fa0e96c1993bddc40386fed73a0fe709d521b329f44759268f1ab5kernel-firmware-2.6.32-754.22.1.el6.noarch.rpmdbdc8a9cb94f0610c942238f40ca385f25a2c6ef786bb3ca740f3f334275739fSLSA-2019:2807-1This update upgrades Thunderbird to version 60.9.0. Security Fix(es): * Mozilla: Covert Content Attack on S/MIME encryption using a crafted multipart/alternative message (CVE-2019-11739) * Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 (CVE-2019-11740) * Mozilla: Same-origin policy violation with SVG filters and canvas to steal cross-origin images (CVE-2019-11742) * Mozilla: XSS by breaking out of title and textarea elements using innerHTML (CVE-2019-11744) * Mozilla: Use-after-free while manipulating video (CVE-2019-11746) * Mozilla: Use-after-free while extracting a key value in IndexedDB (CVE-2019-11752) * Mozilla: Cross-origin access to unload event attributes (CVE-2019-11743)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-60.9.0-1.el6_10.x86_64.rpm77af7f68807931327f3e68614ee41384442e88321a8015e1553eb55254191fc2SLSA-2019:2863-1Security Fix(es): * A buffer overflow flaw was found in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs, logged the buffer descriptors during migration. A privileged guest user able to pass descriptors with invalid length to the host when migration is underway, could use this flaw to increase their privileges on the host. (CVE-2019-14835)importantScientific Linux FermiScientific Linux Fermi 6kernel-abi-whitelists-2.6.32-754.23.1.el6.noarch.rpm30b641fcb0fac4e7afafe495efa54ce97cf00e08a8d20f4282d627cb4778bef3kernel-2.6.32-754.23.1.el6.x86_64.rpmfe3063123520e027e434aaa4556c3a823556883d9758ee24190d5b717288cdcbkernel-doc-2.6.32-754.23.1.el6.noarch.rpmfc5f56359a8e3dc1ed19f769803abccf8a3545537655b039d66bdf0bc1223dd4kernel-debug-devel-2.6.32-754.23.1.el6.i686.rpm287692bea8f530aa95d329c4c8c2e3f2ec62a408fa9ece7df2137e89d1bc7ad9python-perf-2.6.32-754.23.1.el6.x86_64.rpmd9516e951ac3c990e40dab6b1ec44322f348b3b1ab34330dff206e0040a39786kernel-devel-2.6.32-754.23.1.el6.x86_64.rpmf21bc73477acdec2174071288b26802cb9b48d0a543f4b7ca5f0352c4d1bbff0kernel-debug-2.6.32-754.23.1.el6.x86_64.rpmcfc89754e9df101453c43cb07330a4a7f79a5272cb84809cdc000f51fde01c72perf-2.6.32-754.23.1.el6.x86_64.rpmff64c885a5a81643ef445e4fdcf0d01dd4b42634cb9c8f06e8145ae945e94162kernel-firmware-2.6.32-754.23.1.el6.noarch.rpmdbc6d52137509ae28af877af780e07dce4b2cc4d9f370bece38af6e7fb4fea54kernel-headers-2.6.32-754.23.1.el6.x86_64.rpm3c726244d5f13547d1b2eb2cec2a233e107c7befa0051cde169604a09648ca9dkernel-debug-devel-2.6.32-754.23.1.el6.x86_64.rpmd4576c253fb5e49b0be3c9aedf9799d9c65f6074eff74b34d9f1078ea220dc43SLSA-2019:2885-1* dovecot: improper NULL byte handling in IMAP and ManageSieve protocol parsers leads to out of bounds writes (CVE-2019-11500)importantScientific Linux FermiScientific Linux Fermi 6dovecot-2.0.9-22.el6_10.1.i686.rpme181d5a3a17fdd37c0911bf8495ded4c46b035c7459ac38fdc2c7041c83fea23dovecot-pigeonhole-2.0.9-22.el6_10.1.x86_64.rpmf86c2a5d5631dfacabe2cc8284aa345cd1f8307c8978fc156c760b8e74057a1ddovecot-2.0.9-22.el6_10.1.x86_64.rpmbb1cda5df35131a8ffa698f266e26c840e39a4ddfca14a2f89c4e070597002bedovecot-devel-2.0.9-22.el6_10.1.x86_64.rpm8c3c06844ae1d5bb68148980fbc1be94a6fcf616f256461267aa9c07b3cd8cf1dovecot-pgsql-2.0.9-22.el6_10.1.x86_64.rpmac50497add8c533d5ce6d3f1234a25beb9f0f31e632e77a443f4e7c565d5f18cdovecot-mysql-2.0.9-22.el6_10.1.x86_64.rpmb0b6773e02517450b9d060c3ef5fa0074429fdc7ed3d3cd4f691bf208ec323d9SLSA-2019:2892-1Security Fix(es): * QEMU: slirp: heap buffer overflow while reassembling fragmented datagrams (CVE-2018-11806) * QEMU: slirp: heap buffer overflow in tcp_emu() (CVE-2019-6778) * QEMU: ne2000: integer overflow leads to buffer overflow issue (CVE-2018-10839) * QEMU: pcnet: integer overflow leads to buffer overflow (CVE-2018-17962) * QEMU: qxl: null pointer dereference while releasing spice resources (CVE-2019-12155)importantScientific Linux FermiScientific Linux Fermi 6qemu-guest-agent-0.12.1.2-2.506.el6_10.5.x86_64.rpmfb32d1617bc78b502d035cd08a124802f05389e9dad110cfd7cd8abd8f6f0bccqemu-kvm-0.12.1.2-2.506.el6_10.5.x86_64.rpmc9a9a4051b5c2583d3892e237bff35d222ea7fd327f00f31b32c6f5a015f7410qemu-img-0.12.1.2-2.506.el6_10.5.x86_64.rpmdb39ac6e8b3cb1ec0399d7bc58cfbbe7f2ad3b431c881e3bb6ce3a91b15551b2qemu-kvm-tools-0.12.1.2-2.506.el6_10.5.x86_64.rpm2d64f3d46858e6deef062ddbc83761b8567e432584907db9b640bff29acb949aSLSA-2019:3136-1Security Fix(es): * OpenJDK: Improper handling of Kerberos proxy credentials (Kerberos, 8220302) (CVE-2019-2949) * OpenJDK: Unexpected exception thrown during regular expression processing in Nashorn (Scripting, 8223518) (CVE-2019-2975) * OpenJDK: Incorrect handling of nested jar: URLs in Jar URL handler (Networking, 8223892) (CVE-2019-2978) * OpenJDK: Incorrect handling of HTTP proxy responses in HttpURLConnection (Networking, 8225298) (CVE-2019-2989) * OpenJDK: Missing restrictions on use of custom SocketImpl (Networking, 8218573) (CVE-2019-2945) * OpenJDK: NULL pointer dereference in DrawGlyphList (2D, 8222690) (CVE-2019-2962) * OpenJDK: Unexpected exception thrown by Pattern processing crafted regular expression (Concurrency, 8222684) (CVE-2019-2964) * OpenJDK: Unexpected exception thrown by XPathParser processing crafted XPath expression (JAXP, 8223505) (CVE-2019-2973) * OpenJDK: Unexpected exception thrown by XPath processing crafted XPath expression (JAXP, 8224532) (CVE-2019-2981) * OpenJDK: Unexpected exception thrown during Font object deserialization (Serialization, 8224915) (CVE-2019-2983) * OpenJDK: Missing glyph bitmap image dimension check in FreetypeFontScaler (2D, 8225286) (CVE-2019-2987) * OpenJDK: Integer overflow in bounds check in SunGraphics2D (2D, 8225292) (CVE-2019-2988) * OpenJDK: Excessive memory allocation in CMap when reading TrueType font (2D, 8225597) (CVE-2019-2992) * OpenJDK: Insufficient filtering of HTML event attributes in Javadoc (Javadoc, 8226765) (CVE-2019-2999)importantScientific Linux FermiScientific Linux Fermi 6java-1.8.0-openjdk-headless-1.8.0.232.b09-1.el6_10.x86_64.rpm70a858434757339e660f7959f20f763405a5c6a97a34392eba6856937d6e388ajava-1.8.0-openjdk-devel-debug-1.8.0.232.b09-1.el6_10.x86_64.rpm352f46e622eb074f396c5c1300bb0f4e409401365278505258ecf1e5bfd1c633java-1.8.0-openjdk-src-1.8.0.232.b09-1.el6_10.x86_64.rpm3ecd6e0b50bc2efc1b0a5432412ba9729395bc0e4c2cd72330fc17058463c4c9java-1.8.0-openjdk-demo-debug-1.8.0.232.b09-1.el6_10.x86_64.rpmfcb8abbd34e4be3eea09ff6b551ad0fb1d39c44a4b5b52843c0713a86696d45ajava-1.8.0-openjdk-debug-1.8.0.232.b09-1.el6_10.x86_64.rpmd877a81250515dcc0cf802f4b3fdafa64c975b3a1bc2b3d8aa0b40c17898f4bejava-1.8.0-openjdk-devel-1.8.0.232.b09-1.el6_10.x86_64.rpmc1bb5c63ab75d34b27915da5fbab908b238cf6fb18366024effe41740688ff49java-1.8.0-openjdk-headless-debug-1.8.0.232.b09-1.el6_10.x86_64.rpmcbdb58aa7978a5449c97a09ada185b736a981246ddb7a1743f4d7b9e39da7662java-1.8.0-openjdk-src-debug-1.8.0.232.b09-1.el6_10.x86_64.rpm0532495ba9e50ef9430be36f5f606bc695dc2e6113f3a2b8b676dbbac269cefdjava-1.8.0-openjdk-javadoc-debug-1.8.0.232.b09-1.el6_10.noarch.rpmc8fdb685e302cef81cc332755ca32e0b51f62b01a23cae319b773fc4117fec52java-1.8.0-openjdk-demo-1.8.0.232.b09-1.el6_10.x86_64.rpm1707e53296048275f30323b319cf8c4b71a2098aee1f3d9daf60403f64981d16java-1.8.0-openjdk-1.8.0.232.b09-1.el6_10.x86_64.rpm0cbaf1f66f271eb5cb66357d70bdb5fa746cb8b21c07581f7adcf84d87de0cfbjava-1.8.0-openjdk-javadoc-1.8.0.232.b09-1.el6_10.noarch.rpm980bf7a6a1d786f686158f80532419d0bfbc7bfa4f1a441c956f96ae81670d31SLSA-2019:3158-1Security Fix(es): * OpenJDK: Incorrect handling of nested jar: URLs in Jar URL handler (Networking, 8223892) (CVE-2019-2978) * OpenJDK: Incorrect handling of HTTP proxy responses in HttpURLConnection (Networking, 8225298) (CVE-2019-2989) * OpenJDK: Missing restrictions on use of custom SocketImpl (Networking, 8218573) (CVE-2019-2945) * OpenJDK: NULL pointer dereference in DrawGlyphList (2D, 8222690) (CVE-2019-2962) * OpenJDK: Unexpected exception thrown by Pattern processing crafted regular expression (Concurrency, 8222684) (CVE-2019-2964) * OpenJDK: Unexpected exception thrown by XPathParser processing crafted XPath expression (JAXP, 8223505) (CVE-2019-2973) * OpenJDK: Unexpected exception thrown by XPath processing crafted XPath expression (JAXP, 8224532) (CVE-2019-2981) * OpenJDK: Unexpected exception thrown during Font object deserialization (Serialization, 8224915) (CVE-2019-2983) * OpenJDK: Missing glyph bitmap image dimension check in FreetypeFontScaler (2D, 8225286) (CVE-2019-2987) * OpenJDK: Integer overflow in bounds check in SunGraphics2D (2D, 8225292) (CVE-2019-2988) * OpenJDK: Excessive memory allocation in CMap when reading TrueType font (2D, 8225597) (CVE-2019-2992) * OpenJDK: Insufficient filtering of HTML event attributes in Javadoc (Javadoc, 8226765) (CVE-2019-2999)moderateScientific Linux FermiScientific Linux Fermi 6java-1.7.0-openjdk-devel-1.7.0.241-2.6.20.0.el6_10.x86_64.rpm1a3fdb908e3889240d7f63ffe79347a7b6aed026861eca00a4968ab6f0d947dcjava-1.7.0-openjdk-demo-1.7.0.241-2.6.20.0.el6_10.x86_64.rpm3d226f5f0a53b699ceb7328b9fa53cf8a1ccd55bf0c159c90cec7286605bb458java-1.7.0-openjdk-src-1.7.0.241-2.6.20.0.el6_10.x86_64.rpm1e1e306165999c9e395d101ccf96676164cce3f99c794aec2101d43d1bde9c7djava-1.7.0-openjdk-1.7.0.241-2.6.20.0.el6_10.x86_64.rpm85a24f638b0903877576b24cacfe05cf777aaa047e538c90422ba318a5b0880djava-1.7.0-openjdk-javadoc-1.7.0.241-2.6.20.0.el6_10.noarch.rpmf11b5f289c40d212ad78b789e0c87076e9f30223cbe579418314a29139678cbbSLSA-2019:3281-1Security Fix(es): * Mozilla: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2 (CVE-2019-11764) * Mozilla: Use-after-free when creating index updates in IndexedDB (CVE-2019-11757) * Mozilla: Potentially exploitable crash due to 360 Total Security (CVE-2019-11758) * Mozilla: Stack buffer overflow in HKDF output (CVE-2019-11759) * Mozilla: Stack buffer overflow in WebRTC networking (CVE-2019-11760) * Mozilla: Unintended access to a privileged JSONView object (CVE-2019-11761) * Mozilla: document.domain-based origin isolation has same-origin-property violation (CVE-2019-11762) * Mozilla: Incorrect HTML parsing results in XSS bypass technique (CVE-2019-11763)criticalScientific Linux FermiScientific Linux Fermi 6firefox-68.2.0-4.el6_10.i686.rpme2732af72e80e34ad78f7ff963c9f33d9ecccb956047d7fdeaa722cdb62360a7firefox-68.2.0-4.el6_10.x86_64.rpm730a27d3f505918b9109901fcf37b1d3583a1425304d84cda6cf3cfad539d841SLSA-2019:3287-1Security Fix(es): * php: underflow in env_path_info in fpm_main.c (CVE-2019-11043)criticalScientific Linux FermiScientific Linux Fermi 6php-imap-5.3.3-50.el6_10.x86_64.rpmd3c8f8aa03d7e10cc32bdfb04c30eb8edf3682845ce26a56d6bd2847676c350aphp-5.3.3-50.el6_10.x86_64.rpm09a61aa1d74eabc9118259f4fc5d545fbdc563d32b43ca0883cd132d21070828php-soap-5.3.3-50.el6_10.x86_64.rpm282dedd428f952be72e73f215536259e140ce4399ce44d5dcc420c6c8ad4dfc0php-ldap-5.3.3-50.el6_10.x86_64.rpm983b66a76cc2c89e8de67a831c8729bfdbeeac10d4d8b1071974f640a512f488php-devel-5.3.3-50.el6_10.x86_64.rpm2efc8ada4d0f6bd15952e35daea4fe3699b2c6411afecf58234504244b91ec27php-dba-5.3.3-50.el6_10.x86_64.rpm29ac19570cf44c55c50c4b57b4b1e9f8fa4f753f3e2f8f8f08ad6ddd439122a0php-pdo-5.3.3-50.el6_10.x86_64.rpmda57400c8267c1f6a0f29b9cc02c31ee2528be0b494893ad5a41b67f4a8f839dphp-intl-5.3.3-50.el6_10.x86_64.rpm80a2199aadd92dcb4dd19d9067c1d796cb604ccf812d909a4852fe87f11bbac8php-mbstring-5.3.3-50.el6_10.x86_64.rpmc64b85d6c8d464155160fee0f87de2c4cdd781e84b98517956d56feafcbbbb93php-recode-5.3.3-50.el6_10.x86_64.rpm933d5f81cbb898ee9ab110c7711ad31076ac4ab65913e3c0bfb11d7d4dda5435php-pspell-5.3.3-50.el6_10.x86_64.rpm27bc4dbc6bdc37ff097f52e0a9f7163f2a4b7d4e7b1ad480fd6c48236db4713aphp-mysql-5.3.3-50.el6_10.x86_64.rpm80b9aa8e6efa47167e95fdb4bd0a5aaef3b66232a461e2ff8df1ba4d3920bcdfphp-embedded-5.3.3-50.el6_10.x86_64.rpm269ab8cbf6329ccd6c1def5a84f73b861e405d46538f398287dfc4514ba9835aphp-cli-5.3.3-50.el6_10.x86_64.rpm6166d565eb0b5d88dc5e3d0fe580b2f9e80492c6ffb28a0f8c2fc130ba5db42bphp-pgsql-5.3.3-50.el6_10.x86_64.rpmd8a85a3d01086d1cd32d0b9fb1cbc61f6085fbcd5a80a643f0b922497f513628php-xmlrpc-5.3.3-50.el6_10.x86_64.rpmf811864e3e05e4d3c5a0ff9104664b2350f4108ddd577a36e0405a00aa630749php-tidy-5.3.3-50.el6_10.x86_64.rpm65e4841da4dafe4936cf3c456e604316c141c2e2c234e94ba1154219f874ffc2php-zts-5.3.3-50.el6_10.x86_64.rpm6c080e8d43d5f82ee5c7db5b2cfec13dbe16d2181042bae97d7598d38cbf294bphp-enchant-5.3.3-50.el6_10.x86_64.rpm4ec35da47c8612f49971430b10d5ebc9ada8f41d18d1c5fdd66d4db3fdbb89edphp-bcmath-5.3.3-50.el6_10.x86_64.rpm81d54e80df98a76d4648094a433e063969e0b95ee1fb097428189736db9bbdc7php-snmp-5.3.3-50.el6_10.x86_64.rpm89392573dae341b732536dc1efb4b824ca24ed0bf86a3cd2cdd6a68dc4eca86bphp-fpm-5.3.3-50.el6_10.x86_64.rpm711f704be7c6093c333eadaff940a43e631e72d86440ecf40c6735ba39a8e192php-xml-5.3.3-50.el6_10.x86_64.rpm29d98c2b3264ff03c575c8f8ea46feff907253836721d3552bd040c7126103c1php-process-5.3.3-50.el6_10.x86_64.rpm461b8acaab6e5572e35e8285691b1ec3f431867fde8caba94b8b31433bd55446php-gd-5.3.3-50.el6_10.x86_64.rpm24042178795cd124f19e74eb772c30a0b362337e1e5e72f23e073bf70199c19bphp-odbc-5.3.3-50.el6_10.x86_64.rpm1648349aa9659312e05399ecfb44d9c4297e4b486d939a5c9d62f2ac4ee98c55php-common-5.3.3-50.el6_10.x86_64.rpme89cbd68595eca2f82280807eed98945c6e5ffce04cbcf822b98b2a940a3cf83SLSA-2019:3755-1Security Fix(es): * sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword (CVE-2019-14287)importantScientific Linux FermiScientific Linux Fermi 6sudo-devel-1.8.6p3-29.el6_10.2.x86_64.rpma6c3693e9ff0ddd9ad768864f198b9929b54f280e16b3a81884e5bdfbb020284sudo-1.8.6p3-29.el6_10.2.x86_64.rpm9604218222a11b1e52a63cb93b71fcb554a086bc19227d1f6964946f1a5b5632sudo-devel-1.8.6p3-29.el6_10.2.i686.rpm62da827b90ab1c0cc3b28c1fa1eec0bd36c01c9491ee871e3d95a5317995e18aSLSA-2019:3756-1This update upgrades Thunderbird to version 68.2.0. Security Fix(es): * Mozilla: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2 (CVE-2019-11764) * Mozilla: Use-after-free when creating index updates in IndexedDB (CVE-2019-11757) * Mozilla: Potentially exploitable crash due to 360 Total Security (CVE-2019-11758) * Mozilla: Stack buffer overflow in HKDF output (CVE-2019-11759) * Mozilla: Stack buffer overflow in WebRTC networking (CVE-2019-11760) * Mozilla: Unintended access to a privileged JSONView object (CVE-2019-11761) * Mozilla: document.domain-based origin isolation has same-origin-property violation (CVE-2019-11762) * Mozilla: Incorrect HTML parsing results in XSS bypass technique (CVE-2019-11763) * expat: heap-based buffer over-read via crafted XML input (CVE-2019-15903)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-68.2.0-2.el6_10.x86_64.rpmd6b2bc359d1312f47ba5720a832b1bbc5315f6755310be883ed469808a151816SLSA-2019:3836-1Security Fix(es): * hw: Machine Check Error on Page Size Change (IFU) (CVE-2018-12207) * hw: TSX Transaction Asynchronous Abort (TAA) (CVE-2019-11135) * Kernel: vhost_net: infinite loop while receiving packets leads to DoS (CVE-2019-3900) * hw: Intel GPU Denial Of Service while accessing MMIO in lower power state (CVE-2019-0154) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE Bug Fix(es): * [Intel 6.10 Bug] With mWait/C-states disabled, HT on, ibrs enabled, performance impact observed on user space benchmark * kernel-2.6.32-573.60.2.el6 hangs/resets during boot in efi_enter_virtual_mode() on Xeon v2 E7-2870 * Slab leak: skbuff_head_cache slab object still allocated after mcast processes are stopped and "fragments dropped after timeout" errors are shownimportantScientific Linux FermiScientific Linux Fermi 6kernel-debug-devel-2.6.32-754.24.2.el6.i686.rpm0bf43100e7d596cc3977f8255e7deef06fd111310c234fe499fcdeb40a63a296perf-2.6.32-754.24.2.el6.x86_64.rpm78f3ffaff7101240f2203a4da2a29d418217335d54a2e948896f1e0c1c05cdabkernel-firmware-2.6.32-754.24.2.el6.noarch.rpmeb0de1c5f5022dd369e4811d21203ec45af3e4f10fc031e66f3ec7a12556d466kernel-debug-2.6.32-754.24.2.el6.x86_64.rpm8db973e1277417321b7bb710e237c4f6f6695b65f25a11041118ddc6f294f2c0kernel-abi-whitelists-2.6.32-754.24.2.el6.noarch.rpme93510bebf7ae8913e1e229ca397f89a99a334264c845106e2b3d91da5ca8275kernel-2.6.32-754.24.2.el6.x86_64.rpm347aac75319d13e7880387522250d7788ea262f19dc252940d455f960f3c1bc2kernel-debug-devel-2.6.32-754.24.2.el6.x86_64.rpm11f751ace658fdc8c711d6dadf7b9c91d31147dd12d7c76dce0a2a82a9d8a4b7kernel-doc-2.6.32-754.24.2.el6.noarch.rpmaed7222ef4ac7cb673f27d39609ce38a716e3c5201ffc13c08119e771c07de57kernel-headers-2.6.32-754.24.2.el6.x86_64.rpm657e5af97578911888ddd23bf99bc93765fcdd9248b5ba3ef418b73201e11df1python-perf-2.6.32-754.24.2.el6.x86_64.rpmd236428c54e116997c745cd886997d72065e7e7ed48afc6d668ba02539ddb47bkernel-devel-2.6.32-754.24.2.el6.x86_64.rpm010759b6ccefee7f9c8eccce57d1bd2d7c76a5b86510de4001d3765eef09ed6eSLSA-2019:3878-1Security Fix(es): * hw: Intel GPU blitter manipulation can allow for arbitrary kernel memory write (CVE-2019-0155) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE importantScientific Linux FermiScientific Linux Fermi 6kernel-debug-devel-2.6.32-754.24.3.el6.x86_64.rpm2a7ca925614d632eeeb382d81d1841a3541fdb85d3aa66d22173349b2d69f674kernel-debug-devel-2.6.32-754.24.3.el6.i686.rpm9aacbb5fabfee0e958cb74301576437f9251a53f553b5e6fc620331f2f8a474bkernel-firmware-2.6.32-754.24.3.el6.noarch.rpme548f8e9f393db3e2dd773ecd7670b4654fbc4008a41becdec8876c133399eb9python-perf-2.6.32-754.24.3.el6.x86_64.rpmd6beb1c10f32b586266a53f8c91433fce8d18e17510e743fc979a9fe5d41a929kernel-headers-2.6.32-754.24.3.el6.x86_64.rpmc1a8889c53566195c865ad4b53e3369019881caf8711ba2ce6281de43025cd2bkernel-abi-whitelists-2.6.32-754.24.3.el6.noarch.rpmed779305e6cd7a26cd34b413e9b5b4cbec4fba94750a4a358167acfc6741c4e3kernel-2.6.32-754.24.3.el6.x86_64.rpm0af117358df6a0bca8b8a01acb76f65d1b139c9515fdfca1b5ec7524de14c177perf-2.6.32-754.24.3.el6.x86_64.rpma320303cbe84b2add283bd88ec1c03ae65fb1d9fffd1740ee6dc92455256611ekernel-doc-2.6.32-754.24.3.el6.noarch.rpma86ec05a26576ff8c05d31335f8fcefbe0b42b7c93257472082a8466aff77643kernel-devel-2.6.32-754.24.3.el6.x86_64.rpmacd1a4f637aa8ec3f21435f01dc5c35a84257efe91a73c6562b75e5274a14c3bkernel-debug-2.6.32-754.24.3.el6.x86_64.rpm7a05156d47cc9db8404fb1e6c798480e45535d764761d6ef955050b71a68a7edSLSA-2019:4108-1Security Fix(es): * Mozilla: Use-after-free in worker destruction (CVE-2019-17008) * Mozilla: Memory safety bugs fixed in Firefox 71 and Firefox ESR 68.3 (CVE-2019-17012) * Mozilla: Buffer overflow in plain text serializer (CVE-2019-17005) * Mozilla: Use-after-free when performing device orientation checks (CVE-2019-17010) * Mozilla: Use-after-free when retrieving a document in antitracking (CVE-2019-17011)criticalScientific Linux FermiScientific Linux Fermi 6firefox-68.3.0-1.el6_10.x86_64.rpm25c93b689d8a5cedaa05fc33d322d56deddeebcf591169d3e3848ccc79d88735firefox-68.3.0-1.el6_10.i686.rpm7feaa86c2116e03b1ff4f4fc7235405d8eaf1779d2ef6f508b6468785f23bdfbSLSA-2019:4152-1Security Fix(es): * nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate (CVE-2019-11745)importantScientific Linux FermiScientific Linux Fermi 6nss-softokn-3.44.0-6.el6_10.x86_64.rpm4f259c0b34f7db341a2b4a58ec75f6aa38cd49c9817cf802e4ff2fd83de1dc24nss-softokn-3.44.0-6.el6_10.i686.rpm5e0e936804b3227ebd8b2d9b32ee55a2ea10c21e7d5fed428fd5e237c95f5e51nss-softokn-devel-3.44.0-6.el6_10.i686.rpmf8e5626d1adbe04d2fdccf2581069434143452419c0079e25dc683f314fbf267nss-softokn-freebl-3.44.0-6.el6_10.x86_64.rpm9fe462086041f53fe7501099ee7803e95f79c8ab9c8e1bfd85b4dda5d5f3d0c8nss-softokn-devel-3.44.0-6.el6_10.x86_64.rpm525cfd47e790ac19d47f484e1f89677a357411d5b431b33b34198365ccff11cdnss-softokn-freebl-devel-3.44.0-6.el6_10.x86_64.rpm08064c338b58d598c87c332af0bcf5f853acc37cea4c8257f170ca528289cee7nss-softokn-freebl-3.44.0-6.el6_10.i686.rpm70b6a495b8b23ee84cd4b9edf0b604356763656b1bcd51c6d3da401b2c880e2dnss-softokn-freebl-devel-3.44.0-6.el6_10.i686.rpm9fbf5c0a6e9c9cbc4f659846e88b70d70a4a73f63f16219baeb4659ff1cf98ddSLSA-2019:4205-1This update upgrades Thunderbird to version 68.3.0. Security Fix(es): * Mozilla: Use-after-free in worker destruction (CVE-2019-17008) * Mozilla: Memory safety bugs fixed in Firefox 71 and Firefox ESR 68.3 (CVE-2019-17012) * Mozilla: Buffer overflow in plain text serializer (CVE-2019-17005) * Mozilla: Use-after-free when performing device orientation checks (CVE-2019-17010) * Mozilla: Use-after-free when retrieving a document in antitracking (CVE-2019-17011)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-68.3.0-3.el6_10.x86_64.rpm38e05dfc136c36ba0917a1da91f540ab6b354a746e94343ade76dbb9af1379eaSLSA-2019:4254-1Security Fix(es): * freetype: a heap-based buffer over-read in T1_Get_Private_Dict in type1/t1parse.c leading to information disclosure (CVE-2015-9381) * freetype: mishandling ps_parser_skip_PS_token in an FT_New_Memory_Face operation in skip_comment, psaux/psobjs.c, leads to a buffer over-read (CVE-2015-9382)moderateScientific Linux FermiScientific Linux Fermi 6freetype-devel-2.3.11-19.el6_10.i686.rpm6d7fd44af78ce088694751c24e283bdd9341945079d176925056be232849226dfreetype-2.3.11-19.el6_10.i686.rpm77703831c5562ac717a917552eea79e91f347d95dcb199859225515c94320c97freetype-2.3.11-19.el6_10.x86_64.rpmd3ab181c411ee5bc5fe65dc9b1dfc2c1274c7c4d1b327911c31e6174abae0390freetype-demos-2.3.11-19.el6_10.x86_64.rpm539e2b7a36af75507399456d87a1c64b901534ab188a4654821b6f8bbe1aa1c6freetype-devel-2.3.11-19.el6_10.x86_64.rpmc91b50a27d8894f74e60ccdef1c12714430f77c608f8c193055a969984eaeec4SLSA-2019:4256-1Security Fix(es): * Kernel: KVM: OOB memory access via mmio ring buffer (CVE-2019-14821) Bug Fix(es): * KEYS: prevent creating a different user's keyrings SL-6.10 * BUG: unable to handle kernel NULL pointer dereference at (null) * long I/O stalls with bnx2fc from not masking off scope bits of retry delay valueimportantScientific Linux FermiScientific Linux Fermi 6kernel-firmware-2.6.32-754.25.1.el6.noarch.rpm34667f86a2fc275ba9f36d8f885840b5cff80bceeaaad217cb7768aff40cc203kernel-debug-devel-2.6.32-754.25.1.el6.i686.rpm67e02e07f25c5f91e034b860e440fe9f99e19538caca3aa5f8dd6c37f9385c4fpython-perf-2.6.32-754.25.1.el6.x86_64.rpm9d82c91e16bbc683477c0bb48740086afacc0130dd09bc13a7977018949e1f5akernel-devel-2.6.32-754.25.1.el6.x86_64.rpm20efa025bc6fe7618b3e23e0091d47929b9f06874c027574fe373eae8a6eed73kernel-headers-2.6.32-754.25.1.el6.x86_64.rpm2b7161e70c94609c354a85f94829344cf59eaf9d8c2b511fb1731b8566fa808eperf-2.6.32-754.25.1.el6.x86_64.rpm190bf0b4af4810de3323ea3cd5f130ea9a6d5dc152c8f841fc6bee4f2514f485kernel-abi-whitelists-2.6.32-754.25.1.el6.noarch.rpm780620108cc86ba9634200fdc2155ffa65ed82cd0979795eeec0f4370ef73075kernel-2.6.32-754.25.1.el6.x86_64.rpm106d0762b182735bd121ff470567ad68b9b3e3bc7a5038ca8826334c401adaf7kernel-doc-2.6.32-754.25.1.el6.noarch.rpm615fa351cd7986dafec501b533bc5891316d70d4728170b16447a59de9c8631dkernel-debug-2.6.32-754.25.1.el6.x86_64.rpm464ef77837933c8b55e8047a6f10f7c6806c8b31ffca0f00f3c6d9ec7cc64c7akernel-debug-devel-2.6.32-754.25.1.el6.x86_64.rpmb89301e2f0f0172d4293e2d4c54603a4540ea1979652869bd63a9ba776faeb6aSLSA-2020:0086-1This update upgrades Firefox to version 68.4.1 ESR. Security Fix(es): * Mozilla: IonMonkey type confusion with StoreElementHole and FallibleStoreElement (CVE-2019-17026) * Mozilla: Bypass of @namespace CSS sanitization during pasting (CVE-2019-17016) * Mozilla: Type Confusion in XPCVariant.cpp (CVE-2019-17017) * Mozilla: Memory safety bugs fixed in Firefox 72 and Firefox ESR 68.4 (CVE-2019-17024) * Mozilla: CSS sanitization does not escape HTML tags (CVE-2019-17022)criticalScientific Linux FermiScientific Linux Fermi 6firefox-68.4.1-1.el6_10.i686.rpmb8ffce2947a42087edb763eb295b2ce65cb83ee7bf1da62113cebef59aa510a7firefox-68.4.1-1.el6_10.x86_64.rpm1db773e269bb41e5540933eed9647c1b69c49062367e24c1b50cc26a627c3553SLSA-2020:0123-1Security Fix(es): * Mozilla: IonMonkey type confusion with StoreElementHole and FallibleStoreElement (CVE-2019-17026) * Mozilla: Bypass of @namespace CSS sanitization during pasting (CVE-2019-17016) * Mozilla: Type Confusion in XPCVariant.cpp (CVE-2019-17017) * Mozilla: Memory safety bugs fixed in Firefox 72 and Firefox ESR 68.4 (CVE-2019-17024) * Mozilla: CSS sanitization does not escape HTML tags (CVE-2019-17022)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-68.4.1-2.el6_10.x86_64.rpm75444cb60fb3a32328cb563254f185f9adcb8c79f5d2604a8ca46eae1c468fddSLSA-2020:0157-1Security Fix(es): * OpenJDK: Use of unsafe RSA-MD5 checkum in Kerberos TGS (Security, 8229951) (CVE-2020-2601) * OpenJDK: Serialization filter changes via jdk.serialFilter property modification (Serialization, 8231422) (CVE-2020-2604) * OpenJDK: Improper checks of SASL message properties in GssKrb5Base (Security, 8226352) (CVE-2020-2590) * OpenJDK: Incorrect isBuiltinStreamHandler causing URL normalization issues (Networking, 8228548) (CVE-2020-2593) * OpenJDK: Excessive memory usage in OID processing in X.509 certificate parsing (Libraries, 8234037) (CVE-2020-2654) * OpenJDK: Incorrect exception processing during deserialization in BeanContextSupport (Serialization, 8224909) (CVE-2020-2583) * OpenJDK: Incomplete enforcement of maxDatagramSockets limit in DatagramChannelImpl (Networking, 8231795) (CVE-2020-2659)importantScientific Linux FermiScientific Linux Fermi 6java-1.8.0-openjdk-debug-1.8.0.242.b07-1.el6_10.x86_64.rpmd26fee7e50897ab13e30503d1699f4ae0cb3d103bf4c14d888dfebb966d35de6java-1.8.0-openjdk-devel-1.8.0.242.b07-1.el6_10.x86_64.rpm61c5552dba815e68cc5bf2f954b68d19dbcf8110a94b016736056bed1cc47e4ajava-1.8.0-openjdk-demo-1.8.0.242.b07-1.el6_10.x86_64.rpm333ad472cdec6cb8e19cf81d44e846e363c35f8ddd3b7fa02056c2b10e0aa18fjava-1.8.0-openjdk-headless-debug-1.8.0.242.b07-1.el6_10.x86_64.rpmd45d247403b8b4c3274f907c2bd7fd257fe08da3d48d673d0d58e082b10e75fejava-1.8.0-openjdk-src-1.8.0.242.b07-1.el6_10.x86_64.rpm226bc042cbb51d57776e4ed37ee8c4072929985ba16128310ca29a5c73d67266java-1.8.0-openjdk-javadoc-1.8.0.242.b07-1.el6_10.noarch.rpm9cdd1d70e628db2c241753201cffeca47340f741c0548dc678a830bc7e322567java-1.8.0-openjdk-demo-debug-1.8.0.242.b07-1.el6_10.x86_64.rpm4cce2572598761329a6222f17b085104917848b646fc99b1cac7660d29170e1ejava-1.8.0-openjdk-javadoc-debug-1.8.0.242.b07-1.el6_10.noarch.rpmf25b6db5c691786c378a77fb790b1546af5f9434a0533fdeeb637f0a8145ca6djava-1.8.0-openjdk-headless-1.8.0.242.b07-1.el6_10.x86_64.rpm26143c9179ae675b8e5d99ce2764ea792d1b6562bcf97ac73e268fe83b2bfbb0java-1.8.0-openjdk-1.8.0.242.b07-1.el6_10.x86_64.rpmccbca076777ac90eb90b3ade950aa18598e1f77657cd1ae515551b809451d231java-1.8.0-openjdk-devel-debug-1.8.0.242.b07-1.el6_10.x86_64.rpmff0aa8cd1079b74d8f76a096030d9b392f7fdbd7da94b88b4463eb4d216b1b8fjava-1.8.0-openjdk-src-debug-1.8.0.242.b07-1.el6_10.x86_64.rpm4e44abfd19e8e10d3d29cbc279e3596032a311c9ad592bd0e9a7059efcf3a9c1SLSA-2020:0197-1Security Fix(es): * python-reportlab: code injection in colors.py allows attacker to execute code (CVE-2019-17626)importantScientific Linux FermiScientific Linux Fermi 6python-reportlab-2.3-3.el6_10.1.x86_64.rpm445898ca45496ff67cbb31b88700f8f85153239fbaccf8198341664c433985dbpython-reportlab-docs-2.3-3.el6_10.1.noarch.rpm6b3401b4a3265d0b2f86f0291bce38f1e05d99e2349774429f829346cf0345abSLSA-2020:0199-1Security Fix(es): * openslp: Heap-based buffer overflow in ProcessSrvRqst() in slpd_process.c leading to remote code execution (CVE-2019-5544)criticalScientific Linux FermiScientific Linux Fermi 6openslp-2.0.0-4.el6_10.x86_64.rpm21633cd8e1c8ee838a26867b6e6d9b66318cbf57c7228f8d271bf5e78b15b448openslp-devel-2.0.0-4.el6_10.x86_64.rpmb021fc03eb6ff368e384a9585950862112228c02dfac050d743b7fa428f35c9dopenslp-devel-2.0.0-4.el6_10.i686.rpm1f3373a88c9ebe30aee90f957eb32c43d230b47ba1baf50a0b4879b603f69081openslp-server-2.0.0-4.el6_10.x86_64.rpmc3c1aa3f27817bcf7084ba689acbdb4794200e4a8e057f1179abf0e187c71a86openslp-2.0.0-4.el6_10.i686.rpm5b52a1b6835e7c3b194075334dc126747b0bbcaff2bbcc0e64f6ec97180312a6SLSA-2020:0316-1Security Fix(es): * git: arbitrary code execution via .gitmodules (CVE-2018-17456)importantScientific Linux FermiScientific Linux Fermi 6git-svn-1.7.1-10.el6_10.noarch.rpm0f507a011aad8db7cff3e86620b31781d5e519481e518437a185f766dade76ccgit-cvs-1.7.1-10.el6_10.noarch.rpmb8e082a5c273a8340ff1d8ae92ab732a755e57da3cbd67e9d0d998a5a96f8e24git-gui-1.7.1-10.el6_10.noarch.rpma2d8cc8bb16834ee5002b88443b5546f636beb65b8c5d1a2fb024aa065b875b4gitk-1.7.1-10.el6_10.noarch.rpm4e820bf7c778b4bdebc67ac640a42ebc6fd2a4a06f29e06082f20a5404a1a415git-daemon-1.7.1-10.el6_10.x86_64.rpm6de7c466fd1af4e9595cce08010306fffc40d1bdd07e8f856cb1ddf07618b85cgit-1.7.1-10.el6_10.x86_64.rpma0afddd713a34eb67d45fd769503cf48ba4fa71aa82dc84c8532ecf44246fc81gitweb-1.7.1-10.el6_10.noarch.rpmb7cdad0226d27a3422b16c2ba5d6ad38a1d41456fd9f278a5404966ed0edc0a0perl-Git-1.7.1-10.el6_10.noarch.rpm31d03187fdeb8ade325bcf18677794a75d3b3962b7c5c7fc77e7a0c4baf3ee14git-email-1.7.1-10.el6_10.noarch.rpm98bf71aa3ea11db0b4e173676775aca8fe26029da4b73fd9180d38be2827cb23emacs-git-el-1.7.1-10.el6_10.noarch.rpmb34c2c7022314573cdc713354dbb516b14e24e3617c991ad8a5567d30179edd7emacs-git-1.7.1-10.el6_10.noarch.rpma3f91a6e8abb6649c176ad4654abf2433136ece32a762652ed98d733474ff2abgit-all-1.7.1-10.el6_10.noarch.rpm3c2d43ecd8da11d50260f94bb334b0dc44d9457a30eed7ef6901791baa78b61eSLSA-2020:0471-1Security Fix(es): * spice-client: Insufficient encoding checks for LZ can cause different integer/buffer overflows (CVE-2018-10893)moderateScientific Linux FermiScientific Linux Fermi 6spice-glib-devel-0.26-8.el6_10.2.x86_64.rpm949cd1a11bfbba54c4860f7a745291136d4e5320995a6723813472b847e325a3spice-gtk-0.26-8.el6_10.2.i686.rpm150c7a4f9da15facdab9c1cec879d56d74c010d9cb4713d7384dd80ce67cae68spice-gtk-tools-0.26-8.el6_10.2.x86_64.rpmfaed75a03ca59baed00265f865cc23f22a43002cf4f94be1442ddd4366a03115spice-glib-devel-0.26-8.el6_10.2.i686.rpmbe2af02ed6b1bd65b96666c9ff2e356e655ecb3be7f1a89837013186a370d7ffspice-gtk-devel-0.26-8.el6_10.2.x86_64.rpm15583f960f4521a2db743e13aa145ca61da4791cd6d9a431dc888de8f3113bf5spice-gtk-python-0.26-8.el6_10.2.x86_64.rpme561f260914552ce1f322c946b4ab223d246c7f9f48ce50a544397097dbdd6cdspice-glib-0.26-8.el6_10.2.x86_64.rpm77cc9f9e0044d7afbe79b7c8479b710b029e290760f9f8bc6e253063b9c55c32spice-gtk-devel-0.26-8.el6_10.2.i686.rpm2ff61cf3350e2df213116e84bb0e2027a0d5547e37a29ef3f72deb1f28cb5965spice-gtk-0.26-8.el6_10.2.x86_64.rpm6cf60f087d320862934148fc30aa879fa5cf0b59e202d99f2928a1887b82967fspice-glib-0.26-8.el6_10.2.i686.rpmabdb8e54d36de48d4c70945da85a0e5e7c78eb37962b9429c8c73dca13b7a5d4SLSA-2020:0515-1Security Fix(es): * ksh: certain environment variables interpreted as arithmetic expressions on startup, leading to code injection (CVE-2019-14868)importantScientific Linux FermiScientific Linux Fermi 6ksh-20120801-38.el6_10.x86_64.rpm07ca7178e51c6bee1bd196842e67d2573c109faf45be7894a8ed5949327907cbSLSA-2020:0521-1Security Fix(es): * Mozilla: Missing bounds check on shared memory read in the parent process (CVE-2020-6796) * Mozilla: Memory safety bugs fixed in Firefox 73 and Firefox ESR 68.5 (CVE-2020-6800)importantScientific Linux FermiScientific Linux Fermi 6firefox-68.5.0-2.el6_10.x86_64.rpm83f6f21ed4b869591e42a0507c4f61e51f114779e336afe7cfb4827326b9686dfirefox-68.5.0-2.el6_10.i686.rpmeaa61eaccc640698a594708a192d899872c14fa31adef4cf6198d32e4c5abe0eSLSA-2020:0574-1Security Fix(es): Mozilla: Memory safety bugs fixed in Firefox 73 and Firefox ESR 68.5 (CVE-2020-6800) Mozilla: Out-of-bounds read when processing certain email messages (CVE-2020-6793) Mozilla: Setting a master password post-Thunderbird 52 does not delete unencrypted previously stored passwords (CVE-2020-6794) Mozilla: Crash processing S/MIME messages with multiple signatures (CVE-2020-6795) Mozilla: Incorrect parsing of template tag could result in JavaScript injection (CVE-2020-6798) Mozilla: Message ID calculation was based on uninitialized data (CVE-2020-6792)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-68.5.0-1.el6_10.x86_64.rpm53f09978f889cb51849c1b98dcc849b729b237f6313467e59ae3e669a724ba59SLSA-2020:0631-1Security Fix(es): * ppp: Buffer overflow in the eap_request and eap_response functions in eap.c (CVE-2020-8597)importantScientific Linux FermiScientific Linux Fermi 6ppp-2.4.5-11.el6_10.x86_64.rpm0085f38b5d397c77f38dc06d9f76026dcd7240bb0c752af30799895ead275679ppp-devel-2.4.5-11.el6_10.x86_64.rpm6806c3338fe53d3df653525464099cb52baae001753ea2cc603ebc2086d6b4a9ppp-devel-2.4.5-11.el6_10.i686.rpmdbc8ac92000ed47d7c0e9f18cbf663640035f286226fa060f5e1411ed83e09bbSLSA-2020:0632-1Security Fix(es): * OpenJDK: Use of unsafe RSA-MD5 checksum in Kerberos TGS (Security, 8229951) (CVE-2020-2601) * OpenJDK: Serialization filter changes via jdk.serialFilter property modification (Serialization, 8231422) (CVE-2020-2604) * OpenJDK: Improper checks of SASL message properties in GssKrb5Base (Security, 8226352) (CVE-2020-2590) * OpenJDK: Incorrect isBuiltinStreamHandler check causing URL normalization issues (Networking, 8228548) (CVE-2020-2593) * OpenJDK: Excessive memory usage in OID processing in X.509 certificate parsing (Libraries, 8234037) (CVE-2020-2654) * OpenJDK: Incorrect exception processing during deserialization in BeanContextSupport (Serialization, 8224909) (CVE-2020-2583) * OpenJDK: Incomplete enforcement of maxDatagramSockets limit in DatagramChannelImpl (Networking, 8231795) (CVE-2020-2659)importantScientific Linux FermiScientific Linux Fermi 6java-1.7.0-openjdk-demo-1.7.0.251-2.6.21.0.el6_10.x86_64.rpmfc591e43f7f3b5ec83a27e6186b12c8d1c4f2046519ee1c6c1a85f1db166a2bejava-1.7.0-openjdk-devel-1.7.0.251-2.6.21.0.el6_10.x86_64.rpmc18b947519d41a39c12cf864d6e60db6136c260dd49b25d1e24ae1fa955dac8djava-1.7.0-openjdk-src-1.7.0.251-2.6.21.0.el6_10.x86_64.rpm294fdbb58f5119c49a99d411605868e6f380754808f9b4b5192b27972cf27ae5java-1.7.0-openjdk-1.7.0.251-2.6.21.0.el6_10.x86_64.rpm8d4d9c5771e5f5ac31fadaf50604113e8a00cb34ec403b184dd89113272b3c4djava-1.7.0-openjdk-javadoc-1.7.0.251-2.6.21.0.el6_10.noarch.rpma4fa4151a35710d667b1c09c3d00684f8d3c200b74e9075cfd08ddd15585e850SLSA-2020:0702-1Security Fix(es): * xerces-c: XML parser contains a use-after-free error triggered during the scanning of external DTDs (CVE-2018-1311)importantScientific Linux FermiScientific Linux Fermi 6xerces-c-devel-3.0.1-21.el6_10.i686.rpm299f5f4e4944cbd1b4b31bcf4287d85c7f4567477a07fbd7f7b4d7fa14959817xerces-c-doc-3.0.1-21.el6_10.noarch.rpmd992f681dce12e5cc47b634455037596ff101ad2eebc66d459708ce5ac4679e9xerces-c-3.0.1-21.el6_10.i686.rpmfe04f8540a3ed07b20d7c440a04b6cc71552b361b765125e13c7945342d22903xerces-c-devel-3.0.1-21.el6_10.x86_64.rpmfb1c1d8d412e610f4c2ada06556686ef1c35b40857da7d7de637ca870bce12faxerces-c-3.0.1-21.el6_10.x86_64.rpm67dfcdb57d42fd85c7acc29525084cda95196e250a4114811146dd5943e162f5SLSA-2020:0726-1Security Fix(es): * sudo: Stack based buffer overflow when pwfeedback is enabled (CVE-2019-18634)importantScientific Linux FermiScientific Linux Fermi 6sudo-devel-1.8.6p3-29.el6_10.3.i686.rpm37a0c40da8624c01ccbcc4844414f61276b85999256950bce83258c049606f2csudo-1.8.6p3-29.el6_10.3.x86_64.rpmd27012052f72487ec77df1c260ca410a79c88ea1fadf1d35edddc9908fdd6ca7sudo-devel-1.8.6p3-29.el6_10.3.x86_64.rpmfcf52d0fd341a53afb42ba8618c8529e8278d0370e45d33be4e0be925c3ffd66SLSA-2020:0775-1Security Fix(es): * QEMU: slirp: heap buffer overflow during packet reassembly (CVE-2019-14378) * QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu() (CVE-2020-7039) * QEMU: Slirp: use-after-free during packet reassembly (CVE-2019-15890)importantScientific Linux FermiScientific Linux Fermi 6qemu-guest-agent-0.12.1.2-2.506.el6_10.6.x86_64.rpm6bd1d1beee0d88cfd8828f7a4184c501fd85d5896b3ab68688d5c821930f511eqemu-img-0.12.1.2-2.506.el6_10.6.x86_64.rpm8dd5c9352ceda7568f167ce33ebe77899c4b37aeac60cdf506aefad3b33aeae7qemu-kvm-0.12.1.2-2.506.el6_10.6.x86_64.rpm265d9f9805aa34cc4d8833615a5dbd79905bbedafb58958f6285f4deab8219a4qemu-kvm-tools-0.12.1.2-2.506.el6_10.6.x86_64.rpm4bc8edde51ef38350b300c717542bb611556dba95c16f0837bc59c0bb787baefSLSA-2020:0790-1Security Fix(es): * kernel: buffer overflow in cfg80211_mgd_wext_giwessid in net/wireless /wext-sme.c (CVE-2019-17133) * kernel: unprivileged users able to create RAW sockets in AF_ISDN network protocol. (CVE-2019-17055) Bug Fix(es): * LACP bond does not function because bonding driver sees slave speed & duplex as Unknown * ixgbevf guess causes excessive interrupts in hypervisor due to get link settingsimportantScientific Linux FermiScientific Linux Fermi 6kernel-debug-devel-2.6.32-754.28.1.el6.i686.rpm7baeb69b0cce2467013a56c324072bf0d9511b897f882d4425c899cb70348d83kernel-doc-2.6.32-754.28.1.el6.noarch.rpmbd7fcc9e693f1122eb8f6474f3ec7117e8d1ef0610ae4d429284353c2742db1dkernel-debug-devel-2.6.32-754.28.1.el6.x86_64.rpm3601ebbece8776526cbde45dbdfd65f3e820a70dd282d643ff778397f88e9d9dkernel-abi-whitelists-2.6.32-754.28.1.el6.noarch.rpmb49136d71faf2a416f07485e49c4a72e816c2b0c7f5a5a0c2f7b5bd8e9dc0ec8kernel-debug-2.6.32-754.28.1.el6.x86_64.rpm5a9822d8acf5d1d5a0da548cc737b9c4a824037402f895ab9516f8162df74e92kernel-devel-2.6.32-754.28.1.el6.x86_64.rpm2f18e0e05e8d5c21fcd4fa5480db3c4d5ec1b4f301d0c0bc793d5921becb3322python-perf-2.6.32-754.28.1.el6.x86_64.rpmfd983a57e4cd9ef39a320f007894bc645f0e6be2bb37bb0b9d5105468539e9d0perf-2.6.32-754.28.1.el6.x86_64.rpmb2db08b81a68ffd4e46731ae03ef76a55ddbb7d4f82b6abce53db87e1cfce4e5kernel-headers-2.6.32-754.28.1.el6.x86_64.rpm2467ee63d7cb7422111f408ac86f674aafa310c80d776a56448424197c97ccdckernel-firmware-2.6.32-754.28.1.el6.noarch.rpm5a96c1d62011f5cc7044a4079ab4c4d4b805bf97094eebdc7075e330079dbda2kernel-2.6.32-754.28.1.el6.x86_64.rpm8a476372c74eb3f1a92216e9a85fbd64c95d51ecf99e03bb19b9a66eee86f219SLSA-2020:0816-1This update upgrades Firefox to version 68.6.0 ESR. Security Fix(es): * Mozilla: Use-after-free when removing data about origins (CVE-2020-6805) * Mozilla: BodyStream::OnInputStreamReady was missing protections against state confusion (CVE-2020-6806) * Mozilla: Use-after-free in cubeb during stream destruction (CVE-2020-6807) * Mozilla: Memory safety bugs fixed in Firefox 74 and Firefox ESR 68.6 (CVE-2020-6814) * Mozilla: Out of bounds reads in sctp_load_addresses_from_init (CVE-2019-20503) * Mozilla: Devtools' 'Copy as cURL' feature did not fully escape website- controlled data, potentially leading to command injection (CVE-2020-6811) * Mozilla: The names of AirPods with personally identifiable information were exposed to websites with camera or microphone permission (CVE-2020-6812)importantScientific Linux FermiScientific Linux Fermi 6firefox-68.6.0-1.el6_10.x86_64.rpm4894ff68730cc869cacdd692f2b3c0056284d03655f13175da62d3962e5297f5firefox-68.6.0-1.el6_10.i686.rpm42e3aa25d642495bf090dea0eb1deed36d4d7f308b62a6078d755ce3ebdb3b51SLSA-2020:0892-1Security Fix(es): * zsh: insecure dropping of privileges when unsetting PRIVILEGED option (CVE-2019-20044)importantScientific Linux FermiScientific Linux Fermi 6zsh-4.3.11-11.el6_10.x86_64.rpma644b3ffb5758f66ff69c0f37ce3c2bcd1a3aafe355691c2de7110d4005aa756zsh-html-4.3.11-11.el6_10.x86_64.rpmf9121ba3ec790e1837db9577391ecaacd31fcc6c5ff50faa17522998cff729a3SLSA-2020:0896-1Security Fix(es): * ICU: Integer overflow in UnicodeString::doAppend() (CVE-2020-10531)importantScientific Linux FermiScientific Linux Fermi 6libicu-devel-4.2.1-15.el6_10.x86_64.rpmef1da90912a8bbf64a7ec0b967f395c8566520feec20b72068622170577a8507libicu-4.2.1-15.el6_10.i686.rpm9f6dd5d39417b489153c66e23c5aa4fc33766f5c6346715033feb549ce1bead0libicu-4.2.1-15.el6_10.x86_64.rpm8ef5ad8102141a011018261b421f3fdcd66b7f0a9b1143cdb28b30dc17be1947libicu-devel-4.2.1-15.el6_10.i686.rpm04b271467d8f55f0a0dd1dd8140c1339c5cf90defa0d44599d795095deac8b04libicu-doc-4.2.1-15.el6_10.noarch.rpmeb4363fa5c07c028aa3ef1c29c7b7b76c301338ea9ca9ce73eb140cceef386e0icu-4.2.1-15.el6_10.x86_64.rpm089874bb16b87c0fc18ec27e85ad3c840ba6d7dd8b9096054181029d167b90efSLSA-2020:0898-1Security Fix(es): * python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c (CVE-2020-5312)importantScientific Linux FermiScientific Linux Fermi 6python-imaging-tk-1.1.6-20.el6_10.x86_64.rpm01f7c9003d1a2cd8bb40e70dbda2ef3fa2fa187cc2d7d8e0932090a7981b3266python-imaging-sane-1.1.6-20.el6_10.x86_64.rpm3e2292827e757a0ce86bbb301da796f9caca0332cfd3f0c0407dbeec3439ab80python-imaging-devel-1.1.6-20.el6_10.x86_64.rpm68d5017809a147f70a0cdd88d9b1279dffb8cd6bce05087650d0d06a14f88e3dpython-imaging-1.1.6-20.el6_10.x86_64.rpm813a40fc8d9587dd5cbdb08c652558e633c7fa97f0a8a7c6b31e3a74342a1d4dpython-imaging-devel-1.1.6-20.el6_10.i686.rpm6a20bc6a2e92a182be18ddbb8a79fc2d53c829b4f8f1a0e92966386e2f23cdffSLSA-2020:0912-1Security Fix(es): * tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability (CVE-2020-1938)importantScientific Linux FermiScientific Linux Fermi 6tomcat6-6.0.24-114.el6_10.noarch.rpme67c6d4b8ff53161a4042eaf73db125e581793fef161651e13cb59988f1fc6dctomcat6-admin-webapps-6.0.24-114.el6_10.noarch.rpma05f1b783d85bc1f7f64e7bb59d7b43698f9bb368d31e16d36a3ee271d83fdaetomcat6-el-2.1-api-6.0.24-114.el6_10.noarch.rpm400c301bcb75cf7b39b7016f5e023c30efe45e3d25aa61236c63533edb733aaetomcat6-javadoc-6.0.24-114.el6_10.noarch.rpm5c1707db16c145ceb07eafe23966b012b420510d57599dd01709a2fb947c721btomcat6-webapps-6.0.24-114.el6_10.noarch.rpm4ce45e27aa33def8fbf9e9e7d2c6e87562ae1abbabd962b0130a07c4da5e3003tomcat6-servlet-2.5-api-6.0.24-114.el6_10.noarch.rpmbe3c60a3ba52795cf7a62ce5fb4a7ac8dc9f1dd2254b1af2dba4681bfd1fa6bbtomcat6-docs-webapp-6.0.24-114.el6_10.noarch.rpm7bc43c2a6010849c4a713e025c2ffe605601df8cd3f5af5027c978b8da6c7c6ftomcat6-jsp-2.1-api-6.0.24-114.el6_10.noarch.rpm26ce9c8aac1c86685dab7592ae4c24959f039e902114d6de2378052e97eb31e2tomcat6-lib-6.0.24-114.el6_10.noarch.rpme5f8748e8b5e9f488f39dc02b6fdcec0a2aaa655942fbb70bf83e2cc128fbaf5SLSA-2020:0914-1Security Fix(es): * Mozilla: Use-after-free when removing data about origins (CVE-2020-6805) * Mozilla: BodyStream::OnInputStreamReady was missing protections against state confusion (CVE-2020-6806) * Mozilla: Use-after-free in cubeb during stream destruction (CVE-2020-6807) * Mozilla: Memory safety bugs fixed in Firefox 74 and Firefox ESR 68.6 (CVE-2020-6814) * Mozilla: Out of bounds reads in sctp_load_addresses_from_init (CVE-2019-20503) * Mozilla: Devtools' 'Copy as cURL' feature did not fully escape website-controlled data, potentially leading to command injection (CVE-2020-6811) * Mozilla: The names of AirPods with personally identifiable information were exposed to websites with camera or microphone permission (CVE-2020-6812)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-68.6.0-1.el6_10.x86_64.rpmc4e88dad2e40d442ddecf155120adec08feee5f8da7ef2c77ea1934574279897SLSA-2020:1331-1Security Fix(es): * ipmitool: Buffer overflow in read_fru_area_section function in lib/ipmi_fru.c (CVE-2020-5208)importantScientific Linux FermiScientific Linux Fermi 6ipmitool-1.8.15-3.el6_10.x86_64.rpm2e182a751e4523a33a84c771ddbd7034557b9fc467eafe6d65131739f310f83bSLSA-2020:1335-1Security Fix(es): * telnet-server: no bounds checks in nextitem() function allows to remotely execute arbitrary code (CVE-2020-10188)importantScientific Linux FermiScientific Linux Fermi 6telnet-0.17-49.el6_10.x86_64.rpmdfd4f2e67da0c969fc49544fa8d07265de36d95787386055d5f9fd2ee604f7eftelnet-server-0.17-49.el6_10.x86_64.rpm9ee028dd76710ec8cd4a90a7677aadf2a6951ab3f74a6a0f518590bffb51d121SLSA-2020:1339-1Security Fix(es): * Mozilla: Use-after-free while running the nsDocShell destructor (CVE-2020-6819) * Mozilla: Use-after-free when handling a ReadableStream (CVE-2020-6820)criticalScientific Linux FermiScientific Linux Fermi 6firefox-68.6.1-1.el6_10.x86_64.rpmd1b1d470bebd7883e6081f7472b0cb24349ad0bbd7c5c8e953ae63f036723cc2firefox-68.6.1-1.el6_10.i686.rpm8ff4339baa2182e770b13ac184fd96c9931a1224cf68a4e9ed922a18184f0cedSLSA-2020:1349-1Security Fix(es): * telnet-server: no bounds checks in nextitem() function allows to remotely execute arbitrary code (CVE-2020-10188)importantScientific Linux FermiScientific Linux Fermi 6krb5-appl-clients-1.0.1-10.el6_10.x86_64.rpma4a8cc7c5ca0fb9ed73fd1289d55895380e3bc473d3dc69f5670259bb0a76368krb5-appl-servers-1.0.1-10.el6_10.x86_64.rpm4f7243da2587b8b2253b0af6bc856cdfd4b20b5b570f91204b33db73e95aef05SLSA-2020:1403-1Security Fix(es): * QEMU: Slirp: potential OOB access due to unsafe snprintf() usages Bug Fix(es): * QEMU: Slirp: disable emulation of tcp programs like ftp IRC etc. [rhel-6]importantScientific Linux FermiScientific Linux Fermi 6qemu-kvm-tools-0.12.1.2-2.506.el6_10.7.x86_64.rpm9a815c56c55867c75987775efde007b697679b197e86fee08c4b172f5d43b1d2qemu-kvm-0.12.1.2-2.506.el6_10.7.x86_64.rpm1c059e45489b612bcecc8132c9afe6754cd2961d92bdd07e23d2b808f1d45794qemu-img-0.12.1.2-2.506.el6_10.7.x86_64.rpm51761e022be0e5be90b46a272cc274b94bd6524f4cea04c989ef8ca1a0bb1968qemu-guest-agent-0.12.1.2-2.506.el6_10.7.x86_64.rpmfcec253f740936e289929679ecd0b9cc624d0825d81ca770587a0c02456c06a6SLSA-2020:1429-1Security Fix(es): * Mozilla: Uninitialized memory could be read when using the WebGL copyTexSubImage method (CVE-2020-6821) * Mozilla: Memory safety bugs fixed in Firefox 75 and Firefox ESR 68.7 (CVE-2020-6825) * Mozilla: Out of bounds write in GMPDecodeData when processing large images (CVE-2020-6822)importantScientific Linux FermiScientific Linux Fermi 6firefox-68.7.0-2.el6_10.x86_64.rpma00250d6552c391b4b9e9fb0d3234711ad3397424be15cc8d6621b11a56c4b49firefox-68.7.0-2.el6_10.i686.rpmad728bcd2c4f76fcf472c16c6a85db811b9c7f71628cc434bd804e0100a5de05SLSA-2020:1488-1Security Fix(es): * Mozilla: Use-after-free while running the nsDocShell destructor (CVE-2020-6819) * Mozilla: Use-after-free when handling a ReadableStream (CVE-2020-6820) * Mozilla: Uninitialized memory could be read when using the WebGL copyTexSubImage method (CVE-2020-6821) * Mozilla: Memory safety bugs fixed in Firefox 75 and Firefox ESR 68.7 (CVE-2020-6825) * Mozilla: Out of bounds write in GMPDecodeData when processing large images (CVE-2020-6822)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-68.7.0-1.el6_10.x86_64.rpmaf91ecd07df92005868b0db57f737bfac89a24cb8620f163431f4e39fc0f4080SLSA-2020:1506-1Security Fix(es): * OpenJDK: Incorrect bounds checks in NIO Buffers (Libraries, 8234841) (CVE-2020-2803) * OpenJDK: Incorrect type checks in MethodType.readObject() (Libraries, 8235274) (CVE-2020-2805) * OpenJDK: Unexpected exceptions raised by DOMKeyInfoFactory and DOMXMLSignatureFactory (Security, 8231415) (CVE-2020-2773) * OpenJDK: Re-use of single TLS session for new connections (JSSE, 8234408) (CVE-2020-2781) * OpenJDK: CRLF injection into HTTP headers in HttpServer (Lightweight HTTP Server, 8234825) (CVE-2020-2800) * OpenJDK: Regular expression DoS in Scanner (Concurrency, 8236201) (CVE-2020-2830) * OpenJDK: Misplaced regular expression syntax error check in RegExpScanner (Scripting, 8223898) (CVE-2020-2754) * OpenJDK: Incorrect handling of empty string nodes in regular expression Parser (Scripting, 8223904) (CVE-2020-2755) * OpenJDK: Incorrect handling of references to uninitialized class descriptors during deserialization (Serialization, 8224541) (CVE-2020-2756) * OpenJDK: Uncaught InstantiationError exception in ObjectStreamClass (Serialization, 8224549) (CVE-2020-2757)importantScientific Linux FermiScientific Linux Fermi 6java-1.8.0-openjdk-javadoc-debug-1.8.0.252.b09-2.el6_10.noarch.rpme19975268da987ac48575702799aead59f14f335ced187695be30aaec2cc5abbjava-1.8.0-openjdk-src-1.8.0.252.b09-2.el6_10.x86_64.rpma3b8c44122715ab6022e9b01b5fa62ff4f851d7d8b4a0b7f6f0595fc509cdab4java-1.8.0-openjdk-demo-debug-1.8.0.252.b09-2.el6_10.x86_64.rpm930ff7d46c1e87fdea89bde320aafc1d34a300e7121f3d8d596e55e265ca22b8java-1.8.0-openjdk-headless-1.8.0.252.b09-2.el6_10.x86_64.rpm8f2aa5a54befa4237be8fff9ae615360565f66a9e6eeb5310629f363f01d37eajava-1.8.0-openjdk-devel-1.8.0.252.b09-2.el6_10.x86_64.rpm0b189b263b1503ef2103d171ce870d7a3b8d85f87d0a5eff0193f7c4302b1e75java-1.8.0-openjdk-devel-debug-1.8.0.252.b09-2.el6_10.x86_64.rpm8b81e14dd39c45376352d343cb4f004b57d1b35bc63e38283f9afa2f852e37f2java-1.8.0-openjdk-1.8.0.252.b09-2.el6_10.x86_64.rpma7c6f9908f9336b2f5cb4d54a14792a16cc7840a03539f7c9a4086cf13b771efjava-1.8.0-openjdk-src-debug-1.8.0.252.b09-2.el6_10.x86_64.rpm24e5603701b14ad55a9a3ec4cc0b580d5e97430e737df38ad947c2c490f32ff9java-1.8.0-openjdk-headless-debug-1.8.0.252.b09-2.el6_10.x86_64.rpmbd3494a485bb99a8018b1b368992c7aee7ad32bea4a26f7fbbd35536a9d4064ejava-1.8.0-openjdk-javadoc-1.8.0.252.b09-2.el6_10.noarch.rpm135085ccb7581891eea423fd6ef4d02cbc030b48e790aa48781d56271a8434acjava-1.8.0-openjdk-demo-1.8.0.252.b09-2.el6_10.x86_64.rpmdf0372be296f609e4c256b6f24e6b583b8b62576bc063fe1de928fd7b53b9034java-1.8.0-openjdk-debug-1.8.0.252.b09-2.el6_10.x86_64.rpm704b36e530c8859bbf9bf9f2a45352c1ee89c513a0d57eb52b06f6db719daaceSLSA-2020:1508-1Security Fix(es): * OpenJDK: Incorrect bounds checks in NIO Buffers (Libraries, 8234841) (CVE-2020-2803) * OpenJDK: Incorrect type checks in MethodType.readObject() (Libraries, 8235274) (CVE-2020-2805) * OpenJDK: Unexpected exceptions raised by DOMKeyInfoFactory and DOMXMLSignatureFactory (Security, 8231415) (CVE-2020-2773) * OpenJDK: Re-use of single TLS session for new connections (JSSE, 8234408) (CVE-2020-2781) * OpenJDK: CRLF injection into HTTP headers in HttpServer (Lightweight HTTP Server, 8234825) (CVE-2020-2800) * OpenJDK: Regular expression DoS in Scanner (Concurrency, 8236201) (CVE-2020-2830) * OpenJDK: Incorrect handling of references to uninitialized class descriptors during deserialization (Serialization, 8224541) (CVE-2020-2756) * OpenJDK: Uncaught InstantiationError exception in ObjectStreamClass (Serialization, 8224549) (CVE-2020-2757)importantScientific Linux FermiScientific Linux Fermi 6java-1.7.0-openjdk-src-1.7.0.261-2.6.22.1.el6_10.x86_64.rpm73c63e2b81de287aac5f7bf430eea852fc41da527684a817c579bce4248c7ff3java-1.7.0-openjdk-demo-1.7.0.261-2.6.22.1.el6_10.x86_64.rpmdd9ff2660b45fae3a7d969b383e8c1ffeaff10de3d8286cd5bf81f3511e8c77bjava-1.7.0-openjdk-1.7.0.261-2.6.22.1.el6_10.x86_64.rpm2cb171ded0d70794752e3325ae4d2465e91bd74af661dd6270c381ab0516c4c8java-1.7.0-openjdk-javadoc-1.7.0.261-2.6.22.1.el6_10.noarch.rpm5b9f02ba2ad600fb3499389613ac77dc9176a41a7d9876768a59ed01fed443b1java-1.7.0-openjdk-devel-1.7.0.261-2.6.22.1.el6_10.x86_64.rpme979aa46fc8aef3407b4718ba644ba9e57f7734bd819710801d5c39fba167054SLSA-2020:1524-1Security Fix(es): * kernel: rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel lacks a certain upper-bound check, leading to a buffer overflow (CVE-2019-17666) * kernel: offset2lib allows for the stack guard page to be jumped over (CVE-2017-1000371)importantScientific Linux FermiScientific Linux Fermi 6kernel-debug-2.6.32-754.29.1.el6.x86_64.rpmf26a3bbb7c210b3f658b3d56c4b557f92c8eaa46641062b71be010ad0370d7f1kernel-2.6.32-754.29.1.el6.x86_64.rpmefa561c5f9d81e43174e76edf021e6cd721598cc0b71f97fc5a7d8817272d128kernel-firmware-2.6.32-754.29.1.el6.noarch.rpmbd4c2ee33949073a2178159e42b89a1c8c00fa0a4138d734a972ef527ce91efdkernel-debug-devel-2.6.32-754.29.1.el6.i686.rpm6ba2d8062dfb47aa9fa2910f7981ef19987838a6c1a77143594b1c32a3909028kernel-doc-2.6.32-754.29.1.el6.noarch.rpm2defbde25423ad053033684cde92f7e36331c7358e7cef50faaa60613aaccd70kernel-debug-devel-2.6.32-754.29.1.el6.x86_64.rpmbca98da309af6a497c0b6415dd2f16fd845246e1ed1f331f1a17df285e33b6bckernel-headers-2.6.32-754.29.1.el6.x86_64.rpm3928854001daf2aa1adac5270ea0a1a8adcb1261f695fa27864c512709f7560cpython-perf-2.6.32-754.29.1.el6.x86_64.rpm73c51bbcf83983c22f1a55b5c3ac04401434fe046f62fe1651477a7504bdcf86kernel-devel-2.6.32-754.29.1.el6.x86_64.rpme30525b62137d731b7438c26178c219b3fa8fec0d472860f4adbd2d449d491d7kernel-abi-whitelists-2.6.32-754.29.1.el6.noarch.rpm21415c036c175c1ff223d933f78794efdd9bd62777ea5b32533bbe853dfb1a39perf-2.6.32-754.29.1.el6.x86_64.rpm10fe081158aec2aa56d68dbd2e097557f753fde5b36235e153d38dd4e6ed0a83SLSA-2020:1962-1Security Fix(es): * python-twisted: HTTP request smuggling when presented with two Content-Length headers (CVE-2020-10108)importantScientific Linux FermiScientific Linux Fermi 6python-twisted-web-8.2.0-6.el6_10.x86_64.rpm4b997567bac71f44fe6a36e51c1eddcedeb18e7813d51d869b08dd551559eef8SLSA-2020:2036-1Security Fix(es): * Mozilla: Use-after-free during worker shutdown (CVE-2020-12387) * Mozilla: Memory safety bugs fixed in Firefox 76 and Firefox ESR 68.8 (CVE-2020-12395) * Mozilla: Buffer overflow in SCTP chunk input validation (CVE-2020-6831) * Mozilla: Arbitrary local file access with 'Copy as cURL' (CVE-2020-12392)criticalScientific Linux FermiScientific Linux Fermi 6firefox-68.8.0-1.el6_10.x86_64.rpmf61156ae80de43b3b04df36f0bde099750d56eb5c4e5bc26daa6d21cc329bf3bfirefox-68.8.0-1.el6_10.i686.rpmff969ec40b02b9b409cc49bc985aa45bcd464c72e5edee8463141ea0a97840b4SLSA-2020:2049-1Security Fix(es): * Mozilla: Use-after-free during worker shutdown (CVE-2020-12387) * Mozilla: Memory safety bugs fixed in Firefox 76 and Firefox ESR 68.8 (CVE-2020-12395) * usrsctp: Buffer overflow in AUTH chunk input validation (CVE-2020-6831) * Mozilla: Arbitrary local file access with 'Copy as cURL' (CVE-2020-12392) * Mozilla: Sender Email Address Spoofing using encoded Unicode characters (CVE-2020-12397)criticalScientific Linux FermiScientific Linux Fermi 6thunderbird-68.8.0-1.el6_10.x86_64.rpmb016c1eb8a78241e4f41849341b6445947c92d315c22531c5211571649c89f33SLSA-2020:2103-1Security Fix(es): * Kernel: NetLabel: null pointer dereference while receiving CIPSO packet with null category may cause kernel panic (CVE-2020-10711)importantScientific Linux FermiScientific Linux Fermi 6kernel-doc-2.6.32-754.29.2.el6.noarch.rpmd5fc2eaa74a1164e87e0e4c89749626e01abb315781aa3723eef54d091cb717akernel-2.6.32-754.29.2.el6.x86_64.rpm67822d2d9ffb06767fb130179ac4b232fc3478134d54f785ca5d0d1dc9d64f5bkernel-devel-2.6.32-754.29.2.el6.x86_64.rpm0eed25e8b1e7a725965a376be489ca942cb1d526e8bcf95a93bef6442f451e8ckernel-debug-2.6.32-754.29.2.el6.x86_64.rpma2e719080a6c128221f61dc84e3250e4903100fe8763bf6e6b0619ef56fcc7bbkernel-headers-2.6.32-754.29.2.el6.x86_64.rpmc920a16fa9050dd80f2a5a1c95667e4f60aa47f39195c0b1c07b372b24fe32abpython-perf-2.6.32-754.29.2.el6.x86_64.rpm37b490f3f906e248f4eed6f0ecab0aae4fe8b45f5275d3408d194efc896f4398kernel-debug-devel-2.6.32-754.29.2.el6.x86_64.rpm5cc152c1fe431b6cd8426b89dcc95b248cc44186feb0e039bbeca9dc5b2b9f64perf-2.6.32-754.29.2.el6.x86_64.rpm9dcdc836b765999535a2761568038ff8b285059242d5f5ea90ab0fc019be1c09kernel-debug-devel-2.6.32-754.29.2.el6.i686.rpmc0253bd506d0754a0b06020c65c1c748b60f2bc25dfa40928e2d35b216dd414ckernel-abi-whitelists-2.6.32-754.29.2.el6.noarch.rpm0420598dca0abb270d088895439416fa07f685d4099807ee1b9683a815c292d6kernel-firmware-2.6.32-754.29.2.el6.noarch.rpmc115cfac5d1f31547e415ce6299dd8df41c6a3343d6b1f45ed870a4098f1ecdbSLSA-2020:2378-1Security Fix(es): * Mozilla: Use-after-free in SharedWorkerService (CVE-2020-12405) * Mozilla: JavaScript Type confusion with NativeTypes (CVE-2020-12406) * Mozilla: Memory safety bugs fixed in Firefox 77 and Firefox ESR 68.9 (CVE-2020-12410)importantScientific Linux FermiScientific Linux Fermi 6firefox-68.9.0-1.el6_10.i686.rpmc8492bbae72bdea59eb209ed09fdce0979d34a4510a76da61befda5fda11146dfirefox-68.9.0-1.el6_10.x86_64.rpm55e18c2b26e5c1e8641bc1e7bd17a614725638b5fba0ff72fb4be7101afef48dSLSA-2020:2383-1Security Fix(es): * bind: BIND does not sufficiently limit the number of fetches performed when processing referrals (CVE-2020-8616) * bind: A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c (CVE-2020-8617)importantScientific Linux FermiScientific Linux Fermi 6bind-chroot-9.8.2-0.68.rc1.el6_10.7.x86_64.rpm52f6b135369251ae199f61610d307f3caf2be08bdc23d68c305ee6cde34ea077bind-devel-9.8.2-0.68.rc1.el6_10.7.x86_64.rpm1815c31a31e179561976f8fa93e2316ced088eb4ebda0f290edf0b9a5f5d6c19bind-libs-9.8.2-0.68.rc1.el6_10.7.x86_64.rpme0c375f0a9243ce283a7535ec461582e093e008de261fc1ece147c704d672aedbind-sdb-9.8.2-0.68.rc1.el6_10.7.x86_64.rpm37f1379eb05e3e00e9cb64c8c66b8cac38224a3101939b30bb3a12eed9626b66bind-devel-9.8.2-0.68.rc1.el6_10.7.i686.rpmbd5e29847f28c681d00071493941add2c30d9ae99f4eb0469a22b89ee6873acfbind-utils-9.8.2-0.68.rc1.el6_10.7.x86_64.rpm975cb2d7881d175ef5cb2f2756fca72fedc3339a54537ee85cd1ea96c3fdceb8bind-libs-9.8.2-0.68.rc1.el6_10.7.i686.rpm0260edc1e0c226c49f66583e3ca503f3c3976233210f54ae8139bbae52fe23afbind-9.8.2-0.68.rc1.el6_10.7.x86_64.rpm78a7fcee699fa940b18fbc57b8797cc2a656e60851b89d1e6472d9b30a82325fSLSA-2020:2406-1Security Fix(es): * freerdp: Out-of-bounds write in crypto_rsa_common in libfreerdp/crypto/crypto.c (CVE-2020-13398)importantScientific Linux FermiScientific Linux Fermi 6freerdp-plugins-1.0.2-7.el6_10.x86_64.rpm68efb6237f3b6a81a96f0132bf82897c1f0f8eb76df850650c3add70cbb5e59efreerdp-devel-1.0.2-7.el6_10.i686.rpmeacfd27013b2bfdf41cd621abf469ac0aef2df7ad612db6da69bc6132b652730freerdp-libs-1.0.2-7.el6_10.x86_64.rpm3927d1e6cb98dacd45296f32f27d6500d30518ba63df4bc70d07a43af0466ccdfreerdp-libs-1.0.2-7.el6_10.i686.rpma5baa62e16352b5b2ecd546ee16daf3567c42ef094f83f7f466cc12fd2a8c4f9freerdp-1.0.2-7.el6_10.x86_64.rpm382978ac6aa7c58dffe55467896dff6ec7f753b9d377803950c0d6caaf7b739cfreerdp-devel-1.0.2-7.el6_10.x86_64.rpmd2429368f35d36c98b6287bf3451fd701439e2ff72b09e5803f909ec91cd2a1aSLSA-2020:2430-1Security Fix(es): * kernel: NULL pointer dereference due to KEYCTL_READ on negative key (CVE-2017-12192)moderateScientific Linux FermiScientific Linux Fermi 6kernel-devel-2.6.32-754.30.2.el6.x86_64.rpmd016358e5b83bade392d80a6c4e3c8e72eeadcdd6139a27faddd0ea593efbc77python-perf-2.6.32-754.30.2.el6.x86_64.rpme1da983959062addad7af64808335fd166bbd1545f2e3c16cdeac90a987a7673kernel-debug-devel-2.6.32-754.30.2.el6.x86_64.rpme547a746e139188ef1fbdd4c9c989b6700d79d25268a8cdcdfa11c59deca8acckernel-abi-whitelists-2.6.32-754.30.2.el6.noarch.rpm730770d4ce0c67828244447ebc39d11243b6bfe40ddcd34224ab246ca84833d5perf-2.6.32-754.30.2.el6.x86_64.rpm832ae57dacc1a9f4369835c0c28c0083d3f4ccb5f67cfaea41df794309501533kernel-debug-devel-2.6.32-754.30.2.el6.i686.rpmf7c3d857729cb095d06af86f69412a2744053ad84aa50859ddfd0aa2abac566dkernel-doc-2.6.32-754.30.2.el6.noarch.rpm176c75f8d19c75db7f1c00844acd6777c12c2b16caa608896f6a369cdd48a785kernel-headers-2.6.32-754.30.2.el6.x86_64.rpmd2ed20835fe17dfaa1867ebe2dee997af754ce774fd740436e741414fbc71f40kernel-firmware-2.6.32-754.30.2.el6.noarch.rpm8a9d803a8bf4395aa75086a462f5a2f75457ae2c2bd2c4bc07a40a3e648defb9kernel-2.6.32-754.30.2.el6.x86_64.rpmdcc27f6867e38e6626886408b9c5e925bc69cf6d2e5f5e2684c415eb38ae9977kernel-debug-2.6.32-754.30.2.el6.x86_64.rpmc01e8dcbb1ec73428f4179c6661e06bae4cf7d2727f353e50f431df7d1df7c66SLSA-2020:2433-1Security Fix(es): * hw: Special Register Buffer Data Sampling (SRBDS) (CVE-2020-0543) * hw: L1D Cache Eviction Sampling (CVE-2020-0549) * hw: Vector Register Data Sampling (CVE-2020-0548)moderateScientific Linux FermiScientific Linux Fermi 6microcode_ctl-1.17-33.26.el6_10.x86_64.rpmb918dad1934cb5cd362758ddaab492d5fea16719bd11ce28bb66206b5b473b30SLSA-2020:2516-1Security Fix(es): * libexif: several buffer over-reads in EXIF MakerNote handling can lead to information disclosure and DoS (CVE-2020-13112)moderateScientific Linux FermiScientific Linux Fermi 6libexif-devel-0.6.21-6.el6_10.i686.rpm9879765aaf062b70cd05712af8a56585fe8b7183b876064046e3b52a00fb039blibexif-0.6.21-6.el6_10.i686.rpmace0d218fe2af9d4388e16cd74e56407fc84d7449c4734e5083f896cec0965a3libexif-devel-0.6.21-6.el6_10.x86_64.rpm0bd6502a2d401f3b05a7966e9d091fbe8bc03ac384b6613976be18294f73416clibexif-0.6.21-6.el6_10.x86_64.rpm4eef4810aa5ffc7939f61e9c9ded81c18aac11695ef2b5078d2a0f3fb261e6caSLSA-2020:2529-1* tomcat: deserialization flaw in session persistence storage leading to RCE (CVE-2020-9484)importantScientific Linux FermiScientific Linux Fermi 6tomcat6-servlet-2.5-api-6.0.24-115.el6_10.noarch.rpmd8c8a740ba3cc36e91a74d7bbae6901df18ebe696ea3bbbeab47b0b0b4571e7etomcat6-webapps-6.0.24-115.el6_10.noarch.rpmc91a7a99212042e51aa337f876498052253ab3e7c8b92122d9f4bf8e3e78dbedtomcat6-6.0.24-115.el6_10.noarch.rpmf1b3b894b412ff6b21743ec297617202a22eef5f2b1ef6e897d14e2d17e73306tomcat6-docs-webapp-6.0.24-115.el6_10.noarch.rpm1266db8f8dc17028c4ecf3a1e1ca909316d16467f2707a4d011c3a593f8ec9ddtomcat6-jsp-2.1-api-6.0.24-115.el6_10.noarch.rpmbefc720145865fd7c2c8212e17ff455424fa5deb7121938b6aaec3cdbc744dfctomcat6-javadoc-6.0.24-115.el6_10.noarch.rpm6125b1df82d8470a1194b539578bab6a5b579b82d48b292677120b3b04a791e6tomcat6-el-2.1-api-6.0.24-115.el6_10.noarch.rpm5ba010b035d1372221917d23a762d5138648fb2669b799bc0806d7f2102bbcf2tomcat6-admin-webapps-6.0.24-115.el6_10.noarch.rpmab7257bf316de7c76f7c6f94963b25b7249b67eab8917d60658271ad54656af8tomcat6-lib-6.0.24-115.el6_10.noarch.rpmd6c3b2b895ffbcb24ce3002b1f7ada3852ef24da299fc828750bc1eb1b930991SLSA-2020:2613-1Security Fix(es): * Mozilla: Security downgrade with IMAP STARTTLS leads to information leakage (CVE-2020-12398) * Mozilla: Use-after-free in SharedWorkerService (CVE-2020-12405) * Mozilla: JavaScript Type confusion with NativeTypes (CVE-2020-12406) * Mozilla: Memory safety bugs fixed in Firefox 77 and Firefox ESR 68.9 (CVE-2020-12410)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-68.9.0-1.el6_10.x86_64.rpma99a2a5f4a7a5fad290b5552ee431ab1d74a13b2f753f819e2b594e344c67db4SLSA-2020:2640-1Security Fix(es): * unbound: amplification of an incoming query into a large number of queries directed to a target (CVE-2020-12662) * unbound: infinite loop via malformed DNS answers received from upstream servers (CVE-2020-12663)importantScientific Linux FermiScientific Linux Fermi 6unbound-devel-1.4.20-29.el6_10.1.x86_64.rpm1d4f92f44702fc7c904adf5df1a2ef62a908f70506749981cf2efea3e7eb036bunbound-python-1.4.20-29.el6_10.1.i686.rpm24ed8af56ac67370ba105e9d738d0ecc654fa687460e129adfdf21af68f24218unbound-libs-1.4.20-29.el6_10.1.x86_64.rpm18968c7d4b6430c66a42eefb5b100373786fa431711ffa59072638d522fa2a67unbound-devel-1.4.20-29.el6_10.1.i686.rpm1640c1c683df3635ae36acb42b5f14ecca4de9afafc02d2fc8ae56eec77367bfunbound-libs-1.4.20-29.el6_10.1.i686.rpm0be3da9d7576e4670c2a6779820fd9516c14d0be004c979b19adedae8eddead0unbound-python-1.4.20-29.el6_10.1.x86_64.rpmd1707938d7e15ba38cf01607b9bece57a4d64ace5291ccf3947128ab3b2a1f31unbound-1.4.20-29.el6_10.1.x86_64.rpm466c7b780264ff6f47ebb44af6169cb1a1655224975f16020db57ac796cedd4dSLSA-2020:2824-1Security Fix(es): * Mozilla: Information disclosure due to manipulated URL object (CVE-2020-12418) * Mozilla: Use-after-free in nsGlobalWindowInner (CVE-2020-12419) * Mozilla: Use-After-Free when trying to connect to a STUN server (CVE-2020-12420) * Mozilla: Add-On updates did not respect the same certificate trust rules as software updates (CVE-2020-12421)importantScientific Linux FermiScientific Linux Fermi 6firefox-68.10.0-1.el6_10.x86_64.rpm356a5e1f0aae0c2bdeff5ffc239210604c68c31b7200fecca808c4deaa8d03d0firefox-68.10.0-1.el6_10.i686.rpm1804805bd0e916dcf89e3589374aaf5d1f06020b57373970e2ad0e3f3f01c681SLSA-2020:2933-1Security Fix(es): * kernel: powerpc: incomplete Spectre-RSB mitigation leads to information exposure (CVE-2019-18660)moderateScientific Linux FermiScientific Linux Fermi 6kernel-firmware-2.6.32-754.31.1.el6.noarch.rpm7d3a2a63f1a3e7bbc67de2f0ca9c68e7c3daaf0640e4835f9b060961a70b9095kernel-debug-2.6.32-754.31.1.el6.x86_64.rpm52b70051b850207b166b44313808a03b04167353f5562d124de8b04c48f5598fkernel-headers-2.6.32-754.31.1.el6.x86_64.rpm6c0268f370b254d4eb8ae99b1e9122bad14773e073bf622398bc4025a50dd8e7kernel-doc-2.6.32-754.31.1.el6.noarch.rpm6917b2ed40d0db1bd3b8c8df73aac89cfcaf899404b5a011eac2f809b50955f1perf-2.6.32-754.31.1.el6.x86_64.rpm7846bfd191fb45b223c2fbee1c974a7d7b72dca8981d3002cad233f056764793kernel-abi-whitelists-2.6.32-754.31.1.el6.noarch.rpm5a01513018c63477b395dfd3b566e36cb970039217f71703d35d01a9f49ef009kernel-debug-devel-2.6.32-754.31.1.el6.i686.rpm423a5bcbfe1c0407b211abc3598b2c387670f59a3379a7710c824a55ca920132kernel-devel-2.6.32-754.31.1.el6.x86_64.rpmab47cd221afa6fea564e7d67d593a9450261c9a562af71ed5f6aea7622bcd241python-perf-2.6.32-754.31.1.el6.x86_64.rpm0f4cbcc92017a2c8aefabb508ea138855003572bab7ba3a13588b6d7a5713afbkernel-debug-devel-2.6.32-754.31.1.el6.x86_64.rpmcac723d1aa1eae0b48952ea91f67c38659aa44c292b9090180729d2dc7be6224kernel-2.6.32-754.31.1.el6.x86_64.rpmf2b4e68218c5cd61018ec507191d9c24cee1484897ded4bccc2e7d74a5132e4cSLSA-2020:2966-1Security Fix(es): * Mozilla: Information disclosure due to manipulated URL object (CVE-2020-12418) * Mozilla: Use-after-free in nsGlobalWindowInner (CVE-2020-12419) * Mozilla: Use-After-Free when trying to connect to a STUN server (CVE-2020-12420) * Mozilla: Add-On updates did not respect the same certificate trust rules as software updates (CVE-2020-12421)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-68.10.0-1.el6_10.x86_64.rpm5add26292dd2eddb823cfb34090ea6e7b94c3cd95f43b0c827ad37284057ad8cSLSA-2020:2985-1Security Fix(es): * OpenJDK: Bypass of boundary checks in nio.Buffer via concurrent access (Libraries, 8238920) (CVE-2020-14583) * OpenJDK: Incomplete bounds checks in Affine Transformations (2D, 8240119) (CVE-2020-14593) * OpenJDK: Incorrect handling of access control context in ForkJoinPool (Libraries, 8237117) (CVE-2020-14556) * OpenJDK: Unexpected exception raised by DerInputStream (Libraries, 8237731) (CVE-2020-14578) * OpenJDK: Unexpected exception raised by DerValue.equals() (Libraries, 8237736) (CVE-2020-14579) * OpenJDK: XML validation manipulation due to incomplete application of the use-grammar-pool-only feature (JAXP, 8242136) (CVE-2020-14621) * OpenJDK: HostnameChecker does not ensure X.509 certificate names are in normalized form (JSSE, 8237592) (CVE-2020-14577)importantScientific Linux FermiScientific Linux Fermi 6java-1.8.0-openjdk-devel-debug-1.8.0.262.b10-0.el6_10.x86_64.rpm43c5caca3ad62173c7c29bda5040153db67505e38a50f23a596dffa1fbdb9dbfjava-1.8.0-openjdk-headless-debug-1.8.0.262.b10-0.el6_10.x86_64.rpme986ee533e3db2f48d03dd4f678f8912607d8b7f7ae90bd859d61958a3b4ffd3java-1.8.0-openjdk-demo-debug-1.8.0.262.b10-0.el6_10.x86_64.rpm15e836db4c53f5bb642c9310033d5a41404380ec8bf7370f4aa5361361d5d021java-1.8.0-openjdk-1.8.0.262.b10-0.el6_10.x86_64.rpm1ec96fca88bb5b164f5bcc758a70a48eb7ccb2a0943c6317d486e9c79680b5bfjava-1.8.0-openjdk-javadoc-debug-1.8.0.262.b10-0.el6_10.noarch.rpmd9add926a08b73c1a5202a99eacc399216cdeb39d52b5e2941285902e6bf4d58java-1.8.0-openjdk-demo-1.8.0.262.b10-0.el6_10.x86_64.rpm4a910732ba6b00d9d3534361fe859534a371179777d4af967371e16a49c10c93java-1.8.0-openjdk-src-debug-1.8.0.262.b10-0.el6_10.x86_64.rpmb466f0cf03e32161e753e65df8e73201f1e3046e57695b2b00421b7a43dbe26bjava-1.8.0-openjdk-debug-1.8.0.262.b10-0.el6_10.x86_64.rpm400ec4bc198faa393bd5c21248553c1b6db9ea7a26bb5b86ed33e1feecb6ea0ajava-1.8.0-openjdk-devel-1.8.0.262.b10-0.el6_10.x86_64.rpma8e0ddd2c31bd91889ea66406591a8445780d957d41dd63158086499a61abc40java-1.8.0-openjdk-headless-1.8.0.262.b10-0.el6_10.x86_64.rpm6a958747f126f1bbcc808192225e9c808aaa0cdf8b715e7d231cb8a1fae520a2java-1.8.0-openjdk-src-1.8.0.262.b10-0.el6_10.x86_64.rpm84c16382b00f21e4c679db8d36b859284efc761839969856512ae70c88bc0cdajava-1.8.0-openjdk-javadoc-1.8.0.262.b10-0.el6_10.noarch.rpmf4bd52580595be5fb5245aed4860b1346bb6cb78963f1e7c4c0d896254c1b831SLSA-2020:3233-1Security Fix(es): * chromium-browser: Use after free in ANGLE (CVE-2020-6463) * chromium-browser: Inappropriate implementation in WebRTC (CVE-2020-6514) * Mozilla: Potential leak of redirect targets when loading scripts in a worker (CVE-2020-15652) * Mozilla: Memory safety bugs fixed in Firefox 79 and Firefox ESR 68.11 (CVE-2020-15659)importantScientific Linux FermiScientific Linux Fermi 6firefox-68.11.0-1.el6_10.x86_64.rpma172839aa5d9391c700813e8e5c1531515cd9bb90c7957baf56999eb071c8b0cfirefox-68.11.0-1.el6_10.i686.rpm17c09a311a7b229d3d205f635e6753b17d6da51e0fbc2f99264d5ca290d65323SLSA-2020:3284-1Security Fix(es): * postgresql-jdbc: XML external entity (XXE) vulnerability in PgSQLXML (CVE-2020-13692)importantScientific Linux FermiScientific Linux Fermi 6postgresql-jdbc-8.4.704-4.el6_10.noarch.rpm518995d76313e361af8511350b1dec10e78068f1851d168b4a8cda7456f71a39SLSA-2020:3345-1Security Fix(es): * chromium-browser: Use after free in ANGLE (CVE-2020-6463) * chromium-browser: Inappropriate implementation in WebRTC (CVE-2020-6514) * Mozilla: Potential leak of redirect targets when loading scripts in a worker (CVE-2020-15652) * Mozilla: Memory safety bugs fixed in Firefox 79 and Firefox ESR 68.11 (CVE-2020-15659)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-68.11.0-1.el6_10.x86_64.rpmd47a7a6cbcc59666f7a275f9bd4ef19da093f8e9f0378cf9a9543412fb511213SLSA-2020:3548-1Security Fix(es): * kernel: Null pointer dereference in search_keyring (CVE-2017-2647) * kernel: heap-based buffer overflow in lbs_ibss_join_existing function in drivers/net/wireless/marvell/libertas/cfg.c (CVE-2019-14896)importantScientific Linux FermitrueScientific Linux Fermi 6kernel-doc-2.6.32-754.33.1.el6.noarch.rpm89b9afcd74bc9bf1d0602ab37023b48695e0cea186a4612afb5a0697fd92cafakernel-debug-2.6.32-754.33.1.el6.x86_64.rpmf5928642b57484b165a6f368616bdac53ec329c55614eb3506e56e081bfc7c9akernel-firmware-2.6.32-754.33.1.el6.noarch.rpmd760d7286eca3b52ddd6765fe10afa6d88eceeb4dc85f1ce020cae7e7cc040f3kernel-debug-devel-2.6.32-754.33.1.el6.i686.rpm52c94b1c7ab0197a72bef089969a663154c26bf7cd3c9f2ec945e1fd3b1e4a8akernel-abi-whitelists-2.6.32-754.33.1.el6.noarch.rpm1c10f523013b858e8d2e5f087378a56c7f0794fd8d15df97649e51fc2e31fd1bkernel-2.6.32-754.33.1.el6.x86_64.rpm830a36e34b85d43d6e8c4e52236a262fcadccf430a33707070c840740e8bb4bckernel-headers-2.6.32-754.33.1.el6.x86_64.rpm943d7c6f90f897a4307ea2b386da587dc9bc4fcf4f35fbcd92d6cc4b3a36f54akernel-devel-2.6.32-754.33.1.el6.x86_64.rpm70b07ea3991a01cbcd87365e7df0c2b205ad2036b80d9c46e78f8a4c59409c0epython-perf-2.6.32-754.33.1.el6.x86_64.rpm9ea10871e5487c2bb26e9f2821210553277875edc64aaae2ee1ac9a66e8b00b6kernel-debug-devel-2.6.32-754.33.1.el6.x86_64.rpmb73396b2dd5fc840b2d89c3a5dfc83d2f2e6a98cffac322ccfa89e5ad7396c94perf-2.6.32-754.33.1.el6.x86_64.rpm336d7b947c7b64822090441d3f1bfa720a80407184085d5be0b9e0daa3f1ba29SLSA-2020:3558-1Security Fix(es): * Mozilla: Attacker-induced prompt for extension installation (CVE-2020-15664) * Mozilla: Use-After-Free when aborting an operation (CVE-2020-15669)importantScientific Linux FermiScientific Linux Fermi 6firefox-68.12.0-1.el6_10.i686.rpm023f3bb22b3cfba3d49d8262c6c3f3da0bfa7d1900c684eee1b0a343a568bfa2firefox-68.12.0-1.el6_10.x86_64.rpmd686b8cd28185eadb7e578973ea8b5e07312538069a81cd528c11ae732c4afd5SLSA-2020:3643-1Security Fix(es): * Mozilla: Attacker-induced prompt for extension installation (CVE-2020-15664) * Mozilla: Use-After-Free when aborting an operation (CVE-2020-15669)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-68.12.0-1.el6_10.x86_64.rpm956a02dba47c9ee9669646ba512aa9b1c281789a6fc3bd9421fe387ff8b44f05SLSA-2020:3835-1Security Fix(es): * Mozilla: Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3 (CVE-2020-15673) * Mozilla: XSS when pasting attacker-controlled data into a contenteditable element (CVE-2020-15676) * Mozilla: Download origin spoofing via redirect (CVE-2020-15677) * Mozilla: When recursing through layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free scenario (CVE-2020-15678)importantScientific Linux FermiScientific Linux Fermi 6firefox-78.3.0-1.el6_10.x86_64.rpm3d64e88fe9ce00a191a101ea6b99210c8dc027724572f1c25bdf659c74bb5ff4firefox-78.3.0-1.el6_10.i686.rpm9aa64152a903a27623425043682949073834c68188e5a2f177ad87cbafbc645cSLSA-2020:4056-1Security Fix(es): * QEMU: usb: out-of-bounds r/w access issue while processing usb packets (CVE-2020-14364)importantScientific Linux FermiScientific Linux Fermi 6qemu-kvm-0.12.1.2-2.506.el6_10.8.x86_64.rpm79493faab3393d76903fa66483418b9a8c88cddb73061d0bf9ca7d99ce0204c5qemu-kvm-tools-0.12.1.2-2.506.el6_10.8.x86_64.rpm0dfa8bff99e94eb62e28cae9e6e3b655648e10db5ebae4d816ceff51f079453aqemu-guest-agent-0.12.1.2-2.506.el6_10.8.x86_64.rpm74fdd6b189e6310f3ccecc8fd90cfc96e8d0a662b8830d7adc85a670b390fb55qemu-img-0.12.1.2-2.506.el6_10.8.x86_64.rpm49582bab25552394e372d0bd82797d61e30413dd7c4099e4486411a14c7f0ba0SLSA-2020:4158-1Security Fix(es): * Mozilla: Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3 (CVE-2020-15673) * Mozilla: XSS when pasting attacker-controlled data into a contenteditable element (CVE-2020-15676) * Mozilla: Download origin spoofing via redirect (CVE-2020-15677) * Mozilla: When recursing through layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free scenario (CVE-2020-15678)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-78.3.1-1.el6_10.x86_64.rpm593a3053072980885f159f570b670c8e1ea7581988f3cd7240db63a5907d9d53SLSA-2020:4182-1Security Fix(es): * kernel: Count overflow in FUSE request leading to use-after-free issues. (CVE-2019-11487)importantScientific Linux FermiScientific Linux Fermi 6kernel-abi-whitelists-2.6.32-754.35.1.el6.noarch.rpm100e6fd09800c19d354b45d101ee8acf435ff3747dd55fa7c540336e22fa2856python-perf-2.6.32-754.35.1.el6.x86_64.rpmb2eb54a99112bc0bd04280e9b5301339b810d3b93b0023428d533cabe88dbc09kernel-devel-2.6.32-754.35.1.el6.x86_64.rpmcd62756df44ccd1d0f305777eb4b347f005145cfc52be91c267df44cbbc61a2ekernel-doc-2.6.32-754.35.1.el6.noarch.rpm3d2c718136637743613cca4a746e3a2db77f754e1fb8641560311ed6a1bb0e00kernel-2.6.32-754.35.1.el6.x86_64.rpmaa1b9a082e49c92f648f882317252148502f7534762d7e6c2a5abb47f7e3c9dekernel-headers-2.6.32-754.35.1.el6.x86_64.rpm58421dd50c17f8a59633337a7b51cc66e6fe21b5953b4b59d21d1ff111111da7kernel-debug-devel-2.6.32-754.35.1.el6.x86_64.rpm47ececa334eda69e484c2a899c6cab45d08857fd8c84f5c711f4064a2e2e4d1akernel-debug-2.6.32-754.35.1.el6.x86_64.rpm215718a9ba3a5f6bdd195c05b9afc8537bf10fd584b597f188ebae4fc24efbedkernel-debug-devel-2.6.32-754.35.1.el6.i686.rpm82911fc16c01b77d9ab57dbbaaacdc21489aa6c96bd204fa4138779315283f16kernel-firmware-2.6.32-754.35.1.el6.noarch.rpm261ebda42bb7b07feafe9a41c9cd6496388092ad274663bda175b38075a9778bperf-2.6.32-754.35.1.el6.x86_64.rpm116e5d63b02f7a8b2977e93302695dad9429c61166df090eb5cea31b8800f0a7SLSA-2020:4183-1Security Fix(es): * bind: truncated TSIG response can lead to an assertion failure (CVE-2020-8622)moderateScientific Linux FermiScientific Linux Fermi 6bind-sdb-9.8.2-0.68.rc1.el6_10.8.x86_64.rpm7778fd4e617d6e75b840078e17746d0e61cb42ed85c5d2f9555232cd1489513ebind-libs-9.8.2-0.68.rc1.el6_10.8.i686.rpm96e44f398115d84ccab20b597896f01bf83641a97ab85850348fb9c9882d8066bind-devel-9.8.2-0.68.rc1.el6_10.8.x86_64.rpm2a377d769b99b43bc534ffa2add1ee3848e0d502e82609b0bc65fbbb5c25f0f9bind-9.8.2-0.68.rc1.el6_10.8.x86_64.rpmb0a12fd3a4802dddded6a9f85166cef183f596321c8123ca571e7cf57cd3c18abind-utils-9.8.2-0.68.rc1.el6_10.8.x86_64.rpm274692ef5bdb452cab90cb1975853a095b7af500df809e5e46bfecd5171754f1bind-chroot-9.8.2-0.68.rc1.el6_10.8.x86_64.rpm2279a11285bfc7f37a26bfa39bc76534229fec1f70504c7f0150d8dcdb74e27abind-devel-9.8.2-0.68.rc1.el6_10.8.i686.rpmf1d6c007de19e2138ddc190f7280255aec51331651f0077a2cb14883a9aaa193bind-libs-9.8.2-0.68.rc1.el6_10.8.x86_64.rpmc65c3a3b58cb6be99bc07a2235c6ddb77b9c8e84858e8fc917e7a89a048eb0f3SLSA-2020:4330-1Security Fix(es): * Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4 (CVE-2020-15683) * chromium-browser: Use after free in WebRTC (CVE-2020-15969)importantScientific Linux FermiScientific Linux Fermi 6firefox-78.4.0-2.el6_10.x86_64.rpm34bab3186331584d74e21db2ba257f1328247a501a720553371c7202ccc8d0c1firefox-78.4.0-2.el6_10.i686.rpm2ba2f4ee0d42c5c8f1f5814a9c6a21354292c95a1abf09b4ae6c91018cf49e0eSLSA-2020:4348-1Security Fix(es): * OpenJDK: Credentials sent over unencrypted LDAP connection (JNDI, 8237990) (CVE-2020-14781) * OpenJDK: Certificate blacklist bypass via alternate certificate encodings (Libraries, 8237995) (CVE-2020-14782) * OpenJDK: Integer overflow leading to out-of-bounds access (Hotspot, 8241114) (CVE-2020-14792) * OpenJDK: Incomplete check for invalid characters in URI to path conversion (Libraries, 8242685) (CVE-2020-14797) * OpenJDK: Race condition in NIO Buffer boundary checks (Libraries, 8244136) (CVE-2020-14803) * OpenJDK: High memory usage during deserialization of Proxy class with many interfaces (Serialization, 8236862) (CVE-2020-14779) * OpenJDK: Missing permission check in path to URI conversion (Libraries, 8242680) (CVE-2020-14796)moderateScientific Linux FermiScientific Linux Fermi 6java-1.8.0-openjdk-headless-1.8.0.272.b10-0.el6_10.x86_64.rpm9c0a5f98e62813b3e6a30ca8c903f3ee7088480dece25e32e9595ba5cb9807bfjava-1.8.0-openjdk-javadoc-debug-1.8.0.272.b10-0.el6_10.noarch.rpmf80967b523dace32996e65a5aac40e1cfa2b2996f4f251493975e53c4f9620dbjava-1.8.0-openjdk-headless-debug-1.8.0.272.b10-0.el6_10.x86_64.rpm37eb2e53839940a82eea1c09b4a54e21601bcc8bafe883219b6c6c757fb257dbjava-1.8.0-openjdk-demo-1.8.0.272.b10-0.el6_10.x86_64.rpm1a9c8d446436d6aacd08c6093347bd23a26b05ed34b3154382d7ec32dcae1c63java-1.8.0-openjdk-debug-1.8.0.272.b10-0.el6_10.x86_64.rpm989998879ce0d251c9dd943fb7fff0406a04de126e700c3ba1052612236e3a70java-1.8.0-openjdk-src-1.8.0.272.b10-0.el6_10.x86_64.rpm628ebbab774ff7af8f16cd1fa473f6cb5c928f6432e9e33ba05cc55116cf8b7ajava-1.8.0-openjdk-javadoc-1.8.0.272.b10-0.el6_10.noarch.rpm3d848e9ca71e703304c558bb4843f6ac892c281d382699a33caf822871bc80a8java-1.8.0-openjdk-devel-debug-1.8.0.272.b10-0.el6_10.x86_64.rpm586cbe80456e7375c2df56a5668012eab81e6721ddb185f6f862f65eb6d764f5java-1.8.0-openjdk-devel-1.8.0.272.b10-0.el6_10.x86_64.rpm7c49df596715a3bed201741bfb248c3ce43b328879c12a2829d022275cd9e489java-1.8.0-openjdk-1.8.0.272.b10-0.el6_10.x86_64.rpm277b8bd054df66244ae8e3bd93d1961d6b5f114e820837b7cbb51c68157f9772java-1.8.0-openjdk-demo-debug-1.8.0.272.b10-0.el6_10.x86_64.rpm95871a205effc2f6ba225ed6fa35f10f339bac0d9cf2f4f8f0796d5a3815f2c2java-1.8.0-openjdk-src-debug-1.8.0.272.b10-0.el6_10.x86_64.rpmabc01626ea6ed927e2d715ce73d3d99ec2d82381e8d8e126c8850d6d80de5d85SLSA-2020:4946-1importantScientific Linux FermiScientific Linux Fermi 6libX11-common-1.6.4-4.el6_10.noarch.rpmcc943401aa5342763c1624d94045f07d846bcf5ed5f93b752144769100b82d9dlibX11-1.6.4-4.el6_10.x86_64.rpm7028e20cc649831d81a87aaf48e3e16723db03f69977a74ab8b3de300c10b013libX11-devel-1.6.4-4.el6_10.x86_64.rpmd2bab073aebe6d9ef05d14ffa2b3a0bd27f0c850074aeec807070185143fdf0alibX11-devel-1.6.4-4.el6_10.i686.rpm68f1dfbc7ea52eaaa0793c63f6f2488bab061f0e21af1c8cd8f88ad67b030d5elibX11-1.6.4-4.el6_10.i686.rpmf7b2e35a4af10b8d9346697dba79dda970f079c7a77ce54198f3596db2926259SLSA-2020:4947-1Security Fix(es): * Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4 (CVE-2020-15683) * chromium-browser: Use after free in WebRTC (CVE-2020-15969)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-78.4.0-1.el6_10.x86_64.rpm39ea27354633b9b5939ee55fc6ef5da43085fe6c7775122862122d379822f306SLSA-2020:4953-1Security Fix(es): * xorg-x11-server: Out-of-bounds access in XkbSetNames function (CVE-2020-14345) * xorg-x11-server: Integer underflow in the X input extension protocol (CVE-2020-14346) * xorg-x11-server: XkbSelectEvents integer underflow privilege escalation vulnerability (CVE-2020-14361) * xorg-x11-server: XRecordRegisterClients integer underflow privilege escalation vulnerability (CVE-2020-14362)importantScientific Linux FermiScientific Linux Fermi 6xorg-x11-server-Xvfb-1.17.4-18.sl6_10.x86_64.rpmf52d59c9cdce91a21de04d9f681f8ad374ae71fe1a6c76f99450023871b95be4xorg-x11-server-devel-1.17.4-18.sl6_10.i686.rpm810b8bcc70516214184521857befce4baf6d3535e51e230b9c86140cd81517f7xorg-x11-server-Xdmx-1.17.4-18.sl6_10.x86_64.rpm131d150b19665a66f9be1d2fab4a9288eda475a0f867499d0837734c38d25a35xorg-x11-server-source-1.17.4-18.sl6_10.noarch.rpm15077b6f04e8b424e017e80f2ec3e2a25ae54c3cf3de956181a6a66326b0af21xorg-x11-server-common-1.17.4-18.sl6_10.x86_64.rpme73edaf26a85603db1b55c2cd685fee1f31f71f54ec33780a6179eac30071a61xorg-x11-server-devel-1.17.4-18.sl6_10.x86_64.rpm7f70fd0a9de23e51a597962dee0794760aa766a86aa3f72f884ad2e04653004fxorg-x11-server-Xephyr-1.17.4-18.sl6_10.x86_64.rpm499fa86050c694c9dc455f53b84a93f15f22374cb96288eea4d65ce5eef9b404xorg-x11-server-Xorg-1.17.4-18.sl6_10.x86_64.rpma82291850ab02a3950e609def882e951037dfe3442791976dd8989a3550e62ccxorg-x11-server-Xnest-1.17.4-18.sl6_10.x86_64.rpmb29c5e68d7d03a4a696c9d280c22b811a3abd246e9c0649e6af6491bb67adb26SLSA-2020:5084-1Security Fix(es): * hw: Vector Register Leakage-Active (CVE-2020-8696) * hw: Fast forward store predictor (CVE-2020-8698)moderateScientific Linux FermiScientific Linux Fermi 6microcode_ctl-1.17-33.31.el6_10.x86_64.rpmcdd345f1c05a89dbd9b20adcee0c411f0501700c47e7131cd41de0dd3b7e126cSLSA-2020:5104-1Security Fix(es): * Mozilla: Write side effects in MCallGetProperty opcode not accounted for (CVE-2020-26950)criticalScientific Linux FermiScientific Linux Fermi 6firefox-78.4.1-1.el6_10.x86_64.rpmb01febe522d3456a286779a4691550e86e50e9af375a76e840ee42e952df9ef4firefox-78.4.1-1.el6_10.i686.rpmd7a694205e09cdeb988f2f1dda108aa3093beb84ee59a0f4561893f0fba1d5cdSLSA-2020:5129-1Security Fix(es): * net-snmp: Improper Privilege Management in EXTEND MIB may lead to privileged commands execution (CVE-2020-15862)importantScientific Linux FermiScientific Linux Fermi 6net-snmp-perl-5.5-60.el6_10.2.x86_64.rpm173b7cbd3a9b7fd7004ed1593e160f569773e1b00b80db32c4015b109f14eaednet-snmp-libs-5.5-60.el6_10.2.i686.rpmc0c3aad58e11ebd52cd0a15fe50b7096ba65f974ce4c1210c4eeeb8816f9cdd5net-snmp-libs-5.5-60.el6_10.2.x86_64.rpm539b0f4ef0001707c1eb1427cdad7687d0eaa9746b2ca0a906cd4036a2d6f733net-snmp-python-5.5-60.el6_10.2.x86_64.rpm2e20a0abd239594058a6e515e7a34d027a65beb9861dc86e3014facf018be2c9net-snmp-5.5-60.el6_10.2.x86_64.rpm338e8a4931e9a2a73f450566b0c3db8866ef44b4702ac32922ff9c0b2043e696net-snmp-utils-5.5-60.el6_10.2.x86_64.rpm00e9b8d61007fa0647a440ffc34557c07ee84ba14b3a55c57232cf675e51be07net-snmp-devel-5.5-60.el6_10.2.i686.rpm963c5bce27f67b465c2db63793d574a1902c50438dc012fcf8fa1ba803b4e02anet-snmp-devel-5.5-60.el6_10.2.x86_64.rpm153107c98ceec365cba080a5d95f0cc2e00e27957ae7896de121c1479ed61b0cSLSA-2020:5164-1This update upgrades Thunderbird to version 78.4.3. Security Fix(es): * Mozilla: Write side effects in MCallGetProperty opcode not accounted for (CVE-2020-26950)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-78.4.3-1.el6_10.x86_64.rpm101b81ceba64abbdec6e7e0425b7fe0faefb2a8ccc63d70f0da7077dbd609e6cSLSA-2020:5238-1This update upgrades Thunderbird to version 78.5.0. Security Fix(es): * Mozilla: Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code (CVE-2020-26951) * Mozilla: Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5 (CVE-2020-26968) * Mozilla: Variable time processing of cross-origin images during drawImage calls (CVE-2020-16012) * Mozilla: Fullscreen could be enabled without displaying the security UI (CVE-2020-26953) * Mozilla: XSS through paste (manual and clipboard API) (CVE-2020-26956) * Mozilla: Requests intercepted through ServiceWorkers lacked MIME type restrictions (CVE-2020-26958) * Mozilla: Use-after-free in WebRequestService (CVE-2020-26959) * Mozilla: Potential use-after-free in uses of nsTArray (CVE-2020-26960) * Mozilla: DoH did not filter IPv4 mapped IP Addresses (CVE-2020-26961) * Mozilla: Software keyboards may have remembered typed passwords (CVE-2020-26965)importantScientific Linux FermiScientific Linux Fermi 6thunderbird-78.5.0-1.el6_10.x86_64.rpm3bdacab79eee4666d5952ae904ed17bd61fdd482f690463dd12239367c0dee95SLSA-2020:5257-1This update upgrades Firefox to version 78.5.0 ESR. Security Fix(es): * Mozilla: Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code (CVE-2020-26951) * Mozilla: Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5 (CVE-2020-26968) * Mozilla: Variable time processing of cross-origin images during drawImage calls (CVE-2020-16012) * Mozilla: Fullscreen could be enabled without displaying the security UI (CVE-2020-26953) * Mozilla: XSS through paste (manual and clipboard API) (CVE-2020-26956) * Mozilla: Requests intercepted through ServiceWorkers lacked MIME type restrictions (CVE-2020-26958) * Mozilla: Use-after-free in WebRequestService (CVE-2020-26959) * Mozilla: Potential use-after-free in uses of nsTArray (CVE-2020-26960) * Mozilla: DoH did not filter IPv4 mapped IP Addresses (CVE-2020-26961) * Mozilla: Software keyboards may have remembered typed passwords (CVE-2020-26965)importantScientific Linux FermiScientific Linux Fermi 6firefox-78.5.0-1.el6_10.x86_64.rpm2fadd48ac9c380223899da3302f085c787f9d99fccf71d676dfe3a1bc8e731c2firefox-78.5.0-1.el6_10.i686.rpm1360465ffe212a59eec9eaaac5f0a255aa23eef3f5743794bc49bfb8683ad898