Date:         Tue, 17 Nov 2009 16:07:51 -0600
Reply-To:     Troy Dawson 
Sender:       Security Errata for Scientific Linux
              
From:         Troy Dawson 
Subject:      FASTBUGS for SL 5.x i386/x86_64
Comments: To: "scientific-linux-errata@fnal.gov"
          

The following FASTBUGS have been uploaded to



         i386:
dbus-python-0.70-9.el5_4.i386.rpm
libgnomecups-0.2.2-9.i386.rpm
libgnomecups-devel-0.2.2-9.i386.rpm
man-pages-2.39-15.el5.noarch.rpm
star-1.5a75-3.i386.rpm
taskjuggler-2.2.0-5.el5.i386.rpm
vconfig-1.9-3.i386.rpm

        x86_64:
dbus-python-0.70-9.el5_4.x86_64.rpm
libgnomecups-0.2.2-9.i386.rpm
libgnomecups-0.2.2-9.x86_64.rpm
libgnomecups-devel-0.2.2-9.i386.rpm
libgnomecups-devel-0.2.2-9.x86_64.rpm
man-pages-2.39-15.el5.noarch.rpm
star-1.5a75-3.x86_64.rpm
taskjuggler-2.2.0-5.el5.x86_64.rpm
vconfig-1.9-3.x86_64.rpm


-Connie Sieh
-Troy Dawson
Date:         Mon, 23 Nov 2009 15:56:24 -0600
Reply-To:     Troy Dawson 
Sender:       Security Errata for Scientific Linux
              
From:         Troy Dawson 
Subject:      Security ERRATA Moderate: cups on SL5.x i386/x86_64
Comments: To: "scientific-linux-errata@fnal.gov"
          

Synopsis:	Moderate: cups security update
Issue date:	2009-11-18
CVE Names:	CVE-2009-2820 CVE-2009-3553

A use-after-free flaw was found in the way CUPS handled references in 
its file descriptors-handling interface. A remote attacker could, in a
specially-crafted way, query for the list of current print jobs for a
specific printer, leading to a denial of service (cupsd crash).
(CVE-2009-3553)

Several cross-site scripting (XSS) flaws were found in the way the CUPS 
web server interface processed HTML form content. If a remote attacker 
could trick a local user who is logged into the CUPS web interface into 
visiting a specially-crafted HTML page, the attacker could retrieve and 
potentially modify confidential CUPS administration data. (CVE-2009-2820)

After installing the update, the cupsd daemon will be restarted 
automatically.

NOTE: SL 5.0, 5.1 and 5.2 users.  Be sure to update rpm before doing 
this update.  You should just need to do a "yum update rpm\*"
These cups pacakges use API's found in the newer version of rpm, that 
came with SL 5.3 and above.  If you do not update rpm, then this cups 
update might stall and possibly never finish.

SL 5.x

     SRPMS:
cups-1.3.7-11.el5_4.4.src.rpm
     i386:
cups-1.3.7-11.el5_4.4.i386.rpm
cups-devel-1.3.7-11.el5_4.4.i386.rpm
cups-libs-1.3.7-11.el5_4.4.i386.rpm
cups-lpd-1.3.7-11.el5_4.4.i386.rpm
     x86_64:
cups-1.3.7-11.el5_4.4.x86_64.rpm
cups-devel-1.3.7-11.el5_4.4.i386.rpm
cups-devel-1.3.7-11.el5_4.4.x86_64.rpm
cups-libs-1.3.7-11.el5_4.4.i386.rpm
cups-libs-1.3.7-11.el5_4.4.x86_64.rpm
cups-lpd-1.3.7-11.el5_4.4.x86_64.rpm

-Connie Sieh
-Troy Dawson