Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
3752-2/ - https://access.redhat.com/errata/RHSA-2018:3083 - https://usn.ubuntu.com/3752-3/ - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10881 - http://patchwork.ozlabs.org/patch/929792/ - https://usn.ubuntu.com/3753-2/ - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6e8ab72a812396996035a37e5ca4b3b99b5d214b - http://www.securityfocus.com/bid/104901 - https://usn.ubuntu.com/3754-1/ - https://lists.debian.org/debian-lts-announce/2018/07/msg00020.html - https://access.redhat.com/errata/RHSA-2018:2948 - https://bugzilla.kernel.org/show_bug.cgi?id=200015 - https://usn.ubuntu.com/3752-1/ - https://access.redhat.com/errata/RHSA-2018:3096 - https://usn.ubuntu
ug.cgi?id=200015 - https://usn.ubuntu.com/3752-1/ - https://access.redhat.com/errata/RHSA-2018:3096 - https://usn.ubuntu.com/3753-1/
CVE ID: CVE-2018-10882 State: PUBLISHED Published: 2018-07-27T18:00:00 Last Updated: 2024-08-05T07:54:34.712Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: [UNKNOWN] Products: kernel Problem Types: CWE-787 Description: A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound write in in fs/jbd2/transaction.c code, a denial of service, and a system crash by unmounting a crafted ext4 filesystem image. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10882 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c37e9e013469521d9ad
gi?id=CVE-2018-10882 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c37e9e013469521d9adb932d17a1795c139b36db - https://usn.ubuntu.com/3753-2/ - https://usn.ubuntu.com/3871-5/ - https://usn.ubuntu.com/3871-4/ - https://lists.debian.org/debian-lts-announce/2018/07/msg00020.html - https://access.redhat.com/errata/RHSA-2018:2948 - https://bugzilla.kernel.org/show_bug.cgi?id=200069 - https://usn.ubuntu.com/3871-1/ - http://www.securityfocus.com/bid/106503 - https://usn.ubuntu.com/3753-1/ - https://usn.ubuntu.com/3871-3/
CVE ID: CVE-2018-10883 State: PUBLISHED Published: 2018-07-30T15:00:00 Last Updated: 2024-08-05T07:54:34.854Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: [UNKNOWN] Products: kernel Problem Types: CWE-787 Description: A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write in jbd2_journal_dirty_metadata(), a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3083 - https://usn.ubuntu.com/3879-2/ - https://usn.ubuntu.com/3879-1/ - https://bugzilla.redhat.co
com/errata/RHSA-2018:3083 - https://usn.ubuntu.com/3879-2/ - https://usn.ubuntu.com/3879-1/ - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10883 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e09463f220ca9a1a1ecfda84fcda658f99a1f12a - https://usn.ubuntu.com/3871-5/ - https://usn.ubuntu.com/3871-4/ - https://lists.debian.org/debian-lts-announce/2018/07/msg00020.html - https://access.redhat.com/errata/RHSA-2018:2948 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8bc1379b82b8e809eef77a9fedbb75c6c297be19 - https://usn.ubuntu.com/3871-1/ - https://access.redhat.com/errata/RHSA-2018:3096 - https://usn.ubuntu.com/3871-3/ - ht
- https://usn.ubuntu.com/3871-1/ - https://access.redhat.com/errata/RHSA-2018:3096 - https://usn.ubuntu.com/3871-3/ - https://support.f5.com/csp/article/K94735334?utm_source=f5support&amp%3Butm_medium=RSS
CVE ID: CVE-2018-10884 State: PUBLISHED Published: 2018-08-22T14:00:00 Last Updated: 2024-08-05T07:54:34.882Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: ansible-tower Problem Types: CWE-352 Description: Ansible Tower before versions 3.1.8 and 3.2.6 is vulnerable to cross-site request forgery (CSRF) in awx/api/authentication.py. An attacker could exploit this by tricking already authenticated users into visiting a malicious site and hijacking the authtoken cookie. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105136 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10884
CVE ID: CVE-2018-10885 State: PUBLISHED Published: 2018-07-05T13:00:00 Last Updated: 2024-08-05T07:54:34.734Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: [UNKNOWN] Products: atomic-openshift Problem Types: CWE-20 Description: In atomic-openshift before version 3.10.9 a malicious network-policy configuration can cause Openshift Routing to crash when using ovs-networkpolicy plugin. An attacker can use this flaw to cause a Denial of Service (DoS) attack on an Openshift 3.9, or 3.7 Cluster. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10885 - http://www.securityfocus.com/bid/104688
CVE ID: CVE-2018-10886 State: REJECTED Published: 2018-07-16T19:00:00 Last Updated: 2018-07-25T13:57:01 Description: No description available.
CVE ID: CVE-2018-10887 State: PUBLISHED Published: 2018-07-10T14:00:00Z Last Updated: 2024-09-17T01:06:07.091Z Vendors: libgit2 Products: libgit2 Problem Types: CWE-194 Description: A flaw was found in libgit2 before version 0.27.3. It has been discovered that an unexpected sign extension in git_delta_apply function in delta.c file may lead to an integer overflow which in turn leads to an out of bound read, allowing to read before the base object. An attacker may use this flaw to leak memory addresses or cause a Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1598021 - https://lists.debian.org/debian-lts-announce
tainer: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1598021 - https://lists.debian.org/debian-lts-announce/2018/08/msg00024.html - https://github.com/libgit2/libgit2/releases/tag/v0.27.3 - https://github.com/libgit2/libgit2/commit/c1577110467b701dcbcf9439ac225ea851b47d22 - https://github.com/libgit2/libgit2/commit/3f461902dc1072acb8b7607ee65d0a0458ffac2a - https://lists.debian.org/debian-lts-announce/2022/03/msg00031.html
CVE ID: CVE-2018-10888 State: PUBLISHED Published: 2018-07-10T14:00:00Z Last Updated: 2024-09-16T16:18:17.644Z Vendors: libgit2 Products: libgit2 Problem Types: CWE-20 Description: A flaw was found in libgit2 before version 0.27.3. A missing check in git_delta_apply function in delta.c file, may lead to an out-of-bound read while reading a binary delta file. An attacker may use this flaw to cause a Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libgit2/libgit2/commit/9844d38bed10e9ff17174434b3421b227ae710f3 - https://lists.debian.org/debian-lts-announce/2018/08/msg00024.html - https://github.com/libgit2/libgit2/releases/tag/v0.27.3 - ht
ists.debian.org/debian-lts-announce/2018/08/msg00024.html - https://github.com/libgit2/libgit2/releases/tag/v0.27.3 - https://bugzilla.redhat.com/show_bug.cgi?id=1598024 - https://lists.debian.org/debian-lts-announce/2022/03/msg00031.html
CVE ID: CVE-2018-10889 State: PUBLISHED Published: 2018-07-10T18:00:00 Last Updated: 2024-08-05T07:54:34.784Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: [UNKNOWN] Products: moodle Problem Types: CWE-532 Description: A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7. No option existed to omit logs from data privacy exports, which may contain details of other users who interacted with the requester. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104733 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10889 - https://moodle.org/mod/forum/discuss.php?d=373369
CVE ID: CVE-2018-10890 State: PUBLISHED Published: 2018-07-10T18:00:00 Last Updated: 2024-08-05T07:54:35.431Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: [UNKNOWN] Products: moodle Problem Types: CWE-200 Description: A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. It was possible for the core_course_get_categories web service to return hidden categories, which should be omitted when fetching course categories. Additional Analyst Notes: - CVE Program Container: References: - https://moodle.org/mod/forum/discuss.php?d=373370 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10890 - http://www.securityfocus.com/bid/104738
CVE ID: CVE-2018-10891 State: PUBLISHED Published: 2018-07-10T18:00:00 Last Updated: 2024-08-05T07:54:34.734Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: [UNKNOWN] Products: moodle Problem Types: CWE-20 Description: A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. When a quiz question bank is imported, it was possible for the question preview that is displayed to execute JavaScript that is written into the question bank. Additional Analyst Notes: - CVE Program Container: References: - https://moodle.org/mod/forum/discuss.php?d=373371 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10891 - http://www.securityfocus.com/bid/104
discuss.php?d=373371 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10891 - http://www.securityfocus.com/bid/104739
CVE ID: CVE-2018-10892 State: PUBLISHED Published: 2018-07-06T16:00:00 Last Updated: 2024-08-05T07:54:34.913Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: [UNKNOWN] Products: docker Problem Types: CWE-250 Description: The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling bluetooth or turning up/down keyboard brightness. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/moby/moby/pull/37404 - https://access.redhat.com/errata/RHSA-2018:2729 - https://access.redhat.com/errata/
://github.com/moby/moby/pull/37404 - https://access.redhat.com/errata/RHSA-2018:2729 - https://access.redhat.com/errata/RHSA-2018:2482 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10892 - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html - https://access.redhat.com/errata/RHBA-2018:2796
CVE ID: CVE-2018-10893 State: PUBLISHED Published: 2018-09-11T15:00:00 Last Updated: 2024-08-05T07:54:34.900Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L) Vendors: Red Hat Products: spice-client Problem Types: CWE-122, CWE-190 Description: Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames. A malicious server could cause the client to crash or, potentially, execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10893 - https://lists.freedesktop.org/archives/spice-devel/2018-July/044489.html - https://access.redha
.cgi?id=CVE-2018-10893 - https://lists.freedesktop.org/archives/spice-devel/2018-July/044489.html - https://access.redhat.com/errata/RHSA-2019:2229 - https://access.redhat.com/errata/RHSA-2020:0471
CVE ID: CVE-2018-10894 State: PUBLISHED Published: 2018-08-01T17:00:00 Last Updated: 2024-08-05T07:54:34.911Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Red Hat Products: keycloak Problem Types: CWE-345 Description: It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. A malicious user could use this to access unauthorized data or possibly conduct further attacks. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3592 - https://access.redhat.com/errata/RHSA-2018:3593 - https://access.redhat.com/errata/RHSA-2018:3595 - https://bugzilla.redhat
ps://access.redhat.com/errata/RHSA-2018:3593 - https://access.redhat.com/errata/RHSA-2018:3595 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10894 - https://access.redhat.com/errata/RHSA-2019:0877
CVE ID: CVE-2018-10895 State: PUBLISHED Published: 2018-07-12T12:00:00 Last Updated: 2024-08-05T07:54:36.258Z Severity: CRITICAL (CVSS 9.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: qutebrowser Products: cross-site request forgery flaw allows sites to access 'qute Problem Types: CWE-352 Description: qutebrowser before version 1.4.1 is vulnerable to a cross-site request forgery flaw that allows websites to access 'qute://*' URLs. A malicious website could exploit this to load a 'qute://settings/set' URL, which then sets 'editor.command' to a bash script, resulting in arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/quteb
g in arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/qutebrowser/qutebrowser/commit/43e58ac865ff862c2008c510fc5f7627e10b4660 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10895 - http://www.openwall.com/lists/oss-security/2018/07/11/7
CVE ID: CVE-2018-10896 State: PUBLISHED Published: 2018-08-01T17:00:00 Last Updated: 2024-08-05T07:54:36.167Z Severity: MEDIUM (CVSS 4.6 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Canonical Products: cloud-init Problem Types: CWE-321 Description: The default cloud-init configuration, in cloud-init 0.6.2 and newer, included "ssh_deletekeys: 0", disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one another or conduct man-in-the-middle attacks. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.r
r conduct man-in-the-middle attacks. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10896 - https://bugs.launchpad.net/cloud-init/+bug/1781094 - https://bugzilla.redhat.com/show_bug.cgi?id=1574338
CVE ID: CVE-2018-10897 State: PUBLISHED Published: 2018-08-01T17:00:00 Last Updated: 2024-08-05T07:54:34.911Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: The RPM Project Products: yum-utils: Problem Types: CWE-59 Description: A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configuration files. If an attacker controls a repository, they may be able to copy files outside of the destination directory on the targeted system via path traversal. If reposync is running with heightened privileges on a targeted system, this flaw could potentially result in system compromise via the
unning with heightened privileges on a targeted system, this flaw could potentially result in system compromise via the overwriting of critical system files. Version 1.1.31 and older are believed to be affected. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1041594 - https://access.redhat.com/errata/RHSA-2018:2285 - https://access.redhat.com/errata/RHSA-2018:2284 - https://github.com/rpm-software-management/yum-utils/commit/6a8de061f8fdc885e74ebe8c94625bf53643b71c - https://access.redhat.com/errata/RHSA-2018:2626 - https://github.com/rpm-software-management/yum-utils/commit/7554c0133eb830a71dc01846037cc047d0acbc2c - https://bugzilla.redhat
//github.com/rpm-software-management/yum-utils/commit/7554c0133eb830a71dc01846037cc047d0acbc2c - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10897 - https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0 - https://github.com/rpm-software-management/yum-utils/pull/43
CVE ID: CVE-2018-10898 State: PUBLISHED Published: 2018-07-30T16:00:00 Last Updated: 2024-08-05T07:54:34.730Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: [UNKNOWN] Products: openstack-tripleo-heat-templates Problem Types: CWE-798 Description: A vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40. When deployed using Director using default configuration, Opendaylight in RHOSP13 is configured with easily guessable default credentials. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:2214 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10898
CVE ID: CVE-2018-10899 State: PUBLISHED Published: 2019-08-01T13:27:13 Last Updated: 2024-08-05T07:54:35.783Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: jolokia Products: jolokia Problem Types: CWE-20 Description: A flaw was found in Jolokia versions from 1.2 to before 1.6.1. Affected versions are vulnerable to a system-wide CSRF. This holds true for properly configured instances with strict checking for origin and referrer headers. This could result in a Remote Code Execution attack. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10899 - https://jolokia.org/changes-report.html#a1.6.1
ferences: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10899 - https://jolokia.org/changes-report.html#a1.6.1 - https://access.redhat.com/errata/RHSA-2019:2413 - https://access.redhat.com/errata/RHSA-2019:2804 - https://lists.apache.org/thread.html/1392fbebb4fbbec379a40d16e1288fe1e4c0289d257e5206051a3793%40%3Cissues.activemq.apache.org%3E - https://lists.apache.org/thread.html/rc169dac018d07e8ddf2a3bb2fd1efc6cbda4f83f1bbf7a8c798e7f4f%40%3Cissues.activemq.apache.org%3E - https://lists.apache.org/thread.html/rf33ffbba619a4281ce592a6ed259c07a557aefb4975619d83c4122ea%40%3Cissues.activemq.apache.org%3E - https://lists.apache.org/thread.html/rdb0a59d7851e721b75beea13d6488e345a3e2735838e8
40%3Cissues.activemq.apache.org%3E - https://lists.apache.org/thread.html/rdb0a59d7851e721b75beea13d6488e345a3e2735838e89d9269d7d32%40%3Cissues.activemq.apache.org%3E - https://lists.apache.org/thread.html/r64701caec91c43efd7416d6bddef88447371101e00e8562741ede262%40%3Cissues.activemq.apache.org%3E - https://lists.apache.org/thread.html/r46f6dbc029f49e1f638c6eb82accb94b7f990d818cb3b3bc0007dd0a%40%3Cissues.activemq.apache.org%3E - https://lists.apache.org/thread.html/r67cdc50af9caf89c9ebe1bde08393a343dcd89edba1c63677f68f43b%40%3Cissues.activemq.apache.org%3E
CVE ID: CVE-2018-10900 State: PUBLISHED Published: 2018-07-26T15:00:00 Last Updated: 2024-08-05T07:54:36.169Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: [UNKNOWN] Products: networkmanager-vpnc Problem Types: CWE-78 Description: Network Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a privilege escalation attack. A new line character can be used to inject a Password helper parameter into the configuration data passed to VPNC, allowing an attacker to execute arbitrary commands as root. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4253 - https://security.gentoo.
t Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4253 - https://security.gentoo.org/glsa/201808-03 - https://lists.debian.org/debian-lts-announce/2018/07/msg00048.html - https://www.exploit-db.com/exploits/45313/ - https://pulsesecurity.co.nz/advisories/NM-VPNC-Privesc - https://gitlab.gnome.org/GNOME/NetworkManager-vpnc/commit/07ac18a32b4 - https://bugzilla.novell.com/show_bug.cgi?id=1101147 - https://download.gnome.org/sources/NetworkManager-vpnc/1.2/NetworkManager-vpnc-1.2.6.news - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10900
CVE ID: CVE-2018-10901 State: PUBLISHED Published: 2018-07-26T17:00:00 Last Updated: 2024-08-05T07:54:35.810Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: [UNKNOWN] Products: kernel: Problem Types: CWE-665 Description: A flaw was found in Linux kernel's KVM virtualization subsystem. The VMX code does not restore the GDT.LIMIT to the previous host value, but instead sets it to 64KB. With a corrupted GDT limit a host's userspace code has an ability to place malicious entries in the GDT, particularly to the per-cpu variables. An attacker can use this to escalate their privileges. Additional Analyst Notes: - CVE Program Container: References: - http://www.secur
use this to escalate their privileges. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104905 - https://access.redhat.com/errata/RHSA-2018:2393 - https://access.redhat.com/errata/RHSA-2018:2390 - https://access.redhat.com/errata/RHSA-2018:2391 - https://access.redhat.com/errata/RHSA-2018:2392 - https://access.redhat.com/errata/RHSA-2018:2394 - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0 - https://git.kernel.org/pub/scm/linux/kernel/git/torval
DCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3444d7da1839b851eefedd372978d8a982316c36 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10901
CVE ID: CVE-2018-10902 State: PUBLISHED Published: 2018-08-21T19:00:00 Last Updated: 2024-08-05T07:54:35.823Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: [UNKNOWN] Products: kernel Problem Types: CWE-416 Description: It was found that the raw midi kernel driver does not protect against concurrent access which leads to a double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status() which are part of snd_rawmidi_ioctl() handler in rawmidi.c file. A malicious local attacker could possibly use this for privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3
scalation. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3083 - https://usn.ubuntu.com/3776-1/ - https://usn.ubuntu.com/3776-2/ - https://usn.ubuntu.com/3847-1/ - https://lists.debian.org/debian-lts-announce/2018/10/msg00003.html - https://usn.ubuntu.com/3847-2/ - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10902 - https://usn.ubuntu.com/3849-1/ - https://access.redhat.com/errata/RHSA-2019:0415 - https://usn.ubuntu.com/3849-2/ - http://www.securitytracker.com/id/1041529 - https://www.debian.org/security/2018/dsa-4308 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=39675f7a7c7e7702f7d5341f1e
2018/dsa-4308 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=39675f7a7c7e7702f7d5341f1e0d01db746543a0 - https://usn.ubuntu.com/3847-3/ - https://access.redhat.com/errata/RHSA-2018:3096 - http://www.securityfocus.com/bid/105119 - https://access.redhat.com/errata/RHSA-2019:0641 - https://access.redhat.com/errata/RHSA-2019:3217 - https://access.redhat.com/errata/RHSA-2019:3967
CVE ID: CVE-2018-10903 State: PUBLISHED Published: 2018-07-30T15:00:00 Last Updated: 2024-08-05T07:54:36.330Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: [UNKNOWN] Products: python-cryptography Problem Types: CWE-20 Description: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage. Additional Analyst Not