deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-15427
Published: 2018-10-05
Description: A vulnerability in Cisco Video Surveillance Manager (VSM) Software running on certain Cisco Connected Safety and Security Unified Computing System (UCS) platforms could allow an unauthenticated, remote attacker to log in to an affected system by using the root account, which has default, static user credentials. The vulnerability is due to the presence of undocumented, default, static user credentials for the root account of the affected software on certain systems. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and execute arbitrary commands as the root user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: http://www.securityfocus.com/bid/105381; http://www.securitytracker.com/id/1041733; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180921-vsm
CVE: CVE-2018-15428
Published: 2018-10-05
Description: A vulnerability in the implementation of Border Gateway Protocol (BGP) functionality in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to incorrect processing of certain BGP update messages. An attacker could exploit this vulnerability by sending BGP update messages that include a specific, malformed attribute to be processed by an affected system. A successful exploit could allow the attacker to cause the BGP process to restart unexpectedly, resulting in a DoS condition. The Cisco implementation of BGP accepts incoming BGP traffic only from explicitly defined peers. To exploit this vulnerability, the malicious BGP update message would need to come from a configured, valid BGP peer, or would need to be injected by the attacker into the victim's BGP network on an existing, valid TCP connection to a BGP peer.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://www.securitytracker.com/id/1041790; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-iosxr-dos; http://www.securitytracker.com/id/1041790
CVE: CVE-2018-15429
Published: 2018-10-05
Description: A vulnerability in the web-based UI of Cisco HyperFlex HX Data Platform Software could allow an unauthenticated, remote attacker to access sensitive information on an affected system. The vulnerability is due to a lack of proper input and authorization of HTTP requests. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web-based UI of an affected system. A successful exploit could allow the attacker to access files that may contain sensitive data.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-862
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-hyperflex-uda; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-hyperflex-uda
CVE: CVE-2018-15430
Published: 2018-10-05
Description: A vulnerability in the administrative web interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to execute code with user-level privileges on the underlying operating system. The vulnerability is due to insufficient validation of the content of upgrade packages. An attacker could exploit this vulnerability by uploading a malicious archive to the Upgrade page of the administrative web interface. A successful exploit could allow the attacker to execute code with user-level privileges on the underlying operating system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securitytracker.com/id/1041784; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-express-vcs-rce; http://www.securitytracker.com/id/1041784
CVE: CVE-2018-15431
Published: 2018-10-05
Description: A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.
CVSS Score: 7.3 (HIGH)
CWE: CWE-20, CWE-787
References: http://www.securityfocus.com/bid/105520; http://www.securitytracker.com/id/1041795; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-webex-rce
CVE: CVE-2018-15432
Published: 2018-10-05
Description: A vulnerability in the server backup function of Cisco Prime Infrastructure could allow an authenticated, remote attacker to view sensitive information. The vulnerability is due to the transmission of sensitive information as part of a GET request. An attacker could exploit this vulnerability by sending a GET request to a vulnerable device. A successful exploit could allow the attacker to view sensitive information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://www.securityfocus.com/bid/105563; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-pi-id; http://www.securityfocus.com/bid/105563
CVE: CVE-2018-15433
Published: 2018-10-05
Description: A vulnerability in the server backup function of Cisco Prime Infrastructure could allow an authenticated, remote attacker to view sensitive information. The vulnerability is due to the transmission of sensitive information as part of a GET request. An attacker could exploit this vulnerability by sending a GET request to a vulnerable device. A successful exploit could allow the attacker to view sensitive information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://www.securityfocus.com/bid/105562; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-prime-id; http://www.securityfocus.com/bid/105562
CVE: CVE-2018-15434
Published: 2018-10-05
Description: A vulnerability in the web-based management interface of Cisco Unified IP Phone 7900 Series could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securitytracker.com/id/1041791; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-uipp-7900-xss; http://www.securitytracker.com/id/1041791
CVE: CVE-2018-15436
Published: 2018-10-05
Description: A vulnerability in the web-based management interface of Cisco Webex Events Center, Cisco Webex Meeting Center, Cisco Webex Support Center, and Cisco Webex Training Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected service. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected service. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/105557; http://www.securitytracker.com/id/1041793; http://www.securitytracker.com/id/1041794
CVE: CVE-2018-0404
Published: 2018-10-05
Description: A vulnerability in the web framework code for Cisco RV180W Wireless-N Multifunction VPN Router and Small Business RV Series RV220W Wireless Network Security Firewall could allow an unauthenticated, remote attacker to execute arbitrary SQL queries. The attacker could retrieve sensitive information which should be restricted. A vulnerability in the web framework code for Cisco RV180W Wireless-N Multifunction VPN Router and Small Business RV Series RV220W Wireless Network Security Firewall could allow an unauthenticated, remote attacker to execute arbitrary SQL queries. The attacker could retrieve sensitive information which should be restricted. The product has entered the end-of-life phase and there will be no more firmware fixes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvk27179; https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvk27179
CVE: CVE-2018-0464
Published: 2018-10-05
Description: A vulnerability in Cisco Data Center Network Manager software could allow an authenticated, remote attacker to conduct directory traversal attacks and gain access to sensitive files on the targeted system. The vulnerability is due to improper validation of user requests within the management interface. An attacker could exploit this vulnerability by sending malicious requests containing directory traversal character sequences within the management interface. An exploit could allow the attacker to view or create arbitrary files on the targeted system.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22, CWE-22
References: http://www.securityfocus.com/bid/105159; http://www.securitytracker.com/id/1041585; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180828-dcnm-traversal
CVE: CVE-2018-0405
Published: 2018-10-05
Description: A vulnerability in the web framework code for Cisco RV180W Wireless-N Multifunction VPN Router and Small Business RV Series RV220W Wireless Network Security Firewall could allow an unauthenticated, remote attacker to conduct a directory path traversal attack on a targeted device. The issue is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvk28019; https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvk28019
CVE: CVE-2018-18016
Published: 2018-10-05
Description: ImageMagick 7.0.7-28 has a memory leak vulnerability in WritePCXImage in coders/pcx.c.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: https://github.com/ImageMagick/ImageMagick/issues/1049; https://usn.ubuntu.com/4034-1/; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-18016
CVE: CVE-2018-11778
Published: 2018-10-05
Description: UnixAuthenticationService in Apache Ranger 1.2.0 was updated to correctly handle user input to avoid Stack-based buffer overflow. Versions prior to 1.2.0 should be upgraded to 1.2.0
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger; https://lists.apache.org/thread.html/r04bc435a92911de4b52d2b98f169bd7cf2e8bbeb53b03788df8f932c%40%3Cdev.ranger.apache.org%3E; https://lists.apache.org/thread.html/rd88077a781ef38f7687c100f93992f4dda8aa101925050c4af470998%40%3Cdev.ranger.apache.org%3E
CVE: CVE-2018-11797
Published: 2018-10-05
Description: In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.
CVSS Score: 5.5 (MEDIUM)
References: https://lists.apache.org/thread.html/645574bc50b886d39c20b4065d51ccb1cd5d3a6b4750a22edbb565eb%40%3Cannounce.apache.org%3E; https://lists.apache.org/thread.html/a9760973a873522f4d4c0a99916ceb74f361d91006b663a0a418d34a%40%3Cannounce.apache.org%3E; https://lists.apache.org/thread.html/r[PII_REDACTED]9e14c185da9662a5340a52afbbdf75d61c9c3a69c8f2e8%40%3Cdev.pdfbox.apache.org%3E
CVE: CVE-2018-11064
Published: 2018-10-05
Description: Dell EMC Unity OE versions 4.3.0.x and 4.3.1.x and UnityVSA OE versions 4.3.0.x and 4.3.1.x contains an Incorrect File Permissions vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability to alter multiple library files in service tools that might result in arbitrary code execution with elevated privileges. No user file systems are directly affected by this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: http://www.securityfocus.com/bid/105447; https://seclists.org/fulldisclosure/2018/Sep/55; http://www.securityfocus.com/bid/105447
CVE: CVE-2018-11081
Published: 2018-10-05
Description: Pivotal Operations Manager, versions 2.2.x prior to 2.2.1, 2.1.x prior to 2.1.11, 2.0.x prior to 2.0.16, and 1.11.x prior to 2, fails to write the Operations Manager UAA config onto the temp RAM disk, thus exposing the configs directly onto disk. A remote user that has gained access to the Operations Manager VM, can now file search and find the UAA credentials for Operations Manager on the system disk..
CVSS Score: 7.9 (HIGH)
References: https://pivotal.io/security/cve-2018-11081; https://pivotal.io/security/cve-2018-11081
CVE: CVE-2018-11082
Published: 2018-10-05
Description: Cloud Foundry UAA, all versions prior to 4.20.0 and Cloud Foundry UAA Release, all versions prior to 61.0, allows brute forcing of MFA codes. A remote unauthenticated malicious user in possession of a valid username and password can brute force MFA to login as the targeted user.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-307
References: https://www.cloudfoundry.org/blog/cve-2018-11082/; https://www.cloudfoundry.org/blog/cve-2018-11082/
CVE: CVE-2018-11083
Published: 2018-10-05
Description: Cloud Foundry BOSH, versions v264 prior to v264.14.0 and v265 prior to v265.7.0 and v266 prior to v266.8.0 and v267 prior to v267.2.0, allows refresh tokens to be as access tokens when using UAA for authentication. A remote attacker with an admin refresh token given by UAA can be used to access BOSH resources without obtaining an access token, even if their user no longer has access to those resources.
CVSS Score: 8.1 (HIGH)
References: https://www.cloudfoundry.org/blog/cve-2018-11083; https://www.cloudfoundry.org/blog/cve-2018-11083
CVE: CVE-2018-1264
Published: 2018-10-05
Description: Cloud Foundry Log Cache, versions prior to 1.1.1, logs its UAA client secret on startup as part of its envstruct report. A remote attacker who has gained access to the Log Cache VM can read this secret, gaining all privileges held by the Log Cache UAA client. In the worst case, if this client is an admin, the attacker would gain complete control over the Foundation.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-532
References: https://www.cloudfoundry.org/blog/cve-2018-1264/; https://www.cloudfoundry.org/blog/cve-2018-1264/
CVE: CVE-2018-13042
Published: 2018-10-05
Description: The 1Password application 6.8 for Android is affected by a Denial Of Service vulnerability. By starting the activity com.agilebits.onepassword.filling.openyolo.OpenYoloDeleteActivity or com.agilebits.onepassword.filling.openyolo.OpenYoloRetrieveActivity from an external application (since they are exported), it is possible to crash the 1Password instance.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: https://app-updates.agilebits.com/product_history/OPA4; https://www.exploit-db.com/exploits/46165/; https://www.valbrux.it/blog/2019/01/22/cve-2018-13042-1password-android-7-0-denial-of-service/
CVE: CVE-2018-15763
Published: 2018-10-05
Description: Pivotal Container Service, versions prior to 1.2.0, contains an information disclosure vulnerability which exposes IaaS credentials to application logs. A malicious user with access to application logs may be able to obtain IaaS credentials and perform actions using these credentials.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-532
References: https://pivotal.io/security/cve-2018-15763; https://pivotal.io/security/cve-2018-15763
CVE: CVE-2018-17456
Published: 2018-10-06
Description: Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-88
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html; http://packetstormsecurity.com/files/152173/Sourcetree-Git-Arbitrary-Code-Execution-URL-Handling.html; http://www.securityfocus.com/bid/105523
CVE: CVE-2018-18020
Published: 2018-10-06
Description: In QPDF 8.2.1, in libqpdf/QPDFWriter.cc, QPDFWriter::unparseObject and QPDFWriter::unparseChild have recursive calls for a long time, which allows remote attackers to cause a denial of service via a crafted PDF file.
CVSS Score: 3.3 (LOW)
CWE: CWE-674
References: https://github.com/qpdf/qpdf/issues/243; https://lists.debian.org/debian-lts-announce/2023/08/msg00037.html; https://github.com/qpdf/qpdf/issues/243
CVE: CVE-2[PII_REDACTED]
Published: 2018-10-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2018-17074.  Reason: This candidate is a reservation duplicate of CVE-2018-17074.  Notes: All CVE users should reference CVE-2018-17074 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2018-18021
Published: 2018-10-07
Description: arch/arm64/kvm/guest.c in KVM in the Linux kernel before 4.18.12 on the arm64 platform mishandles the KVM_SET_ON_REG ioctl. This is exploitable by attackers who can create virtual machines. An attacker can arbitrarily redirect the hypervisor flow of control (with full register control). An attacker can also cause a denial of service (hypervisor panic) via an illegal exception return. This occurs because of insufficient restrictions on userspace access to the core register file, and because PSTATE.M validation does not prevent unintended execution modes.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2a3f93459d689d990b3ecfbe782fec89b97d3279; http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d26c25a9d19b5976b319af528886f89cf455692d; http://www.securityfocus.com/bid/105550
CVE: CVE-2015-9273
Published: 2018-10-07
Description: The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated with JavaScript-based Referer tracking.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://plugins.svn.wordpress.org//wp-slimstat/tags/4.1.6.1/readme.txt; https://plugins.trac.wordpress.org/changeset/1204104; https://www.openwall.com/lists/oss-security/2015/07/30/1
CVE: CVE-2012-6710
Published: 2018-10-07
Description: ext_find_user in eXtplorer through 2.1.2 allows remote attackers to bypass authentication via a password[]= (aka an empty array) in an action=login request to index.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://itsecuritysolutions.org/2012-12-31-eXtplorer-v2.1-authentication-bypass-vulnerability; http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201212-371; https://www.securityfocus.com/bid/57058
CVE: CVE-2018-18023
Published: 2018-10-07
Description: In ImageMagick 7.0.8-13 Q16, there is a heap-based buffer over-read in the SVGStripString function of coders/svg.c, which allows attackers to cause a denial of service via a crafted SVG image file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/ImageMagick/ImageMagick/issues/1336; https://usn.ubuntu.com/4034-1/; https://github.com/ImageMagick/ImageMagick/issues/1336
CVE: CVE-2018-18024
Published: 2018-10-07
Description: In ImageMagick 7.0.8-13 Q16, there is an infinite loop in the ReadBMPImage function of the coders/bmp.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: https://github.com/ImageMagick/ImageMagick/issues/1337; https://lists.debian.org/debian-lts-announce/2020/08/msg00030.html; https://usn.ubuntu.com/4034-1/
CVE: CVE-2018-18025
Published: 2018-10-07
Description: In ImageMagick 7.0.8-13 Q16, there is a heap-based buffer over-read in the EncodeImage function of coders/pict.c, which allows attackers to cause a denial of service via a crafted SVG image file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/ImageMagick/ImageMagick/issues/1335; https://lists.debian.org/debian-lts-announce/2018/11/msg00014.html; https://lists.debian.org/debian-lts-announce/2020/09/msg00007.html
CVE: CVE-2018-14810
Published: 2018-10-08
Description: WECON Technology Co., Ltd. PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior parse files and pass invalidated user data to an unsafe method call, which may allow code to be executed in the context of an administrator.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://ics-cert.us-cert.gov/advisories/ICSA-18-277-01; https://ics-cert.us-cert.gov/advisories/ICSA-18-277-01
CVE: CVE-2018-14818
Published: 2018-10-08
Description: WECON Technology Co., Ltd. PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior have a stack-based buffer overflow vulnerability which may allow remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://ics-cert.us-cert.gov/advisories/ICSA-18-277-01; https://ics-cert.us-cert.gov/advisories/ICSA-18-277-01
CVE: CVE-2018-17889
Published: 2018-10-08
Description: In WECON Technology Co., Ltd. PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior when parsing project files, the XMLParser that ships with Wecon PIStudio is vulnerable to a XML external entity injection attack, which may allow sensitive information disclosure.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://ics-cert.us-cert.gov/advisories/ICSA-18-277-01; https://ics-cert.us-cert.gov/advisories/ICSA-18-277-01
CVE: CVE-2[PII_REDACTED]
Published: 2018-10-08
Description: Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. This attack appear to be exploitable via Watch a repository to receive email notifications. Emails received contain the other recipients even if they have the email set as private. This vulnerability appears to have been fixed in 1.5.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/go-gitea/gitea/pull/4664; https://github.com/go-gitea/gitea/pull/4664/files#diff-146e0c2b5bb1ea96c9fb73d509456e57; https://github.com/go-gitea/gitea/pull/4664
CVE: CVE-2[PII_REDACTED]
Published: 2018-10-08
Description: contiki-ng version 4 contains a Buffer Overflow vulnerability in AQL (Antelope Query Language) database engine that can result in Attacker can perform Remote Code Execution on device using Contiki-NG operating system. This attack appear to be exploitable via Attacker must be able to run malicious AQL code (e.g. via SQL-like Injection attack).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://github.com/contiki-ng/contiki-ng/issues/594; https://github.com/contiki-ng/contiki-ng/pull/624; https://github.com/contiki-ng/contiki-ng/issues/594
CVE: CVE-2[PII_REDACTED]
Published: 2018-10-08
Description: Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via network connectivity.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://access.redhat.com/errata/RHBA-2018:3497; https://access.redhat.com/errata/RHSA-2018:3347; https://access.redhat.com/errata/RHSA-2018:3406