huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Integer overflow in shuffle leads to DoS
CVE: CVE-2023-34453
Component: snappy-java
CWE: CWE-190
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-06-15T00:00:00+00:00

A flaw was found in Snappy-java's shuffle function, which does not check input sizes before beginning operations. This issue could allow an attacker to send malicious input to trigger an overflow error that crashes the program, resulting in a denial of service.


Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link (you must log in to download the update).
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
CVE: CVE-2023-52685
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

[REJECTED CVE] In the Linux kernel, the following vulnerability has been resolved:

pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()

The Linux kernel CVE team has assigned CVE-2023-52685 to this issue.

Statement: This CVE has been rejected upstream: https://lore.kernel.org/linux-cve-announce/2024061855-REJECTED-ba28@gregkh/

Remediation:
TinyMCE loaders susceptible to Arbitrary Folder Creation
CVE: CVE-2023-30943
Component: moodle
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Release date: 2023-05-01T04:00:00+00:00

The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Cleaning an ECS-enabled cache may cause excessive CPU load
CVE: CVE-2023-5680
Component: bind9
CWE: CWE-400
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2023-01-01T00:00:00+00:00

A flaw was found in the bind9 package. This issue may allow an attacker to substantially decrease `named` performance by sending a specific set of queries, forcing the same name to have a large number of ECS records stored. In the worst case scenario, `named` can become unresponsive, leading to a Denial of Service.

Statement: The versions of bind9 shipped with Red Hat Enterprise Linux 6, 7, 8 and 9 are not affected by this vulnerability as it doesn't contain the vulnerable code. This CVE only impacts the "-S" versions of bind9 package, which are different in code base than the ones distributed in Red Hat products.

Remediation:
tty: serial: fsl_lpuart: fix race on RX DMA shutdown
CVE: CVE-2023-53094
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

tty: serial: fsl_lpuart: fix race on RX DMA shutdown

From time to time DMA completion can come in the middle of DMA shutdown:

<process ctx>:				<IRQ>:
lpuart32_shutdown()
  lpuart_dma_shutdown()
    del_timer_sync()
					lpuart_dma_rx_complete()
					  lpuart_copy_rx_to_tty()
					    mod_timer()
    lpuart_dma_rx_free()

When the timer fires a bit later, sport->dma_rx_desc is NULL:

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004
pc : lpuart_copy_rx_to_tty+0xcc/0x5bc
lr : lpuart_timer_func+0x1c/0x2c
Call trace:
 lpuart_copy_rx_to_tty
 lpuart_timer_func
 call_timer_fn
 __run_timers.part.0
 run_timer_softirq
 __do_softirq
 __irq_exit_rcu
 irq_exit
 handle_domain_irq
 gic_handle_irq
 call_on_irq_stack
 do_interrupt_handler
 ...

To fix this fold del_timer_sync() into lpuart_dma_rx_free() after
dmaengine_terminate_sync() to make sure timer will not be re-started in
lpuart_copy_rx_to_tty() <= lpuart_dma_rx_complete().


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
CVE: CVE-2023-51553
Component: Foxit PDF Reader Bookmark Out-Of-Bounds Read Information Disclosure Vulnerability
Release date: 2023-12-20T23:07:08.298000+00:00

Foxit PDF Reader Bookmark Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Bookmark objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22110.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Reachable assertion in avahi_escape_label
CVE: CVE-2023-38470
Component: avahi
CWE: CWE-617
Severity: Moderate
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-04-26T00:00:00+00:00

A vulnerability was found in Avahi. A reachable assertion exists in the avahi_escape_label() function.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, avahi-daemon will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, avahi-daemon will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, avahi-daemon will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, avahi-daemon will be restarted automatically.
SMB clients can truncate files with read-only permissions
CVE: CVE-2023-4091
Component: samba
CWE: CWE-276
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Release date: 2023-10-10T00:00:00+00:00

A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xattr" is configured with "acl_xattr:ignore system acls = yes". The SMB protocol allows opening files when the client requests read-only access but then implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create disposition request. The issue arises in configurations that bypass kernel file system permissions checks, relying solely on Samba's permissions.

Statement: The vulnerability primarily affects Samba configurations using the "acl_xattr" module with the "acl_xattr:ignore system acls = yes" setting.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the smb service will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the smb service will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the smb service will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the smb service will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the smb service will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the smb service will be restarted automatically.
The vulnerability is most commonly associated with the "acl_xattr" module and can be mitigated by setting:
~~~
"acl_xattr:ignore system acls = no"
~~~
Secrets can be unmasked in the "Rendered Template"
CVE: CVE-2023-40712
Component: Airflow
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Release date: 2023-09-12T00:00:00+00:00

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be masked in the UI.

Users are strongly advised to upgrade to version 2.7.1 or later which has removed the vulnerability.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
serial: 8250_bcm7271: fix leak in `brcmuart_probe`
CVE: CVE-2023-54301
Component: kernel
CWE: CWE-772
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2023-01-01T00:00:00+00:00

A resource leak flaw was found in the Broadcom BCM7271 serial driver. In the brcmuart_probe() function, the baud_mux_clk clock is prepared and enabled but not released in error paths, causing a clock resource leak when driver probe fails.

Statement: This affects only Broadcom BCM7271 platforms using the 8250_bcm7271 serial driver. The leak occurs only during failed probe operations, not during normal runtime. Standard x86 systems and most ARM platforms are unaffected.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Multiple vulnerabilities
CVE: CVE-2023-51103
Component: mupdf
Release date: 2023-12-26T00:00:00+00:00

A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF 1.23.4 in the function fz_new_pixmap_from_float_data() of pixmap.c.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
irqchip: Fix refcount leak in platform_irqchip_probe
CVE: CVE-2023-53610
Component: kernel
CWE: CWE-772
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

irqchip: Fix refcount leak in platform_irqchip_probe

of_irq_find_parent() returns a node pointer with refcount incremented,
We should use of_node_put() on it when not needed anymore.
Add missing of_node_put() to avoid refcount leak.


Remediation:
nommu: fix memory leak in do_mmap() error path
CVE: CVE-2023-52902
Component: kernel
CWE: CWE-401
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nommu: fix memory leak in do_mmap() error path

The preallocation of the maple tree nodes may leak if the error path to
"error_just_free" is taken.  Fix this by moving the freeing of the maple
tree nodes to a shared location for all error paths.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
powerpc: Fix access beyond end of drmem array
CVE: CVE-2023-52451
Component: kernel
CWE: CWE-125
Severity: Moderate
CVSS v3: 7.2/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Release date: 2023-01-01T00:00:00+00:00

A flaw was found in the Linux kernel, specifically affecting the PowerPC architecture's pseries memory hotplug functionality. The issue arises from the dlpar_memory_remove_by_index() function, which may access memory beyond the bounds of the drmem logical memory block (LMB) array when it fails to find a matching entry for a given Dynamic Reconfiguration Connector (DRC) index. This out-of-bounds access can lead to unintended behavior, including potential system crashes or exposure of sensitive information.

Statement: The vulnerability was discovered through code inspection and confirmed using Kernel Address Sanitizer (KASAN) tools. To address this issue, the Linux kernel has been updated to ensure that failed lookups are logged separately, and pointers are dereferenced only when they point to valid entries.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
No mitigation is currently available for this vulnerability. Make sure to perform the updates as they become available.
Multiple CVEs published by Talos
CVE: CVE-2023-35995
Component: gtkwave
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2023-01-01T00:00:00+00:00

Multiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the tdelta indexing when signal_lens is 1.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2023-50196
Component: Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability
Release date: 2023-12-20T20:57:29.778000+00:00

Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21800.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Open redirect vulnerability in OpenShift Login Plugin
CVE: CVE-2023-37947
Component: Jenkins
CWE: CWE-601
Severity: Moderate
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Release date: 2023-07-12T00:00:00+00:00

A flaw was found in the Jenkins OpenShift Login Plugin. Affected versions of this plugin could allow a remote attacker to conduct phishing attacks caused by an open redirect vulnerability. An attacker can use a specially crafted URL to redirect a victim to arbitrary web sites.


Remediation:
negative-size-param in URIParser::parse
CVE: CVE-2023-33457
Component: workflow
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Release date: 2023-06-06T00:00:00+00:00

In Sogou Workflow v0.10.6, memcpy a negtive size in URIParser::parse , may cause buffer-overflow and crash.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
OOB write in SMB decoder
CVE: CVE-2023-1801
Component: tcpdump
CWE: CWE-787
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2023-04-07T00:00:00+00:00

A vulnerability was found in the tcpdump tool. This issue allows the SMB protocol decoder in tcpdump to perform an out-of-bounds write when decoding a crafted network packet.


Remediation:
x86/reboot: VMCLEAR active VMCSes before emergency reboot
CVE: CVE-2023-52514
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

A flaw was found in the Linux Kernel's x86/reboot: VMCLEAR active VMCSes before emergency reboot.

Statement: This CVE has been rejected by upstream.

Remediation:
SEGV on PackLinuxElf64::invert_pt_dynamic() in p_lx_elf.cpp
CVE: CVE-2023-23457
Component: upx
CVSS v3: 5.2/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2023-01-01T00:00:00+00:00

A Segmentation fault was found in UPX in PackLinuxElf64::invert_pt_dynamic() in p_lx_elf.cpp. An attacker with a crafted input file allows invalid memory address access that could lead to a denial of service.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
use-after-free in function bt_quickfix
CVE: CVE-2023-4750
Component: vim
CWE: CWE-416
Severity: Low
CVSS v3: 6.9/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2023-09-04T00:00:00+00:00

A flaw was found in Vim, where it is vulnerable to a use-after-free in the bt_quickfix function. This flaw allows a specially crafted file to crash software, use unexpected values, or possibly execute code when opened in Vim.

Statement: Red Hat Product Security has rated this issue as having a Low security impact, because the "victim" has to run an untrusted file IN SCRIPT MODE. Someone who is running untrusted files in script mode is equivalent to someone just taking a random python script and running it.

Remediation:
CVE: CVE-2023-40483
Component: Maxon Cinema 4D SKP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Release date: 2023-08-24T21:06:39.259000+00:00

Maxon Cinema 4D SKP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Maxon Cinema 4D. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper validation of user-supplied data, which can result in a write  past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21431.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Multiple vulnerabilities
CVE: CVE-2023-39959
Component: nextcloud
Release date: 2023-08-10T00:00:00+00:00

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.9, 26.0.4, and 27.0.1, unauthenticated users could send a DAV request which reveals whether a calendar or an address book with the given identifier exists for the victim. Nextcloud Server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 25.0.9, 26.0.4, and 27.0.1 contain a patch for this issue. No known workarounds are available.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
ixgbe: Fix panic during XDP_TX with > 64 CPUs
CVE: CVE-2023-54090
Component: kernel
CWE: CWE-1285
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

A flaw was found in the Linux kernel's ixgbe network driver. On systems with more than 64 CPUs, XDP_TX operations can cause a kernel panic due to an array-index-out-of-bounds access. The ixgbe_xdp_locking_key variable can be incorrectly decremented to zero during ring reconfiguration, causing the driver to use raw CPU numbers instead of CPU % 64 for XDP ring indexing, leading to NULL pointer dereference.

Statement: This flaw affects high-core-count systems (more than 64 CPUs) using Intel ixgbe network adapters with XDP programs. The panic can be triggered when loading XDP programs or when using ethtool --set-channels to reconfigure the interface. Servers with many cores using ixgbe NICs for XDP packet processing are at risk.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
To mitigate this issue, avoid using XDP programs on ixgbe interfaces on systems with more than 64 CPUs, or prevent the ixgbe module from being loaded if not needed. See https://access.redhat.com/solutions/41278 for instructions on blocking modules.