huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
block: null pointer dereference in ioctl.c when length and logical block size are misaligned
CVE: CVE-2023-52458
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 4.7/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

A flaw was found in the Linux kernel's block subsystem, where a NULL pointer dereference occurs if partitions are created or resized with a size that is not a multiple of the logical block size. This flaw allows a privileged attacker to cause a denial of service.

Statement: The impact of this vulnerability is considered Low because the affected code requires system administration privileges to exploit.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
No mitigation is currently available for this vulnerability. Make sure to perform the updates as they become available.
bad color space object in input leads to divide-by-zero
CVE: CVE-2023-2662
Component: xpdf
Release date: 2023-05-11T00:00:00+00:00

In Xpdf 4.04 (and earlier), a bad color space object in the input PDF file can cause a divide-by-zero.




Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
incorrect free when decoding target information
CVE: CVE-2023-25565
Component: gssntlmssp
CWE: CWE-590
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-02-14T00:00:00+00:00

A flaw was found in GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication. An incorrect free when decoding target information can trigger a denial of service. The error condition incorrectly assumes the `cb` and `sh` buffers contain a copy of the data that needs to be freed. However, that is not the case. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point. This issue will likely trigger an assertion failure in `free,` causing a denial of service.


Remediation:
Server: Security: Encryption unspecified vulnerability (CPU Jan 2023)
CVE: CVE-2023-21875
Component: mysql
Severity: Moderate
CVSS v3: 6.5/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H
Release date: 2023-01-17T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption).  Supported versions that are affected are 8.0.31 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.9 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
CVE: CVE-2023-44426
Component: D-Link DIR-X3260 SetSysEmailSettings AccountPassword Command Injection Remote Code Execution Vulnerability
Release date: 2023-10-04T23:06:36.292000+00:00

D-Link DIR-X3260 SetSysEmailSettings AccountPassword Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within prog.cgi, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21160.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
sender may send dangerous new files to a receiver
CVE: CVE-2023-43619
Component: croc
CVSS v3: 5.2/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Release date: 2023-09-20T00:00:00+00:00

An issue was discovered in Croc through 9.6.5. A sender may send dangerous new files to a receiver, such as executable content or a .ssh/authorized_keys file.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
clk: imx: clk-imx8mn: fix memory leak in imx8mn_clocks_probe
CVE: CVE-2023-53249
Component: kernel
CWE: CWE-772
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

clk: imx: clk-imx8mn: fix memory leak in imx8mn_clocks_probe

Use devm_of_iomap() instead of of_iomap() to automatically handle
the unused ioremap region.

If any error occurs, regions allocated by kzalloc() will leak,
but using devm_kzalloc() instead will automatically free the memory
using devm_kfree().


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
memory access violation
CVE: CVE-2023-45667
Component: stb
Release date: 2023-10-21T00:00:00+00:00

stb_image is a single file MIT licensed library for processing images.

If `stbi__load_gif_main` in `stbi_load_gif_from_memory` fails it returns a null pointer and may keep the `z` variable uninitialized. In case the caller also sets the flip vertically flag, it continues and calls `stbi__vertical_flip_slices` with the null pointer result value and the uninitialized `z` value. This may result in a program crash.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
smb: client: fix missed ses refcounting
CVE: CVE-2023-54076
Component: kernel
CWE: CWE-911
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

A use-after-free vulnerability was found in the Linux kernel's SMB client implementation. When handling SMB sessions with DFS (Distributed File System) root sessions, the code fails to properly increment the reference count for both the session and its dfs_root_ses. This can cause the dfs_root_ses to be freed prematurely in a subsequent cifs_put_smb_ses() call, leading to a use-after-free condition.

Statement: This flaw affects systems using the SMB/CIFS client with DFS referrals. The use-after-free can occur during session handling when DFS root sessions are involved. Exploitation requires mounting SMB shares with DFS enabled, which is common in enterprise environments with Windows file servers.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
CVE: CVE-2023-51624
Component: D-Link DCS-8300LHV2 RTSP ValidateAuthorizationHeader Nonce Stack-Based Buffer Overflow Remote Code Execution Vulnerability
Release date: 2023-01-01T00:00:00+00:00

D-Link DCS-8300LHV2 RTSP ValidateAuthorizationHeader Nonce Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DCS-8300LHV2 IP cameras. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of the Authorization header by the RTSP server, which listens on TCP port 554. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20072.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
netfilter: conntrack: Avoid nf_ct_helper_hash uses after free
CVE: CVE-2023-53619
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.4/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netfilter: conntrack: Avoid nf_ct_helper_hash uses after free

If nf_conntrack_init_start() fails (for example due to a
register_nf_conntrack_bpf() failure), the nf_conntrack_helper_fini()
clean-up path frees the nf_ct_helper_hash map.

When built with NF_CONNTRACK=y, further netfilter modules (e.g:
netfilter_conntrack_ftp) can still be loaded and call
nf_conntrack_helpers_register(), independently of whether nf_conntrack
initialized correctly. This accesses the nf_ct_helper_hash dangling
pointer and causes a uaf, possibly leading to random memory corruption.

This patch guards nf_conntrack_helper_register() from accessing a freed
or uninitialized nf_ct_helper_hash pointer and fixes possible
uses-after-free when loading a conntrack module.

Statement: A UAF in netfilter conntrack helpers could occur if nf_conntrack init fails and helper modules are loaded afterward, dereferencing the freed nf_ct_helper_hash. The fix guards registration when the table is absent and NULLs it on teardown. For the CVSS the PR:H because exploitation requires module management / kernel privileges (loading helpers or inducing init failure), so typical exposure is to privileged local actors.

Remediation:
Use of a Weak PseudoRandom Number Generator
CVE: CVE-2023-45237
Component: edk2
CWE: CWE-338
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2023-01-01T00:00:00+00:00

A security flaw has been identified in the cryptographic system of EDK2, the open-source reference implementation of the UEFI specification. This vulnerability enables an unauthorized remote attacker to potentially expose sensitive information.

Statement: The identified flaw in the NetworkPkg IP stack within the EDK2, an open-source UEFI implementation, poses a moderate security concern as the vulnerability allows an unauthenticated attacker within the same local network to exploit via a specifically crafted Destination Options IPv6 header.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE: CVE-2023-51599
Component: Honeywell Saia PG5 Controls Suite Directory Traversal Remote Code Execution Vulnerability
Release date: 2023-12-20T22:49:25.983000+00:00

Honeywell Saia PG5 Controls Suite Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Honeywell Saia PG5 Controls Suite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of ZIP files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user.
. Was ZDI-CAN-18412.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
drm/amdkfd: Add missing gfx11 MQD manager callbacks
CVE: CVE-2023-54261
Component: kernel
CWE: CWE-824
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2023-01-01T00:00:00+00:00

A NULL pointer dereference was found in the AMD KFD driver for GFX11 GPUs. The mqd_stride callback was not assigned for GFX11 hardware, causing crashes when accessing the MQD debugfs interface.

Statement: This affects systems with AMD RDNA3 (GFX11) GPUs when reading debugfs entries. Normal GPU operation without debugfs access is unaffected. The crash requires debugfs mounted and accessible.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Malicious IKEv1 Aggressive Mode packets can crash libreswan
CVE: CVE-2023-30570
Component: libreswan
CWE: CWE-400
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-05-03T00:00:00+00:00

A vulnerability was found in the libreswan library. This security issue occurs when an IKEv1 Aggressive Mode packet is received with only unacceptable crypto algorithms, and the response packet is not sent with a zero responder SPI. When a subsequent packet is received where the sender reuses the libreswan responder SPI as its own initiator SPI, the pluto daemon state machine crashes. No remote code execution is possible.


Remediation:
See the following documentation, which will be updated shortly for this
release, for important instructions on how to upgrade your cluster and
fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.15/release_notes/ocp-4-15-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.15/updating/updating-cluster-cli.html
See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.16/release_notes/ocp-4-16-release-notes.html

Details on how to access this content are available at https://docs.openshift.com/container-platform/4.16/updating/updating-cluster-cli.html
See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.17/release_notes/ocp-4-17-release-notes.html

Details on how to access this content are available at https://docs.openshift.com/container-platform/4.17/updating/updating-cluster-cli.html
CVE: CVE-2023-50222
Component: Inductive Automation Ignition ResponseParser Notification Deserialization of Untrusted Data Remote Code Execution Vulnerability
Release date: 2023-01-01T00:00:00+00:00

Inductive Automation Ignition ResponseParser Notification Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. User interaction is required to exploit this vulnerability in that the target must connect to a malicious server.

The specific flaw exists within the ResponseParser method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22067.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Missing HTTP security headers allows for clickjacking in web UI
CVE: CVE-2023-4958
Component: stackrox
CWE: CWE-1021
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L
Release date: 2023-01-01T00:00:00+00:00

In Red Hat Advanced Cluster Security (RHACS), it was found that some security related HTTP headers were missing, allowing an attacker to exploit this with a clickjacking attack. An attacker could exploit this by convincing a valid RHACS user to visit an attacker-controlled web page, that deceptively points to valid RHACS endpoints, hijacking the user's account permissions to perform other actions.


Remediation:
To take advantage of the new features, bug fixes, and enhancements in RHACS 4.2, you are advised to upgrade to RHACS 4.2.
XSS vulnerability allow local attackers to execute arbitrary code
CVE: CVE-2023-49453
Component: racktables
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2023-01-01T00:00:00+00:00

Reflected cross-site scripting (XSS) vulnerability in Racktables v0.22.0 and before, allows local attackers to execute arbitrary code and obtain sensitive information via the search component in index.php.

Statement: This vulnerability doesn't affect any supported Red Hat products.

Remediation:
unauthorized HID device connections allows keystroke injection and arbitrary commands execution
CVE: CVE-2023-45866
Component: bluez
CWE: CWE-285
Severity: Moderate
CVSS v3: 6.2/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2023-12-07T00:00:00+00:00

A flaw was found in the HID Profile in BlueZ that opens doors for unauthorized connections, especially by devices like keyboards, to inject keystrokes without user confirmation. BlueZ lacks proper restrictions on non-bonded devices, creating a risk for attackers that are physically close to inject keystrokes and execute arbitrary commands when the device is in a discoverable state.

Statement: BlueZ was found to inadequately limit non-bonded devices from injecting HID events into the input subsystem. This vulnerability could permit a nearby attacker (physically proximate) to inject keystrokes and carry out arbitrary commands when the device is in discoverable mode.

Remediation:
Put Bluetooth device in non-discoverable mode / disable incoming pairing.
Or
Disable Bluetooth.  Instructions on disabling bluetooth in Red Hat Enterprise Linux are available at: https://access.redhat.com/solutions/2682931
path traversal attack may lead to authentication bypass
CVE: CVE-2023-46749
Component: shiro
CWE: CWE-288
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Release date: 2023-01-01T00:00:00+00:00

A flaw was found in Apache Shiro, which may allow a path traversal attack. When this issue is combined with the path rewriting feature, it can lead to an authentication bypass.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
This flaw can be mitigated by making sure 'blockSemicolon' is enabled.
Server: DDL unspecified vulnerability (CPU Jul 2023)
CVE: CVE-2023-22058
Component: mysql
Severity: Moderate
CVSS v3: 4.9/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-07-18T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are 8.0.33 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
Kernel: A flaw in ARM Zynq could lead to system unavailability
CVE: CVE-2023-53818
Component: kernel
CWE: CWE-772
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

A flaw was found in the Linux kernel. A local attacker could exploit a vulnerability in the ARM Zynq component, specifically within the zynq_early_slcr_init function. This flaw, a 'reference count leak,' means that system resources are not properly released, which can lead to resource exhaustion. Consequently, this could result in a Denial of Service (DoS), making the system unavailable to legitimate users.


Remediation:
CVE: CVE-2023-51576
Component: Voltronic Power ViewPower Deserialization of Untrusted Data Remote Code Execution Vulnerability
Release date: 2023-12-20T23:09:01.491000+00:00

Voltronic Power ViewPower Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the RMI interface, which listens on TCP port 51099 by default. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-22012.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation: