huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Heap buffer overflow in libphonenumber
CVE: CVE-2023-0138
Component: chromium-browser
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2023-01-10T00:00:00+00:00

Heap buffer overflow in libphonenumber in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
integer overflow in LoadPixelDataRLE4() function in PluginBMP.cpp
CVE: CVE-2023-47994
Component: FreeImage
Release date: 2023-01-01T00:00:00+00:00

An integer overflow vulnerability in LoadPixelDataRLE4 function in PluginBMP.cpp in Freeimage 3.18.0 allows attackers to obtain sensitive information, cause a denial of service and/or run arbitrary code.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
1-byte array overrun in common path resolve code
CVE: CVE-2023-0568
Component: php
CWE: CWE-131
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2023-02-15T00:00:00+00:00

A vulnerability was found in PHP. This security issue occurs because the core path resolution function allocates a buffer one byte small. Resolving paths with lengths close to the system MAXPATHLEN setting may lead to the byte after the allocated buffer being overwritten with a NULL value, which might lead to unauthorized data access or modification.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with partially controlled contents
CVE: CVE-2023-25652
Component: git
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2023-04-25T00:00:00+00:00

A vulnerability was found in Git. This security flaw occurs when feeding specially crafted input to `git apply --reject`; a path outside the working tree can be overwritten with partially controlled contents corresponding to the rejected hunk(s) from the given patch.


Remediation:
Specific recursive query patterns may lead to an out-of-memory condition
CVE: CVE-2023-6516
Component: bind9
CWE: CWE-400
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

A flaw was found in the `named` application, part of the bind9 package, which uses a cache database to speeds up DNS queries. To maintain its efficiency when running as a recursive name resolver, `named` performs a cache database clean up under certain conditions. This issue may allow an attacker to craft a continuous set of crafted queries, which can induce `named` to trigger the cleanup process with a high frequency, making the internal cleanup items queue to grow indefinitely. This can lead to an uncontrolled memory consumption and resource starvation, potentially making `named` consume all available memory in the host, leading to a Denial of Service of the targeted system.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, the BIND daemon (named) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, the BIND daemon (named) will be restarted automatically.
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
There is no available mitigation for this issue other than applying the required fixes via the released updates.
a heap-buffer-overflow in raw2image_ex()
CVE: CVE-2023-1729
Component: LibRaw
CWE: CWE-787
Severity: Low
CVSS v3: 3.2/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2023-01-14T00:00:00+00:00

A flaw was found in LibRaw. A heap-buffer-overflow in raw2image_ex() caused by a maliciously crafted file may lead to an application crash.


Remediation:
lib: cpu_rmap: Avoid use after free on rmap->obj array entries
CVE: CVE-2023-53484
Component: kernel
CWE: CWE-664
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

lib: cpu_rmap: Avoid use after free on rmap->obj array entries

When calling irq_set_affinity_notifier() with NULL at the notify
argument, it will cause freeing of the glue pointer in the
corresponding array entry but will leave the pointer in the array. A
subsequent call to free_irq_cpu_rmap() will try to free this entry again
leading to possible use after free.

Fix that by setting NULL to the array entry and checking that we have
non-zero at the array entry when iterating over the array in
free_irq_cpu_rmap().

The current code does not suffer from this since there are no cases
where irq_set_affinity_notifier(irq, NULL) (note the NULL passed for the
notify arg) is called, followed by a call to free_irq_cpu_rmap() so we
don't hit and issue. Subsequent patches in this series excersize this
flow, hence the required fix.

Statement: The bug stems from calling irq_set_affinity_notifier(irq, NULL) which frees the notifier “glue” but leaves a stale pointer in rmap->obj[index]. A later free_irq_cpu_rmap() iteration may free it again, causing a use-after-free.
For the CVSS the PR:H is because this is a kernel-internal API used by drivers.

Remediation:
Undefined behavior in box_div function
CVE: CVE-2023-48948
Component: virtuoso-opensource
CWE: CWE-20
Severity: Low
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-11-29T00:00:00+00:00

An issue in the box_div function in openlink virtuoso-opensource allows attackers to cause a Denial of Service (DoS) after running a SELECT statement.

Statement: Red Hat ships virtuoso-opensource only in RHEL 7, which is no longer supported within our support scope.

Remediation:
renesas_usb3: race condition leading to use-after-free in renesas_usb3_remove()
CVE: CVE-2023-35828
Component: kernel
CWE: CWE-366
Severity: Moderate
CVSS v3: 6.4/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2023-06-19T00:00:00+00:00

A race condition was found in the Linux kernel's Renesas USB3.0 controller when removing the module before cleanup in the usbhs_remove function. This can result in a use-after-free issue, possibly leading to a system crash or other undefined behaviors.


Remediation:
an abort in  CWriter::MangleType.
CVE: CVE-2023-27116
Component: webassembly
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2023-03-10T09:28:00+00:00

WebAssembly v1.0.29 discovered to contain an abort in CWriter::MangleType.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2023-44438
Component: Ashlar-Vellum Argon Uncontrolled Search Path Element Remote Code Execution Vulnerability
Release date: 2023-11-14T20:28:54.770000+00:00

Ashlar-Vellum Argon Uncontrolled Search Path Element Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Argon. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of various file types. The process loads a library from an unsecured location. An attacker can leverage this vulnerability to execute code in the context of the current process.
. Was ZDI-CAN-21678.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
f2fs: compress: fix to call f2fs_wait_on_page_writeback() in f2fs_write_raw_pages()
CVE: CVE-2023-54068
Component: kernel
Severity: None
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

f2fs: compress: fix to call f2fs_wait_on_page_writeback() in f2fs_write_raw_pages()

BUG_ON() will be triggered when writing files concurrently,
because the same page is writtenback multiple times.

1597 void folio_end_writeback(struct folio *folio)
1598 {
		......
1618     if (!__folio_end_writeback(folio))
1619         BUG();
		......
1625 }

kernel BUG at mm/filemap.c:1619!
Call Trace:
 <TASK>
 f2fs_write_end_io+0x1a0/0x370
 blk_update_request+0x6c/0x410
 blk_mq_end_request+0x15/0x130
 blk_complete_reqs+0x3c/0x50
 __do_softirq+0xb8/0x29b
 ? sort_range+0x20/0x20
 run_ksoftirqd+0x19/0x20
 smpboot_thread_fn+0x10b/0x1d0
 kthread+0xde/0x110
 ? kthread_complete_and_exit+0x20/0x20
 ret_from_fork+0x22/0x30
 </TASK>

Below is the concurrency scenario:

[Process A]		[Process B]		[Process C]
f2fs_write_raw_pages()
  - redirty_page_for_writepage()
  - unlock page()
			f2fs_do_write_data_page()
			  - lock_page()
			  - clear_page_dirty_for_io()
			  - set_page_writeback() [1st writeback]
			    .....
			    - unlock page()

						generic_perform_write()
						  - f2fs_write_begin()
						    - wait_for_stable_page()

						  - f2fs_write_end()
						    - set_page_dirty()

  - lock_page()
    - f2fs_do_write_data_page()
      - set_page_writeback() [2st writeback]

This problem was introduced by the previous commit 7377e853967b ("f2fs:
compress: fix potential deadlock of compress file"). All pagelocks were
released in f2fs_write_raw_pages(), but whether the page was
in the writeback state was ignored in the subsequent writing process.
Let's fix it by waiting for the page to writeback before writing.


Remediation:
secondary factor bypass in step-up authentication
CVE: CVE-2023-3597
Component: keycloak
CWE: CWE-287
Severity: Moderate
CVSS v3: 5.2/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2023-01-01T00:00:00+00:00

A flaw was found in Keycloak, where it does not correctly validate its client step-up authentication in org.keycloak.authentication. This flaw allows a remote user authenticated with a password to register a false second authentication factor along with an existing one and bypass authentication.

Statement: Note that exploitation of this flaw requires several factors to be successful. The attacker must already have valid credentials within the system, without which there is no vulnerability, and the application must be configured to use the step-up flow, which is the only aspect of authentication bypassed by this flaw; the name and password restriction function as expected. Further, the impact effects of this flaw are limited to user-level and do not affect the system as a whole. For this reason, Red Hat Product Security has assessed this flaw to be Moderate security impact.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link (you must log in to download the update).
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
integer-Underflow leading to Out-Of-Bound Read in zgfx_decompress_segment
CVE: CVE-2023-40181
Component: freerdp
CWE: CWE-191
Severity: Low
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-09-01T00:00:00+00:00

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Integer-Underflow leading to Out-Of-Bound Read in the `zgfx_decompress_segment` function. In the context of `CopyMemory`, it's possible to read data beyond the transmitted packet range and likely cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.


Remediation:
wifi: mac80211: check S1G action frame size
CVE: CVE-2023-53257
Component: kernel
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: check S1G action frame size

Before checking the action code, check that it even
exists in the frame.

Statement: Exploitable by an RF-adjacent attacker via malformed 802.11ah (S1G) action frames. No local privileges required. Impact is limited to potential denial-of-service from a kernel crash. Not applicable where 802.11ah/S1G is not in use.
Fixed starting from the Red Hat Enterprise Linux 9.4.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
To mitigate this issue, prevent module mac80211 from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
Parsing an empty HTTP response as a JSON.NET JObject causes a stack overflow and crashes a process
CVE: CVE-2023-21538
Component: dotnet
CWE: CWE-121
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-10T00:00:00+00:00

A vulnerability was found in dotnet. This flaw occurs when parsing an empty HTTP response as a JSON.NET JObject that causes a stack overflow and crashes a process.


Remediation:
Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message
CVE: CVE-2023-45229
Component: edk2
CWE: CWE-835
Severity: Moderate
CVSS v3: 6.4/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2023-01-01T00:00:00+00:00

A vulnerability has been identified in the NetworkPkg IP stack of EDK2, the open-source reference implementation of the UEFI specification. This flaw enables an unauthenticated attacker within the same network vicinity to transmit a specifically crafted DHCPv6 message. Exploiting this vulnerability may result in unauthorized access to memory beyond its boundaries, potentially leading to the exposure of sensitive information.

Statement: The identified flaw in the NetworkPkg IP stack within the EDK2, an open-source UEFI implementation, poses a moderate security concern. This vulnerability allows an unauthenticated attacker within the same network to exploit via a crafted DHCPv6 message, potentially leading to the unauthorized access of memory beyond its designated boundaries. While the issue has the potential to leak sensitive information, its impact is considered moderate, requiring an attacker to be within the adjacent network for successful exploitation.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer
CVE: CVE-2023-52915
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

A NULL pointer dereference vulnerability was found in the af9035_i2c_master_xfer function of the dvb-usb-v2 driver in the Linux kernel. This issue occurred because the function did not adequately check the msg[i].buf and msg[i].len fields, allowing a NULL pointer dereference if msg[i].buf was NULL and msg[i].len was zero. The fix introduces a sanity check on msg[i].len to prevent such crashes by ensuring the buffer is valid before accessing its contents.

Statement: This vulnerability is classified as a Moderate severity rather than Important due to its specific conditions and impact. The NULL pointer dereference in `af9035_i2c_master_xfer` requires both `msg[i].buf` to be `NULL` and `msg[i].len` to be zero for exploitation, which limits its exploitation to cases where these conditions are met. Furthermore, while it can cause a denial of service (crash) when accessing invalid memory, it does not directly lead to arbitrary code execution or data corruption.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Sandbox Escape
CVE: CVE-2023-32314
Component: vm2
CWE: CWE-74
Severity: Critical
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2023-05-15T00:00:00+00:00

A flaw was found in the vm2 sandbox. When a host object is created based on the specification of Proxy, an attacker can bypass the sandbox protections. This may allow an attacker to run remote code execution on the host running the sandbox. This vulnerability impacts the confidentiality, integrity, and availability of the system.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
ALSA: ymfpci: Fix BUG_ON in probe function
CVE: CVE-2023-53607
Component: kernel
CWE: CWE-131
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

An assertion failure was found in the Linux kernel's Yamaha YMF sound card driver during buffer validation. The probe function includes a BUG_ON assertion that compares DMA buffer sizes without accounting for alignment, causing the assertion to fail when the aligned buffer size doesn't exactly match the requested size. This triggers a kernel warning and can lead to driver initialization failure and denial of service.

Statement: The YMF PCI sound driver allocates DMA buffers for audio operations during device probe. Recent changes to the DMA buffer allocation code made the bytes field reflect the aligned buffer size rather than the exact requested size—this ensures proper memory alignment for DMA operations. However, the snd_ymfpci_create function contains a snd_BUG_ON check that asserts the allocated size exactly matches the requested size. With the new alignment behavior, buffers are typically rounded up to page or cache-line boundaries, causing the sizes to differ slightly. When this happens, the assertion fires, producing kernel warnings and potentially failing driver initialization. While primarily a debug check rather than actual memory corruption, on systems with panic-on-warn enabled or depending on driver initialization behavior, this could prevent the sound card from functioning at all.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
To mitigate this issue, prevent the snd_ymfpci module from being loaded. See https://access.redhat.com/solutions/41278 for instructions on blacklisting kernel modules.