huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
integer overflow and divide-by-zero due to very large coordinates in a page box
CVE: CVE-2024-7867
Component: xpdf
CVSS v3: 2.8/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2024-08-15T00:00:00+00:00

In Xpdf 4.05 (and earlier), very large coordinates in a page box can cause an integer overflow and divide-by-zero.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Use after free in Media Stream
CVE: CVE-2024-6775
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2024-07-16T00:00:00+00:00

A use-after-free flaw was found in Media Stream in Google Chrome. This issue may allow a remote attacker to convince a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
drm/xe/oa: Fix overflow in oa batch buffer
CVE: CVE-2024-50090
Component: kernel
CWE: CWE-130
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-11-05T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/oa: Fix overflow in oa batch buffer

By default xe_bb_create_job() appends a MI_BATCH_BUFFER_END to batch
buffer, this is not a problem if batch buffer is only used once but
oa reuses the batch buffer for the same metric and at each call
it appends a MI_BATCH_BUFFER_END, printing the warning below and then
overflowing.

[  381.072016] ------------[ cut here ]------------
[  381.072019] xe 0000:00:02.0: [drm] Assertion `bb->len * 4 + bb_prefetch(q->gt) <= size` failed!
               platform: LUNARLAKE subplatform: 1
               graphics: Xe2_LPG / Xe2_HPG 20.04 step B0
               media: Xe2_LPM / Xe2_HPM 20.00 step B0
               tile: 0 VRAM 0 B
               GT: 0 type 1

So here checking if batch buffer already have MI_BATCH_BUFFER_END if
not append it.

v2:
- simply fix, suggestion from Ashutosh

(cherry picked from commit 9ba0e0f30ca42a98af3689460063edfb6315718a)


Remediation:
drm: zynqmp_dp: Fix integer overflow in zynqmp_dp_rate_get()
CVE: CVE-2024-52557
Component: kernel
CWE: CWE-190
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm: zynqmp_dp: Fix integer overflow in zynqmp_dp_rate_get()

This patch fixes a potential integer overflow in the zynqmp_dp_rate_get()

The issue comes up when the expression
drm_dp_bw_code_to_link_rate(dp->test.bw_code) * 10000 is evaluated using 32-bit
Now the constant is a compatible 64-bit type.

Resolves coverity issues: CID 1636340 and CID 1635811


Remediation:
undisclosed HTTP/3 requests can cause NGINX worker processes to terminate
CVE: CVE-2024-31079
Component: nginx
CWE: CWE-121
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Release date: 2024-05-29T00:00:00+00:00

A flaw was found in the nginx HTTP/3 implementation. Undisclosed HTTP/3 requests can trigger a stack-based buffer overflow, causing worker processes to crash and lead to a denial of service.

Statement: To exploit this flaw, a request must be specifically timed during the connection draining process, which the attacker has no visibility and limited influence. For this reason, this flaw has been rated with a Moderate severity.

The nginx package as shipped in Red Hat Enterprise Linux 8, 9 and RHSCL is not affected by this vulnerability because the support for HTTP/3 is not enabled and the vulnerable code was introduced in a later version of nginx.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
netfilter: ipset: Fix suspicious rcu_dereference_protected()
CVE: CVE-2024-40993
Component: kernel
CWE: CWE-99
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-07-12T00:00:00+00:00

A suspicious rcu_dereference_protected() was observed in netfilter in the Linux kernel. This may lead to a loss of Availability.


Remediation:
ice: Don't process extts if PTP is disabled
CVE: CVE-2024-42107
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-07-30T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ice: Don't process extts if PTP is disabled

The ice_ptp_extts_event() function can race with ice_ptp_release() and
result in a NULL pointer dereference which leads to a kernel panic.

Panic occurs because the ice_ptp_extts_event() function calls
ptp_clock_event() with a NULL pointer. The ice driver has already
released the PTP clock by the time the interrupt for the next external
timestamp event occurs.

To fix this, modify the ice_ptp_extts_event() function to check the
PTP state and bail early if PTP is not ready.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
CVE: CVE-2024-5509
Component: Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability
Release date: 2024-05-31T16:34:51.821000+00:00

Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of BIP files. The issue results from loading a library from an unsecured location. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22738.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Heap buffer overflow in Layout
CVE: CVE-2024-7534
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2024-08-06T00:00:00+00:00

Heap buffer overflow in Layout in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Tornado has HTTP cookie parsing DoS vulnerability
CVE: CVE-2024-52804
Component: python-tornado
CWE: CWE-770
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-11-22T15:43:38.572000+00:00

A flaw was found in Tornado's HTTP cookie parsing algorithm. This vulnerability allows excessive CPU consumption via maliciously crafted cookie headers due to Quadratic complexity, potentially blocking the processing of other requests and leading to the loss of availability of the system.


Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
btrfs: scrub: avoid use-after-free when chunk length is not 64K aligned
CVE: CVE-2024-26616
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2024-02-29T00:00:00+00:00

A use-after-free flaw was found in the Linux Kernel when the chunk length is not 64K aligned.

Statement: Red Hat Enterprise Linux 8 and 9 are not affected by this CVE as they do not include Btrfs filesystem support (CONFIG_BTRFS_FS is not set).

Remediation:
CVE: CVE-2024-11565
Component: IrfanView CGM File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
Release date: 2024-11-21T20:47:30.297000+00:00

IrfanView CGM File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of CGM files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24866.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
net/mlx5e: Fix netif state handling
CVE: CVE-2024-38608
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-06-19T00:00:00+00:00

A vulnerability was found in the Linux kernel within the net/mlx5e component, where improper handling of network interface states could lead to a NULL pointer dereference or resource leaks if network registration fails during initialization. This condition could cause system instability, as resources may not be cleaned up correctly, although it presents a low risk due to limited overall impact.

Statement: This vulnerability is rated as low severity, as it requires specific conditions in network interface setup and does not compromise confidentiality or integrity. Its impact is restricted to potential stability issues under rare circumstances.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Heap buffer overflow in ANGLE
CVE: CVE-2024-5159
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2024-05-21T00:00:00+00:00

Heap buffer overflow in ANGLE in Google Chrome prior to 125.0.6422.76 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
wrongly matches ALL unauthorized SIP requests
CVE: CVE-2024-35190
Component: asterisk
CVSS v3: 5.7/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Release date: 2024-05-17T00:00:00+00:00

Asterisk is an open source private branch exchange and telephony toolkit. After upgrade to 18.23.0, ALL unauthorized SIP requests are identified as PJSIP Endpoint of local asterisk server. This vulnerability is fixed in 18.23.1, 20.8.1, and 21.3.1.


Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
nvdimm: Fix devs leaks in scan_labels()
CVE: CVE-2024-47755
Component: kernel
CWE: CWE-400
Severity: None
CVSS v3: 0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N
Release date: 2024-10-21T00:00:00+00:00

This CVE has been marked as Rejected by the assigning CNA.

Statement: This CVE has been rejected upstream:
https://lore.kernel.org/linux-cve-announce/2024102325-REJECTED-5016@gregkh/T/#u

Red Hat has also evaluated this issue and determined that it does not meet the criteria to be classified as a security vulnerability. This assessment is based on the issue not posing a significant security risk, being a result of misconfiguration or usage error, or falling outside the scope of security considerations. 

As such, this CVE has been marked as "Rejected" in alignment with Red Hat's vulnerability management policies.

If you have additional information or concerns regarding this determination, please contact Red Hat Product Security for further clarification.

Remediation:
mm: vmalloc: ensure vmap_block is initialised before adding to queue
CVE: CVE-2024-46847
Component: kernel
CWE: CWE-129
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-09-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mm: vmalloc: ensure vmap_block is initialised before adding to queue

Commit 8c61291fd850 ("mm: fix incorrect vbq reference in
purge_fragmented_block") extended the 'vmap_block' structure to contain a
'cpu' field which is set at allocation time to the id of the initialising
CPU.

When a new 'vmap_block' is being instantiated by new_vmap_block(), the
partially initialised structure is added to the local 'vmap_block_queue'
xarray before the 'cpu' field has been initialised.  If another CPU is
concurrently walking the xarray (e.g.  via vm_unmap_aliases()), then it
may perform an out-of-bounds access to the remote queue thanks to an
uninitialised index.

This has been observed as UBSAN errors in Android:

 | Internal error: UBSAN: array index out of bounds: 00000000f2005512 [#1] PREEMPT SMP
 |
 | Call trace:
 |  purge_fragmented_block+0x204/0x21c
 |  _vm_unmap_aliases+0x170/0x378
 |  vm_unmap_aliases+0x1c/0x28
 |  change_memory_common+0x1dc/0x26c
 |  set_memory_ro+0x18/0x24
 |  module_enable_ro+0x98/0x238
 |  do_init_module+0x1b0/0x310

Move the initialisation of 'vb->cpu' in new_vmap_block() ahead of the
addition to the xarray.


Remediation:
Client: mysqldump unspecified vulnerability (CPU Apr 2024)
CVE: CVE-2024-21096
Component: mysql
Severity: Moderate
CVSS v3: 4.8/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2024-04-16T00:00:00+00:00

A flaw was found in the MySQL Server product of Oracle MySQL (component: Client: mysqldump). Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server.


Remediation:
crypto: virtio/akcipher - Fix stack overflow on memcpy
CVE: CVE-2024-26753
Component: kernel
CWE: CWE-121
Severity: Low
CVSS v3: 6.7/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
Release date: 2024-04-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

crypto: virtio/akcipher - Fix stack overflow on memcpy

sizeof(struct virtio_crypto_akcipher_session_para) is less than
sizeof(struct virtio_crypto_op_ctrl_req::u), copying more bytes from
stack variable leads stack overflow. Clang reports this issue by
commands:
make -j CC=clang-14 mrproper >/dev/null 2>&1
make -j O=/tmp/crypto-build CC=clang-14 allmodconfig >/dev/null 2>&1
make -j O=/tmp/crypto-build W=1 CC=clang-14 drivers/crypto/virtio/
  virtio_crypto_akcipher_algs.o


Remediation:
usb: typec: fix potential array underflow in ucsi_ccg_sync_control()
CVE: CVE-2024-53203
Component: kernel
CWE: CWE-129
Severity: Moderate
CVSS v3: 7.4/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2024-12-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: fix potential array underflow in ucsi_ccg_sync_control()

The "command" variable can be controlled by the user via debugfs.  The
worry is that if con_index is zero then "&uc->ucsi->connector[con_index
- 1]" would be an array underflow.

Statement: This issue is considered to be a moderate impact flaw, as the exploitation for this will need an ADMIN (or ROOT) privilege (PR:H).

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Type Confusion in V8
CVE: CVE-2024-10231
Component: chromium-browser
Release date: 2024-10-22T21:43:11.374000+00:00

Type Confusion in V8 in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2024-6260
Component: Malwarebytes Antimalware Link Following Local Privilege Escalation Vulnerability
Release date: 2024-09-05T18:19:47.580000+00:00

Malwarebytes Antimalware Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Malwarebytes Antimalware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the Malwarebytes service. By creating a symbolic link, an attacker can abuse the service to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22321.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
OOB-write in convert_to_s334_1a
CVE: CVE-2024-47539
Component: gstreamer1-plugins-good
CWE: CWE-787
Severity: Important
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2024-12-11T18:53:00.750000+00:00

A flaw was found in the GStreamer library. An out-of-bounds write in the MP4/MOV demuxer when handling CEA608 Closed Caption tracks can lead to crashes for certain input files. This vulnerability allows a malicious third party to trigger a crash of the application and perform code execution through heap manipulation.

Statement: This vulnerability classified as important severity rather than moderate due to its potential for out-of-bounds memory writes, which are highly exploitable in many scenarios. The discrepancy between the memory allocation and loop bounds allows overwriting up to 3 bytes beyond the intended storage array, which could corrupt adjacent memory. Depending on the execution context, this could lead to critical security consequences, such as the alteration of control structures, heap corruption, or stack manipulation, opening paths for arbitrary code execution or escalation of privileges.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Improper Isolation or Compartmentalization in NVIDIA Container Toolkit
CVE: CVE-2024-0137
Component: nvidia-container-toolkit
CWE: CWE-653
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
Release date: 2024-01-01T00:00:00+00:00

A flaw was found in the NVIDIA Container Toolkit. NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted code running in the host’s network namespace. This vulnerability is present only when the NVIDIA Container Toolkit is configured in a non-default way. A successful exploit of this vulnerability may lead to denial of service and escalation of privileges.


Remediation:
net: core: reject skb_copy(_expand) for fraglist GSO skbs
CVE: CVE-2024-36929
Component: kernel
CWE: CWE-822
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-05-30T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: core: reject skb_copy(_expand) for fraglist GSO skbs

SKB_GSO_FRAGLIST skbs must not be linearized, otherwise they become
invalid. Return NULL if such an skb is passed to skb_copy or
skb_copy_expand, in order to prevent a crash on a potential later
call to skb_gso_segment.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
drm/qxl: Add check for drm_cvt_mode
CVE: CVE-2024-43829
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-08-17T00:00:00+00:00

drm/qxl in linux kernel may cause a null pointer dereference when calling drm_cvt_mode.


Remediation: