huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
drm/amd/display: Avoid NULL dereference of timing generator
CVE: CVE-2023-52753
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Avoid NULL dereference of timing generator

[Why & How]
Check whether assigned timing generator is NULL or not before
accessing its funcs to prevent NULL dereference.


Remediation:
heap-buffer-overflow on frame size change
CVE: CVE-2023-6879
Component: aom
CWE: CWE-787
Severity: Important
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2023-12-28T00:00:00+00:00

A heap-based buffer overflow vulnerability was found in AOM. When increasing the resolution of video frames during a multi-threaded encode, a heap overflow may occur in av1_loop_restoration_dealloc() within thread_common.c, leading to a denial of service or unauthorized reading of memory.

Statement: The AOM heap-based buffer overflow vulnerability, triggered when increasing video frame resolution during a multi-threaded encode, is considered moderate. Limited conditions for exploitation and constrained impacts, such as potential denial of service and unauthorized memory reading, contribute to this classification. The issue is not universally exploitable, requiring specific circumstances, and does not immediately lead to widespread system compromise.

Mozilla Firefox & Thunderbird don't have any AV1 encode paths currently, so Red Hat Enterprise Linux 7, 8 & 9 is not affected.

Remediation:
Bleichenbacher timing attacks in the RSA decryption API - incomplete fix for CVE-2020-25657
CVE: CVE-2023-50781
Component: m2crypto
CWE: CWE-385
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2023-12-13T00:00:00+00:00

A flaw was found in m2crypto. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.

Statement: This vulnerability exists due to an incomplete fix for CVE-2020-25657.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Authenticated SQL injection vulnerability when managing reports
CVE: CVE-2023-39358
Component: cacti
CVSS v3: 9.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2023-09-06T00:00:00+00:00

Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authenticated users to perform privilege escalation and remote code execution. The vulnerability resides in the `reports_user.php` file. In `ajax_get_branches`, the `tree_id` parameter is passed to the `reports_get_branch_select` function without any validation. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2023-41190
Component: D-Link DAP-1325 HNAP SetAPLanSettings IPAddr Command Injection Remote Code Execution Vulnerability
Release date: 2023-09-07T13:36:31.095000+00:00

D-Link DAP-1325 HNAP SetAPLanSettings IPAddr Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of a request parameter provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18810.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2023-27346
Component: TP-Link AX1800 Firmware Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
Release date: 2023-03-31T20:45:32.764000+00:00

TP-Link AX1800 Firmware Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link AX1800 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the parsing of firmware images. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-19703.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Inappropriate implementation in Prompts
CVE: CVE-2023-4901
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2023-09-12T00:00:00+00:00

Inappropriate implementation in Prompts in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to potentially spoof security UI via a crafted HTML page. (Chromium security severity: Medium)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Denial Of Service Via Deflate Decompression Bomb
CVE: CVE-2023-28119
Component: crewjam/saml
CWE: CWE-770
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2023-03-22T00:00:00+00:00

The crewjam/saml go library contains a partial implementation of the SAML standard in golang. Prior to version 0.4.13, the package's use of `flate.NewReader` does not limit the size of the input. The user can pass more than 1 MB of data in the HTTP request to the processing functions, which will be decompressed server-side using the Deflate algorithm. Therefore, after repeating the same request multiple times, it is possible to achieve a reliable crash since the operating system kills the process. This issue is patched in version 0.4.13.



Remediation:
crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init
CVE: CVE-2023-52616
Component: kernel
CWE: CWE-20
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

A vulnerability was found in the crypto: lib/mpi component of the Linux kernel, where the initialization of the mpi_ec_ctx structure caused crashes due to uncleared fields. This issue occurs when the structure is referenced after being released. It typically triggers during specific calculations, like the Za value for SM2.


Remediation:
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
Multiple dissector excessive loops
CVE: CVE-2023-0411
Component: wireshark
CWE: CWE-834
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2023-01-27T00:00:00+00:00

A flaw was found in the BPv6, NCP, and RTPS dissectors of Wireshark. This issue occurs when decoding malformed packets from a pcap file or from the network, causing excessive consumption of CPU resources due to excessive loops, resulting in a Denial of Service.


Remediation:
slab-use-after-free Write in txEnd due to race condition
CVE: CVE-2023-3397
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2023-05-08T00:00:00+00:00

A race condition occurred between the functions lmLogClose and txEnd in JFS, in the Linux Kernel, executed in different threads. This flaw allows a local attacker with normal user privileges to crash the system or leak internal kernel information.


Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE: CVE-2023-37346
Component: Kofax Power PDF TIF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Release date: 2023-07-13T20:36:27.510000+00:00

Kofax Power PDF TIF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write  past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20443.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
FS: JFS: Fix null-ptr-deref Read in txBegin
CVE: CVE-2023-53457
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

FS: JFS: Fix null-ptr-deref Read in txBegin

 Syzkaller reported an issue where txBegin may be called
 on a superblock in a read-only mounted filesystem which leads
 to NULL pointer deref. This could be solved by checking if
 the filesystem is read-only before calling txBegin, and returning
 with appropiate error code.


Remediation:
CVE: CVE-2023-32144
Component: D-Link DAP-1360 webproc COMM_MakeCustomMsg Stack-based Buffer Overflow Remote Code Execution Vulnerability
Release date: 2023-05-04T22:15:31.164000+00:00

D-Link DAP-1360 webproc COMM_MakeCustomMsg Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of requests to the /cgi-bin/webproc endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-18454.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Linux kernel: Denial of Service in mlx5 driver due to memory leaks
CVE: CVE-2023-54238
Component: kernel
CWE: CWE-772
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

A flaw was found in the Linux kernel's mlx5 driver. During a Precision Time Protocol (PTP) resynchronization operation, socket buffers (SKBs) were not properly freed, leading to a memory leak. Additionally, an error in the mlx5e_skb_fifo_has_room() function's counter check could cause further resource leaks. A local attacker with low privileges could exploit these memory and resource leaks to cause a Denial of Service (DoS).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Linux kernel: Denial of Service due to trace_printk() event registration timing
CVE: CVE-2023-53007
Component: kernel
CWE: CWE-909
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

A flaw was found in the Linux kernel. A local user could experience a denial of service (DoS) if a system crash occurs very early in the boot process. This is because trace_printk() events, which are crucial for debugging, are not registered early enough. This timing issue results in unreadable trace output, hindering critical system analysis and debugging efforts.


Remediation:
CVE: CVE-2023-38119
Component: Foxit PDF Reader AcroForm signature Out-Of-Bounds Read Remote Code Execution Vulnerability
Release date: 2023-07-26T17:06:23.859000+00:00

Foxit PDF Reader AcroForm signature Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of signature fields. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21326.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Server: Security: Privileges unspecified vulnerability (CPU Apr 2023)
CVE: CVE-2023-21912
Component: mysql
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-04-18T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges).  Supported versions that are affected are 5.7.41 and prior and  8.0.30 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
stack-based buffer overflow vulnerabilities exist in the readOFF.cpp
CVE: CVE-2023-35951
Component: meshlab
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2023-01-01T00:00:00+00:00

Multiple stack-based buffer overflow vulnerabilities exist in the readOFF.cpp functionality of libigl v2.4.0. A specially-crafted .off file can lead to a buffer overflow. An attacker can arbitrary code execution to trigger these vulnerabilities.This vulnerability exists within the code responsible for parsing geometric vertices of an OFF file.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
soc: qcom: pmic_glink_altmode: fix port sanity check
CVE: CVE-2023-52495
Component: kernel
CWE: CWE-99
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

A flaw was found in the Linux Kernel. An incomplete port sanity check on notifications  may lead to accessing and corrupting memory beyond the port array.

Statement: No Red Hat products are affected by this vulnerability.

Remediation:
Open Redirect Vulnerability in Action Controller
CVE: CVE-2023-22797
Component: rubygem-actionpack
CWE: CWE-601
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Release date: 2023-01-20T00:00:00+00:00

An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling redirect_to with untrusted user input. In prior versions the developer was fully responsible for only providing trusted input. However the check introduced could allow an attacker to bypass with a carefully crafted URL resulting in an open redirect vulnerability.


Remediation:
Multiple vulnerabilities
CVE: CVE-2023-29421
Component: bzip3
Release date: 2023-04-06T00:00:00+00:00

An issue was discovered in libbzip3.a in bzip3 before 1.2.3. There is an out-of-bounds write in bz3_decode_block.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups
CVE: CVE-2023-54111
Component: kernel
Severity: None
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups

of_find_node_by_phandle() returns a node pointer with refcount incremented,
We should use of_node_put() on it when not needed anymore.
Add missing of_node_put() to avoid refcount leak.


Remediation:
CVE: CVE-2023-40502
Component: LG Simple Editor cropImage Directory Traversal Arbitrary File Deletion Vulnerability
Release date: 2023-08-24T21:11:08.168000+00:00

LG Simple Editor cropImage Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the cropImage command. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files in the context of SYSTEM.
. Was ZDI-CAN-19951.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
drm/msm/dpu: check for null return of devm_kzalloc() in dpu_writeback_init()
CVE: CVE-2023-53284
Component: kernel
Severity: None
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/msm/dpu: check for null return of devm_kzalloc() in dpu_writeback_init()

Because of the possilble failure of devm_kzalloc(), dpu_wb_conn might
be NULL and will cause null pointer dereference later.

Therefore, it might be better to check it and directly return -ENOMEM.

Patchwork: https://patchwork.freedesktop.org/patch/512277/
[DB: fixed typo in commit message]


Remediation:
Heap-buffer-overflow binutils-gdb/bfd/libbfd.c in bfd_getl64
CVE: CVE-2023-1579
Component: binutils
CWE: CWE-787
Severity: Moderate
CVSS v3: 6.9/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2023-01-11T00:00:00+00:00

A heap based buffer overflow was found in binutils-gdb/bfd/libbfd.c in bfd_getl64 in binutils.

Statement: Because this vulnerability requires that an unsuspecting user uses binutils-gdb to analyze a specially crafted malicious DWARF file, and because the consequences of the memory corruption caused by the flaw are limited to the privileges of the user who analyzes the malicious file, Red Hat assesses this vulnerability's impact as Moderate.

Remediation:
scsi: qla2xxx: Fix buffer overrun
CVE: CVE-2023-54054
Component: kernel
CWE: CWE-787
Severity: Moderate
CVSS v3: 6.4/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

No description is available for this CVE.

Statement: This issue is a driver-level buffer overrun caused by using an oversized structure when calculating the copy length for a nested buffer in the qla2xxx Fibre Channel driver. The flaw can result in memory corruption leading to a kernel crash or I/O disruption, but it does not provide a controlled overwrite primitive. As the data source is a local FC adapter/firmware and the code runs during device initialization, this is best classified as a robustness and availability.

Remediation:
md: fix warning for holder mismatch from export_rdev()
CVE: CVE-2023-53791
Component: kernel
CWE: CWE-772
Severity: Low
CVSS v3: 3.6/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2023-01-01T00:00:00+00:00

A logic inconsistency was identified in the Linux kernel md (multiple device) driver involving the export_rdev() function and associated block device holder bookkeeping. Under certain sequences where mddev->external is toggled, the code would use one holder (claim_rdev) to get a block device but a different holder (rdev) to put it back, leading to a mismatch in reference accounting. This could result in spurious kernel warnings and potential resource lifetime misbehavior when interacting with md devices via sysfs


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
drm/amdgpu: Fix possible null pointer dereference
CVE: CVE-2023-52883
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix possible null pointer dereference

abo->tbo.resource may be NULL in amdgpu_vm_bo_update.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.