huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()
CVE: CVE-2024-58006
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()

In commit 4284c88fff0e ("PCI: designware-ep: Allow pci_epc_set_bar() update
inbound map address") set_bar() was modified to support dynamically
changing the backing physical address of a BAR that was already configured.

This means that set_bar() can be called twice, without ever calling
clear_bar() (as calling clear_bar() would clear the BAR's PCI address
assigned by the host).

This can only be done if the new BAR size/flags does not differ from the
existing BAR configuration. Add these missing checks.

If we allow set_bar() to set e.g. a new BAR size that differs from the
existing BAR size, the new address translation range will be smaller than
the BAR size already determined by the host, which would mean that a read
past the new BAR size would pass the iATU untranslated, which could allow
the host to read memory not belonging to the new struct pci_epf_bar.

While at it, add comments which clarifies the support for dynamically
changing the physical address of a BAR. (Which was also missing.)


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
PHP-FPM Log Manipulation Vulnerability
CVE: CVE-2024-9026
Component: php
CWE: CWE-158
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Release date: 2024-10-08T04:15:11.060000+00:00

A flaw was found in PHP-FPM, the FastCGI Process Manager. This vulnerability can allow an attacker to manipulate or remove up to 4 characters from log messages via crafted log content, potentially polluting or altering the final log. If PHP-FPM is configured to use syslog output, further log data manipulation is possible via the same vector.

Statement: This vulnerability only affects configurations with the `catch_workers_output` directive enabled or set to yes in the configuration file. This option is disabled by default.

Additionally, if the `error_log` directive is set to `syslog`, the logs are being sent to syslogd instead of a regular file, allowing further log data manipulation.

Remediation:
CVE: CVE-2024-30364
Component: Foxit PDF Reader U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Release date: 2024-03-28T12:40:25.846000+00:00

Foxit PDF Reader U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-23009.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
HTTP3 dissector crash via packet injection or crafted capture file
CVE: CVE-2024-0207
Component: wireshark
CWE: CWE-125
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2024-01-03T00:00:00+00:00

A flaw was found in the HTTP3 dissector of Wireshark. It may be possible to make Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

Statement: Red Hat Enterprise Linux 6, 7, 8 and 9 are not affected by this CVE as they shipped an older version of Wireshark that did not include the vulnerable code.

Remediation:
Remotely exploitable DoS in Tonic `<=v0.12.2`
CVE: CVE-2024-47609
Component: rust-tonic
CWE: CWE-755
Severity: Low
CVSS v3: 3.6/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2024-10-01T20:13:55.017000+00:00

A flaw was found in the hyperium/tonic package. In certain conditions, it may be possible for a remote attacker to cause the application to terminate upon accepting a TCP/TLS stream, which may lead to a denial of service.


Remediation:
CVE: CVE-2024-23118
Component: Centreon updateContactHostCommands SQL Injection Remote Code Execution Vulnerability
Release date: 2024-02-09T19:09:02.839000+00:00

Centreon updateContactHostCommands SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability.

The specific flaw exists within the updateContactHostCommands function. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-22298.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
FTS unspecified vulnerability (CPU Jul 2024)
CVE: CVE-2024-21125
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-07-16T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS).  Supported versions that are affected are 8.0.37 and prior and  8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
CVE: CVE-2024-5510
Component: Kofax Power PDF JP2 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
Release date: 2024-05-31T19:15:50.244000+00:00

Kofax Power PDF JP2 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of JP2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22019.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Insecure HTTP in App::cpanminus Allows Code Execution Vulnerability
CVE: CVE-2024-45321
Component: perl-App-cpanminus
Severity: Moderate
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2024-08-27T04:15:09.010000+00:00

A flaw was found in App::cpanminus (cpanm) through version 1.7047. The default configuration downloads Perl modules from CPAN using HTTP, which could allow an attacker to view or modify the content without the knowledge of the user. This issue could allow an attacker to execute malicious code if they have the ability to intercept and modify the content before it reaches to user.


Remediation:
A user can force cpanminus to use a HTTPS mirror using the --from command-line argument. This can be configured as a CLI option or as an environment variable. 

As a command line argument, replacing DISTNAME in the command with the name of the distribution you want to install:

`$ cpanm --from https://www.cpan.org DISTNAME`

As set with the environment variable:

`$ export PERL_CPANM_OPT="--from https://www.cpan.org"`
media: i2c: et8ek8: Don&#39;t strip remove function when driver is builtin
CVE: CVE-2024-38611
Component: kernel
CWE: CWE-402
Severity: Low
CVSS v3: 5.7/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L
Release date: 2024-06-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

media: i2c: et8ek8: Don't strip remove function when driver is builtin

Using __exit for the remove function results in the remove callback
being discarded with CONFIG_VIDEO_ET8EK8=y. When such a device gets
unbound (e.g. using sysfs or hotplug), the driver is just removed
without the cleanup being performed. This results in resource leaks. Fix
it by compiling in the remove callback unconditionally.

This also fixes a W=1 modpost warning:

	WARNING: modpost: drivers/media/i2c/et8ek8/et8ek8: section mismatch in reference: et8ek8_i2c_driver+0x10 (section: .data) -> et8ek8_remove (section: .exit.text)


Remediation:
Server: Data Dictionary unspecified vulnerability (CPU Apr 2024)
CVE: CVE-2024-21060
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-04-16T00:00:00+00:00

A flaw was found in the MySQL Server product of Oracle MySQL (component: Server: Data Dictionary). Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.


Remediation:
media: mediatek: vcodec: adding lock to protect decoder context list
CVE: CVE-2024-35920
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-05-19T00:00:00+00:00

A vulnerability was found in the Linux kernel's MediaTek VCodec driver, caused by the absence of a lock to protect the decoder context list (`ctx_list`). This issue can lead to a NULL pointer dereference in the `vpu_dec_ipi_handler` function, resulting in a kernel panic.

Statement: Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Malicious artifects can cause machine-wide denial of service
CVE: CVE-2024-29903
Component: cosign
CWE: CWE-770
Severity: Moderate
CVSS v3: 4.5/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H
Release date: 2024-04-10T00:00:00+00:00

A flaw was found in the Cosign package where maliciously crafted software artifacts can trigger uncontrolled resource consumption by allocating too much memory and starving out the system. A successful attack may result in a denial of service of the machine running Cosign, impacting availability.

Statement: This vulnerability results only in a Denial-of-Service (DoS) against the Cosign service. Additionally, exploitation requires that the service is configured to accept artifacts from untrusted sources. Consequently, Red Hat's assessment indicates the security impact of this vulnerability is Moderate.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
To take advantage of the new features, bug fixes, and enhancements in RHACS 4.5, you are advised to upgrade to RHACS 4.5.0.
bpf: Add the missing BPF_LINK_TYPE invocation for sockmap
CVE: CVE-2024-50123
Component: kernel
CWE: CWE-125
Severity: Moderate
CVSS v3: 7.2/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Release date: 2024-11-05T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

bpf: Add the missing BPF_LINK_TYPE invocation for sockmap

There is an out-of-bounds read in bpf_link_show_fdinfo() for the sockmap
link fd. Fix it by adding the missing BPF_LINK_TYPE invocation for
sockmap link

Also add comments for bpf_link_type to prevent missing updates in the
future.


Remediation:
auth bypass via timing side channel
CVE: CVE-2024-25189
Component: libjwt
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2024-02-08T00:00:00+00:00

libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Inappropriate implementation in Downloads
CVE: CVE-2024-5843
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2024-06-11T00:00:00+00:00

Inappropriate implementation in Downloads in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to obfuscate security UI via a malicious file. (Chromium security severity: Medium)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
unicode: Don't special case ignorable code points
CVE: CVE-2024-50089
Component: kernel
CWE: CWE-1186
Severity: None
Release date: 2024-11-05T00:00:00+00:00

No description is available for this CVE.

Statement: This CVE has been marked as Rejected by the assigning CNA.

Remediation:
malicious code in distributed source
CVE: CVE-2024-3094
Component: xz
CWE: CWE-506
Severity: Critical
CVSS v3: 10/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Release date: 2024-03-29T00:00:00+00:00

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. 
Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

Statement: Current investigation indicates that the packages are only present in Fedora 41 and Fedora Rawhide within the Red Hat community ecosystem. 

No versions of Red Hat Enterprise Linux (RHEL) are affected.

The malicious injection present in the xz versions 5.6.0 and 5.6.1 libraries is only included in the tarball download package. The Git distribution lacks the M4 macro that triggers the build of the malicious code. The second-stage artifacts are present in the Git repository for the injection during the build time, in case the malicious M4 macro is present. Without the merge into the build, the 2nd-stage file is innocuous.
In the finder’s demonstration, it was found that it interfered with the OpenSSH daemon. While OpenSSH is not directly linked to the liblzma library, it does communicate with systemd in such a way that exposes it to the malware due to systemd linking to liblzma.

Remediation:
badly seeded PRNG may result in guessable values
CVE: CVE-2024-36048
Component: qtnetworkauth
CWE: CWE-1390
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2024-05-18T00:00:00+00:00

A predictable seed vulnerability was found in QtNetworkAuth. QAbstractOAuth uses only the time to seed the PRNG, which may result in guessable values.


Remediation:
predictable /tmp file due to unseeded RNG usage in displayGraph()
CVE: CVE-2024-55566
Component: colpack
CVSS v3: 6.6/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H
Release date: 2024-12-09T00:00:00+00:00

A flaw was found in colpack. Affected versions of colpack have a predictable temporary file located under /tmp with a name derived from an unseeded RNG. This issue can result in overwriting files or making ColPack graphing unavailable to other users.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2024-9724
Component: Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability
Release date: 2024-11-12T22:21:55.287000+00:00

Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24108.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2024-8836
Component: PDF-XChange Editor TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Release date: 2024-09-17T16:26:01.767000+00:00

PDF-XChange Editor TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24354.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
comedi: Flush partial mappings in error case
CVE: CVE-2024-53148
Component: kernel
Severity: None
Release date: 2024-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

comedi: Flush partial mappings in error case

If some remap_pfn_range() calls succeeded before one failed, we still have
buffer pages mapped into the userspace page tables when we drop the buffer
reference with comedi_buf_map_put(bm). The userspace mappings are only
cleaned up later in the mmap error path.

Fix it by explicitly flushing all mappings in our VMA on the error path.

See commit 79a61cc3fc04 ("mm: avoid leaving partial pfn mappings around in
error case").


Remediation:
From CVEorg collector
CVE: CVE-2024-21277
Component: Oracle E-Business Suite
Release date: 2024-10-15T19:53:00.651000+00:00

Vulnerability in the Oracle MES for Process Manufacturing product of Oracle E-Business Suite (component: Device Integration).  Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle MES for Process Manufacturing.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle MES for Process Manufacturing accessible data as well as  unauthorized access to critical data or complete access to all Oracle MES for Process Manufacturing accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes
CVE: CVE-2024-42309
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-08-17T00:00:00+00:00

A null pointer dereference in Linux kernel in psb_intel_lvds_get_modes. This may lead to a crash.

Statement: Red Hat Enterprise Linux 9 is not affected by this vulnerability.

Remediation:
incorrect access control for some sockd.conf configurations
CVE: CVE-2024-54662
Component: dante
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2024-12-17T00:00:00+00:00

Dante 1.4.0 through 1.4.3 (fixed in 1.4.4) has incorrect access control for some sockd.conf configurations involving socksmethod.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Invalid value for OpenSSL API may cause Buffer over-read when NPN is used
CVE: CVE-2024-5642
Component: python
CWE: CWE-20
Severity: Low
CVSS v3: 3.7/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Release date: 2024-06-27T00:00:00+00:00

A vulnerability was found in Python/CPython that does not disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols(), which is an invalid value for the underlying OpenSSL API. This issue results in a buffer over-read when NPN is used. See CVE -2024-5535 for OpenSSL for more information.

Statement: This vulnerability is rated with a Low severity due to NPN not being widely used and specifying an empty list is likely uncommon in practice. Typically, a protocol name would be configured.

Remediation:
The container images provided by this update can be downloaded from the
Red Hat container registry at registry.redhat.io using the "podman pull" command.
The containers required to run Discovery can be installed through discovery-installer
RPM. See the official documentation for more details.
The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.
See the official documentation for more details.