huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
CVE: CVE-2023-34293
Component: Ashlar-Vellum Cobalt Out-Of-Bounds Write Remote Code Execution Vulnerability
Release date: 2023-06-08T22:09:29.634000+00:00

Ashlar-Vellum Cobalt Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of X_B or X_T files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
. Was ZDI-CAN-18636.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
samples/bpf: Fix buffer overflow in tcp_basertt
CVE: CVE-2023-54312
Component: kernel
CWE: CWE-131
Severity: Low
CVSS v3: 2.6/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2023-01-01T00:00:00+00:00

A buffer overflow was found in the BPF sample code tcp_basertt. Incorrect buffer size calculation could cause out-of-bounds writes when copying string data.

Statement: This is in samples/bpf code which is not compiled or included in production kernels. It serves only as example code for BPF developers. Production systems are unaffected.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
use-after-free in wifi  mt7921 fw features query
CVE: CVE-2023-3317
Component: kernel
CWE: CWE-416
Severity: Low
CVSS v3: 5.6/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2023-03-22T06:30:00+00:00

A use-after-free flaw was found in mt7921_check_offload_capability in drivers/net/wireless/mediatek/mt76/mt7921/init.c in the wifi mt76/mt7921 sub-component of the Linux Kernel. This issue could allow an attacker to crash the system after the 'features' memory releases which could lead to a kernel information leak.


Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Candump log file parser crash
CVE: CVE-2023-2855
Component: wireshark
CWE: CWE-121
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2023-05-11T00:00:00+00:00

A flaw was found in the Candump log file parser of Wireshark. This issue occurs when decoding malformed packets from a pcap file or from the network, causing a buffer overflow, resulting in a denial of service.

Statement: Wireshark as shipped in Red Hat Enterprise Linux 8 is not affected by this vulnerability because the Candump log file parser was introduced in a newer Wireshark version.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Wireshark must be restarted for the update to take effect.
Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer
CVE: CVE-2023-6816
Component: xorg-x11-server
CWE: CWE-787
Severity: Important
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2023-01-01T00:00:00+00:00

A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leading to a heap overflow if a bigger value was used.

Statement: The Xorg server does not run with root privileges in Red Hat Enterprise Linux 8 and 9, therefore, Red Hat Enterprise Linux 8 and 9 have been rated with a moderate severity.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Improper input validation in UEFI firmware
CVE: CVE-2023-34440
Component: microcode_ctl
CWE: CWE-20
Severity: Important
CVSS v3: 7.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Release date: 2023-01-01T00:00:00+00:00

An improper input validation flaw was found in UEFI firmware. Some Intel(R) processors may allow a privileged user to enable privilege escalation via local access.

Statement: Red Hat has given this vulnerability the impact rating of Important due to the potential of escalating privileges locally.

Remediation:
powerpc/powernv: Add a null pointer check in opal_powercap_init()
CVE: CVE-2023-52696
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

powerpc/powernv: Add a null pointer check in opal_powercap_init()

kasprintf() returns a pointer to dynamically allocated memory
which can be NULL upon failure.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Multiple CVEs published by Talos
CVE: CVE-2023-39272
Component: gtkwave
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2023-01-01T00:00:00+00:00

Multiple integer overflow vulnerabilities exist in the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `lsb` array.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
net: IPv6 RPL protocol reachable assertion leads to DoS
CVE: CVE-2023-2156
Component: kernel
CWE: CWE-617
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-05-04T00:00:00+00:00

A flaw was found in the Linux kernel's networking subsystem within the RPL protocol's handling. This issue results from the improper handling of user-supplied data, which can lead to an assertion failure. This flaw allows an unauthenticated, remote attacker to create a denial of service condition on the system.

Statement: Red Hat Enterprise Linux 6, 7, and 8 are not affected by this flaw as they did not include RPL source routing support (upstream commit 8610c7c "net: ipv6: add support for rpl sr exthdr"). The flaw cannot be triggered if the `rpl_seg_enabled` sysctl is set to 0. Please note that the `rpl_seg_enabled` sysctl is not enabled by default in Red Hat Enterprise Linux 9. As such, the impact has been lowered to Moderate on Red Hat Enterprise Linux 9.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
of: Fix double free in of_parse_phandle_with_args_map
CVE: CVE-2023-52679
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

of: Fix double free in of_parse_phandle_with_args_map

The Linux kernel CVE team has assigned CVE-2023-52679 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051750-CVE-2023-52679-948f@gregkh/T


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
CVE: CVE-2023-27329
Component: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability
Release date: 2023-03-09T08:25:52.085000+00:00

Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-19477.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2023-50214
Component: D-Link G416 nodered tar File Handling Command Injection Remote Code Execution Vulnerability
Release date: 2023-12-20T10:44:42.655000+00:00

D-Link G416 nodered tar File Handling Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the HTTP service listening on TCP port 80. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21808.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
net: usb: lan78xx: Limit packet length to skb->len
CVE: CVE-2023-53068
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: usb: lan78xx: Limit packet length to skb->len

Packet length retrieved from descriptor may be larger than
the actual socket buffer length. In such case the cloned
skb passed up the network stack will leak kernel memory contents.

Additionally prevent integer underflow when size is less than
ETH_FCS_LEN.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
gpio: sifive: Fix refcount leak in sifive_gpio_probe
CVE: CVE-2023-53592
Component: kernel
Severity: None
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

gpio: sifive: Fix refcount leak in sifive_gpio_probe

of_irq_find_parent() returns a node pointer with refcount incremented,
We should use of_node_put() on it when not needed anymore.
Add missing of_node_put() to avoid refcount leak.


Remediation:
STOMP server process client frames that would not send initially a connect frame
CVE: CVE-2023-32081
Component: vertx-stomp
CWE: CWE-287
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Release date: 2023-05-12T00:00:00+00:00

A flaw was found in the Vert.X Stomp server. The Vert.x STOMP server processes client STOMP frames without checking that the client sent an initial CONNECT frame and replied with a successful CONNECTED frame. A malicious user can connect and then create or receive unauthorized content.


Remediation:
CVE: CVE-2023-35744
Component: D-Link DAP-2622 DDP Configuration Restore Server IPv6 Address Stack-based Buffer Overflow Remote Code Execution Vulnerability
Release date: 2023-08-25T21:25:10.135000+00:00

D-Link DAP-2622 DDP Configuration Restore Server IPv6 Address Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-20071.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
x86/MCE: Always save CS register on AMD Zen IF Poison errors
CVE: CVE-2023-53438
Component: kernel
CWE: CWE-755
Severity: Moderate
CVSS v3: 4.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

x86/MCE: Always save CS register on AMD Zen IF Poison errors

The Instruction Fetch (IF) units on current AMD Zen-based systems do not
guarantee a synchronous #MC is delivered for poison consumption errors.
Therefore, MCG_STATUS[EIPV|RIPV] will not be set. However, the
microarchitecture does guarantee that the exception is delivered within
the same context. In other words, the exact rIP is not known, but the
context is known to not have changed.

There is no architecturally-defined method to determine this behavior.

The Code Segment (CS) register is always valid on such IF unit poison
errors regardless of the value of MCG_STATUS[EIPV|RIPV].

Add a quirk to save the CS register for poison consumption from the IF
unit banks.

This is needed to properly determine the context of the error.
Otherwise, the severity grading function will assume the context is
IN_KERNEL due to the m->cs value being 0 (the initialized value). This
leads to unnecessary kernel panics on data poison errors due to the
kernel believing the poison consumption occurred in kernel context.

Statement: On some AMD Zen systems, Instruction Fetch poison consumption can raise an MCE without EIPV/RIPV, causing the kernel to misidentify the context as kernel space (cs=0) and needlessly panic. The patch adds a Zen IFU quirk that always records CS for IF-bank (bank 1) poison errors, preventing incorrect severity grading and spurious panics. This is a reliability/availability fix tied to hardware error reporting (that is not a typical software-triggerable vulnerability).
This issue cannot be triggered remotely or through software inputs. It depends on hardware-level memory poisoning (e.g., ECC errors or IFU poison events) on AMD Zen CPUs. Only physical attackers or test tools with MCE injection capabilities could reproduce it. The vulnerability primarily affects reliability by causing unnecessary kernel panics and does not provide any direct exploit path.

Remediation:
heap overwrite in PGS subtitle overlay decoder
CVE: CVE-2023-37329
Component: gstreamer-plugins-bad
CWE: CWE-787
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2023-07-05T00:00:00+00:00

A heap-based buffer overflow vulnerability was found in the PGS Blu-ray subtitle decoder within GStreamer when processing specific files. This issue could allow a malicious third party to crash the application and execute code by manipulating the heap.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
null pointer dereference
CVE: CVE-2023-49936
Component: slurm
Release date: 2023-12-14T00:00:00+00:00

An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. A NULL pointer dereference leads to denial of service. The fixed versions are 22.05.11, 23.02.7, and 23.11.1.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
vulnerability exists in NuGet where a potential race condition can lead to a symlink attack
CVE: CVE-2023-29337
Component: dotnet
Severity: Important
CVSS v3: 7.2/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2023-06-14T00:00:00+00:00

A vulnerability was found in dotnet. This issue exists in NuGet where a potential race condition can lead to a symlink attack.


Remediation:
Multiple CVEs published by Talos
CVE: CVE-2023-37446
Component: gtkwave
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2023-01-01T00:00:00+00:00

Multiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when triggered via the vcd2lxt2 conversion utility.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
RDMA/mlx4: Prevent shift wrapping in set_user_sq_size()
CVE: CVE-2023-54168
Component: kernel
CWE: CWE-190
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx4: Prevent shift wrapping in set_user_sq_size()

The ucmd->log_sq_bb_count variable is controlled by the user so this
shift can wrap.  Fix it by using check_shl_overflow() in the same way
that it was done in commit 515f60004ed9 ("RDMA/hns: Prevent undefined
behavior in hns_roce_set_user_sq_size()").

Statement: A flaw was found in the Linux kernel RDMA mlx4 driver where a user-controlled log_sq_bb_count could trigger shift overflow/undefined behavior in set_user_sq_size(). This could bypass the intended send-queue size sanity check and lead to invalid queue sizing, potentially causing a kernel crash (DoS) and, in a worst-case scenario, kernel memory corruption. Exploitation requires local access to RDMA user verbs on systems with mlx4 hardware/support enabled.

Remediation:
Type Confusion in V8
CVE: CVE-2023-4352
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2023-08-15T00:00:00+00:00

Type confusion in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Dynamic memory not released after it is allocated in dlt-control-common.c
CVE: CVE-2023-26257
Component: dlt-daemon
CVSS v3: 3.7/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2023-02-27T00:00:00+00:00

An issue was discovered in the Connected Vehicle Systems Alliance (COVESA; formerly GENIVI) dlt-daemon through 2.18.8. Dynamic memory is not released after it is allocated in dlt-control-common.c.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
md/raid10: check slab-out-of-bounds in md_bitmap_get_counter
CVE: CVE-2023-53357
Component: kernel
CWE: CWE-787
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

md/raid10: check slab-out-of-bounds in md_bitmap_get_counter

If we write a large number to md/bitmap_set_bits, md_bitmap_checkpage()
will return -EINVAL because 'page >= bitmap->pages', but the return value
was not checked immediately in md_bitmap_get_counter() in order to set
*blocks value and slab-out-of-bounds occurs.

Move check of 'page >= bitmap->pages' to md_bitmap_get_counter() and
return directly if true.

Statement: This issue in the RAID10 bitmap handling could lead to a slab out-of-bounds access when an excessively large value is written to the md/bitmap_set_bits sysfs attribute. The problem can only be triggered locally and requires privileged access, making it a denial-of-service only.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
SMTP Challenge Stack-based Buffer Overflow Remote Code Execution Vulnerability
CVE: CVE-2023-42116
Component: Exim
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2023-09-27T00:00:00+00:00

The vulnerability was found in Exim within the handling of NTLM challenge requests. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Authentication is not required to exploit this vulnerability.

Statement: The vulnerable package Exim is not shipped in any Red Hat products.

Remediation:
ntfs3: out-of-bounds read in ntfs_attr_find()
CVE: CVE-2023-26607
Component: kernel
CWE: CWE-125
Severity: Moderate
CVSS v3: 7.2/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Release date: 2023-02-26T00:00:00+00:00

In the Linux kernel 6.0.8, there is an out-of-bounds read in ntfs_attr_find in fs/ntfs/attrib.c.

Statement: Red Hat Enterprise Linux is not affected by this flaw as it does not include support for the NTFS3 file system driver.

Remediation: