huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
lack of class checking in deserialization of XMSS/XMSS^MT private keys with BDS state information
CVE: CVE-2018-1000613
Component: bouncycastle
CWE: CWE-470
Severity: Moderate
CVSS v3: 4.8/CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2018-03-03T00:00:00+00:00

Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in XMSS/XMSS^MT private key deserialization that can result in Deserializing an XMSS/XMSS^MT private key can result in the execution of unexpected code. This attack appear to be exploitable via A handcrafted private key can include references to unexpected classes which will be picked up from the class path for the executing application. This vulnerability appears to have been fixed in 1.60 and later.

Statement: The XMSS/XMSS^MT algorithms were first introduced in upstream bouncycastle version 1.57.  Versions prior to this, that have not had the new algorithms back-ported, are not affected.

Remediation:
null pointer dereference in crop_page function
CVE: CVE-2018-20751
Component: podofo
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2018-11-19T00:00:00+00:00

An issue was discovered in crop_page in PoDoFo 0.9.6. For a crafted PDF document, pPage->GetObject()->GetDictionary().AddKey(PdfName("MediaBox"),var) can be problematic due to the function GetObject() being called for the pPage NULL pointer object. The value of pPage at this point is 0x0, which causes a NULL pointer dereference.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
buffer overflow in utils.c:checkmailpath() can lead to local arbitrary code execution
CVE: CVE-2018-1100
Component: zsh
CWE: CWE-121
Severity: Low
CVSS v3: 7.4/CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Release date: 2018-04-07T00:00:00+00:00

A buffer overflow flaw was found in the zsh shell check path functionality. A local, unprivileged user can create a specially crafted message file, which, if used to set a custom "you have new mail" message, leads to code execution in the context of the user who receives the message. If the user affected is privileged, this leads to privilege escalation.


Remediation:
ActiveMQ Client Missing TLS Hostname Verification
CVE: CVE-2018-11775
Component: activemq
Severity: Moderate
CVSS v3: 6.8/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Release date: 2018-09-10T00:00:00+00:00

TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a Java application using the ActiveMQ client and the ActiveMQ server. This is now enabled by default.


Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

Installation instructions are available from the Fuse 7.5.0 product documentation page:
https://access.redhat.com/documentation/en-us/red_hat_fuse/7.5/
/uploads/results page allows to remove files
CVE: CVE-2018-10867
Component: redhat-certification
CWE: CWE-552
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Release date: 2018-06-21T00:00:00+00:00

It has been discovered that redhat-certification does not restrict file access in the /update/results page. A remote attacker could use this vulnerability to remove any file accessible by the user which is running httpd.


Remediation:
If SELinux is enabled, it will restrict the number of files accessible by the httpd process.
Remote code execution in seamless_process_line
CVE: CVE-2018-20182
Component: rdesktop
CWE: CWE-119
Severity: Moderate
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2018-01-01T00:00:00+00:00

rdesktop versions up to and including v1.8.3 contain a Buffer Overflow over the global variables in the function seamless_process_line() that results in memory corruption and probably even a remote code execution.


Remediation:
out of bounds memory write in peXXigen.c files
CVE: CVE-2018-10534
Component: binutils
CWE: CWE-787
Severity: Low
CVSS v3: 2.9/CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Release date: 2018-04-24T00:00:00+00:00

The _bfd_XX_bfd_copy_private_bfd_data_common function in peXXigen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, processes a negative Data Directory size with an unbounded loop that increases the value of (external_IMAGE_DEBUG_DIRECTORY) *edd so that the address exceeds its own memory region, resulting in an out-of-bounds memory write, as demonstrated by objcopy copying private info with _bfd_pex64_bfd_copy_private_bfd_data_common in pex64igen.c.


Remediation:
CVE: CVE-2018-1000869
Component: CVE-2018-1000869
Release date: 2018-01-01T00:00:00+00:00

phpIPAM version 1.3.2 contains a CWE-89 vulnerability in /app/admin/nat/item-add-submit.php that can result in SQL Injection.. This attack appear to be exploitable via Rough user, exploiting the vulnerability to access information he/she does not have access to.. This vulnerability appears to have been fixed in 1.4.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Manipulation of cupsd.conf by a local attacker resulting in limited reads of arbitrary files as root
CVE: CVE-2018-4181
Component: cups
CWE: CWE-266
Severity: Moderate
CVSS v3: 5.6/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2018-05-09T00:00:00+00:00

In macOS High Sierra before 10.13.5, an issue existed in CUPS. This issue was addressed with improved access restrictions.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the cupsd service will be restarted automatically.
Buffer overflow in asm/stdscan.c:130 resulting in a denial of service
CVE: CVE-2018-1000886
Component: nasm
CWE: CWE-122
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2018-09-06T00:00:00+00:00

nasm version 2.14.01rc5, 2.15 contains a Buffer Overflow vulnerability in asm/stdscan.c:130 that can result in Stack-overflow caused by triggering endless macro generation, crash the program. This attack appear to be exploitable via a crafted nasm input file.


Remediation:
Stack buffer overflow in Skia
CVE: CVE-2018-6153
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2018-07-24T00:00:00+00:00

A precision error in Skia in Google Chrome prior to 68.0.3440.75 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
x86 PV guest may crash Xen with XPTI
CVE: CVE-2018-10471
Component: xen
CWE: CWE-787
Severity: Moderate
CVSS v3: 5.4/CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H
Release date: 2018-04-25T12:00:00+00:00

An OOB write issue was found in the way Xen hypervisor handled error in the Page Table Isolation (PTI) implementation, used to fix the Meltdown issue. It could occur while processing interrupt 'INT 0x80', when PV guest's vCPU has no handler for it. A malicious guest user/process could use this flaw to crash the hypervisor resulting in denial of service issue.


Remediation:
Server: DDL unspecified vulnerability (CPU Apr 2018)
CVE: CVE-2018-2813
Component: mysql
Severity: Moderate
CVSS v3: 4.5/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2018-04-17T00:00:00+00:00

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.59 and prior, 5.6.39 and prior and 5.7.21 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.
ata qc leak in drivers/scsi/libsas/sas_scsi_host.c allows local users to cause denial-of-service
CVE: CVE-2018-10021
Component: kernel
CWE: CWE-772
Severity: None
CVSS v3: 0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N
Release date: 2018-03-08T00:00:00+00:00

[Disputed] A memory leak was identified in the Serial Attached SCSI (SAS) implementation in the Linux kernel, specifically in the libsas component. This issue occurs when ATA devices in error handling (EH) fail to properly pass commands to libata, causing ATA queued commands (qc) to leak and triggering warnings. If enough ATA qcs are leaked, it can lead to allocation failures, causing I/O to block indefinitely, potentially resulting in a denial of service (DoS) due to memory exhaustion. However, this issue has been disputed, with claims that the vulnerability only arises under specific failure conditions that require physical proximity, such as unplugging SAS Host Bus Adapter cables.

Statement: This issue has been fully addressed with the release of Red Hat Enterprise Linux 8 and later, including Red Hat Enterprise Linux 9. As a result, no versions of Red Hat Enterprise Linux 8 and 9 are currently affected by this vulnerability.

Furthermore, Red Hat Product Security does not classify this as a security vulnerability. Given that the relevance of this vulnerability has been disputed by a third party vendors. The argument is that the issue can only be triggered under very specific conditions—namely, by physically proximate attackers who manually unplug SAS Host Bus Adapter cables. As a result, the vulnerability is not considered a significant security risk, since it requires direct physical access and cannot be exploited remotely. Given these constraints, this flaw is not classified as a security vulnerability, but rather a system reliability issue in highly specific, physical environments.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Server-side request forgery vulnerability (SECURITY-806)
CVE: CVE-2018-1000185
Component: jenkins-plugin-github-branch-source
CWE: CWE-918
Severity: Moderate
CVSS v3: 4.6/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Release date: 2018-06-04T00:00:00+00:00

A server-side request forgery vulnerability exists in Jenkins GitHub Branch Source Plugin 2.3.4 and older in Endpoint.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL.


Remediation:
an improper input validation leads to an out-of-bound read in git_delta_apply, allowing to read beyond delta limits
CVE: CVE-2018-10888
Component: libgit2
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2018-07-09T00:00:00+00:00

A missing check in git_delta_apply function in delta.c file may lead to an out-of-bound read while reading a binary delta file. An attacker may use this flaw to cause a Denial of Service.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Crash on invalid reply in XListExtensions in ListExt.c
CVE: CVE-2018-14598
Component: libX11
CWE: CWE-20
Severity: Moderate
CVSS v3: 5.8/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2018-08-21T00:00:00+00:00

It was discovered that libX11 does not properly validate input coming from the server, causing XListExtensions() and XGetFontPath() functions to produce an invalid list of elements that in turn make XFreeExtensionsList() and XFreeFontPath() access invalid memory. An attacker who can either configure a malicious X server or modify the data coming from one, could use this flaw to crash the application using libX11, resulting in a denial of service.

Statement: This issue did not affect the versions of libX11 as shipped with Red Hat Enterprise Linux 5 as they did not include the vulnerable code.

To exploit the vulnerability an attacker would need to have already compromised the X server used by your applications. Normally, the X client that runs libX11 and the X server runs on the same machine, thus if an attacker can trigger this flaw he has already compromised the X server, which runs as root, and he has already full control on the system. If the X client runs on another system than the X server (e.g. DISPLAY environment variable is used and it points to an X server on another system) then exploiting this vulnerability would only crash the client, which should not be run with high privileges.  For the above reasons, this flaw was rated as Moderate Impact.

Remediation:
Information Exposure through /v3/OS-FEDERATION/projects
CVE: CVE-2018-14432
Component: openstack-keystone
CWE: CWE-200
Severity: Important
CVSS v3: 5.4/CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2018-07-25T15:00:00+00:00

A flaw was found in Keystone federation. By doing GET /v3/OS-FEDERATION/projects an authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is affected.

Statement: Red Hat Quay does not include the vulnerable keystone/federation/controllers.py file fixed in [1]

[1] https://review.opendev.org/c/openstack/keystone/+/585782/

Remediation:
NULL pointer dereference via uriResetUri* function
CVE: CVE-2018-19200
Component: uriparser
CWE: CWE-476
Severity: Low
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2018-09-23T00:00:00+00:00

An issue was discovered in uriparser before 0.9.0. UriCommon.c allows attempted operations on NULL input via a uriResetUri* function.

Statement: This issue affects the versions of uriparser as shipped with Red Hat Enterprise Linux 7.

Remediation:
use of untrusted length field may lead to denial of service
CVE: CVE-2018-10922
Component: ttembed
CWE: CWE-20
Severity: Low
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2018-08-02T15:45:00+00:00

An input validation flaw exists in ttembed. With a crafted input file, an attacker may be able to trigger a denial of service condition due to ttembed trusting attacker controlled values.


Remediation:
Unintentional file and directory creation with directory traversal in tempfile and tmpdir
CVE: CVE-2018-6914
Component: ruby
CWE: CWE-22
Severity: Low
CVSS v3: 3.6/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Release date: 2018-03-28T00:00:00+00:00

It was found that the tmpdir and tempfile modules did not sanitize their file name argument. An attacker with control over the name could create temporary files and directories outside of the dedicated directory.

Statement: This issue affects the versions of ruby as shipped with Red Hat CloudForms 4. Red Hat Product Security has rated this issue as having security impact of Moderate. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

This issue affects the versions of ruby as shipped with Red Hat Subscription Asset Manager 1. Red Hat Product Security has rated this issue as having security impact of Moderate. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
arbitrary file write vulnerability / arbitrary code execution using a specially crafted zip file
CVE: CVE-2018-8009
Component: hadoop
CWE: CWE-20
Severity: Important
CVSS v3: 6.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2018-06-05T00:00:00+00:00

Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the zip slip vulnerability in places that accept a zip file.

Statement: This issue did not affect the versions of rhs-hadoop as shipped with Red Hat Gluster Storage 3. For JBoss Fuse 6.3 and 7 standalone, while they ship vulnerable artifact via camel-hbase, camel-hdfs2 (fuse 6.3) and camel-hdfs2 (fuse 7), there's no invocation on the flawed code that could lead to an unzip operation. So fuse 6.3, 7 standalone are not affected. However FIS 2.0 and Fuse 7 on OpenShift ship vulnerable artifact via maven BOM, so setting fuse as affected for this reason.

Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

Installation instructions are available from the Fuse 7.5.0 product documentation page:
https://access.redhat.com/documentation/en-us/red_hat_fuse/7.5/
remove a "system" file without authorization
CVE: CVE-2018-10866
Component: redhat-certification
CWE: CWE-862
Severity: Low
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Release date: 2018-06-21T00:00:00+00:00

It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthenticated user to remove a "system" file, that is an xml file with host related information, not belonging to him.


Remediation:
NULL pointer dereference in elf.c
CVE: CVE-2018-10535
Component: binutils
CWE: CWE-476
Severity: Low
CVSS v3: 2.9/CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Release date: 2018-04-24T00:00:00+00:00

The ignore_section_sym function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, does not validate the output_section pointer in the case of a symtab entry with a "SECTION" type that has a "0" value, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file, as demonstrated by objcopy.


Remediation:
CVE: CVE-2018-1000868
Component: CVE-2018-1000868
Release date: 2018-01-01T00:00:00+00:00

WeBid version up to current version 1.2.2 contains a Cross Site Scripting (XSS) vulnerability in user_login.php, register.php that can result in Javascript execution in the user's browser, injection of malicious markup into the page. This attack appear to be exploitable via The victim user must click a malicous link. This vulnerability appears to have been fixed in after commit 256a5f9d3eafbc477dcf77c7682446cc4b449c7f.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Local privilege escalation to root due to insecure environment variable handling
CVE: CVE-2018-4180
Component: cups
CWE: CWE-642
Severity: Moderate
CVSS v3: 7.4/CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2018-05-09T00:00:00+00:00

It was discovered that CUPS allows non-root users to pass environment variables to CUPS backends. Affected backends use attacker-controlled environment variables without proper sanitization. A local attacker, who is part of one of the groups specified in the SystemGroups directive, could use the cupsctl binary to set SetEnv and PassEnv directives and potentially controls the flow of the affected backend, resulting in some cases in arbitrary code execution with root privileges.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the cupsd service will be restarted automatically.
Do not add untrusted users to sys and root groups.
Divide-by-zero in the function H5D__chunk_init() resulting in a denial of service
CVE: CVE-2018-15672
Component: hdf5
CWE: CWE-369
Severity: Moderate
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2018-08-18T00:00:00+00:00

No description is available for this CVE.


Remediation:
CVE: CVE-2018-1000887
Component: CVE-2018-1000887
Release date: 2018-01-01T00:00:00+00:00

Peel shopping peel-shopping_9_1_0 version contains a Cross Site Scripting (XSS) vulnerability that can result in an authenticated user injecting java script code in the "Site Name EN" parameter. This attack appears to be exploitable if the malicious user has access to the administration account.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Local file write in DevTools
CVE: CVE-2018-6152
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2018-07-24T00:00:00+00:00

The implementation of the Page.downloadBehavior backend unconditionally marked downloaded files as safe, regardless of file type in Google Chrome prior to 66.0.3359.117 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted HTML page and user interaction.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.