huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Use after free in HTML select elements
CVE: CVE-2019-5759
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2019-01-29T00:00:00+00:00

Incorrect lifetime handling in HTML select elements in Google Chrome on Android and Mac prior to 72.0.3626.81 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
XSS vulnerability in function clearFilter() in utilities.php
CVE: CVE-2019-11025
Component: cacti
CVSS v3: 4.5/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Release date: 2019-03-28T00:00:00+00:00

In clearFilter() in utilities.php in Cacti before 1.2.3, no escaping occurs before printing out the value of the SNMP community string (SNMP Options) in the View poller cache, leading to XSS.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2019-11926
Component: CVE-2019-11926
Release date: 2019-01-01T00:00:00+00:00

Insufficient boundary checks when processing M_SOFx markers from JPEG headers in the GD extension could allow access to out-of-bounds memory via a maliciously constructed invalid JPEG input. This issue affects HHVM versions prior to 3.30.9, all versions between 4.0.0 and 4.8.3, all versions between 4.9.0 and 4.15.2, and versions 4.16.0 to 4.16.3, 4.17.0 to 4.17.2, 4.18.0 to 4.18.1, 4.19.0, 4.20.0 to 4.20.1.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Authorization bypass via null characters injection in HTTP/1.x
CVE: CVE-2019-9900
Component: istio/envoy
CWE: CWE-20
Severity: Important
CVSS v3: 8.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Release date: 2019-04-05T00:00:00+00:00

A flaw was found in Envoy version 1.9.0 and older, where Envoy does not reject embedded zero characters (NUL, ASCII 0x0) when processing HTTP/1.x header values. This flaw allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules, gaining access to unauthorized resources.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Corrupt MQTT frame can cause broker shutdown
CVE: CVE-2019-0222
Component: activemq
Severity: Moderate
CVSS v3: 5.8/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2019-03-27T00:00:00+00:00

In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.


Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link (you must log in to download the update).
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link (you must log in to download the update).
denial of service in _RADIUSAttrPacketListField
CVE: CVE-2019-1010262
Component: scapy
CVSS v3: 4.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2019-01-08T00:00:00+00:00

No description is available for this CVE.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Incorrect security UI in Omnibox
CVE: CVE-2019-13761
Component: chromium-browser
Severity: Low
CVSS v3: 4.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2019-12-10T00:00:00+00:00

Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
use-after-free and OOPS in drivers/char/ipmi/ipmi_msghandler.c
CVE: CVE-2019-9003
Component: kernel
CWE: CWE-416
Severity: Low
CVSS v3: 5.1/CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2019-01-16T00:00:00+00:00

A use-after-free and OOPs flaw was found in the Linux kernel's drivers/char/ipmi/ipmi_msghandler.c code. By arranging certain simultaneous execution of the code accessing IPMI device files, an attacker can cause a denial of service (DoS) attack.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Improper input validation in request allows for proxy manipulation
CVE: CVE-2019-12520
Component: squid
CWE: CWE-20
Severity: Moderate
CVSS v3: 7.4/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2019-01-01T00:00:00+00:00

A flaw was found in squid. The absolute URL of a request can include the decoded UserInfo (username and password) for certain protocols. This decoded info may contain special characters to delimit the domain, and treat the rest of the URL as a path or query string. An attacker could first make a request to their domain using an encoded username, then when a request for the target domain comes in that decodes to the exact URL, it will serve the attacker's HTML instead of the real HTML. On Squid servers that also act as reverse proxies, this allows an attacker to gain access to features that only reverse proxies can use, such as ESI.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the squid service will be restarted automatically.
out of bounds read in F2FS touch driver leads to local information disclosure
CVE: CVE-2019-9453
Component: kernel
CWE: CWE-200
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Release date: 2019-09-03T00:00:00+00:00

In the Android kernel in F2FS touch driver there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with system execution privileges needed. User interaction is not needed for exploitation.


Remediation:
Incomplete fixes for CVE-2019-1002101 and CVE-2019-11246, kubectl cp potential directory traversal
CVE: CVE-2019-11249
Component: kubernetes
CWE: CWE-22
Severity: Moderate
CVSS v3: 4.9/CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
Release date: 2019-08-05T00:00:00+00:00

The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user’s machine when kubectl cp is called, limited only by the system permissions of the local user. Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions prior to 1.15.2, and versions 1.1, 1.2, 1.4, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11, 1.12.


Remediation:
For OpenShift Container Platform 3.10 see the following documentation,
which will be updated shortly for release 3.10.181, for important
instructions on how to upgrade your cluster and fully apply this
asynchronous errata update:

https://docs.openshift.com/container-platform/3.10/release_notes/ocp_3_10_release_notes.html
Before applying this update, ensure all previously released errata
relevant to your system have been applied.

For OpenShift Container Platform 3.11 see the following documentation,
which will be updated shortly for release 3.11.146, for important
instructions on how to upgrade your cluster and fully apply this
asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258.
For OpenShift Container Platform 3.9 see the following documentation, which
will be updated shortly for release 3.9.102, for important instructions on
how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/3.9/release_notes/ocp_3_9_release_notes.html
Before applying this update, ensure all previously released errata
relevant to your system have been applied.

For OpenShift Container Platform 4.1 see the following documentation, which
will be updated shortly for release 4.1.16, for important instructions on
how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/4.1/release_notes/ocp-4-1-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.1/updating/updating-cluster-cli.html.
Improper application of config allows for insecure ciphers and TLS 1.0
CVE: CVE-2019-3818
Component: kube-rbac-proxy
CWE: CWE-327
Severity: Low
CVSS v3: 3.6/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2019-01-25T00:00:00+00:00

The kube-rbac-proxy container, as used in Red Hat OpenShift Container Platform, does not honor TLS configurations allowing for the use of insecure ciphers and TLS 1.0. An attacker could target traffic sent over a TLS connection with a weak configuration and potentially break the encryption of the data stream.


Remediation:
Before applying this update, ensure all previously released errata relevant to your system have been applied.

See the following documentation, which will be updated shortly for release 3.11.82, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258.
Incorrect state management leading to universal cross-site scripting
CVE: CVE-2019-8813
Component: webkitgtk
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2019-11-08T00:00:00+00:00

A logic issue was addressed with improved state management. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0. Processing maliciously crafted web content may lead to universal cross site scripting.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

GDM must be restarted for this update to take effect.
Content Security Policy bypass for XSL stylesheet
CVE: CVE-2019-17020
Component: Mozilla
CWE: CWE-20
Severity: Important
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Release date: 2019-01-01T00:00:00+00:00

If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL sheet e.g. includes JavaScript, it would bypass any of the restrictions of the Content Security Policy applied to the XML document. This vulnerability affects Firefox < 72.


Remediation:
out-of-bounds read in function SDL_InvalidateMap in video/SDL_pixels.c
CVE: CVE-2019-12222
Component: SDL
CWE: CWE-125
Severity: Moderate
CVSS v3: 5.0/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Release date: 2019-05-20T00:00:00+00:00

An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9. There is an out-of-bounds read in the function SDL_InvalidateMap at video/SDL_pixels.c.

Statement: This issue did not affect the versions of SDL as shipped with Red Hat Enterprise Linux 5, 6, 7, and 8 as they did not include SDL2_Image add-on.

Remediation:
denial of service due to incorrect width and height value of JPEG image
CVE: CVE-2019-13960
Component: libjpeg-turbo
CWE: CWE-400
Severity: Low
CVSS v3: 3.9/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2019-07-18T00:00:00+00:00

In libjpeg-turbo 2.0.2, a large amount of memory can be used during processing of an invalid progressive JPEG image containing incorrect width and height values in the image header. NOTE: the vendor's expectation, for use cases in which this memory usage would be a denial of service, is that the application should interpret libjpeg warnings as fatal errors (aborting decompression) and/or set limits on resource consumption or image sizes

Statement: Upstream suggests that applications compiled against libjpeg-turbo should treat these warnings and fatal and abort parsing the image. They do not consider this issue as a security flaw.

Remediation:
requests to debug api can result in panic
CVE: CVE-2019-25014
Component: istio-pilot
CWE: CWE-125
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2019-11-06T00:00:00+00:00

An out-of-bounds read flaw was found in istio-pilot. This flaw allows an attacker to send a crafted HTTP GET request to the pilot debug API endpoint. This action causes pilot to panic, resulting in a denial of service to the istio pilot application. The highest threat from this vulnerability is to system availability.


Remediation:
XSSI due to invalid javascript
CVE: CVE-2019-9644
Component: python-notebook
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Release date: 2019-03-13T00:00:00+00:00

An XSSI (cross-site inclusion) vulnerability in Jupyter Notebook before 5.7.6 allows inclusion of resources on malicious pages when visited by users who are authenticated with a Jupyter server. Access to the content of resources has been demonstrated with Internet Explorer through capturing of error messages, though not reproduced with other browsers. This occurs because Internet Explorer's error messages can include the content of any invalid JavaScript that was encountered.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
SCTP: use-after-free while traversing list of endpoint associations
CVE: CVE-2019-8956
Component: Kernel
CWE: CWE-416
Severity: Important
CVSS v3: 7.7/CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Release date: 2019-02-21T00:00:00+00:00

A use-after-free issue was found in the Linux kernel's SCTP implementation. The issue could occur while traversing a list of endpoint associations to send a message to all of them via SCTP_SENDALL process. A user/process could use this flaw to crash the kernel resulting in a denial of service or potentially escalate privileges on a system.

Statement: This issue does not affect the versions of the kernel package as shipped with Red Hat Enterprise Linux 5, 6, 7, and Red Hat Enterprise MRG 2.

Remediation:
null-deference read in RPCAP dissector
CVE: CVE-2019-9214
Component: wireshark
CWE: CWE-476
Severity: Moderate
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2019-02-27T00:00:00+00:00

In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the RPCAP dissector could crash. This was addressed in epan/dissectors/packet-rpcap.c by avoiding an attempted dereference of a NULL conversation.

Statement: This issue did not affect the versions of wireshark as shipped with Red Hat Enterprise Linux 5, 6, and 7.

Remediation:
Improper handling of buffer limits for CAC certificates
CVE: CVE-2019-19481
Component: opensc
CWE: CWE-119
Severity: Moderate
CVSS v3: 4.5/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2019-10-30T00:00:00+00:00

An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-cac1.c mishandles buffer limits for CAC certificates.


Remediation:
memory leak in mwifiex_tm_cmd in drivers/net/wireless/marvell/mwifiex/cfg80211.c
CVE: CVE-2019-20095
Component: kernel
CWE: CWE-772
Severity: Low
CVSS v3: 5.2/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Release date: 2019-12-30T00:00:00+00:00

A flaw was found in the Linux kernel's mwifiex driver implementation when connecting to other WiFi devices in "Test Mode." A kernel memory leak can occur if an error condition is met during the parameter negotiation. This issue can lead to a denial of service if multiple error conditions meeting the repeated connection attempts are attempted.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
As connecting to a wireless device is not automatic and initiated by a user, not connecting to rogue access points would prevent this flaw from being abused.
Several CVEs fixed in nextcloud 15, 16 and 17
CVE: CVE-2019-15621
Component: nextcloud
Release date: 2019-01-01T00:00:00+00:00

Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
an attacker can inject data into the TCP stream which allows a hijack of active connections inside the VPN tunnel
CVE: CVE-2019-14899
Component: VPN
CVSS v3: 7.5/CVSS:3.0/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2019-12-04T15:00:00+00:00

A flaw was found in openvpn. A malicous access point or adjacent user can determine if a connected user is using a VPN by making positive inferences about the websites they are visiting, and determining the correct sequence and acknowledgement numbers in use, which allows the attacker to inject data into the TCP stream. With this information, an attacker could hijack an active connection inside the VPN tunnel. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: This issue did not affect Red Hat Enterprise Linux 5, 6, 7, and 8 as openvpn package is currently not provided in any of our supported products.

Remediation:
cached use of fpu_fpregs_owner_ctx in arch/x86/include/asm/fpu/internal.h can lead to DoS
CVE: CVE-2019-19602
Component: kernel
CWE: CWE-672
Severity: Moderate
CVSS v3: 6.2/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Release date: 2019-11-26T00:00:00+00:00

A flaw was found in the Linux kernel. When compiled with GCC 9, a vector register corruption occurs on return from a signal handler where the top page of the signal stack had not yet been paged in which can allow a local attacker with special user privilege (or root) to leak kernel internal information. The highest threat from this vulnerability is to data confidentiality.


Remediation:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from the References section.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
vcs_write in drivers/tty/vt/vc_screen.c does not prevent write access to vcsu devices
CVE: CVE-2019-19252
Component: kernel
CWE: CWE-862
Severity: Low
CVSS v3: 5.6/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2019-11-25T00:00:00+00:00

A flaw was found in the Linux kernel’s virtual console implementation of Unicode usage. This flaw allows a local attacker with permissions on the /dev/vcsu* devices to crash the system or corrupt memory.


Remediation:
At this time there is no workaround that is suitable for a production system that would completely mitigate this flaw.
Multiple memory corruption issues leading to arbitrary code execution
CVE: CVE-2019-8686
Component: webkitgtk
Severity: Moderate
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2019-08-29T00:00:00+00:00

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution.


Remediation:
heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c
CVE: CVE-2019-7573
Component: SDL
CWE: CWE-122
Severity: Low
CVSS v3: 5.0/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Release date: 2019-02-06T00:00:00+00:00

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (inside the wNumCoef loop).


Remediation: