huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Arbitrary Code Execution vulnerability (APSB18-42)
CVE: CVE-2018-15982
Component: flash-plugin
CWE: CWE-416
Severity: Critical
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2018-12-05T00:00:00+00:00

Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.


Remediation:
URL spoof in Omnibox
CVE: CVE-2018-6172
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2018-07-24T00:00:00+00:00

Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Remote arbitrary file disclosure vulnerability via WEBSERVICE formula
CVE: CVE-2018-6871
Component: libreoffice
CWE: CWE-200
Severity: Moderate
CVSS v3: 4.6/CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2018-02-12T00:00:00+00:00

A flaw was found in libreoffice before 5.4.5 and before 6.0.1. Arbitrary remote file disclosure may be achieved by the use of the WEBSERVICE formula in a specially crafted ODS file.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of LibreOffice applications must be restarted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of LibreOffice applications must be restarted for this update to take effect.
GCM tag forgery via truncated tag in finalize_with_tag API
CVE: CVE-2018-10903
Component: python-cryptography
CWE: CWE-20
Severity: Moderate
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2018-07-18T00:00:00+00:00

A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.


Remediation:
a user who can escalate to yarn user can possibly run arbitrary commands as root user
CVE: CVE-2018-8029
Component: hadoop
CWE: CWE-284
Severity: Moderate
CVSS v3: 9.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2018-01-01T00:00:00+00:00

A flaw was found in Apache Hadoop in versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4. A user who can escalate to a yarn user can possibly run arbitrary commands as root user. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Remediation:
"Just in Time" PRIME + PROBE cache-based side channel attack can lead to plaintext recovery
CVE: CVE-2018-10846
Component: gnutls
CWE: CWE-327
Severity: Moderate
CVSS v3: 5.1/CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
Release date: 2018-08-21T00:00:00+00:00

A cache-based side channel attack was found in the way GnuTLS implements CBC-mode cipher suites. An attacker could use a combination of "Just in Time" Prime+probe and Lucky-13 attacks to recover plain text in a cross-VM attack scenario.


Remediation:
9pfs: Use-after-free due to race condition while updating fid path
CVE: CVE-2018-19364
Component: Qemu
CWE: CWE-362
Severity: Low
CVSS v3: 2.7/CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L
Release date: 2018-11-07T00:00:00+00:00

hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid path while it is being accessed by a second thread, leading to (for example) a use-after-free outcome.


Remediation:
insufficient user gesture requirements in autofill
CVE: CVE-2018-6037
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2018-01-24T00:00:00+00:00

Inappropriate implementation in autofill in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to obtain autofill data with insufficient user gestures via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
improper implementation of GPOs due to too restrictive permissions
CVE: CVE-2018-16838
Component: sssd
CWE: CWE-269
Severity: Low
CVSS v3: 5.6/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Release date: 2018-01-01T00:00:00+00:00

A flaw was found in sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to a too strict permission settings on the server side, SSSD will allow all authenticated users to login instead of denying access.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/2974891
Multiple vulnerabilities
CVE: CVE-2018-20459
Component: radare2
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2018-12-02T00:00:00+00:00

In radare2 through 3.1.3, the armass_assemble function in libr/asm/arch/arm/armass.c allows attackers to cause a denial-of-service (application crash by out-of-bounds read) by crafting an arm assembly input because a loop uses an incorrect index in armass.c and certain length validation is missing in armass64.c, a related issue to CVE-2018-20457.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
improper DNS packet size check
CVE: CVE-2018-12178
Component: edk2
CWE: CWE-787
Severity: Important
CVSS v3: 7.1/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L
Release date: 2018-01-01T00:00:00+00:00

A missing check leads to an out-of-bounds read and write flaw in NetworkPkg/DnsDxe as shipped in edk2, when it parses DNS responses. A remote attacker who controls the DNS server used by the vulnerable firmware may use this flaw to make the system crash.

Statement: This issue did not affect the versions of OVMF as shipped with Red Hat Enterprise Linux 7 as they were not compiled with HTTP_BOOT_ENABLE set, thus they do not contain the vulnerable code.

Remediation:
CVE: CVE-2018-1000848
Component: CVE-2018-1000848
Release date: 2018-01-01T00:00:00+00:00

Wampserver version prior to version 3.1.5 contains a Cross Site Scripting (XSS) vulnerability in index.php localhost page that can result in very low. This attack appear to be exploitable via payload onmouseover. This vulnerability appears to have been fixed in 3.1.5 and later.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
memory leak in epan/dissectors/packet-smb2.c
CVE: CVE-2018-9268
Component: wireshark
CWE: CWE-400
Severity: Low
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2018-03-06T00:00:00+00:00

In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-smb2.c has a memory leak.


Remediation:
FPU state information leakage via lazy FPU restore
CVE: CVE-2018-3665
Component: Kernel
CWE: CWE-200
Severity: Moderate
CVSS v3: 5.4/CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Release date: 2018-06-13T21:00:00+00:00

A Floating Point Unit (FPU) state information leakage flaw was found in the way the Linux kernel saved and restored the FPU state during task switch. Linux kernels that follow the "Lazy FPU Restore" scheme are vulnerable to the FPU state information leakage issue. An unprivileged local attacker could use this flaw to read FPU state bits by conducting targeted cache side-channel attacks, similar to the Meltdown vulnerability disclosed earlier this year.

Statement: This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5, 6, 7, and Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise Linux 6, 7, and Red Hat Enterprise MRG 2 may address this issue.

Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and
maintenance life cycle. This has been rated as having Moderate security
impact and is not currently planned to be addressed in future updates. For
additional information, refer to the Red Hat Enterprise Linux Life
Cycle: https://access.redhat.com/support/policy/updates/errata/.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
RHEL-7 will automatically default to (safe) “eager” floating point register restore on Sandy Bridge and newer Intel processors. AMD processors are not affected. You can mitigate this issue on older processors by booting the kernel with the 'eagerfpu=on' parameter to enable eager FPU restore mode.  In this mode FPU state is saved and restored for every task/context switch regardless of whether the current process invokes FPU instructions or not. The parameter does not affect performance negatively, and can be applied with no adverse effects to processors that are not affected.
Use of v2 grant tables may cause crash on ARM (XSA-268)
CVE: CVE-2018-15469
Component: xen
CWE: CWE-665
Severity: Moderate
CVSS v3: 5.2/CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Release date: 2018-08-14T17:00:00+00:00

An issue was discovered in Xen through 4.11.x. ARM never properly implemented grant table v2, either in the hypervisor or in Linux. Unfortunately, an ARM guest can still request v2 grant tables; they will simply not be properly set up, resulting in subsequent grant-related hypercalls hitting BUG() checks. An unprivileged guest can cause a BUG() check in the hypervisor, resulting in a denial-of-service (crash).


Remediation:
CVE: CVE-2018-6349
Component: CVE-2018-6349
Release date: 2018-01-01T00:00:00+00:00

When receiving calls using WhatsApp for Android, a missing size check when parsing a sender-provided packet allowed for a stack-based overflow. This issue affects WhatsApp for Android prior to 2.18.248 and WhatsApp Business for Android prior to 2.18.132.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Stack-based buffer overflow in ffghbn() allows for potential code execution
CVE: CVE-2018-3848
Component: cfitsio
CWE: CWE-121
Severity: Important
CVSS v3: 7.3/CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2018-03-10T00:00:00+00:00

In the ffghbn function in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigger this vulnerability and potentially gain code execution.


Remediation:
Cross-site scripting in i18n-test/unit.html and _base/i18nExhaustive.js
CVE: CVE-2018-1000665
Component: dojo
CWE: CWE-79
Severity: Moderate
CVSS v3: 8.0/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Release date: 2018-09-06T00:00:00+00:00

Dojo Dojo Objective Harness (DOH) version prior to version 1.14 contains a Cross Site Scripting (XSS) vulnerability in unit.html and testsDOH/_base/loader/i18n-exhaustive/i18n-test/unit.html and testsDOH/_base/i18nExhaustive.js in the DOH that can result in Victim attacked through their browser - deliver malware, steal HTTP cookies, bypass CORS trust. This attack appear to be exploitable via Victims are typically lured to a web site under the attacker's control; the XSS vulnerability on the target domain is silently exploited without the victim's knowledge. This vulnerability appears to have been fixed in 1.14.


Remediation:
Unprivileged read of deleted object tombstones in AD LDAP server
CVE: CVE-2018-14628
Component: samba
CWE: CWE-862
Severity: Moderate
CVSS v3: 4.5/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2018-01-01T00:00:00+00:00

An information leak vulnerability was discovered in Samba's LDAP server.  Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store.

Statement: Samba 4 packages distributed with Red Hat Enterprise Linux are built without the AD DC functionality, where this flaw is present.  These packages are not affected by this vulnerability.

Remediation:
CVE: CVE-2018-1002208
Component: CVE-2018-1002208
Release date: 2018-06-11T00:00:00+00:00

SharpZipLib before 1.0 RC1 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Resource exhaustion in bgp_attr_print() function in print-bgp.c
CVE: CVE-2018-16300
Component: tcpdump
CWE: CWE-400
Severity: Low
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2018-01-01T00:00:00+00:00

An uncontrolled resource consumption flaw was discovered in the way tcpdump prints BGP packets. The BGP protocol allows ATTR_SET to be nested as many times as the message can accommodate, however when a specially crafted packet is crafted and parsed by tcpdump, this may lead to stack exhaustion due to uncontrolled recursion. System availability is the highest threat from this vulnerability.


Remediation:
Memory leak in the formatIPTCfromBuffer function in coders/meta.c
CVE: CVE-2018-16750
Component: ImageMagick
CWE: CWE-400
Severity: Low
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2018-09-11T00:00:00+00:00

In ImageMagick 7.0.7-29 and earlier, a memory leak in the formatIPTCfromBuffer function in coders/meta.c was found.


Remediation:
decompile.c: decompileJUMP() mishandles cases where the header indicates a file size greater than the actual size
CVE: CVE-2018-11095
Component: ming
CVSS v3: 5.8/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2018-05-14T00:00:00+00:00

The decompileJUMP function in decompile.c in libming through 0.4.8 mishandles cases where the header indicates a file size greater than the actual size, which allows remote attackers to cause a denial of service (Segmentation fault and application crash) or possibly have unspecified other impact.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
predictable temporary file name in test-xcf.c unit test
CVE: CVE-2018-12713
Component: gimp
CWE: CWE-20
Severity: Low
CVSS v3: 6.7/CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2018-06-21T00:00:00+00:00

GIMP through 2.10.2 makes g_get_tmp_dir calls to establish temporary filenames, which may result in a filename that already exists, as demonstrated by the gimp_write_and_read_file function in app/tests/test-xcf.c. This might be leveraged by attackers to overwrite files or read file content that was intended to be private.

Statement: This issue did affect the versions of gimp as shipped with Red Hat Enterprise Linux 7. However, as this is an issue in a unit test, it is not a problem if you are using the precompiled gimp package. This is only a problem if you recompile gimp using the src.rpm/SPEC file. Even then it's only a problem if you do not make use of isolating build tools like mock, but instead use rpmbuild directly.

Remediation:
SIGABRT PDFDoc::setup class in PDFDoc.cc
CVE: CVE-2018-20662
Component: poppler
CWE: CWE-617
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2018-12-30T00:00:00+00:00

In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc allows attackers to cause a denial-of-service (application crash caused by Object.h SIGABRT, because of a wrong return value from PDFDoc::setup) by crafting a PDF file in which an xref data structure is mishandled during extractPDFSubtype processing.


Remediation:
Improper URL path validation allows for bypassing of security checks on static resources
CVE: CVE-2018-1199
Component: spring-framework
CWE: CWE-20
Severity: Important
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2018-01-29T00:00:00+00:00

Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. In this particular attack, different character encodings used in path parameters allows secured Spring MVC static resource URLs to be bypassed.


Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

Updating instructions and release notes may be found at:

https://access.redhat.com/articles/3060411
As a general precaution, users are encouraged to separate public and private resources. For example, separating static resources and mapping them to /resources/public/** and /resources/private/** is preferred to having one common root with mixed public and private resource content underneath.
CVE: CVE-2018-1000059
Component: CVE-2018-1000059
Release date: 2018-01-01T00:00:00+00:00

ValidFormBuilder version 4.5.4 contains a PHP Object Injection vulnerability in Valid Form unserialize method that can result in Possible to execute unauthorised system commands remotely and disclose file contents in file system.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
out-of-bounds read in dwgCompressor::decompress18 in dwgutil.cpp
CVE: CVE-2018-14444
Component: libdxfrw
CVSS v3: 3.9/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2018-07-17T00:00:00+00:00

libdxfrw 0.6.3 has an Integer Overflow in dwgCompressor::decompress18 in dwgutil.cpp, leading to an out-of-bounds read and application crash.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
integer overflow in dbentry->n_key_data in kadmin/dbutil/dump.c
CVE: CVE-2018-5709
Component: krb5
CWE: CWE-190
Severity: None
CVSS v3: 6.5/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2018-01-15T00:00:00+00:00

An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.

Statement: This is essentially an integer truncation issue, and not an integer overflow. We have determined that this should not affect any other data allocated close to the  16-bit integer in question "dbentry-> n_key_data". Red Hat Product Security does not consider this issue as a security flaw.

Remediation:
Session fixation vulnerability on user signup
CVE: CVE-2018-1000409
Component: jenkins
CWE: CWE-384
Severity: Moderate
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Release date: 2018-10-10T00:00:00+00:00

A session fixation vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java that prevented Jenkins from invalidating the existing session and creating a new one when a user signed up for a new user account.


Remediation:
Before applying this update, ensure all previously released errata relevant to your system have been applied.

See the following documentation, which will be updated shortly for release  3.11.51, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258.
DCOM dissector crash resulting in information leak
CVE: CVE-2018-19626
Component: wireshark
CWE: CWE-456
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
Release date: 2018-11-27T00:00:00+00:00

Missing initialization of buffer in DCOM dissector could allow Wireshark to crash when parsing a specially crafted pcap file. A remote attacker could cause a denial of service to Wireshark by injecting malicious packets into the network that are automatically processed. Moreover, the content of uninitialized stack memory is leaked to the local user via Wireshark, causing an information leak as secondary impact.

Statement: This issue did not affect the versions of wireshark as shipped with Red Hat Enterprise Linux 5, 6 and 7.

Remediation: