huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
non-atomic modification of live EPT PTE leads to DoS (XSA-328)
CVE: CVE-2020-15567
Component: xen
CWE: CWE-362
Severity: Moderate
CVSS v3: 7.4/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H
Release date: 2020-07-07T12:00:00+00:00

An issue was discovered in Xen through 4.13.x, allowing Intel guest OS users to gain privileges or cause a denial of service because of non-atomic modification of a live EPT PTE. When mapping guest EPT (nested paging) tables, Xen would in some circumstances use a series of non-atomic bitfield writes. Depending on the compiler version and optimisation flags, Xen might expose a dangerous partially written PTE to the hardware, which an attacker might be able to race to exploit. A guest administrator or perhaps even an unprivileged guest user might be able to cause denial of service, data corruption, or privilege escalation. Only systems using Intel CPUs are vulnerable. Systems using AMD CPUs, and Arm systems, are not vulnerable. Only systems using nested paging (hap, aka nested paging, aka in this case Intel EPT) are vulnerable. Only HVM and PVH guests can exploit the vulnerability. The presence and scope of the vulnerability depends on the precise optimisations performed by the compiler used to build Xen. If the compiler generates (a) a single 64-bit write, or (b) a series of read-modify-write operations in the same order as the source code, the hypervisor is not vulnerable. For example, in one test build using GCC 8.3 with normal settings, the compiler generated multiple (unlocked) read-modify-write operations in source-code order, which did not constitute a vulnerability. We have not been able to survey compilers; consequently we cannot say which compiler(s) might produce vulnerable code (with which code-generation options). The source code clearly violates the C rules, and thus should be considered vulnerable.

Statement: This flaw affects systems using Intel CPUs with support for nested paging (HAP). Only HVM and PVH guests can exploit the vulnerability, PV guests are not affected by this flaw.

Remediation:
Switching to shadow paging (e.g. using the `hap=0` xl domain domain configuration file parameter) will avoid exposing the vulnerability to those guests.
outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h
CVE: CVE-2020-27768
Component: ImageMagick
CWE: CWE-190
Severity: Low
CVSS v3: 3.2/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2020-01-01T00:00:00+00:00

In ImageMagick, there is an outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h.

Statement: This flaw is out of support scope for Red Hat Enterprise Linux 5, 6, and 7. Inkscape is not affected because it no longer uses a bundled ImageMagick in Red Hat Enterprise Linux 8. For more information regarding support scopes, please see https://access.redhat.com/support/policy/updates/errata .

Remediation:
Memory safety bugs fixed in Thunderbird 78
CVE: CVE-2020-12426
Component: Mozilla
CWE: CWE-120
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-07-16T00:00:00+00:00

Mozilla developers and community members reported memory safety bugs present in Firefox 77. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 78.


Remediation:
Workspaces module doesn't sufficiently check access permissions when switching workspaces
CVE: CVE-2020-13667
Component: drupal
CVSS v3: 7.4/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2020-01-01T00:00:00+00:00

Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions. The Workspaces module doesn't sufficiently check access permissions when switching workspaces, leading to an access bypass vulnerability. An attacker might be able to see content before the site owner intends people to see the content. This vulnerability is mitigated by the fact that sites are only vulnerable if they have installed the experimental Workspaces module. This issue affects Drupal Core8.8.X versions prior to 8.8.10; 8.9.X versions prior to 8.9.6; 9.0.X versions prior to 9.0.6.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Insufficient data validation in cros-disks
CVE: CVE-2020-16035
Component: chromium-browser
Severity: Moderate
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-11-17T00:00:00+00:00

Insufficient data validation in cros-disks in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had compromised the browser process to bypass noexec restrictions via a malicious file.


Remediation:
Segmentation fault in SSL_check_chain causes denial of service
CVE: CVE-2020-1967
Component: openssl
CWE: CWE-476
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-04-21T00:00:00+00:00

A NULL pointer dereference flaw was found in the way OpenSSL handled certain TLS handshake messages. This flaw allows an unauthenticated attacker to cause a server application compiled with OpenSSL to crash, causing a denial of service. In some cases a malicious server could also cause a client compiled with OpenSSL to crash.

Statement: This flaw was introduced by the following OpenSSL commit:
https://github.com/openssl/openssl/commit/5235ef44b93306a14d0b6c695b13c64b16e1fdec
which was shipped as a part of OpenSSL-1.1.1d, therefore older versions are not affected by this flaw. 
OpenSSL packages shipped with Red Hat Products are NOT affected by this flaw.

The affected  `signature_algorithm_cert`  check which causes the flaw is only applied to TLS 1.3, therefore older versions of TLS are not be affected by this flaw.

Also, the vulnerable `SSL_check_chain()` is not called directly from libssl, but may be used by the application inside a callback (e.g., client_hello or cert callback) to verify that a candidate certificate chain will be acceptable to the client. Thus, applications that use openssl without invoking the `SSL_check_chain()` function are not vulnerable to this flaw.

Lastly, no Red Hat Middleware products ship the affected version of OpenSSL. However, some components, such as Netty and Wildfly, may be configured by customers to use any OpenSSL version. Customers who have configured their setups to use a vulnerable version of OpenSSL are advised to upgrade to the latest unaffected version immediately.

Remediation:
Applications compiled with OpenSSL >= 1.1.1d that either use openssl without invoking the `SSL_check_chain()` function or do not use TLS 1.3 are not vulnerable to this flaw.
an attacker could leverage the way that HTML is rendered for affected forms
CVE: CVE-2020-13688
Component: drupal
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Release date: 2020-09-16T00:00:00+00:00

Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.X versions prior to 8.8.10; 8.9.X versions prior to 8.9.6; 9.0.X versions prior to 9.0.6.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Integer overflow on 32bit architectures via crafted certificate allows for denial of service
CVE: CVE-2020-7919
Component: golang
CWE: CWE-190
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-01-28T00:00:00+00:00

An integer overflow vulnerability was found in the Go crypto/x509 and golang.org/x/crypto/cryptobyte libraries on 32-bit architectures. A remote attacker could exploit this by supplying a crafted x.509 certificate, or other ASN.1 structure, as either a client or server to crash vulnerable Go applications.

Statement: Below products are only supported on 64bit architectures and are therefore not affected by this flaw:

* OpenShift Container Platform
* OpenShift Service Mesh 
* Red Hat Ceph Storage
* Red Hat Gluster Storage
* Container-native Virtualization

Remediation:
Buffer overflow in function H5S_close at H5S.c
CVE: CVE-2020-18494
Component: hdf5
CWE: CWE-119
Severity: Moderate
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-01-01T00:00:00+00:00

A flaw was found in the HDF5 package. Affected versions of this package are vulnerable to an out-of-bounds issue in the H5S_close function in H5S.c, which allows remote attackers to run arbitrary code via the creation of a crafted file.


Remediation:
Data Manipulation with X-Forwarded-For header at WordPress
CVE: CVE-2020-35539
Component: wordpress
Release date: 2020-01-01T00:00:00+00:00

No description is available for this CVE.

Statement: Red Hat Product Security does not consider this to be a vulnerability.

Remediation:
heap-based buffer overflow in bfd_pef_parse_function_stubs function in bfd/pef.c via crafted PEF file
CVE: CVE-2020-35493
Component: binutils
CWE: CWE-125
Severity: Low
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2020-01-01T00:00:00+00:00

A flaw was found in Binutils in bfd/pef.c. This flaw allows an attacker who can submit a crafted PEF file to be parsed by objdump to cause a heap buffer overflow, leading to an out-of-bounds read. The highest threat from this vulnerability is to system availability.

Statement: Binutils as shipped with Red Hat Enterprise Linux 8's GCC Toolset 10 and Red Hat Developer Toolset 10 are not affected by this flaw because the versions shipped have already received the patch.

The issue is classified as low severity primarily because binutils is not typically exposed to untrusted inputs in most environments, limiting its exploitation potential. The memory leak in bfd_pef_parse_function_stubs only triggers during the parsing of malformed files, which would require an attacker to convince a user to process a malicious file. Moreover, binutils does not handle privileged operations, meaning exploitation is unlikely to lead to system compromise or escalation of privileges. Additionally, the impact is localized to the application itself, without affecting the broader system or network security.

Remediation:
InnoDB unspecified vulnerability (CPU Jul 2020)
CVE: CVE-2020-14634
Component: mysql
Severity: Low
CVSS v3: 3.7/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Release date: 2020-07-14T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
Inappropriate implementation in external protocol handlers
CVE: CVE-2020-6522
Component: chromium-browser
Severity: Moderate
CVSS v3: 9.6/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Release date: 2020-07-14T00:00:00+00:00

Inappropriate implementation in external protocol handlers in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Insufficient policy enforcement in downloads
CVE: CVE-2020-6488
Component: chromium-browser
Severity: Low
CVSS v3: 4.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2020-05-19T00:00:00+00:00

Insufficient policy enforcement in downloads in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Resource exhaustion via memory leak with CMAC keys
CVE: CVE-2020-15025
Component: ntp
CWE: CWE-400
Severity: Low
CVSS v3: 4.9/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-06-23T00:00:00+00:00

ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, because memory is not freed in situations where a CMAC key is used and associated with a CMAC algorithm in the ntp.keys file.

Statement: As per upstream, this issue only affects ntp-4.2.8p11p to ntp-4.2.8p14p, and 4.3.97 to 4.3.100. These packages versions do not ship with any Red Hat products, therefore they are not affected by this flaw.

Remediation:
Use after free in WebRTC
CVE: CVE-2020-6467
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-05-19T00:00:00+00:00

Use after free in WebRTC in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
uninitialized kernel data leak in userspace coredumps
CVE: CVE-2020-10732
Component: kernel
CWE: CWE-908
Severity: Moderate
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2020-05-01T00:00:00+00:00

A flaw was found in the Linux kernel’s implementation of Userspace core dumps. This flaw allows an attacker with a local account to crash a trivial program and exfiltrate private kernel data.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from the References section.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from the References section.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Possible mitigation would be to disable core dumps system-wide by setting:

* hard core 0

In the  /etc/security/limits.conf file and restarting applications/services/processes which users may have access to or simply reboot the system.  This disables core dumps which may not be a suitable workaround in your environment.
normal users can intercept stdout from jobs running in other organizations
CVE: CVE-2020-10698
Component: Tower
CWE: CWE-200
Severity: Low
CVSS v3: 3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
Release date: 2020-03-27T00:00:00+00:00

A flaw was found in Ansible Tower when running jobs. This flaw allows an attacker to access the stdout of the executed jobs which are run from other organizations. Some sensible data can be disclosed. However, critical data should not be disclosed, as it should be protected by the no_log flag when debugging is enabled.

Statement: Ansible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.

Remediation:
This issue is possible to mitigate by disabling the stdout from jobs run through the nginx configuration file. However this may affect the usage of Tower as stdout stream would be hidden. To disable the output of running jobs the entire 'location /websocket' block from the nginx configuration (and restarting nginx service) it would be required. Nginx will stop serving /websocket by 404 HTTP code return.
plaintext storage of password via API call
CVE: CVE-2020-8183
Component: nextcloud
CVSS v3: 5.2/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2020-06-04T00:00:00+00:00

A logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it was given on the initial create API call.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Gnome Fonts Viewer: Denial of Service via malicious TTF font file
CVE: CVE-2020-37011
Component: gnome-font-viewer
CWE: CWE-787
Severity: Moderate
CVSS v3: 5.2/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2020-01-01T00:00:00+00:00

Gnome Fonts Viewer 3.34.0 contains a heap corruption vulnerability that allows attackers to trigger an out-of-bounds write by crafting a malicious TTF font file. Attackers can generate a specially crafted TTF file with an oversized pattern to cause an infinite malloc() loop and potentially crash the gnome-font-viewer process.


Remediation:
To mitigate this issue, avoid opening untrusted TrueType Font (TTF) files with Gnome Fonts Viewer. If the Gnome Fonts Viewer application is not required, it can be removed. Removing `gnome-font-viewer` may also remove other GNOME desktop components if they depend on it, potentially impacting graphical desktop functionality. Server installations without a graphical environment are not affected.
stack-based overflow in xgmac_enet_send() in hw/net/xgmac.c
CVE: CVE-2020-15863
Component: QEMU
CWE: CWE-121
Severity: Low
CVSS v3: 5.2/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
Release date: 2020-07-10T00:00:00+00:00

A buffer overflow vulnerability was found in the XGMAC Ethernet controller of the QEMU emulator. This flaw occurs during packet transmission and affects the highbank and midway emulated machines. A guest user or process could use this flaw to crash the QEMU process on the host, resulting in a denial of service or potential code execution with the privileges of the QEMU process.

Statement: The XGMAC device can only be found on highbank and midway QEMU ARM emulated machines. This flaw did not affect the following versions of QEMU as they did not include support for XGMAC:
* `qemu-kvm-ma` as shipped with Red Hat Enterprise Linux 7.
* `qemu-kvm-rhev` as shipped with Red Hat Virtualization and Red Hat OpenStack.
* `qemu-kvm` as shipped with Red Hat Enterprise Linux 6, 7 and 8.
* `virt:8.2/qemu-kvm` as shipped with RHEL Advanced Virtualization.

Remediation:
Server: Security: LDAP Auth unspecified vulnerability (CPU Oct 2020)
CVE: CVE-2020-14771
Component: mysql
Severity: Low
CVSS v3: 2.7/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L
Release date: 2020-10-20T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: LDAP Auth). Supported versions that are affected are 5.7.31 and prior and 8.0.21 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.2 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L).

Statement: MySQL as shipped in Red Hat Enterprise Linux and Software Collection do not have support for LDAP authentication. As a result, this flaw does not affect the component.

Remediation:
out-of-bounds read in irp functions
CVE: CVE-2020-11089
Component: freerdp
CWE: CWE-125
Severity: Low
CVSS v3: 5.6/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Release date: 2020-05-29T00:00:00+00:00

In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create, serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu, serial_process_irp_write). This has been fixed in 2.1.0.


Remediation:
The vulnerability is associated with the use of the command line options: /drive, +multitouch, /paralell, /printer, and /servial. To mitigate this vulnerability, do not use these commands.
buffer overflow in TIFFVGetField() in libtiff/tif_dir.c
CVE: CVE-2020-19143
Component: libtiff
CWE: CWE-119
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-01-01T00:00:00+00:00

Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "TIFFVGetField" funtion in the component 'libtiff/tif_dir.c'.


Remediation:
out-of-bounds write in copyIntoFrameBuffer function in ImfMisc.cpp
CVE: CVE-2020-11764
Component: OpenEXR
CWE: CWE-787
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2020-02-08T00:00:00+00:00

An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
heap-based buffer overflow in phar_extract_file
CVE: CVE-2020-7061
Component: php
CWE: CWE-122
Severity: Low
CVSS v3: 9.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Release date: 2020-01-26T00:00:00+00:00

In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.

Statement: This flaw affects only PHP running on Windows operating system.

Remediation:
Buffer overflow in src/symtab.c via crafted input file redefining the EOF token can lead to DoS
CVE: CVE-2020-24979
Component: bison
CWE: CWE-122
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2020-09-04T00:00:00+00:00

[REJECTED CVE] A Buffer Overflow vulnerability was found in GNU bison in src/symtab.c. A local attacker may execute bison with crafted input file redefining the EOF token, which could triggers Heap buffer overflow and thus cause system crash.

Statement: Please note that this CVE has been rejected Upstream.

Remediation:
This flaw can be mitigated by not supplying untrusted input to be processed by GNU Bison.