huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Out of bounds write in get_rx_bufs() function in drivers/vhost/net.c
CVE: CVE-2018-16880
Component: kernel
CWE: CWE-787
Severity: Important
CVSS v3: 5.8/CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Release date: 2018-01-01T00:00:00+00:00

A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions, can trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.


Remediation:
Overly permissive policy in WebUSB
CVE: CVE-2018-6125
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2018-05-29T00:00:00+00:00

Insufficient policy enforcement in USB in Google Chrome on Windows prior to 67.0.3396.62 allowed a remote attacker to obtain potentially sensitive information via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
XSS in the import dialog
CVE: CVE-2018-15605
Component: phpMyAdmin
CVSS v3: 8.3/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Release date: 2018-08-21T00:00:00+00:00

An issue was discovered in phpMyAdmin before 4.8.3. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted file to manipulate an authenticated user who loads that file through the import feature.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
write access violation in gegl_tile_backend_swap_constructed function in buffer/gegl-tile-backend-swap.c
CVE: CVE-2018-10112
Component: gegl
CWE: CWE-787
Severity: Moderate
CVSS v3: 7.7/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2018-04-14T00:00:00+00:00

An issue was discovered in GEGL through 0.3.32. The gegl_tile_backend_swap_constructed function in buffer/gegl-tile-backend-swap.c allows remote attackers to cause a denial of service (write access violation) or possibly have unspecified other impact via a malformed PNG file that is mishandled during a call to the babl_format_get_bytes_per_pixel function in babl-format.c in babl 0.1.46.


Remediation:
Stack-based buffer overflow in compileTranslationTable.c
CVE: CVE-2018-12085
Component: liblouis
CWE: CWE-121
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2018-06-05T00:00:00+00:00

Liblouis 3.6.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c, a different vulnerability than CVE-2018-11440.


Remediation:
use-after-free in blink
CVE: CVE-2018-6060
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2018-03-06T00:00:00+00:00

Use after free in WebAudio in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Missing initialization of a variable in IKEv2 key derivation allows denial of service
CVE: CVE-2018-10811
Component: strongswan
CWE: CWE-456
Severity: Moderate
CVSS v3: 5.8/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2018-05-28T00:00:00+00:00

strongSwan 5.6.0 and older allows Remote Denial of Service because of Missing Initialization of a Variable.

Statement: This issue did not affect the versions of strongimcv as shipped with Red Hat Enterprise Linux 7 as they did not include support for IKE features.

Remediation:
CVE: CVE-2018-6342
Component: CVE-2018-6342
Release date: 2018-12-31T00:00:00+00:00

react-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an editor. The input to that command was not properly sanitized, allowing an attacker who can make a network request to the server (either via CSRF or by direct request) to execute arbitrary commands on the targeted system. This issue affects multiple branches: 1.x.x prior to 1.0.4, 2.x.x prior to 2.0.2, 3.x.x prior to 3.1.2, 4.x.x prior to 4.2.2, and 5.x.x prior to 5.0.2.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
SQL inject in errata-related REST API
CVE: CVE-2018-14623
Component: katello
CWE: CWE-89
Severity: Low
CVSS v3: 4.5/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2018-12-12T00:00:00+00:00

A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs.


Remediation:
For detailed instructions how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.3/html/upgrading_and_updating_red_hat_satellite/
CVE: CVE-2018-1002203
Component: CVE-2018-1002203
Release date: 2018-01-01T00:00:00+00:00

unzipper npm library before 0.8.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Infinite loop in runzip.z:runzip_fd() allows for denial of service
CVE: CVE-2018-9058
Component: lrzip
CVSS v3: 3.4/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2018-03-27T00:00:00+00:00

In Long Range Zip (aka lrzip) 0.631, there is an infinite loop in the runzip_fd function of runzip.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted lrz file.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
missing access_ok() checks in i915_gem_execbuffer2_ioctl() results in priviledge escalation
CVE: CVE-2018-20669
Component: kernel
CWE: CWE-391
Severity: Important
CVSS v3: 7.9/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2018-01-01T00:00:00+00:00

A flaw was found in the Linux kernel where a provided address with access_ok() is not checked before accessing userspace data in certain situations. Lack of such checks in i915_gem_execbuffer2_ioctl in drivers/gpu/drm/i915/i915_gem_execbuffer.c may allow a local unprivileged attacker to possible escalate its privileges.


Remediation:
Remote code execution (RCE) in rpc session-id via dns rebinding attack
CVE: CVE-2018-5702
Component: transmission
CVSS v3: 8.3/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Release date: 2018-01-11T00:00:00+00:00

Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access control, which allows remote attackers to execute arbitrary RPC commands, and consequently write to arbitrary files, via POST requests to /transmission/rpc in conjunction with a DNS rebinding attack.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2018-1000402
Component: CVE-2018-1000402
Release date: 2018-06-25T00:00:00+00:00

Jenkins project Jenkins AWS CodeDeploy Plugin version 1.19 and earlier contains a File and Directory Information Exposure vulnerability in AWSCodeDeployPublisher.java that can result in Disclosure of environment variables. This vulnerability appears to have been fixed in 1.20 and later.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Heap-based buffer overflow in Curl_smtp_escape_eob() when uploading data over SMTP
CVE: CVE-2018-0500
Component: curl
CWE: CWE-122
Severity: Moderate
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2018-07-11T00:00:00+00:00

A heap-based buffer overflow has been found in the Curl_smtp_escape_eob() function of curl. An attacker could exploit this by convincing a user to use curl to upload data over SMTP with a reduced buffer to cause a crash or corrupt memory.

Statement: This issue did not affect the versions of curl/libcurl as shipped with Red Hat Enterprise Linux 5, 6 and 7 as they did not include the vulnerable code.

This issue did not affect the versions of curl/libcurl as shipped with Red Hat Software Collections 3 as they did not include the vulnerable code.

Remediation:
The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Core Services installation (including all applications and configuration files).
CVE: CVE-2018-1000052
Component: CVE-2018-1000052
Release date: 2018-02-01T00:00:00+00:00

fmtlib version prior to version 4.1.0 (before commit 0555cea5fc0bf890afe0071a558e44625a34ba85) contains a Memory corruption (SIGSEGV), CWE-134 vulnerability in fmt::print() library function that can result in Denial of Service. This attack appear to be exploitable via Specifying an invalid format specifier in the fmt::print() function results in a SIGSEGV (memory corruption, invalid write). This vulnerability appears to have been fixed in after commit 8cf30aa2be256eba07bb1cefb998c52326e846e7.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
XSS in lxml.html.clean module in lxml/html/clean.py
CVE: CVE-2018-19787
Component: python-lxml
CWE: CWE-79
Severity: Moderate
CVSS v3: 4.7/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2018-09-09T00:00:00+00:00

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to CVE-2014-3146.


Remediation:
prototype pollution due to injected properties on Object.prototype
CVE: CVE-2018-16472
Component: nodejs-cached-path-relative
CWE: CWE-400
Severity: Moderate
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2018-11-02T00:00:00+00:00

A prototype pollution attack in cached-path-relative versions <=1.0.1 allows an attacker to inject properties on Object.prototype which are then inherited by all the JS objects through the prototype chain causing a DoS attack.


Remediation:
XML parser contains a use-after-free error triggered during the scanning of external DTDs
CVE: CVE-2018-1311
Component: xerces-c
CWE: CWE-416
Severity: Important
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2018-01-01T00:00:00+00:00

A use-after-free vulnerability was found in xerces-c in the way an XML document is processed via the SAX API. Applications that process XML documents with an external Document Type Definition (DTD) may be vulnerable to this flaw. A remote attacker could exploit this flaw by creating a specially crafted XML file that would crash the application or potentially lead to arbitrary code execution.


Remediation:
Disable DTD processing by setting the environment variable `XERCES_DISABLE_DTD=1`. Please note that this feature was introduced in xerces-c upstream version 3.1.4 and is not available in older versions. The versions of xerces-c as shipped with Red Hat Enterprise Linux 6 and 7 did not include this feature.
memory leak in liblas in liblas.hpp
CVE: CVE-2018-20540
Component: liblas
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2018-01-01T00:00:00+00:00

There is memory leak at liblas::Open (liblas/liblas.hpp) in libLAS 1.8.1.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Server: Security: Privileges unspecified vulnerability (CPU Oct 2018)
CVE: CVE-2018-3286
Component: mysql
Severity: Moderate
CVSS v3: 4.5/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Release date: 2018-10-16T00:00:00+00:00

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).


Remediation:
Incorrect use of Distributed Objects in Google Software Updater on MacOS
CVE: CVE-2018-6084
Component: chromium-browser
Severity: Low
CVSS v3: 4.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2018-04-17T00:00:00+00:00

Insufficiently sanitized distributed objects in Updater in Google Chrome on macOS prior to 66.0.3359.117 allowed a local attacker to execute arbitrary code via an executable file.


Remediation:
out-of-bounds read in Exiv2::Internal::stringFormat image.cpp
CVE: CVE-2018-8976
Component: exiv2
CWE: CWE-125
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2018-03-23T00:00:00+00:00

In Exiv2 0.26, jpgimage.cpp allows remote attackers to cause a denial of service (image.cpp Exiv2::Internal::stringFormat out-of-bounds read) via a crafted file.


Remediation:
Integer overflow in cplus-dem.c:get_count() allows for denial of service
CVE: CVE-2018-18483
Component: binutils
CWE: CWE-190
Severity: Moderate
CVSS v3: 5.4/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2018-01-01T00:00:00+00:00

The get_count function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31, allows remote attackers to cause a denial of service (malloc called with the result of an integer-overflowing calculation) or possibly have unspecified other impact via a crafted string, as demonstrated by c++filt.

Statement: This vulnerability is rated as moderate because an integer overflow in the get_count function in cplus-dem.c can lead to a denial of service or potentially other unintended behavior, achieving successful exploitation is not straightforward and depends on the specific conditions to craft input, which could trigger memory corruption.

Remediation:
stack overflow when calling syslog from a command with long cmdline
CVE: CVE-2018-16864
Component: systemd
CWE: CWE-770
Severity: Important
CVSS v3: 7.3/CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2018-01-01T00:00:00+00:00

An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program with long command line arguments calls syslog. A local attacker may use this flaw to crash systemd-journald or escalate privileges.

Statement: This issue affects the versions of systemd as shipped with Red Hat Enterprise Linux 7. Red Hat Product Security has rated this issue as having a security impact of Important because it allows a local attacker to crash systemd-journald or escalate his privileges. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/2974891
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/2974891
To increase the time an attacker needs to exploit this flaw you could override the `StartLimitInterval=` (called StartLimitIntervalSec in newer systemd versions) and `StartLimitBurst=` settings. In this way the attack may require much longer to be successful.

To edit the journald service use `sudo systemctl edit systemd-journald.service` and add:
```
[Service]
StartLimitInterval=120
StartLimitBurst=3
```
Out-of-bounds read in ext/exif/exif.c:exif_read_data() when reading crafted JPEG data
CVE: CVE-2018-10549
Component: php
CWE: CWE-125
Severity: Low
CVSS v3: 3.6/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2018-04-26T00:00:00+00:00

An out-of-bounds read has been found in PHP when function exif_iif_add_value handles the case of a MakerNote that lacks a final terminator character. A remote attacker could use this vulnerability to cause a crash.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
Unenforced configuration allows for apparently valid certifications actually signed by signing subkeys
CVE: CVE-2018-9234
Component: GnuPG
CWE: CWE-325
Severity: Low
CVSS v3: 2.3/CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
Release date: 2018-03-19T00:00:00+00:00

GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey.


Remediation:
Use-after-free in sdstor/stgstrms.cxx:StgSmallStrm class allows for denial of service with crafted document
CVE: CVE-2018-10119
Component: libreoffice
CWE: CWE-416
Severity: Moderate
CVSS v3: 6.7/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Release date: 2018-01-28T00:00:00+00:00

sot/source/sdstor/stgstrms.cxx in LibreOffice before 5.4.5.1 and 6.x before 6.0.1.1 uses an incorrect integer data type in the StgSmallStrm class, which allows remote attackers to cause a denial of service (use-after-free with write access) or possibly have unspecified other impact via a crafted document that uses the structured storage ole2 wrapper file format.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of LibreOffice applications must be restarted for this update to take effect.
CVE: CVE-2018-1000814
Component: CVE-2018-1000814
Release date: 2018-01-01T00:00:00+00:00

aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a cookie post-expiry with the same value.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Use after free in packet-q931.c
CVE: CVE-2018-11358
Component: wireshark
CWE: CWE-416
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Release date: 2018-05-13T00:00:00+00:00

A use-after-free flaw was found in the code responsible for processing packages from Q.931 protocol, in wireshark. An attacker can send specially crafted packages over the network which, when received, would cause an application to crash, or potentially, corrupt information.


Remediation:
CVE: CVE-2018-1000547
Component: CVE-2018-1000547
Release date: 2018-06-26T00:00:00+00:00

coreBOS version 7.0 and earlier contains a Incorrect Access Control vulnerability in Module: Contacts that can result in The error allows you to access records that you have no permissions to. .

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2018-1000117
Component: CVE-2018-1000117
Release date: 2018-01-01T00:00:00+00:00

Python Software Foundation CPython version From 3.2 until 3.6.4 on Windows contains a Buffer Overflow vulnerability in os.symlink() function on Windows that can result in Arbitrary code execution, likely escalation of privilege. This attack appears to be exploitable via a python script that creates a symlink with an attacker controlled name or location. This vulnerability appears to have been fixed in 3.7.0 and 3.6.5.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Information Disclosure vulnerabilities (APSB18-25)
CVE: CVE-2018-12827
Component: flash-plugin
Severity: Important
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2018-08-14T00:00:00+00:00

Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.


Remediation:
Out-of-bounds read in remap_struct function in sa_common.c
CVE: CVE-2018-19416
Component: sysstat
CWE: CWE-125
Severity: Low
CVSS v3: 4.6/CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2018-11-21T00:00:00+00:00

An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of-bounds read during a memmove call, as demonstrated by sadf.

Statement: This issue did not affect the versions of sysstat as shipped with Red Hat Enterprise Linux 5, 6, and 7.

Remediation:
CVE: CVE-2018-1000639
Component: CVE-2018-1000639
Release date: 2018-01-01T00:00:00+00:00

LatexDraw version <=4.0 contains a XML External Entity (XXE) vulnerability in SVG parsing functionality that can result in disclosure of data, server side request forgery, port scanning, possible rce. This attack appear to be exploitable via Specially crafted SVG file.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation: