huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Use after free in Bluetooth
CVE: CVE-2019-13725
Component: chromium-browser
Severity: Critical
CVSS v3: 9.6/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Release date: 2019-12-10T00:00:00+00:00

Use-after-free in Bluetooth in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
user session cookie does not set HTTPOnly
CVE: CVE-2019-14849
Component: 3scale
CWE: CWE-201
Severity: Low
CVSS v3: 4.8/CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Release date: 2019-12-11T00:00:00+00:00

A flaw was found where 3scale did not set the HTTPOnly attribute on the user session cookie. An attacker could abuse this flaw to conduct Cross-site Scripting attacks and gain access to unauthorized information.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_3scale_api_management/2.6/html-single/installing_3scale/#onpremises-installation
Updater temporary files accessible to unprivileged processes
CVE: CVE-2019-17009
Component: Mozilla
CWE: CWE-377
Severity: Moderate
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2019-12-03T00:00:00+00:00

When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to locate and exploit a vulnerability in file handling in the updater service. *Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.*. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.


Remediation:
hw/display/bochs-display.c does not ensure a sufficient PCI config space allocation leading to a buffer overflow involving the PCIe extended config space
CVE: CVE-2019-15034
Component: qemu
CWE: CWE-120
Severity: Important
CVSS v3: 5.9/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
Release date: 2019-08-12T00:00:00+00:00

A buffer overflow flaw was found in the way the Bochs display driver of QEMU handled the PCIe extended configuration space when the device is connected to a PCIe bus. Accessing the PCIe extended config space could overflow the conventional PCI config space buffer due to limited memory allocation. As the PCIe config space is guest writeable, this flaw allows a local attacker to gain access and potentially execute arbitrary code on the host with the privileges of the QEMU process.

Statement: This flaw does not affect the module stream`virt:8.1/qemu-kvm` as shipped with RHEL Advanced Virtualization, as it already includes the patch.
Several other packages are unaffected because they do not include PCIe support:
* `kvm` and `xen` as shipped with Red Hat Enterprise Linux 5
* `qemu-kvm` as shipped with Red Hat Enterprise Linux 6 and 7
* `qemu-kvm-rhev` as shipped with Red Hat Enterprise Linux 7
* `virt:rhel/qemu-kvm` as shipped with Red Hat Enterprise Linux 8
* `qemu-kvm-rhev` as shipped with Red Hat OpenStack Platform 10 and 13

Remediation:
Use `-device bochs-display` as conventional PCI device only.
stack-based buffer overflow in calc_arrow in bound.c
CVE: CVE-2019-14275
Component: transfig
CWE: CWE-787
Severity: Low
CVSS v3: 6.5/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Release date: 2019-07-26T00:00:00+00:00

Xfig fig2dev 3.2.7a has a stack-based buffer overflow in the calc_arrow function in bound.c.


Remediation:
mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c
CVE: CVE-2019-19447
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.7/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2019-12-10T00:00:00+00:00

A flaw was found in the Linux kernel's ext4_unlink function. An attacker could corrupt memory or escalate privileges when deleting a file from a recently unmounted specially crafted ext4 filesystem, including local, USB, and iSCSI.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from the References section.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from the References section.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Ext4 filesytems are built into the kernel so it is not possible to prevent the kernel module from loading.  However, this flaw can be prevented by disallowing mounting of untrusted filesystems.

As mounting is a privileged operation, (except for device hotplug) removing the ability for mounting and unmounting will prevent this flaw from being exploited.
Server: Replication unspecified vulnerability (CPU Jan 2019)
CVE: CVE-2019-2534
Component: mysql
Severity: Moderate
CVSS v3: 7.3/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Release date: 2019-01-15T00:00:00+00:00

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.6.42 and prior, 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
Multiple memory corruption issues leading to arbitrary code execution
CVE: CVE-2019-8586
Component: webkitgtk
Severity: Moderate
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2019-05-20T00:00:00+00:00

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution.


Remediation:
Insufficient input validation in MdeModulePkg may lead to privilege escalation
CVE: CVE-2019-11098
Component: edk2
CWE: CWE-20
Severity: Moderate
CVSS v3: 6.4/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2019-05-08T00:00:00+00:00

An improper input validation flaw in the MdeModulePkg module of edk2 may allow an unauthenticated attacker with physical access to the system handled by edk2 to escalate his privileges and cause a denial of service or disclose information.

Statement: Within Red Hat Enterprise Linux, edk2 is used only on virtualized systems, thus in this context the attacker needs to be a local user of the host system who have already the ability to compromise the guests systems. For this reason, this flaw has a Low Impact on both Red Hat Enterprise Linux 7 and 8.

Remediation:
Memory leak in PdfPagesTreeCache class in doc/PdfPagesTreeCache.cpp
CVE: CVE-2019-10723
Component: podofo
CVSS v3: 4.6/CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2019-04-03T00:00:00+00:00

An issue was discovered in PoDoFo 0.9.6. The PdfPagesTreeCache class in doc/PdfPagesTreeCache.cpp has an attempted excessive memory allocation because nInitialSize is not validated.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
stack-overflow when parsing yang files with self-referential union types
CVE: CVE-2019-20395
Component: libyang
CWE: CWE-674
Severity: Low
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2019-03-08T00:00:00+00:00

A stack-overflow flaw was found in libyang due to a self-referential union type containing leafrefs. Applications that use libyang to process untrusted input YANG files may crash while processing malformed files.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
TYP03 does not prevent directory traversal resulting in bypass of deserialization of protection mechanism
CVE: CVE-2019-11831
Component: phar-stream-wrapper
CVSS v3: 5.4/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2019-05-08T00:00:00+00:00

The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Server: Security: Encryption unspecified vulnerability (CPU Oct 2019)
CVE: CVE-2019-2922
Component: mysql
Severity: Moderate
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2019-10-15T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 5.6.45 and prior and 5.7.27 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).


Remediation:
Google URI shown for certificate warning
CVE: CVE-2019-13676
Component: chromium-browser
Severity: Low
CVSS v3: 4.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2019-09-10T00:00:00+00:00

Insufficient policy enforcement in Chromium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
integer overflow in xmalloc.h
CVE: CVE-2019-8355
Component: sox
CWE: CWE-190
Severity: Low
CVSS v3: 3.9/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2019-02-07T00:00:00+00:00

An issue was discovered in SoX 14.4.2. In xmalloc.h, there is an integer overflow on the result of multiplication fed into the lsx_valloc macro that wraps malloc. When the buffer is allocated, it is smaller than expected, leading to a heap-based buffer overflow in channels_start in remix.c.


Remediation:
InnoDB unspecified vulnerability (CPU Jul 2019)
CVE: CVE-2019-2758
Component: mysql
Severity: Moderate
CVSS v3: 6.5/CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
Release date: 2019-07-16T00:00:00+00:00

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.
predictable path in the Helper::temporaryMountDevice() function enabling a symlink exploit
CVE: CVE-2019-13226
Component: deepin-clone
CVSS v3: 7.0/CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2019-07-16T00:00:00+00:00

deepin-clone before 1.1.3 uses a predictable path /tmp/.deepin-clone/mount/<block-dev-basename> in the Helper::temporaryMountDevice() function to temporarily mount a file system as root. An unprivileged user can prepare a symlink at this location to have the file system mounted in an arbitrary location. By winning a race condition, the attacker can also enter the mount point, thereby preventing a subsequent unmount of the file system.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Stealing of cross-domain images using canvas
CVE: CVE-2019-9817
Component: Mozilla
CWE: CWE-829
Severity: Important
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2019-05-22T00:00:00+00:00

Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.

Statement: In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
NULL dereference in ahci_commit_buf() leading to DoS
CVE: CVE-2019-12067
Component: QEMU
CWE: CWE-476
Severity: Low
CVSS v3: 3.1/CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L
Release date: 2019-10-09T00:00:00+00:00

A NULL pointer dereference flaw was found in the QEMU emulator's IDE AHCI emulator. Exploitation of the flaw could occur while committing DMA buffer in ahci_commit_buf() if the command header 'ad->cur_cmd' was null. A privileged guest user could use this flaw to crash the QEMU process instance resulting in DoS. Reduced performance of the system is the highest threat to the system.

Statement: The qemu-kvm package versions as shipped with Red Hat Enterprise Linux 6 and 7 are not affected by this issue. 

The qemu-kvm package version as shipped with Red Hat Enterprise Linux 8 is affected by this issue. Future qemu-kvm updates for Red Hat Enterprise Linux 8 may address this issue.

Remediation:
URL spoof in Omnibox on iOS
CVE: CVE-2019-5834
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2019-06-04T00:00:00+00:00

Insufficient data validation in Blink in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to perform domain spoofing via a crafted HTML page.


Remediation:
out-of-bounds write in function strcpyext() in decompile.c
CVE: CVE-2019-9114
Component: ming
CVSS v3: 5.0/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Release date: 2019-01-02T00:00:00+00:00

Ming (aka libming) 0.4.8 has an out of bounds write vulnerability in the function strcpyext() in the decompile.c file in libutil.a.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
out-of-bounds write in the vertProfile part of the TextPage::findGaps function in TextOutputDev.cc
CVE: CVE-2019-16927
Component: xpdf
CVSS v3: 5.4/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2019-12-02T00:00:00+00:00

Xpdf 4.01.01 has an out-of-bounds write in the vertProfile part of the TextPage::findGaps function in TextOutputDev.cc, a different vulnerability than CVE-2019-9877.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
TOCTOU vulnerability leads to cache pollution
CVE: CVE-2019-15608
Component: yarn
CWE: CWE-367
Severity: Moderate
CVSS v3: 4.9/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
Release date: 2019-01-01T00:00:00+00:00

A flaw was found in Yarn. The package integrity validation in Yarn contains a time-of-check to time-of-use (TOCTOU) vulnerability where the hash is computed before writing a package to cache and is not computed again when reading from the cache. This flaw may lead to a cache pollution attack. The highest threat from this vulnerability is to integrity.


Remediation:
Run 'yarn cache clean' before installs.
invalid memory address dereference in canUnpack in p_mach.cpp
CVE: CVE-2019-20053
Component: upx
CVSS v3: 6.5/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Release date: 2019-12-27T00:00:00+00:00

An invalid memory address dereference was discovered in the canUnpack function in p_mach.cpp in UPX 3.95 via a crafted Mach-O file.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Use-after-free in media
CVE: CVE-2019-13699
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2019-10-22T00:00:00+00:00

Use after free in media in Google Chrome prior to 78.0.3904.70 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.