huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
heap out-of-bounds write in dwgCompressor:copyCompBytes21
CVE: CVE-2021-21899
Component: librecad
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2021-11-19T00:00:00+00:00

A code execution vulnerability exists in the dwgCompressor::copyCompBytes21 functionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted .dwg file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
possible heap corruption with LzmaUefiDecompressGetInfo
CVE: CVE-2021-28211
Component: edk2
CWE: CWE-120
Severity: Moderate
CVSS v3: 7.4/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2021-01-01T00:00:00+00:00

A flaw was found in edk2. A possible heap corruption in LzmaUefiDecompressGetInfo function may allow an attacker to execute code on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Remediation:
Multiple flaws in binaryen
CVE: CVE-2021-46048
Component: binaryen
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::readFunctions.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Prototype Pollution via the cache variable
CVE: CVE-2021-23518
Component: cached-path-relative
CWE: CWE-915
Severity: Moderate
CVSS v3: 8.6/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Release date: 2021-01-01T00:00:00+00:00

A prototype pollution vulnerability was discovered in cached-path-relative. This flaw allows a remote, unauthenticated attacker to inject a cache variable to leak sensitive information.


Remediation:
drm/plane: Move range check for format_count earlier
CVE: CVE-2021-47659
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/plane: Move range check for format_count earlier

While the check for format_count > 64 in __drm_universal_plane_init()
shouldn't be hit (it's a WARN_ON), in its current position it will then
leak the plane->format_types array and fail to call
drm_mode_object_unregister() leaking the modeset identifier. Move it to
the start of the function to avoid allocating those resources in the
first place.


Remediation:
Inappropriate implementation in Site isolation
CVE: CVE-2021-21175
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2021-03-02T00:00:00+00:00

Inappropriate implementation in Site isolation in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
uncontrolled recursion in libiberty/rust-demangle.c
CVE: CVE-2021-46195
Component: gcc
CWE: CWE-674
Severity: Low
CVSS v3: 3.2/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2021-01-29T00:00:00+00:00

A flaw was discovered in the GNU libiberty library within the demangle_path() function in rust-demangle.c, as distributed in the GNU Compiler Collection (GCC). This flaw allows a crafted symbol to cause stack memory to be exhausted, leading to a crash.

Statement: This flaw has been rated as having a security impact of Low. The problem is only triggered when deliberately corrupt input is passed to a tool that attempts to demangle symbol names. Normal users should never encounter this problem.

Remediation:
Authenticate remote code execution through Sendmail configuration
CVE: CVE-2021-3584
Component: foreman
CWE: CWE-78
Severity: Moderate
CVSS v3: 8.2/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2021-06-16T14:00:00+00:00

A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could use Sendmail configuration options to overwrite the defaults and perform command injection. The highest threat from this vulnerability is to confidentiality, integrity and availability of system.


Remediation:
For Red Hat Satellite 6.11 see the following documentation for the release.
https://access.redhat.com/documentation/en-us/red_hat_satellite/6.11

The important instructions on how to upgrade are available below.
https://access.redhat.com/documentation/en-us/red_hat_satellite/6.11/html/upgrading_and_updating_red_hat_satellite
This vulnerability can be mitigated by setting following two values in `/etc/foreman/settings.yaml` file which will render them read-only from the application: 
:sendmail_location: '/usr/sbin/sendmail'
:sendmail_arguments: '-i'
heap overflow in flb_msgpack_gelf_value_ext
CVE: CVE-2021-46879
Component: fluent-bit
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2021-01-01T00:00:00+00:00

An issue was discovered in Treasure Data Fluent Bit 1.7.1, a wrong variable is used to get the msgpack data resulting in a heap overflow in flb_msgpack_gelf_value_ext. An attacker can craft a malicious file and tick the victim to open the file with the software, triggering a heap overflow and execute arbitrary code on the target system.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Integer overflow via STRALGO LCS command
CVE: CVE-2021-29477
Component: redis
CWE: CWE-190
Severity: Important
CVSS v3: 9.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2021-05-04T00:00:00+00:00

A flaw was found in redis. An integer overflow bug could be exploited to corrupt the heap and potentially result with remote code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: redis:5/redis as shipped in Red Hat Enterprise Linux 8 is not affected by this flaw because it does not ship a vulnerable version of Redis.

Remediation:
The flaw can be mitigated by disallowing usage of the STRALGO LCS command via ACL configuration. Please see https://redis.io/topics/acl for more information on how to do this.
ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions
CVE: CVE-2021-47291
Component: kernel
CWE: CWE-125
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions

While running the self-tests on a KASAN enabled kernel, I observed a
slab-out-of-bounds splat very similar to the one reported in
commit 821bbf79fe46 ("ipv6: Fix KASAN: slab-out-of-bounds Read in
 fib6_nh_flush_exceptions").

We additionally need to take care of fib6_metrics initialization
failure when the caller provides an nh.

The fix is similar, explicitly free the route instead of calling
fib6_info_release on a half-initialized object.


Remediation:
bluetooth DHT dissector large loop
CVE: CVE-2021-39924
Component: wireshark
CWE: CWE-400
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-11-17T00:00:00+00:00

A flaw was found in Wireshark. A process failure on crafted or malformed Bluetooth DHT input can cause a denial of service via packet injection or a crafted capture file.


Remediation:
A use after free via invalid SoundFont file
CVE: CVE-2021-21417
Component: fluidsynth
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Release date: 2021-04-29T00:00:00+00:00

fluidsynth is a software synthesizer based on the SoundFont 2 specifications. A use after free violation was discovered in fluidsynth, that can be triggered when loading an invalid SoundFont file.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Privilege escalation vulnerability in bundled Spring Security library
CVE: CVE-2021-22112
Component: jenkins
CWE: CWE-281
Severity: Important
CVSS v3: 9.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2021-02-19T00:00:00+00:00

A flaw was found in jenkins. Unintentional persisted temporary elevated privileges in some circumstances in a user's session can occur in Spring Security. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Remediation:
Out-of-bounds read in J2K image reader
CVE: CVE-2021-25287
Component: python-pillow
CWE: CWE-125
Severity: Moderate
CVSS v3: 9.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Release date: 2021-04-01T00:00:00+00:00

There is an out-of-bounds read in J2kDecode in j2ku_graya_la. For J2k images with multiple bands, it’s legal to have different widths for each band, e.g. 1 byte for L, 4 bytes for A.


Remediation:
To mitigate this feature on Red Hat Quay keep the invoice generation feature disabled as it is by default.
RDMA/siw: Fix a use after free in siw_alloc_mr
CVE: CVE-2021-47012
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 5.7/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

RDMA/siw: Fix a use after free in siw_alloc_mr

Our code analyzer reported a UAF.

In siw_alloc_mr(), it calls siw_mr_add_mem(mr,..). In the implementation of
siw_mr_add_mem(), mem is assigned to mr->mem and then mem is freed via
kfree(mem) if xa_alloc_cyclic() failed. Here, mr->mem still point to a
freed object. After, the execution continue up to the err_out branch of
siw_alloc_mr, and the freed mr->mem is used in siw_mr_drop_mem(mr).

My patch moves "mr->mem = mem" behind the if (xa_alloc_cyclic(..)<0) {}
section, to avoid the uaf.


Remediation:
NFC: digital: fix possible memory leak in digital_in_send_sdd_req()
CVE: CVE-2021-47442
Component: kernel
Severity: Low
CVSS v3: 4.4/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

NFC: digital: fix possible memory leak in digital_in_send_sdd_req()

'skb' is allocated in digital_in_send_sdd_req(), but not free when
digital_in_send_cmd() failed, which will cause memory leak. Fix it
by freeing 'skb' if digital_in_send_cmd() return failed.


Remediation:
Heap buffer overflow in ntfs_inode_real_open() triggered by a specially crafted NTFS inode
CVE: CVE-2021-35268
Component: ntfs-3g
CWE: CWE-119
Severity: Moderate
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2021-08-30T00:00:00+00:00

The ntfs3g package is susceptible to a heap overflow on crafted input. When processing NTFS inodes, proper bounds checking was not enforced leading to this software flaw. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.


Remediation:
Heap buffer overflow in Bookmarks
CVE: CVE-2021-30590
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2021-08-02T00:00:00+00:00

Heap buffer overflow in Bookmarks in Google Chrome prior to 92.0.4515.131 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
course participants download did not restrict which users could be exported
CVE: CVE-2021-40692
Component: moodle
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2021-09-20T00:00:00+00:00

Insufficient capability checks made it possible for teachers to download users outside of their courses.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
"file forwarding" feature can be used to gain unprivileged access to files
CVE: CVE-2021-21381
Component: flatpak
CWE: CWE-284
Severity: Important
CVSS v3: 8.3/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Release date: 2021-03-09T00:00:00+00:00

A sandbox escape flaw was found in the way flatpak handled special tokens in ".desktop" files. This flaw allows an attacker to gain access to files that are not ordinarily allowed by the app's permissions. The highest threat from this vulnerability is to confidentiality and integrity.

Statement: This is essentially a sandbox escape flaw and needs a malicious app publisher to execute the exploit.

Remediation:
Avoid installing Flatpak apps from untrusted sources, or check the contents of the exported .desktop files in exports/share/applications/*.desktop (typically ~/.local/share/flatpak/exports/share/applications/*.desktop and /var/lib/flatpak/exports/share/applications/*.desktop) to make sure that literal filenames do not follow @@ or @@u.
Server: Optimizer unspecified vulnerability (CPU Oct 2021)
CVE: CVE-2021-35638
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-10-19T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.26 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
CVE: CVE-2021-24029
Component: CVE-2021-24029
Release date: 2021-01-01T00:00:00+00:00

A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC specification, this particular message should be treated as a connection error. This issue affects mvfst versions prior to commit a67083ff4b8dcbb7ee2839da6338032030d712b0 and proxygen versions prior to v2021.03.15.00.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
nfsd: Fix nsfd startup race (again)
CVE: CVE-2021-47507
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

A vulnerability was found in the Linux kernel's NFS daemon related to a race condition during startup in the rpc_pipefs_event() function, this race occurs between the registration of the NFS network ID and the notifier chain, leading to potential NULL pointer dereferences when the NFS daemon is initialized, causing system crash during NFS operations, compromising the stability of the kernel.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
use-after-free vulnerability
CVE: CVE-2021-4187
Component: vim
CWE: CWE-416
Severity: Low
CVSS v3: 7.3/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2021-12-27T00:00:00+00:00

A flaw was found in vim. A possible use after free vulnerability could allow an attacker to input a specially crafted file leading to a crash or code execution.


Remediation:
memory leak found in th_read() function
CVE: CVE-2021-33646
Component: libtar
CWE: CWE-401
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

A flaw was found in libtar. This security vulnerability occurs because the th_read() function in libtar doesn’t free a variable t->th_buf.gnu_longname after allocating memory, which may cause a memory leak.


Remediation:
memory leak in AcquireSemaphoreMemory() in semaphore.c and AcquireMagickMemory() in memory.c
CVE: CVE-2021-34183
Component: ImageMagick
CWE: CWE-401
Severity: None
CVSS v3: 0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N
Release date: 2021-06-01T00:00:00+00:00

[REJECTED CVE] ImageMagick has a memory leak in AcquireSemaphoreMemory in semaphore.c and AcquireMagickMemory in memory.c.

Statement: This CVE has been rejected Upstream: https://github.com/ImageMagick/ImageMagick/issues/3767#issuecomment-871458820

Red Hat has also evaluated this issue and determined that it does not meet the criteria to be classified as a security vulnerability. This assessment is based on the issue not posing a significant security risk, being a result of misconfiguration or usage error, or falling outside the scope of security considerations. 

As such, this CVE has been marked as "Rejected" in alignment with Red Hat's vulnerability management policies.

If you have additional information or concerns regarding this determination, please contact Red Hat Product Security for further clarification.

Remediation:
symlink following vulnerability
CVE: CVE-2021-39135
Component: nodejs-arborist
CWE: CWE-59
Severity: Important
CVSS v3: 8.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Release date: 2021-08-31T00:00:00+00:00

A flaw was found in nodejs-arborist. Arborist could write package dependencies to any arbitrary location on the file system if an attacker had replaced a project folder with a symbolic link in the node_modules folder. The highest threat from this vulnerability is to data integrity and system availability.


Remediation:
stack buffer overflow when processing SPF explanation macros
CVE: CVE-2021-20314
Component: libspf2
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Release date: 2021-08-11T00:00:00+00:00

A stack buffer overflow was found in libspf2 when processing certain SPF macros. This issue can lead to a denial of service and potentially code execution via malicious crafted SPF explanation messages. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
heap-based buffer overflow in Get16u() in exif.c
CVE: CVE-2021-3496
Component: jhead
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2021-04-13T00:00:00+00:00

A heap-based buffer overflow was found in jhead in version 3.06 in Get16u() in exif.c when processing a crafted file.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Use after free in Incognito
CVE: CVE-2021-37982
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2021-10-19T00:00:00+00:00

Use after free in Incognito in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
PCI: aardvark: Fix kernel panic during PIO transfer
CVE: CVE-2021-47229
Component: kernel
CWE: CWE-99
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

PCI: aardvark: Fix kernel panic during PIO transfer

Trying to start a new PIO transfer by writing value 0 in PIO_START register
when previous transfer has not yet completed (which is indicated by value 1
in PIO_START) causes an External Abort on CPU, which results in kernel
panic:

    SError Interrupt on CPU0, code 0xbf000002 -- SError
    Kernel panic - not syncing: Asynchronous SError Interrupt

To prevent kernel panic, it is required to reject a new PIO transfer when
previous one has not finished yet.

If previous PIO transfer is not finished yet, the kernel may issue a new
PIO request only if the previous PIO transfer timed out.

In the past the root cause of this issue was incorrectly identified (as it
often happens during link retraining or after link down event) and special
hack was implemented in Trusted Firmware to catch all SError events in EL3,
to ignore errors with code 0xbf000002 and not forwarding any other errors
to kernel and instead throw panic from EL3 Trusted Firmware handler.

Links to discussion and patches about this issue:
https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git/commit/?id=3c7dcdac5c50
https://lore.kernel.org/linux-pci/20190316161243.29517-1-repk@triplefau.lt/
https://lore.kernel.org/linux-pci/971be151d24312cc533989a64bd454b4@www.loen.fr/
https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/1541

But the real cause was the fact that during link retraining or after link
down event the PIO transfer may take longer time, up to the 1.44s until it
times out. This increased probability that a new PIO transfer would be
issued by kernel while previous one has not finished yet.

After applying this change into the kernel, it is possible to revert the
mentioned TF-A hack and SError events do not have to be caught in TF-A EL3.


Remediation: