huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
out-of-bounds read in set_fdc in drivers/block/floppy.c
CVE: CVE-2020-9383
Component: kernel
CWE: CWE-125
Severity: Moderate
CVSS v3: 7.2/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Release date: 2020-02-21T00:00:00+00:00

An out-of-bounds (OOB) memory access flaw was found in the floppy driver module in the Linux kernel. A bounds check failure allows a local attacker to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is to skip loading the affected floppy driver module onto the system till we have a fix available, this can be done by a blacklist mechanism, this will ensure the driver is not loaded at the boot time.
~~~
How do I blacklist a kernel module to prevent it from loading automatically?
https://access.redhat.com/solutions/41278 
~~~
Out-of-bounds access in XkbSetMap function
CVE: CVE-2020-14360
Component: xorg-x11-server
CWE: CWE-119
Severity: Important
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-12-01T00:00:00+00:00

A flaw was found in the X.Org Server. An out-of-bounds access in the XkbSetMap function may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: The Xorg server in Red Hat Enterprise Linux 8 does not run with root privileges, thus this flaw has been rated as having a moderate impact on that platform.

Remediation:
Insufficient policy enforcement in downloads
CVE: CVE-2020-15988
Component: chromium-browser
Severity: Low
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2020-10-06T00:00:00+00:00

Insufficient policy enforcement in downloads in Google Chrome on Windows prior to 86.0.4240.75 allowed a remote attacker who convinced the user to open files to execute arbitrary code via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
remote code execution due to input validation in Performance Boost Debug Log
CVE: CVE-2020-7237
Component: cacti
CVSS v3: 9.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-01-20T00:00:00+00:00

Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_automation.php. OS commands are executed when a new poller cycle begins. The attacker must be authenticated, and must have access to modify the Performance Settings of the product.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
IMAP hibernation function allows mail access
CVE: CVE-2020-24386
Component: dovecot
CWE: CWE-138
Severity: Moderate
CVSS v3: 7.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Release date: 2020-01-01T00:00:00+00:00

An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, leading to access to other users' email messages (and path disclosure).


Remediation:
To mitigate this flaw, ensure that imap_hibernate_timeout is set to 0 or not set at all/commented out in both /etc/dovecot/dovecot.conf or /etc/dovecot/conf.d/20-imap.conf.
Null Pointer Dereference in debug_get_real_type could result in DoS
CVE: CVE-2020-16598
Component: binutils
CWE: CWE-476
Severity: Low
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2020-12-10T00:00:00+00:00

[REJECTED CVE] A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils, in debug_get_real_type, as demonstrated in objdump, that can cause a denial of service via a crafted file.

Statement: The version of binutils shipped in Red Hat Developer Toolset 10 and Red Hat Enterprise Linux 8's GCC Toolset 10 is not affected by this flaw because it has already been patched.

Also, please note that this CVE has been rejected Upstream and it is not considered as a security issue.

Remediation:
heap-based buffer overflow via a crafted PDF document
CVE: CVE-2020-35702
Component: poppler
CWE: CWE-787
Severity: Moderate
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-12-20T00:00:00+00:00

A heap buffer overflow flaw was found in poppler. This flaw allows a remote attacker to provide a specially crafted PDF file that, when processed by the 'pdftops' program, leads to a crash or potential code execution. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.

Statement: The versions of `poppler` as shipped with Red Hat Enterprise Linux are not affected by this flaw, as the vulnerable code was introduced in a newer version of the package.

Remediation:
Use-after-free in fts3EvalNextRow in ext/fts3/fts3.c
CVE: CVE-2020-13630
Component: sqlite
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-05-16T00:00:00+00:00

A use-after-free vulnerability was found in the SQLite FTS3 extension module in the way it implemented the snippet function. This flaw allows an attacker who can execute SQL statements to crash the application or potentially execute arbitrary code.

Statement: This flaw did not affect the versions of SQLite as shipped with Red Hat Enterprise Linux 7 as they did not include the vulnerable code, which was introduced in a later version of the package.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/4.19/html/updating_openshift_data_foundation/updating-ocs-to-odf_rhodf
crafted romfs filesystem leaks uninitialized memory to userspace
CVE: CVE-2020-29371
Component: kernel
CWE: CWE-200
Severity: None
CVSS v3: 0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:N
Release date: 2020-08-13T00:00:00+00:00

An issue was discovered in romfs_dev_read in fs/romfs/storage.c in the Linux kernel before 5.8.4. Uninitialized memory leaks to userspace, aka CID-bcf85fcedfdd.


Remediation:
Stored XSS possible when renaming content bank items
CVE: CVE-2020-25702
Component: moodle
CVSS v3: 4.8/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Release date: 2020-11-16T04:00:00+00:00

It was possible to include JavaScript when re-naming content bank items.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Out-of-bounds write in grub_usb_device_initialize()
CVE: CVE-2020-25647
Component: grub2
CWE: CWE-787
Severity: Moderate
CVSS v3: 7.5/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Release date: 2020-01-01T00:00:00+00:00

A flaw was found in grub2. During USB device initialization, descriptors are read with very little bounds checking and assumes the USB device is providing sane values. If properly exploited, an attacker could trigger memory corruption leading to arbitrary code execution allowing a bypass of the Secure Boot mechanism. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Remediation:
Improper input validation in function async_READ_handler
CVE: CVE-2020-23793
Component: spice
CWE: CWE-20
Severity: Moderate
CVSS v3: 7.4/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Release date: 2020-01-01T00:00:00+00:00

A flaw was found in spice-server in Redhat's VDI product that can restart KVMvirtual machine without any authorization. A handshake is required before spice-server and spice-client can establish communication, and spice-client will send a request containing information that the server needs. This TCP request requires only host and port; A malformed TCP packet causes the vm to crash and the QEMu-KVM process to be restarted.


Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
command injection via crafted configuration file
CVE: CVE-2020-1930
Component: spamassassin
CWE: CWE-78
Severity: Moderate
CVSS v3: 7.4/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-01-30T00:00:00+00:00

A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious rule configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. With this bug unpatched, exploits can be injected in a number of scenarios including the same privileges as spamd is run which may be elevated though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again recommend that users should only use update channels or 3rd party .cf files from trusted places. If you cannot upgrade, do not use 3rd party rulesets, do not use sa-compile and do not run spamd as an account with elevated privileges.

Statement: The attack is triggered by malicious specially crafted .cf files which are basically configuration files for spamassasin. These files can be located at:
1. /usr/share/spamassassin
2. /etc/mail/spamassassin
3. user's home directory, in a directory called .spamassassin

All of these locations can only be accessed by either the system administrator or by a user having a local shell account on the machine. In order to successfully exploit this flaw, the attacker needs to convince the user to place the malicious configuration files in one of the above locations.

Remediation:
performs an incorrect CSRF verification
CVE: CVE-2020-35217
Component: vertx-web
CWE: CWE-352
Severity: Moderate
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-01-01T00:00:00+00:00

Vert.x-Web framework v4.0 milestone 1-4 does not perform a correct CSRF verification. Instead of comparing the CSRF token in the request with the CSRF token in the cookie, it compares the CSRF token in the cookie against a CSRF token that is stored in the session. An attacker does not even need to provide a CSRF token in the request because the framework does not consider it. The cookies are automatically sent by the browser and the verification will always succeed, leading to a successful CSRF attack.


Remediation:
NULL pointer dereference in sanei_epson_net_read function
CVE: CVE-2020-12867
Component: sane-backends
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.9/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-06-01T00:00:00+00:00

A NULL pointer dereference in sanei_epson_net_read in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to cause a denial of service, aka GHSL-2020-075.


Remediation:
heap-based buffer overflow via a crafted ARJ file
CVE: CVE-2020-3327
Component: clamav
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-05-12T00:00:00+00:00

A vulnerability in the ARJ archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.102.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a heap buffer overflow read. An attacker could exploit this vulnerability by sending a crafted ARJ file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Race in Mojo
CVE: CVE-2020-6575
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-09-08T00:00:00+00:00

Race in Mojo in Google Chrome prior to 85.0.4183.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
soft lockup via a crafted journal size in ext4_protect_reserved_inode in fs/ext4/block_validity.c
CVE: CVE-2020-8992
Component: kernel
CWE: CWE-400
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-02-11T00:00:00+00:00

A vulnerability was found in ext4_protect_reserved_inode in the fs/ext4/block_validity.c function. This flaw allows an attacker to mount a crafted image with a large size inode journal, causing a denial of service.

Statement: The affected code was not introduced into any kernel versions shipped with Red Hat Enterprise Linux making this vulnerable not applicable to these platforms.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread
installation base or stability.
Use after free in printing
CVE: CVE-2020-15971
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-10-06T00:00:00+00:00

Use after free in printing in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Server: Security: Privileges unspecified vulnerability (CPU Jul 2020)
CVE: CVE-2020-14663
Component: mysql
Severity: Important
CVSS v3: 8.2/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-07-14T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c
CVE: CVE-2020-14399
Component: libvncserver
CWE: CWE-200
Severity: Low
CVSS v3: 0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N
Release date: 2020-06-17T00:00:00+00:00

An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c. NOTE: there is reportedly "no trust boundary crossed.

Statement: This flaw does not affect versions of vino shipped with Red Hat Enterprise Linux 6, 7, or 8 because vino does not ship the libvncclient. Additionally, Red Hat Product Security does not consider this to be a security vulnerability because no trust boundary is crossed and there is no known path of exploitation. This is a standard software reliability bug.

Remediation:
Memory safety bugs fixed in Firefox 75
CVE: CVE-2020-6826
Component: Mozilla
CWE: CWE-119
Severity: Important
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-04-10T12:00:00+00:00

Mozilla developers Tyson Smith, Bob Clary, and Alexandru Michis reported memory safety bugs present in Firefox 74. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 75.


Remediation:
encryption algorithm used is insecure
CVE: CVE-2020-11031
Component: glpi
CVSS v3: 7.8/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Release date: 2020-07-07T00:00:00+00:00

In GLPI before version 9.5.0, the encryption algorithm used is insecure. The security of the data encrypted relies on the password used, if a user sets a weak/predictable password, an attacker could decrypt data. This is fixed in version 9.5.0 by using a more secure encryption library. The library chosen is sodium.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Out-of-bounds write in interleaved.c
CVE: CVE-2020-11524
Component: freerdp
CWE: CWE-125
Severity: Important
CVSS v3: 7.2/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-04-09T00:00:00+00:00

A flaw was found in FreeRDP between versions 1.0 and 2.0.0. An out-of-bounds memory write was found in the interleaved.c function which could allow an attacker to take over and control the RDP server, including data sent to the client. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Remediation:
Segmentation fault in the redis-server component
CVE: CVE-2020-21468
Component: redis
CWE: CWE-119
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-01-01T00:00:00+00:00

A segmentation fault in the redis-server component of Redis 5.0.7 leads to a denial of service (DOS). NOTE: the vendor cannot reproduce this issue in a released version, such as 5.0.7


Remediation:
mysql_install_db allows privilege escalation due to unsafe chown and chmod operations
CVE: CVE-2020-7221
Component: mariadb
CWE: CWE-267
Severity: Moderate
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-02-04T00:00:00+00:00

A privilege escalation vulnerability was found in MariaDB, in the way it handled a `setuid` program during the installation process. A local MySQL user could abuse this flaw to escalate their privileges on the system, by gaining root privileges once the bash script `mysql_install_db.sh` is executed.

Statement: This flaw did not affect the versions of MariaDB as shipped with Red Hat Enterprise Linux 7, and 8 as they did not include the vulnerable code, which was introduced in a newer version of the package. The same is true for the versions of MariaDB as shipped with Red Hat Software Collections 3.

Remediation:
buffer overflow copying iv_data from guest to host (prepare_sym_cipher_op & prepare_sym_chain_op)
CVE: CVE-2020-14376
Component: dpdk
CWE: CWE-120
Severity: Important
CVSS v3: 7.7/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Release date: 2020-09-28T15:00:00+00:00

A flaw was found in dpdk. A lack of bounds checking when copying iv_data from the VM guest memory into host memory can lead to a large buffer overflow. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: This flaw does not affect the versions of `dpdk` as shipped with Red Hat Enterprise Linux 7 and 8 or the versions embedded in Red Hat Virtualization or the Fast Datapath `openvswitch` package, as they do not enable generic crypto device library support. This causes the vulnerable code in vhost_crypto.c to not be included.

This flaw does not affect Red Hat Ceph Storage 3 and 4 as dpdk (embedded in ceph source rpm) is not built in the packages, therefore the vulnerable code is not available in the resulting RPM and the issue cannot be exploited.

Remediation:
Type Confusion in V8
CVE: CVE-2020-6430
Component: chromium-browser
Severity: Moderate
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-04-07T00:00:00+00:00

Type Confusion in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.