huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Use after free in payments
CVE: CVE-2020-6496
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-06-03T00:00:00+00:00

Use after free in payments in Google Chrome on MacOS prior to 83.0.4103.97 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
stack-based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with a non-canonical bit pattern
CVE: CVE-2020-29573
Component: glibc
CWE: CWE-121
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-09-22T00:00:00+00:00

A stack buffer overflow flaw was found in glibc in the way the printf family of functions processed an 80-bit long double with a non-canonical bit pattern. This flaw allows an attacker who can control the arguments of these functions with the non-standard long double pattern to trigger an overflow and cause an application crash. The highest threat from this vulnerability is to system availability.

Statement: This is essentially a crash which can only be triggered by a non-standard argument passed as a long double input to a member of printf family of functions. The application has to be written in this way to allow this issue to be triggered. The maximum impact is an application crash.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

For the update to take effect, all services linked to the glibc library must be restarted, or the system rebooted.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

For the update to take effect, all services linked to the glibc library must be restarted, or the system rebooted.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

For the update to take effect, all services linked to the glibc library must be restarted, or the system rebooted.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

For the update to take effect, all services linked to the glibc library must be restarted, or the system rebooted.
Download and install a new CLI binary by following the instructions linked from the References section.
possible OOB write due to a heap buffer overflow
CVE: CVE-2020-0470
Component: libaom
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2020-12-07T00:00:00+00:00

In extend_frame_highbd of restoration.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-10Android ID: A-166268541

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
crafted TAR archive with symlinks can install files outside the extraction directory
CVE: CVE-2020-24654
Component: ark
CWE: CWE-59
Severity: Low
CVSS v3: 3.2/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Release date: 2020-08-27T00:00:00+00:00

In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the extraction directory, as demonstrated by a write operation to a user's home directory.


Remediation:
The way to mitigate this flaw is to pay attention to the contents of the archive in ark before extracting, to ensure that there are no improper symlinks, and heed the file overwrite warnings.
Denial of Service via unrecognized field injection
CVE: CVE-2020-14348
Component: AMQ
CWE: CWE-248
Severity: Moderate
CVSS v3: 3.7/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Release date: 2020-07-02T16:40:00+00:00

A flaw was found in AMQ Online before 1.5.2, where injecting an invalid field to a user's address space configuration of the user namespace puts AMQ Online in an inconsistent state. In this inconsistent state, the AMQ Online components do not operate properly. For example, the failure of provisioning and the failure of creating addresses may occur. However, this issue does not impact already existing messaging clients or brokers.


Remediation:
The Red Hat OpenShift Container Platform 3.11 and 4.4/4.5 container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available from https://access.redhat.com.

Dockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally.

Before applying this update, make sure all previously released errata relevant to your system have been applied.
The user can work around the issue by repairing the resource and removing the invalid (top-level) field.
no bounds checks in nextitem() function allows to remotely execute arbitrary code
CVE: CVE-2020-10188
Component: telnet-server
CWE: CWE-119
Severity: Important
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-02-28T00:00:00+00:00

A vulnerability was found where incorrect bounds checks in the telnet server’s (telnetd) handling of short writes and urgent data, could lead to information disclosure and corruption of heap data. An unauthenticated remote attacker could exploit these bugs by sending specially crafted telnet packets to achieve arbitrary code execution in the telnet server.

Statement: This vulnerability exists in the `telnet-server` package, not in the `telnet` client-side package. For a Red Hat Enterprise Linux host to be vulnerable, it must have telnet-server installed and the telnetd service enabled.  Use of telnetd is not recommended, as it is an un-encrypted protocol with cleartext transmission of passwords; alternatives such as openssh are preferred.

Remediation:
When in enforcing mode, SELinux as configured in Red Hat Enterprise Linux provides some mitigation against an exploit for telnet-server, because it limits the kind of operations it can perform and programs that can be run from the telnet-server's context.
Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2
CVE: CVE-2020-15670
Component: Mozilla
CWE: CWE-120
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-08-25T00:00:00+00:00

Mozilla developers reported memory safety bugs present in Firefox for Android 79. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 80, Firefox ESR < 78.2, Thunderbird < 78.2, and Firefox for Android < 80.


Remediation:
Use after free in audio
CVE: CVE-2020-6377
Component: chromium-browser
CWE: CWE-416
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-01-07T00:00:00+00:00

Use after free in audio in Google Chrome prior to 79.0.3945.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Uninitialized use in PDFium
CVE: CVE-2020-6398
Component: chromium-browser
Severity: Moderate
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-02-04T00:00:00+00:00

Use of uninitialized data in PDFium in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Server: Security: LDAP Auth unspecified vulnerability (CPU Oct 2020)
CVE: CVE-2020-14827
Component: mysql
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2020-10-20T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: LDAP Auth). Supported versions that are affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

Statement: MySQL as shipped in Red Hat Enterprise Linux and Software Collection do not have support for LDAP authentication. As a result, this flaw does not affect the component.

Remediation:
out-of-bounds write in parse_exif function in metadata/exif_gps.cpp
CVE: CVE-2020-15365
Component: LibRaw
CWE: CWE-787
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-06-15T00:00:00+00:00

LibRaw before 0.20-Beta3 has an out-of-bounds write in parse_exif() in metadata\exif_gps.cpp via an unrecognized AtomName and a zero value of tiff_nifds.

Statement: Versions of LibRaw shipped with Red Hat Enterprise Linux 7 and 8 are not affected by this flaw because the vulnerable code was introduced in a newer version of LibRaw. CR3 support was not introduced until 0.20-RC1 and the older exif code does not have the same logic.

Remediation:
Memory consumption issue leading to arbitrary code execution
CVE: CVE-2020-3899
Component: webkitgtk
Severity: Moderate
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-04-27T00:00:00+00:00

A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. A remote attacker may be able to cause arbitrary code execution.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

GDM must be restarted for this update to take effect.
buffer overflow in Databuf function in types.cpp leads to DoS
CVE: CVE-2020-19716
Component: exiv2
CWE: CWE-476
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2020-01-01T00:00:00+00:00

There's a flaw in exiv2. An attacker able to submit a crafted file to an application linked with exiv2 could trigger excessive resource consumption or a null pointer dereference, leading to an impact to application availability.

Statement: This flaw does not affect exiv2 as shipped with Red Hat Enterprise Linux 8; the fix is already applied. This flaw is out of support scope for exiv2 as shipped with Red Hat Enterprise Linux 7, and did not reproduce on it.

Remediation:
allows an unserialization attack because phar: is blocked but PHAR: is not blocked
CVE: CVE-2020-28948
Component: Archive_Tar
CWE: CWE-502
Severity: Moderate
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-11-19T00:00:00+00:00

Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.

Statement: PHP 7.2 and 7.3 marked End of Life at the time this CVE was released. There would be no patches made available for php-pear.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
memory leak via messages to an instance that performs many regex lookups due to a missing regfree call
CVE: CVE-2020-35679
Component: opensmtpd
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-12-23T00:00:00+00:00

smtpd/table.c in OpenSMTPD before 6.8.0p1 lacks a certain regfree, which might allow attackers to trigger a "very significant" memory leak via messages to an instance that performs many regex lookups.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
DCCP CCID structure use-after-free may lead to DoS or code execution
CVE: CVE-2020-16119
Component: kernel
CWE: CWE-416
Severity: Important
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-10-13T17:00:00+00:00

A flaw was found in the Linux kernel. When reusing a socket with an attached dccps_hc_tx_ccid as a listener, the socket will be used after being released leading to denial of service (DoS) or a potential code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Remediation:
Red Hat has previously automatically blacklisted the DCCP module in Red Hat Enterprise Linux 7.5 and later in /etc/modprobe.d/dccp-blacklist.conf.

If this file does not exist with the above contents, the module can be prevented loading by running the  command

# echo "install dccp /bin/true" >> /etc/modprobe.d/dccp-blacklist.conf
 
The system will need to be restarted if the DCCP module is loaded. In most circumstances, the DCCP kernel modules will be unable to be unloaded while any network interfaces are active and the protocol is in use.

If the system requires this module to work correctly, this mitigation may not be suitable.

If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services.
NULL pointer dereference in bfd_pef_parse_function_stubs function in bfd/pef.c
CVE: CVE-2020-35507
Component: binutils
CWE: CWE-476
Severity: Low
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2020-01-01T00:00:00+00:00

A flaw was found in bfd_pef_parse_function_stubs of bfd/pef.c in binutils which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability.

Statement: binutils as shipped with Red Hat Enterprise Linux 8's GCC Toolset 10 and Red Hat Developer Toolset 10 are not affected by this flaw because the versions shipped have already received the patch.

The issue is classified as low severity primarily because binutils is not typically exposed to untrusted inputs in most environments, limiting its exploitation potential. The NULL pointer dereference in bfd_pef_parse_function_stubs() only triggers during the parsing of malformed files, which would require an attacker to convince a user to process a malicious file. Moreover, binutils does not handle privileged operations, meaning exploitation is unlikely to lead to system compromise or escalation of privileges. Additionally, the impact is localized to the application itself, without affecting the broader system or network security.

Remediation:
stream out-of-bounds seek in rdp_read_font_capability_set could lead to out-of-bounds read
CVE: CVE-2020-11058
Component: freerdp
CWE: CWE-125
Severity: Low
CVSS v3: 2.7/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L
Release date: 2020-04-09T00:00:00+00:00

In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in rdp_read_font_capability_set could lead to a later out-of-bounds read. As a result, a manipulated client or server might force a disconnect due to an invalid data read. This has been fixed in 2.0.0.


Remediation:
Improper confidentiality protection of server-side encryption keys
CVE: CVE-2020-8152
Component: nextcloud
CVSS v3: 4.8/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N
Release date: 2020-11-16T00:00:00+00:00

Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the public key to decrypt them later on.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
NULL pointer dereference in sqlite3ExprCodeTarget()
CVE: CVE-2020-13435
Component: sqlite
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-05-23T00:00:00+00:00

A NULL pointer dereference flaw was found in SQLite when rewriting select statements for window functions. This flaw allows an attacker who can execute SQL statements, to crash the application, resulting in a denial of service.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/4.19/html/updating_openshift_data_foundation/updating-ocs-to-odf_rhodf
logout endpoint /oauth/logout?redirect=url can be abused to redirect logged in users to arbitrary web pages
CVE: CVE-2020-1723
Component: keycloak
CWE: CWE-601
Severity: Low
CVSS v3: 4.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Release date: 2020-01-01T00:00:00+00:00

A flaw was found in Keycloak Gatekeeper (Louketo). The logout endpoint can be abused to redirect logged-in users to arbitrary web pages.


Remediation:
Crash due to assert in RPA implementation
CVE: CVE-2020-12674
Component: dovecot
CWE: CWE-125
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-08-12T12:00:00+00:00

A flaw was found in dovecot. An attacker can use the way dovecot handles RPA (Remote Passphrase Authentication) to crash the authentication process repeatedly preventing login. The highest threat from this vulnerability is to system availability.


Remediation:
Upstream suggests that this flaw can be mitigated by disabling RPA (Remote Passphrase Authentication). RPA can be disabled by using the configuration parameter "auth_mechanisms". More details available at: https://doc.dovecot.org/configuration_manual/authentication/authentication_mechanisms/
heap-based buffer overflow in pixFewColorsOctcubeQuantMixed in colorquant1.c
CVE: CVE-2020-36281
Component: leptonica
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2020-06-10T00:00:00+00:00

A flaw was found in leptonica. A heap-based buffer over-read in the pixFewColorsOctcubeQuantMixed function in colorquant1.c file may allow an attacker to read data from an application using leptonica. The highest threat from this vulnerability is to data confidentiality.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Use after free in payments
CVE: CVE-2020-6459
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-04-21T00:00:00+00:00

Use after free in payments in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Insuficient atributes checking in firewall function could result in unauthorized access
CVE: CVE-2020-5275
Component: symfony
CVSS v3: 7.7/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:H
Release date: 2020-03-30T00:00:00+00:00

In symfony/security-http before versions 4.4.7 and 5.0.7, when a `Firewall` checks access control rule, it iterate overs each rule's attributes and stops as soon as the accessDecisionManager decides to grant access on the attribute, preventing the check of next attributes that should have been take into account in an unanimous strategy. The accessDecisionManager is now called with all attributes at once, allowing the unanimous strategy being applied on each attribute. This issue is patched in versions 4.4.7 and 5.0.7.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
buffer overflow in pj_common_print_page() in devices/gdevpjet.c could result in a DoS
CVE: CVE-2020-16288
Component: ghostscript
CWE: CWE-125
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2020-08-13T00:00:00+00:00

A buffer overflow vulnerability in pj_common_print_page() in devices/gdevpjet.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.