huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
powerpc: local user can read vector registers of other users' processes via a Facility Unavailable exception
CVE: CVE-2019-15030
Component: kernel
CWE: CWE-200
Severity: Moderate
CVSS v3: 4.5/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Release date: 2019-09-06T00:00:00+00:00

A flaw in the Linux kernel on the PowerPC platform, was found where a local user can read vector registers of other user processes (via a Facility Unavailable exception). An attacker must start a transaction when the FPU operation begins or there is no leakage. Vector registers will become corrupted with values from the different local Linux processes, because of the missing check inside arch/powerpc/kernel/process.c. The highest threat from this vulnerability is confidentiality of data and availability of the system.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
When applicable rely on FPU emulation (for example by rebuilding the critical services code) instead of the hardware FPU.
nsswitch based config loaded inside chroot under Glibc
CVE: CVE-2019-14271
Component: docker
CWE: CWE-426
Severity: Important
CVSS v3: 8.3/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Release date: 2019-07-30T00:00:00+00:00

A flaw was discovered in Docker if it is compiled with Go 1.11. During a `docker cp` command, the nsswitch facility dynamically loads a library inside a chroot that contains the contents of the container. An attacker could abuse this flaw by executing code with the root privileges.

Statement: This issue did not affect the versions of docker as shipped with Red Hat Enterprise Linux 7 as they did not use Go 1.11.

Remediation:
Server: Optimizer unspecified vulnerability (CPU Jan 2019)
CVE: CVE-2019-2530
Component: mysql
Severity: Moderate
CVSS v3: 5.9/CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2019-01-15T00:00:00+00:00

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
exploitable code execution in the XPM image rendering leads to an integer overflow in the colorhash function
CVE: CVE-2019-5060
Component: SDL2_image
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2019-08-09T00:00:00+00:00

An exploitable code execution vulnerability exists in the XPM image rendering function of SDL2_image 2.0.4. A specially crafted XPM image can cause an integer overflow in the colorhash function, allocating too small of a buffer. This buffer can then be written out of bounds, resulting in a heap overflow, ultimately ending in code execution. An attacker can display a specially crafted image to trigger this vulnerability.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
null pointer dereference in component filterbank
CVE: CVE-2019-1010222
Component: aubio
CVSS v3: 3.9/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2019-08-01T00:00:00+00:00

No description is available for this CVE.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
use-after-free in PDFium
CVE: CVE-2019-13721
Component: chromium-browser
CWE: CWE-416
Severity: Important
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2019-10-12T00:00:00+00:00

Use after free in PDFium in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
HTML5 colon named entity mishandling in wp_kses_bad_protocol in wp-includes/kses.php allows bypass input sanitization
CVE: CVE-2019-20041
Component: wordpress
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Release date: 2019-12-27T00:00:00+00:00

wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization, as demonstrated by the javascript&colon; substring.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Use-after-free in IndexedDB
CVE: CVE-2019-5826
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2019-04-30T00:00:00+00:00

Use after free in IndexedDB in Google Chrome prior to 73.0.3683.86 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
XSS vulnerability in the documentation XML-RPC server in server_title field
CVE: CVE-2019-16935
Component: python
CWE: CWE-79
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2019-09-21T00:00:00+00:00

A reflected cross-site scripting (XSS) vulnerability was found in Python XML-RPC server. The `server_title` field is not sufficiently sanitized allowing malicious JavaScript to be injected. Successful exploitation would allow a remote attacker to execute JavaScript code within the context of the affected user.

Statement: This flaw does not affect the versions of python27-python as shipped with Red Hat Software Collections 3 as they already include the fix.
This flaw does not affect the versions of python36:3.6/python36 as shipped with Red Hat Enterprise Linux 8 as they are "symlinks" to the main python3 component, which provides the actual interpreter of the Python programming language.

Remediation:
Download and install a new CLI binary by following the instructions linked from the References section.
allows arbitrary command injection in conf.c in download_with_xfercommand function
CVE: CVE-2019-18182
Component: pacman
CVSS v3: 7.2/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2019-10-12T00:00:00+00:00

pacman before 5.2 is vulnerable to arbitrary command injection in conf.c in the download_with_xfercommand() function. This can be exploited when unsigned databases are used. To exploit the vulnerability, the user must enable a non-default XferCommand and retrieve an attacker-controlled crafted database and package.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
memory leak vulnerability in function ReadPCLImage in coders/pcl.c
CVE: CVE-2019-12976
Component: imagemagick
CWE: CWE-400
Severity: Low
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2019-06-26T00:00:00+00:00

It was discovered that ImageMagick does not properly release acquired memory when some error conditions occur in the ReadPCLImage() function. Applications compiled against ImageMagick libraries that accept untrustworthy images may be exploited to use all available memory and make them crash.
An attacker could abuse this flaw by providing a specially crafted image and cause a Denial of Service by using all available memory.


Remediation:
SQL Injection when the group_by parameter can be controlled
CVE: CVE-2019-7548
Component: python-sqlalchemy
CWE: CWE-89
Severity: Moderate
CVSS v3: 7.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2019-02-01T00:00:00+00:00

SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.

Statement: This issue affects the versions of python-sqlalchemy(bundled in calamari-server) shipped with Red Hat Ceph Storage 2. However, this flaw is not known to be exploitable in any meaningful way within calamari webapp. A future update may address this issue.

Remediation:
CSRF bypass
CVE: CVE-2019-13664
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2019-09-10T00:00:00+00:00

Insufficient policy enforcement in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
NULL pointer dereference when validating the certificate of a client connecting to the server
CVE: CVE-2019-19269
Component: proftpd
CVSS v3: 5.8/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2019-11-26T00:00:00+00:00

An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b. A dereference of a NULL pointer may occur. This pointer is returned by the OpenSSL sk_X509_REVOKED_value() function when encountering an empty CRL installed by a system administrator. The dereference occurs when validating the certificate of a client connecting to the server in a TLS client/server mutual-authentication setup.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
users can execute arbitrary OS commands via scripting interfaces in the rvim restricted mode
CVE: CVE-2019-20807
Component: vim
CWE: CWE-78
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2019-01-01T00:00:00+00:00

A flaw was found in vim in the restricted mode, where all commands that make use of external shells are disabled. However, it was found that users could still execute some arbitrary OS commands in the restricted mode. This flaw was fixed by filtering the functions that can call OS commands. Interfaces such as Python, Ruby, and Lua, are also disabled, as they can be used to execute shell commands. Perl uses the Safe module.

Statement: Upstream suggests that users may still find loopholes to execute a shell commands, it has only been made difficult. So administrators should not assume that vim restricted mode will completely disable execution of OS commands.

Remediation:
Zero-byte allocation with a specially crafted SFTP packed leading to an out-of-bounds read
CVE: CVE-2019-3858
Component: libssh2
CWE: CWE-125
Severity: Moderate
CVSS v3: 5.0/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2019-03-13T00:00:00+00:00

An out of bounds read flaw was discovered in libssh2 when a specially crafted SFTP packet is received from the server. A remote attacker who compromises a SSH server may be able to cause a denial of service or read data in the client memory.

Statement: This flaw was present in libssh2 packages included in Red Hat Virtualization Hypervisor and Management Appliance, however libssh2 in these hosts is never exposed to malicious clients or servers.

libssh2 is no longer included in the virt module since Red Hat Enterprise Linux 8.1.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing these updated packages, all running applications using libssh2 must be restarted for this update to take effect.
For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html
Null pointer dereference in rpcapd/daemon.c
CVE: CVE-2019-15163
Component: libpcap
CWE: CWE-119
Severity: Low
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2019-09-20T00:00:00+00:00

rpcapd/daemon.c in libpcap before 1.9.1 allows attackers to cause a denial of service (NULL pointer dereference and daemon crash) if a crypt() call fails.

Statement: This issue did not affect the versions of libpcap as shipped with Red Hat Enterprise Linux 6, 7, and 8 as they did not include support for RPCAPD.

Remediation:
out-of-bounds read in repodata_schema2id in repodata.c
CVE: CVE-2019-20387
Component: libsolv
CWE: CWE-125
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2019-01-01T00:00:00+00:00

An out-of-bounds read was discovered in Libsolv when the last schema has a length that is less than the length of the input schema. A remote attacker may abuse this flaw to crash an application that uses Libsolv.


Remediation:
Multiple memory corruption issues leading to arbitrary code execution
CVE: CVE-2019-8594
Component: webkitgtk
Severity: Moderate
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2019-05-20T00:00:00+00:00

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution.


Remediation:
integer overflow in function JBIG2Bitmap::combine in JBIG2Stream.cc
CVE: CVE-2019-14288
Component: xpdf
CVSS v3: 6.1/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2019-07-10T00:00:00+00:00

An issue was discovered in Xpdf 4.01.01. There is an Integer overflow in the function JBIG2Bitmap::combine at JBIG2Stream.cc for the "one byte per line" case.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Xpdf 2.00 allows a SIGSEGV in XRef::constructXRef in XRef.cc
CVE: CVE-2019-15860
Component: Xpdf
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2019-09-03T00:00:00+00:00

Xpdf 2.00 allows a SIGSEGV in XRef::constructXRef in XRef.cc. NOTE: 2.00 is a version from November 2002.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
out-of-bounds access in function hclge_tm_schd_mode_vnet_base_cfg
CVE: CVE-2019-15925
Component: kernel
CWE: CWE-787
Severity: Moderate
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2019-09-04T00:00:00+00:00

An out-of-bounds access flaw was found in the hclge_shaper_para_calc driver in the Linux kernel. Access to an array with an index higher than its maximum index will lead to an out-of-bounds access vulnerability. This could affect both data confidentiality and integrity as well as system availability.


Remediation:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from the References section.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from the References section.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Blacklisting the affected HCLGE driver module until a patch is available can be done using the blacklist mechanism. This will ensure the driver is not loaded at boot time.  For instructions on how to black list a kernel module, please read: https://access.redhat.com/solutions/41278.
bitmap double free in main.c allows attackers to cause an unspecified impact
CVE: CVE-2019-19005
Component: autotrace
Severity: Moderate
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2019-01-01T00:00:00+00:00

A bitmap double free in main.c in autotrace 0.31.1 allows attackers to cause an unspecified impact via a malformed bitmap image. This may occur after the use-after-free in CVE-2017-9182.


Remediation:
ISAKMP dissector crash in epan/dissectors/packet-isakmp.c
CVE: CVE-2019-5719
Component: wireshark
CWE: CWE-476
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2019-01-08T00:00:00+00:00

In Wireshark 2.6.0 to 2.6.5 and 2.4.0 to 2.4.11, the ISAKMP dissector could crash. This was addressed in epan/dissectors/packet-isakmp.c by properly handling the case of a missing decryption data block.


Remediation:
buffer overflow via a crafted PDF file
CVE: CVE-2019-14267
Component: pdfresurrect
CVSS v3: 4.3/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Release date: 2019-07-26T00:00:00+00:00

PDFResurrect 0.15 has a buffer overflow via a crafted PDF file because data associated with startxref and %%EOF is mishandled.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Insecure HTTP URL used to download dependencies leading to possibly maliciously compromised artifacts.
CVE: CVE-2019-11065
Component: gradle
CWE: CWE-345
Severity: Important
CVSS v3: 8.0/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Release date: 2019-04-09T00:00:00+00:00

A flaw was discovered in Gradle, where it uses an insecure HTTP URL to download dependencies.  This flaw causes dependency artifacts to be maliciously compromised by a Man-in-the-middle(MITM) attack.


Remediation:
stack-based buffer over-read in conn_to_str in memcached.c
CVE: CVE-2019-15026
Component: memcached
CWE: CWE-119
Severity: Moderate
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2019-08-20T00:00:00+00:00

memcached 1.5.16, when UNIX sockets are used, has a stack-based buffer over-read in conn_to_str in memcached.c.

Statement: The versions of memcached shipped with Red Hat Enterprise Linux 5 to 7 are not affected by this issue as it doesn't contain the vulnerable source code.

Remediation:
denial of service in _sasl_add_string function
CVE: CVE-2019-19906
Component: cyrus-sasl
CWE: CWE-400
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2019-11-28T00:00:00+00:00

cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl.


Remediation:
using dscreate in verbose mode results in information disclosure
CVE: CVE-2019-10224
Component: 389-ds-base
CWE: CWE-538
Severity: Low
CVSS v3: 4.3/CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2019-01-01T00:00:00+00:00

When executed in verbose mode, the dscreate and dsconf commands may display sensitive information, such as the Directory Manager password. An attacker, able to see the screen or record the terminal standard error output, could use this flaw to gain sensitive information.


Remediation:
invalid free error in function SDL_SetError_REAL
CVE: CVE-2019-12219
Component: SDL
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2019-05-20T00:00:00+00:00

An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is an invalid free error in the SDL function SDL_SetError_REAL at SDL_error.c.

Statement: This issue did not affect the versions of SDL as shipped with Red Hat Enterprise Linux 5, 6, 7, and 8 as they did not include SDL2_Image add-on.

Remediation:
kernel pointer leak in sync debug fs driver leads to local information disclosure
CVE: CVE-2019-9444
Component: kernel
CWE: CWE-200
Severity: Moderate
CVSS v3: 5.1/CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Release date: 2019-09-03T00:00:00+00:00

In the Android kernel in sync debug fs driver there is a kernel pointer leak due to the usage of printf with %p. This could lead to local information disclosure with system execution privileges needed. User interaction is not needed for exploitation.


Remediation:
Resource exhaustion via crafted SVG file with nested patterns
CVE: CVE-2019-20446
Component: librsvg
CWE: CWE-400
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2019-01-01T00:00:00+00:00

In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The attacker constructs pattern elements so that the number of final rendered objects grows exponentially.

Statement: This flaw is similar to billion laughs. A specially-crafted XML file can cause librsvg to consume excessive memory and result in denial of service. This flaw also affects browsers. Currently Mozilla and Google are working on updates for Firefox and Chromium browser respectively.

Remediation:
This flaw is triggered when untrusted XML files are parsed with applications compiled with librsvg2 library. Applications which do not parse untrusted XML files are not affected by this flaw.