huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
zip slip - arbitrary file write vulnerability / arbitrary code execution using a specially crafted container image
CVE: CVE-2020-27833
Component: openshift/oc
CWE: CWE-20
Severity: Moderate
CVSS v3: 7.2/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-12-10T00:00:00+00:00

A Zip Slip vulnerability was found in the oc binary in openshift-clients where an arbitrary file write is achieved by using a specially crafted raw container image (.tar file) which contains symbolic links. The vulnerability is limited to the command `oc image extract`. If a symbolic link is first created pointing within the tarball, this allows further symbolic links to bypass the existing path check. This flaw allows the tarball to create links outside the tarball's parent directory, allowing for executables or configuration files to be overwritten, resulting in arbitrary code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.


Remediation:
The option `--only-files=true` can be specified to ensure that only files and directories from the image are extracted and symbolic links are ignored. While this means that if a  image does implement malicious symbolic links, no links will be created outside the parent tarball. However, this does mean that if legitimate symbolic links are specific within the image these will also not be created.
Inappropriate implementation in installer
CVE: CVE-2020-6546
Component: chromium-browser
Severity: Important
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-08-10T00:00:00+00:00

Inappropriate implementation in installer in Google Chrome prior to 84.0.4147.125 allowed a local attacker to potentially elevate privilege via a crafted filesystem.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
division by zero in OptimizeLayerFrames function in MagickCore/layer.c
CVE: CVE-2020-27560
Component: ImageMagick
CWE: CWE-369
Severity: Low
CVSS v3: 3.2/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2020-10-19T00:00:00+00:00

ImageMagick 7.0.10-34 allows Division by Zero in OptimizeLayerFrames in MagickCore/layer.c, which may cause a denial of service.

Statement: This flaw is out of support scope for Red Hat Enterprise Linux 5, 6, and 7. Inkscape is not affected because it no longer uses a bundled ImageMagick in Red Hat Enterprise Linux 8. For more information regarding support scopes, please see https://access.redhat.com/support/policy/updates/errata.

Remediation:
Incorrect security UI in Omnibox
CVE: CVE-2020-6403
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2020-02-04T00:00:00+00:00

Incorrect implementation in Omnibox in Google Chrome on iOS prior to 80.0.3987.87 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
slirp: networking out-of-bounds read information disclosure vulnerability
CVE: CVE-2020-10756
Component: QEMU
CWE: CWE-125
Severity: Moderate
CVSS v3: 6.3/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Release date: 2020-05-27T00:00:00+00:00

An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible information disclosure.

Statement: This flaw did not affect the versions of SLiRP embedded in `qemu-kvm` as shipped with Red Hat Enterprise Linux 6 and 7, as they did not include support for ICMPv6, which was introduced in a later version of the package.

OpenShift 4.x packages slirp4netns  as a dependency of podman however podman doesn't set the --enable-ipv6 flag. Hence the impact has been reduced to low, as the code is still being packaged and podman might decide to enable IPv6 in future.

In Red Hat OpenStack Platform, because the flaw has a lower impact and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP qemu-kvm-rhev package.

Remediation:
incorrectly validates TLS certificates when using wildcards for DNS SAN's
CVE: CVE-2020-15104
Component: envoyproxy/envoy
CWE: CWE-297
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N
Release date: 2020-07-08T00:00:00+00:00

An improper certificate validation vulnerability was found in envoyproxy/envoy, when externally created certificates with wildcards in the DNS Subject Alternative Name are used. This flaw allows an attacker to subvert the envoy filter or destination rules to access restricted resources. The highest threat from this vulnerability is to confidentiality.

Statement: For OpenShift ServiceMesh to be affected by this vulnerability, it must be configured to validate externally issued certificates. By default, ServiceMesh does not issue certificates that use DNS wildcard SANs.

Remediation:
The OpenShift Service Mesh release notes provide information on the features and
known issues:

https://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html
inefficient algorithm allows a DoS (CPU consumption) in _encode_invalid_chars function in util/url.py
CVE: CVE-2020-7212
Component: python-urllib3
CWE: CWE-400
Severity: None
CVSS v3: 0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
Release date: 2020-03-06T00:00:00+00:00

If provided a specially crafted URL, urllib3 could be made to encode it using an O(N^2) algorithm, when an approximately O(N) one was possible.

Statement: Red Hat Product Security does not consider this to be a vulnerability. The choice of an inefficient algorithm could cause a little more CPU time to be used than the alternative, however the difference in practice is not sufficient to cause a meaningful or even noticeable impact on the application.

Remediation:
Out-of-bounds access in XkbSetNames function
CVE: CVE-2020-14345
Component: xorg-x11-server
CWE: CWE-119
Severity: Important
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-08-25T00:00:00+00:00

A flaw was found in X.Org Server. An Out-Of-Bounds access in XkbSetNames function may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: Xorg server does not run with root  privileges in Red Hat Enterprise Linux 8, therefore this flaw has been rated as having moderate impact for Red Hat Enterprise linux 8.

Remediation:
Heap buffer overflow in handshake with no_renegotiation alert sent
CVE: CVE-2020-24659
Component: gnutls
CWE: CWE-20
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-09-04T00:00:00+00:00

A flaw was found in GnuTLS, where the server can trigger the client to run into heap buffer overflow if a no_renegotiation alert is sent in an unexpected timing. This flaw allows the client to crash at the session deinitialization timing. The highest threat from this vulnerability is to system availability.

Statement: This issue only affects TLS 1.3 implementation of GnuTLS which is available on GnuTLS 3.6.x branch. Therefore only GnuTLS packages shipped with Red Hat Enterprise Linux 8 are affected by this flaw.

Remediation:
allows remote attackers to replay an OTP
CVE: CVE-2020-10185
Component: yubikey-val
CVSS v3: 6.5/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
Release date: 2020-03-03T00:00:00+00:00

The sync endpoint in YubiKey Validation Server before 2.40 allows remote attackers to replay an OTP. NOTE: this issue is potentially relevant to persons outside Yubico who operate a self-hosted OTP validation service with a non-default configuration such as an open sync pool; the issue does NOT affect YubiCloud.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
sd: OOB access could crash the guest resulting in DoS
CVE: CVE-2020-13253
Component: QEMU
CWE: CWE-125
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2020-05-20T00:00:00+00:00

An out-of-bounds read-access flaw was found in the SD Memory Card emulator of the QEMU. This flaw occurs while performing block write commands via sdhci_write(), if a guest user has sent an 'address' which is out-of-bounds of 's->wp_groups'. A guest user or process may use this flaw to crash the QEMU process resulting in a denial of service.


Remediation:
CVE: CVE-2020-1903
Component: CVE-2020-1903
Release date: 2020-01-01T00:00:00+00:00

An issue when unzipping docx, pptx, and xlsx documents in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have resulted in an out-of-memory denial of service. This issue would have required the receiver to explicitly open the attachment if it was received from a number not in the receiver's WhatsApp contacts.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Race condition allows reading of restricted memory
CVE: CVE-2020-3894
Component: webkitgtk
Severity: Low
CVSS v3: 3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Release date: 2020-04-27T00:00:00+00:00

A race condition was addressed with additional validation. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. An application may be able to read restricted memory.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

GDM must be restarted for this update to take effect.
injecting a malformed packet may cause WiMax DLMAP dissector to crash due to out-of-bound read
CVE: CVE-2020-9430
Component: wireshark
CWE: CWE-125
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-02-26T00:00:00+00:00

An out-of-bounds read was discovered in Wireshark when processing WiMax packets. An attacker can trigger the flaw by injecting special packets onto the wire or by convincing a victim user into opening a malformed packet trace file.


Remediation:
mishandling the URL argument to browsers.openDefaultBrowser could lead to arbitrary command execution
CVE: CVE-2020-15692
Component: nim
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-08-14T00:00:00+00:00

In Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser. This argument can be a local file path that will be opened in the default explorer. An attacker can pass one argument to the underlying open command to execute arbitrary registered system commands.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Out of bounds read in JavaScript
CVE: CVE-2020-6395
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2020-02-04T00:00:00+00:00

Out of bounds read in JavaScript in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
heap-based buffer overflow in WriteOnePNGImage in coders/png.c
CVE: CVE-2020-25674
Component: ImageMagick
CWE: CWE-125
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2020-01-01T00:00:00+00:00

A flaw was found in ImageMagick. When the colormap has less than 256 valid values, the loop condition will continue to loop 256 times, attempting to pass invalid colormap data to the event logger, leading to an improper exit condition and an out-of-bounds read via heap-buffer-overflow. The highest threat from this vulnerability is to system availability.

Statement: This flaw is out of support scope for Red Hat Enterprise Linux 5, 6, and 7. Inkscape is not affected because it no longer uses a bundled ImageMagick in Red Hat Enterprise Linux 8. For more information regarding support scopes, please see https://access.redhat.com/support/policy/updates/errata.

Remediation:
SQL injection due to missing check of the length of SQL queries
CVE: CVE-2020-10184
Component: yubikey-val
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-03-03T00:00:00+00:00

The verify endpoint in YubiKey Validation Server before 2.40 does not check the length of SQL queries, which allows remote attackers to cause a denial of service, aka SQL injection. NOTE: this issue is potentially relevant to persons outside Yubico who operate a self-hosted OTP validation service; the issue does NOT affect YubiCloud.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Server: Optimizer unspecified vulnerability (CPU Jul 2020)
CVE: CVE-2020-14597
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-07-14T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
possible use-after-free due to a race condition in cdev_get of char_dev.c
CVE: CVE-2020-0305
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-07-17T00:00:00+00:00

A use-after-free flaw was found in the way the Linux kernel's filesystem subsystem handled a race condition in the chrdev_open function. This flaw allows a privileged local user to starve the resources, causing a denial of service or potentially escalating their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Statement: This issue is rated as having Moderate impact because of the preconditions needed to trigger the issue (elevated/root privileges).

Remediation:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from the References section.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from the References section.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
XSS via HTML or plain text messages with malicious content
CVE: CVE-2020-35730
Component: roundcubemail
CVSS v3: 7.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Release date: 2020-12-27T00:00:00+00:00

An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2020-1902
Component: CVE-2020-1902
Release date: 2020-01-01T00:00:00+00:00

A user running a quick search on a highly forwarded message on WhatsApp for Android from v2.20.108 to v2.20.140 or WhatsApp Business for Android from v2.20.35 to v2.20.49 could have been sent to the Google service over plain HTTP.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Memory corruption triggered by a malicious web content
CVE: CVE-2020-3895
Component: webkitgtk
Severity: Moderate
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-04-27T00:00:00+00:00

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. Processing maliciously crafted web content may lead to arbitrary code execution.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

GDM must be restarted for this update to take effect.
Lilypond allows attackers to bypass the -dsafe protection mechanism
CVE: CVE-2020-17354
Component: LilyPond
CVSS v3: 5.6/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2020-01-01T00:00:00+00:00

LilyPond before 2.24 allows attackers to bypass the -dsafe protection mechanism via output-def-lookup or output-def-scope, as demonstrated by dangerous Scheme code in a .ly file that causes arbitrary code execution during conversion to a different file format. NOTE: in 2.24 and later versions, safe mode is removed, and the product no longer tries to block code execution when external files are used.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
LTE RRC dissector memory leak could result in excessive memory resource consumption
CVE: CVE-2020-9431
Component: wireshark
CWE: CWE-400
Severity: Low
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-02-26T00:00:00+00:00

A memory leak was discovered in Wireshark in the LTE RRC dissector. This issue allows an attacker to trigger the flaw by injecting special packets onto the wire or by convincing a victim user into opening a malformed packet trace file.


Remediation:
CR-LF injection in the target URL in standard library httpClient
CVE: CVE-2020-15693
Component: nim
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Release date: 2020-08-14T00:00:00+00:00

In Nim 1.2.4, the standard library httpClient is vulnerable to a CR-LF injection in the target URL. An injection is possible if the attacker controls any part of the URL provided in a call (such as httpClient.get or httpClient.post), the User-Agent header value, or custom HTTP header names or values.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Insufficient policy enforcement in Blink
CVE: CVE-2020-6394
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2020-02-04T00:00:00+00:00

Insufficient policy enforcement in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass content security policy via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
outside the range of representable values of type 'long' and integer overflow at MagickCore/transform.c and MagickCore/image.c
CVE: CVE-2020-25675
Component: ImageMagick
CWE: CWE-190
Severity: Moderate
CVSS v3: 3.2/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2020-01-01T00:00:00+00:00

A flaw was found in ImageMagick. Rounding calculations performed on unconstrained pixel offsets causes undefined behavior in the form of integer overflow and out-of-range values. Such issues could cause a negative impact to application availability or other problems related to undefined behavior, in cases where ImageMagick processes untrusted input data. The highest threat from this vulnerability is to system availability.

Statement: This flaw is out of support scope for Red Hat Enterprise Linux 5, 6, and 7. Inkscape is not affected because it no longer uses a bundled ImageMagick in Red Hat Enterprise Linux 8. For more information regarding support scopes, please see https://access.redhat.com/support/policy/updates/errata.

Remediation: