huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
CVE: CVE-2020-1904
Component: CVE-2020-1904
Release date: 2020-01-01T00:00:00+00:00

A path validation issue in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have allowed for directory traversal overwriting files when sending specially crafted docx, xlsx, and pptx files as attachments to messages.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Use after free in WebUSB
CVE: CVE-2020-6541
Component: chromium-browser
CWE: CWE-416
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-07-27T00:00:00+00:00

Use after free in WebUSB in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
information leak via power sidechannel
CVE: CVE-2020-28368
Component: xen
CWE: CWE-200
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Release date: 2020-11-10T00:00:00+00:00

A flaw was found in Xen where access to power/energy monitoring interfaces was not properly restricted to privileged software. This flaw allows an unprivileged guest administrator to create covert channels and infer the operations or data used by other contexts within the system, such as AES keys or additional sensitive information. The highest threat from this vulnerability is to confidentiality.

Statement: This flaw has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates of Red Hat Enterprise Linux 5. Red Hat Enterprise Linux 5 is now in  the Extended Life Phase of the support and maintenance life cycle. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Remediation:
There is no known mitigation for this flaw apart from applying the patch.
NTFS protections inactive when running Git in the Windows Subsystem for Linux
CVE: CVE-2020-12279
Component: libgit2
CWE: CWE-358
Severity: Low
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-01-01T00:00:00+00:00

An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1353.

Statement: Even if the code in the versions of libgit2 as shipped with Red Hat Enterprise Linux 7, and 8 are affected by this flaw, Red Hat does not support the NTFS filesystem nor Windows Subsystem for Linux (WSL). For this reason, the flaw has a Low Impact.

Remediation:
out-of-bounds read in the SPA authenticator can lead to SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c
CVE: CVE-2020-12783
Component: exim
CWE: CWE-125
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2020-05-05T00:00:00+00:00

A flaw was found in exim in versions through 4.93. An out-of-bounds memory read in the SPA authenticator was found that could result in a SPA/NTLM authentication bypass. The highest threat from this vulnerability is to data confidentiality.

Statement: This flaw does not affect Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, or Red Hat Enterprise Linux 8.

Remediation:
error message for Repository URL field form validation leads to reflected XSS
CVE: CVE-2020-2152
Component: jenkins-subversion-plugin
CWE: CWE-79
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2020-03-09T00:00:00+00:00

Jenkins Subversion Release Manager Plugin 1.2 and earlier does not escape the error message for the Repository URL field form validation, resulting in a reflected cross-site scripting vulnerability.

Statement: The `jenkins-2-plugins` package includes `subversion` plugin, not `svn-release-mgr-plugin` and is therefore not affected by this vulnerability.

Remediation:
The names of AirPods with personally identifiable information were exposed to websites with camera or microphone permission
CVE: CVE-2020-6812
Component: Mozilla
CWE: CWE-200
Severity: Moderate
CVSS v3: 6.0/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2020-03-10T00:00:00+00:00

The Mozilla Foundation Security Advisory describes this flaw as:

The first time AirPods are connected to an iPhone, they become named after the user's name by default (e.g. Jane Doe's AirPods.)  Websites with camera or microphone permission are able to enumerate device names, disclosing the user's name. To resolve this issue, Firefox added a special case that renames devices containing the substring 'AirPods' to simply 'AirPods'.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
attacker can send the same request over and over again without changing the CSRF token
CVE: CVE-2020-27834
Component: zabbix
CVSS v3: 4.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Release date: 2020-12-14T00:00:00+00:00

A flaw was found in Zabbix. This flaw allows an attacker to use one CSRF token to send requests on a user’s behalf that are valid with each request. The highest threat from this vulnerability is to confidentiality and integrity.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
slirp: out-of-bounds access while processing ARP/NCSI packets
CVE: CVE-2020-29129
Component: QEMU
CWE: CWE-125
Severity: Low
CVSS v3: 2.0/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N
Release date: 2020-11-26T00:00:00+00:00

An out-of-bounds access issue was found in the SLiRP user networking implementation of QEMU. It could occur while processing ARP/NCSI packets, if the packet length was shorter than required to accommodate respective protocol headers and payload. A privileged guest user may use this flaw to potentially leak host information bytes.


Remediation:
segmentation fault in changedline in ldebug.c
CVE: CVE-2020-15945
Component: lua
CWE: CWE-20
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-07-09T00:00:00+00:00

A flaw was found in lua. A segmentation fault is possible because it incorrectly expects that an oldpc value is always updated upon a return of the flow of control to a function.

Statement: Red Hat Ceph Storage 3 and 4 ships vulnerable version of Lua(embedded in Ceph), however Lua is no longer supported in Ceph.

Remediation:
shell command injection in mount.cifs
CVE: CVE-2020-14342
Component: cifs-utils
CWE: CWE-78
Severity: Low
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-09-03T00:00:00+00:00

A flaw was found in cifs-utils' mount.cifs where it was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. This flaw allows an attacker who can invoke mount.cifs with special permission, such as via sudo rules, to escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Statement: In order to exploit this flaw, the attacker would need to be able to inject a specially crafted username into the command run by root. This requires a specific setup (e.g.: sudo rules, etc.).
As a result, the vulnerability is considered as low severity.

Remediation:
exploitable environment variables leads to execution of arbitrary commands
CVE: CVE-2020-7645
Component: chrome-launcher
CWE: CWE-78
Severity: Important
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-05-02T00:00:00+00:00

All versions of chrome-launcher allow execution of arbitrary commands, by controlling the $HOME environment variable in Linux operating systems.


Remediation:
Inappropriate implementation in Blink
CVE: CVE-2020-6404
Component: chromium-browser
Severity: Moderate
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-02-04T00:00:00+00:00

Inappropriate implementation in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
SELinux netlink permission check bypass
CVE: CVE-2020-10751
Component: kernel
CWE: CWE-349
Severity: Moderate
CVSS v3: 6.2/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Release date: 2020-04-27T14:00:00+00:00

A flaw was found in the Linux kernel’s SELinux LSM hook implementation, where it anticipated the skb would only contain a single Netlink message. The hook incorrectly validated the first Netlink message in the skb only, to allow or deny the rest of the messages within the skb with the granted permissions and without further processing. At this time, there is no known ability for an attacker to abuse this flaw.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from the References section.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from the References section.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
integer overflow due to missing input sanitation in rdpegfx channel
CVE: CVE-2020-15103
Component: freerdp
CWE: CWE-190
Severity: Moderate
CVSS v3: 3.7/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Release date: 2020-07-20T00:00:00+00:00

In FreeRDP less than or equal to 2.1.2, an integer overflow exists due to missing input sanitation in rdpegfx channel. All FreeRDP clients are affected. The input rectangles from the server are not checked against local surface coordinates and blindly accepted. A malicious server can send data that will crash the client later on (invalid length arguments to a `memcpy`) This has been fixed in 2.2.0. As a workaround, stop using command line arguments /gfx, /gfx-h264 and /network:auto


Remediation:
address bar spoof using history navigation and blocked ports
CVE: CVE-2020-12412
Component: firefox
CWE: CWE-601
Severity: Moderate
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Release date: 2020-07-09T00:00:00+00:00

By navigating a tab using the history API, an attacker could cause the address bar to display the incorrect domain (with the https:// scheme, a blocked port number such as '1', and without a lock icon) while controlling the page contents. This vulnerability affects Firefox < 70.

Statement: This vulnerability was reported in Firefox 70 mainline; ESR versions were not affected.

Remediation:
prototype pollution via the main functionality
CVE: CVE-2020-28503
Component: copy-props
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-01-01T00:00:00+00:00

A flaw was found in copy-props. An attacker is able to change the prototype of a javascript object (prototype pollution) using the main functionality, which can lead to unsafe operations. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Use after free in media
CVE: CVE-2020-16001
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-10-20T00:00:00+00:00

Use after free in media in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
ACL restricting access to the internal web server is not properly enforced
CVE: CVE-2020-14196
Component: pdns
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2020-07-01T00:00:00+00:00

In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal web server is not properly enforced.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
heap-use-after-free in streamExtractor.cpp
CVE: CVE-2020-21722
Component: oggvideotools
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-01-01T00:00:00+00:00

Buffer Overflow vulnerability in oggvideotools 0.9.1 allows remote attackers to run arbitrary code via opening of crafted ogg file.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Attempting QNAME minimization after forwarding can lead to an assertion failure in resolver.c
CVE: CVE-2020-8621
Component: bind
CWE: CWE-400
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-08-20T00:00:00+00:00

In BIND 9.14.0 -> 9.16.5, 9.17.0 -> 9.17.3, If a server is configured with both QNAME minimization and 'forward first' then an attacker who can send queries to it may be able to trigger the condition that will cause the server to crash. Servers that 'forward only' are not affected.

Statement: This flaw only affects bind >= 9.14.x. Therefore versions of bind package shipped with Red Hat Enterprise Linux are not affected by this flaw.

Remediation:
out-of-bounds read in fbcon_get_font function
CVE: CVE-2020-28915
Component: kernel
CWE: CWE-125
Severity: Moderate
CVSS v3: 6.0/AV:P/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H
Release date: 2020-11-16T00:00:00+00:00

An out-of-bounds (OOB) memory access flaw was found in fbcon_get_font() in drivers/video/fbdev/core/fbcon.c in fbcon driver module in the Linux kernel. A bound check failure allows a local attacker with special user privilege to gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to integrity and system availability.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Add 'nomodeset' option as kernel boot parameter to disable frame buffering (edit /etc/default/grub, and run 'grub2-mkconfig -o /boot/grub2/grub.cfg' and reboot).
~~~
# cat /proc/cmdline 
BOOT_IMAGE=(hd0,msdos1)/vmlinuz-4.18.0-147.el8.x86_64 root=/dev/mapper/rhel_rhel8u2--1-root ro crashkernel=auto resume=/dev/mapper/rhel_rhel8u2--1-swap rd.lvm.lv=rhel_rhel8u2-1/root rd.lvm.lv=rhel_rhel8u2-1/swap nomodeset

# ls -l /dev/fb*
ls: cannot access '/dev/fb*': No such file or directory
~~~
uncontrolled class instantiation when loading YAML files
CVE: CVE-2020-1953
Component: apache-commons-configuration
CWE: CWE-20
Severity: Important
CVSS v3: 8.9/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Release date: 2020-03-13T00:00:00+00:00

A flaw was found in the Apache Commons Configuration, where it uses a third-party library to process YAML files, which by default, allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default settings of this library. If a YAML file was loaded from an untrusted source, it could load and execute code out of the control of the host application.

Statement: Several packages are unaffected because they do not include support for YAML configurations:
* `apache-commons-configuration` as shipped with Red Hat Enterprise Linux 7
* `apache-commons-configuration` as shipped with Red Hat Enterprise Virtualization
* `rh-maven35-apache-commons-configuration` as shipped with Red Hat Software Collections
* `commons-configuration` as shipped with Red Hat Gluster Storage

Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link (you must log in to download the update).
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

Installation instructions are available from the Fuse 7.7.0 product documentation page:
https://access.redhat.com/documentation/en-us/red_hat_fuse/7.7/
There is currently no mitigation available for this vulnerability.
Unsafe use of eval() on data retrieved via HTTP in the test suite
CVE: CVE-2020-27619
Component: python
CWE: CWE-95
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-10-05T00:00:00+00:00

In Python3's Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.

Statement: As of Red Hat Quay 3.4 the python runtime will be consumed from RHEL. Currently releases up to 3.3 won't get fixes for this moderate issue.

Remediation:
In versions of Python shipped with Red Hat Enterprise Linux and Red Hat Software Collections, the flaw can be mitigated by not running the python tests with network resources enabled. By default, the tests are not run with network resources enabled. Ensure that `-u network` or `-uall` are not passed as options to `python -m test`. For more information on how these commands work, see [1].

1. https://docs.python.org/3/library/test.html
usb: hcd-ohci: out-of-bound access issue while processing transfer descriptors
CVE: CVE-2020-25624
Component: QEMU
CWE: CWE-787
Severity: Moderate
CVSS v3: 4.5/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L
Release date: 2020-09-11T00:00:00+00:00

A flaw was found in QEMU. An out-of-bounds read/write access issue was found in the USB OHCI controller emulator. This issue occurs while servicing transfer descriptors (TD), as the OHCI controller derives variables 'start_addr', 'end_addr', and 'len' from values supplied by the host controller driver. The host controller driver may supply values when using these variables, leading to an out-of-bounds access issue. This flaw allows a guest user or process to crash the QEMU process on the host, resulting in a denial of service.


Remediation:
Crash processing S/MIME messages with multiple signatures
CVE: CVE-2020-6795
Component: Mozilla
CWE: CWE-476
Severity: Moderate
CVSS v3: 6.0/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2020-02-11T00:00:00+00:00

When processing a message that contains multiple S/MIME signatures, a bug in the MIME processing code caused a null pointer dereference, leading to an unexploitable crash. This vulnerability affects Thunderbird < 68.5.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.