huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
buffer overflow in LANG in w_help.c
CVE: CVE-2021-40241
Component: xfig
CWE: CWE-120
Severity: Low
Release date: 2021-01-01T00:00:00+00:00

xfig 3.2.7 is vulnerable to Buffer Overflow.


Remediation:
iocost: Fix divide-by-zero on donation from low hweight cgroup
CVE: CVE-2021-47584
Component: kernel
CWE: CWE-369
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

A vulnerability was found in the Linux kernel in the ioc_timer_fn() function, where a lack of proper controls allows for a cgroup with a hweight of 1 to donate, leaving themselves with a zero hweight after donation and causing a potential divide-by-zero error. This could lead to crashes.

Statement: Red Hat Enterprise Linux is not impacted by this CVE, as the vulnerability in question does not affect the specific versions or configurations of the Linux kernel used in its distributions. This ensures that users of Red Hat Enterprise Linux are not exposed to the potential risks associated with this issue, and no further action or mitigation is necessary for systems running this operating system.

Remediation:
out-of-bounds memory access in v3 onion service descriptor parsing
CVE: CVE-2021-34550
Component: tor
Release date: 2021-06-14T00:00:00+00:00

An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-006. The v3 onion service descriptor parsing allows out-of-bounds memory access, and a client crash, via a crafted onion service descriptor

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
use-after-free in the file polling implementation
CVE: CVE-2021-39698
Component: kernel
CWE: CWE-416
Severity: Important
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2021-01-01T00:00:00+00:00

A vulnerability was found in the Linux kernel’s file polling implementation in kernel/sched/wait.c., which leads to a use-after-free problem. This flaw allows a local user to cause a denial of service (memory corruption or crash) or privilege escalation.

Statement: There was no shipped kernel version that was seen affected by this problem.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
heap-based buffer overflow (4 bytes) in __bpf_object__open
CVE: CVE-2021-45940
Component: libbpf
CWE: CWE-131
Severity: Low
CVSS v3: 5.3/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

A flaw was found in libbpf. The vulnerability occurs due to incorrect handling of memory in the __bpf_object__open function and leads to a heap-buffer-overflow. This flaw allows an attacker to execute unauthorized code or commands, read memory, or modify memory.

Statement: The default Red Hat Enterprise Linux kernel prevents unprivileged users from being able to use eBPF.That means to exploit this vulnerability it would require a privileged user with CAP_SYS_ADMIN or root making the severity of this vulnerability as low.

Remediation:
dump_desc function was called incorrectly in several places in a way that could lead to excessive CPU usage
CVE: CVE-2021-28089
Component: tor
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-03-16T00:00:00+00:00

Tor before 0.4.5.7 allows a remote participant in the Tor directory protocol to exhaust CPU resources on a target, aka TROVE-2021-001.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Side-channel information leakage in autofill
CVE: CVE-2021-21181
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2021-03-02T00:00:00+00:00

Side-channel information leakage in autofill in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
atm: iphase: fix possible use-after-free in ia_module_exit()
CVE: CVE-2021-47357
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.4/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2021-01-01T00:00:00+00:00

A use-after-free flaw was found in the Linux kernel’s ATM networking card driver in how a user unloads the driver's module. This flaw allows a local user to crash the system.

Statement: The bug happens during module unloading. Therefore, only a privileged user can trigger the issue. This issue not actual for Red Hat Enterprise Linux, because related part of source codes disabled.

Remediation:
To mitigate this issue, prevent module atm from being loaded. Please see https://access.redhat.com/solutions/41278 for information on blacklisting a kernel module to prevent it from loading automatically.
XSS in 3scale at various places
CVE: CVE-2021-3442
Component: RHOAM
CWE: CWE-134
Severity: Important
CVSS v3: 7.3/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Release date: 2021-07-08T00:00:00+00:00

A flaw was found in the Red Hat OpenShift API Management product. User input is not validated allowing an authenticated user to inject scripts into some text boxes leading to a XSS attack. The highest threat from this vulnerability is to data confidentiality.


Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_3scale_api_management/2.11/html-single/installing_3scale/index
Use after free in Offline use
CVE: CVE-2021-37956
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2021-09-21T00:00:00+00:00

Use after free in Offline use in Google Chrome on Android prior to 94.0.4606.54 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Race condition when reading from disk while verifying signatures
CVE: CVE-2021-29948
Component: Mozilla
CWE: CWE-367
Severity: Low
CVSS v3: 2.6/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Release date: 2021-04-19T00:00:00+00:00

Signatures are written to disk before and read during verification, which might be subject to a race condition when a malicious local process or user is replacing the file. This vulnerability affects Thunderbird < 78.10.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
heap-based buffer overflow in PackLinuxElf32::elf_lookup() at p_lx_elf.cpp
CVE: CVE-2021-43314
Component: upx
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2021-01-01T00:00:00+00:00

A heap-based buffer overflows was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le32(). The problem is essentially caused in PackLinuxElf32::elf_lookup() at p_lx_elf.cpp:5368

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
ReDoS in the parsing of authority part of URL
CVE: CVE-2021-33503
Component: python-urllib3
CWE: CWE-835
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-06-01T00:00:00+00:00

A flaw was found in python-urllib3. When provided with a URL containing many @ characters in the authority component, the authority's regular expression exhibits catastrophic backtracking. This flaw causes a denial of service if a URL is passed as a parameter or redirected via an HTTP redirect. The highest threat from this vulnerability is to system availability.

Statement: * Red Hat OpenShift Container Platform (OCP) 4 delivers the python-urllib3 package which includes a vulnerable version of urllib3 module, however from OCP 4.6 the python-urllib3 package is no longer shipped. OCP 4.5 is out of support scope for Moderate and Low impact vulnerabilities, hence is marked Out Of Support Scope.
The python-urllib3 package used in OCP 3.11 is not affected by this flaw.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
fdc: heap buffer overflow in DMA read data transfers
CVE: CVE-2021-3507
Component: QEMU
CWE: CWE-119
Severity: Low
CVSS v3: 3.8/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:L
Release date: 2021-04-19T00:00:00+00:00

A heap buffer overflow was found in the floppy disk emulator of QEMU. It could occur in fdctrl_transfer_handler() in hw/block/fdc.c while processing DMA read data transfers from the floppy drive to the guest system. A privileged guest user could use this flaw to crash the QEMU process on the host resulting in DoS scenario, or potential information leakage from the host memory.

Statement: This issue affects the version of `qemu-kvm` as shipped with Red Hat Enterprise Linux 8 and Red Hat Enterprise Linux 8 Advanced Virtualization. A future update may address this flaw.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.
Multiple flaws in binaryen
CVE: CVE-2021-46053
Component: binaryen
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

A Denial of Service vulnerability exists in Binaryen 103. The program terminates with signal SIGKILL.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Illegal memory access in canPack function in p_lx_elf.cpp
CVE: CVE-2021-20285
Component: upx
CVSS v3: 4.6/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

A flaw was found in upx canPack in p_lx_elf.cpp in UPX 3.96. This flaw allows attackers to cause a denial of service (SEGV or buffer overflow and application crash) or possibly have unspecified other impacts via a crafted ELF. The highest threat from this vulnerability is to system availability.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
System.Text.Encodings.Web Remote Code Execution
CVE: CVE-2021-26701
Component: dotnet
CWE: CWE-119
Severity: Important
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2021-02-25T00:00:00+00:00

A remote code execution vulnerability was found in dotnet in the System.Text.Encodings.Web package, caused by a buffer overrun. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.


Remediation:
net/mlx5: Update error handler for UCTX and UMEM
CVE: CVE-2021-47212
Component: kernel
CWE: CWE-99
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

A vulnerability was found in the Linux kernel, affecting the Mellanox MLX5 driver. This issue involves improper error handling in the UCTX (user context) and UMEM (user memory) operations. When the system executes a destroy command during a fast unload flow, it should return a success code (MLX5_CMD_STAT_OK), but in the affected versions, it incorrectly returned an error code (EIO), causing issues in releasing user memory and removing context in the system. This error handling flaw could lead to system instability during device removal or context destruction in the kernel's Infiniband stack.


Remediation:
video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow
CVE: CVE-2021-47642
Component: kernel
Severity: None
Release date: 2021-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow

Coverity complains of a possible buffer overflow. However,
given the 'static' scope of nvidia_setup_i2c_bus() it looks
like that can't happen after examiniing the call sites.

CID 19036 (#1 of 1): Copy into fixed size buffer (STRING_OVERFLOW)
1. fixed_size_dest: You might overrun the 48-character fixed-size string
  chan->adapter.name by copying name without checking the length.
2. parameter_as_source: Note: This defect has an elevated risk because the
  source argument is a parameter of the current function.
 89        strcpy(chan->adapter.name, name);

Fix this warning by using strscpy() which will silence the warning and
prevent any future buffer overflows should the names used to identify the
channel become much longer.


Remediation:
md/raid1: properly indicate failure when ending a failed write request
CVE: CVE-2021-46950
Component: kernel
CWE: CWE-20
Severity: Moderate
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2021-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

md/raid1: properly indicate failure when ending a failed write request

This patch addresses a data corruption bug in raid1 arrays using bitmaps.
Without this fix, the bitmap bits for the failed I/O end up being cleared.

Since we are in the failure leg of raid1_end_write_request, the request
either needs to be retried (R1BIO_WriteError) or failed (R1BIO_Degraded).


Remediation:
Heap buffer overflow in WebGL
CVE: CVE-2021-30568
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2021-07-20T00:00:00+00:00

Heap buffer overflow in WebGL in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
ptp: Fix possible memory leak in ptp_clock_register()
CVE: CVE-2021-47455
Component: kernel
Severity: Low
CVSS v3: 5.7/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L
Release date: 2021-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ptp: Fix possible memory leak in ptp_clock_register()

I got memory leak as follows when doing fault injection test:

unreferenced object 0xffff88800906c618 (size 8):
  comm "i2c-idt82p33931", pid 4421, jiffies 4294948083 (age 13.188s)
  hex dump (first 8 bytes):
    70 74 70 30 00 00 00 00                          ptp0....
  backtrace:
    [<00000000312ed458>] __kmalloc_track_caller+0x19f/0x3a0
    [<0000000079f6e2ff>] kvasprintf+0xb5/0x150
    [<0000000026aae54f>] kvasprintf_const+0x60/0x190
    [<00000000f323a5f7>] kobject_set_name_vargs+0x56/0x150
    [<000000004e35abdd>] dev_set_name+0xc0/0x100
    [<00000000f20cfe25>] ptp_clock_register+0x9f4/0xd30 [ptp]
    [<000000008bb9f0de>] idt82p33_probe.cold+0x8b6/0x1561 [ptp_idt82p33]

When posix_clock_register() returns an error, the name allocated
in dev_set_name() will be leaked, the put_device() should be used
to give up the device reference, then the name will be freed in
kobject_cleanup() and other memory will be freed in ptp_clock_release().


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
PCI: endpoint: Fix NULL pointer dereference for -&gt;get_features()
CVE: CVE-2021-47005
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

PCI: endpoint: Fix NULL pointer dereference for ->get_features()

get_features ops of pci_epc_ops may return NULL, causing NULL pointer
dereference in pci_epf_test_alloc_space function. Let us add a check for
pci_epc_feature pointer in pci_epf_test_bind before we access it to avoid
any such NULL pointer dereference and return -ENOTSUPP in case
pci_epc_feature is not found.

When the patch is not applied and EPC features is not implemented in the
platform driver, we see the following dump due to kernel NULL pointer
dereference.

Call trace:
 pci_epf_test_bind+0xf4/0x388
 pci_epf_bind+0x3c/0x80
 pci_epc_epf_link+0xa8/0xcc
 configfs_symlink+0x1a4/0x48c
 vfs_symlink+0x104/0x184
 do_symlinkat+0x80/0xd4
 __arm64_sys_symlinkat+0x1c/0x24
 el0_svc_common.constprop.3+0xb8/0x170
 el0_svc_handler+0x70/0x88
 el0_svc+0x8/0x640
Code: d2800581 b9403ab9 f9404ebb 8b394f60 (f9400400)
---[ end trace a438e3c5a24f9df0 ]---


Remediation:
Permission Prompt could be overlaid, resulting in user confusion and potential spoofing
CVE: CVE-2021-38508
Component: Mozilla
CWE: CWE-1021
Severity: Moderate
CVSS v3: 6.0/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2021-11-02T00:00:00+00:00

By displaying a form validity message in the correct location at the same time as a permission prompt (such as for geolocation), the validity message could have obscured the prompt, resulting in the user potentially being tricked into granting the permission. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
information disclosure
CVE: CVE-2021-45038
Component: mediawiki
CWE: CWE-200
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2021-12-16T00:00:00+00:00

A flaw was found in mediawiki. The "rollback" feature (action=rollback) could be passed a specially crafted parameter that allowed an attacker to view the contents of arbitrary pages, regardless of whether they had permissions to do so.

Statement: The mediawiki package was removed from OpenShift Container Platform (OCP) in version 4.3, therefore for OCP 4 has been marked as out of support scope.

Remediation:
Negative-offset memcpy in TIFF image reader
CVE: CVE-2021-25290
Component: python-pillow
CWE: CWE-120
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-02-28T00:00:00+00:00

A flaw was found in python-pillow. In TiffDecode.c, there is a negative-offset memcpy with an invalid size which could lead to a system crash.


Remediation:
Disable the invoice generation feature to mitigate this vulnerability in Red Hat Quay.
Divide by zero via the function H5T__complete_copy () at /hdf5/src/H5T.c
CVE: CVE-2021-46244
Component: hdf5
CWE: CWE-369
Severity: Low
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

A Divide By Zero vulnerability exists in HDF5 v1.13.1-1 vis the function H5T__complete_copy () at /hdf5/src/H5T.c. This vulnerability causes an aritmetic exception, leading to a Denial of Service (DoS).

Statement: In Red Hat OpenStack Platform, HDF5 is only included as part of a loose dependency trail from python3-hardware. Because there is a very low likelihood that an attacker would be able to exploit this vulnerability in a meaningful way, no RHOSP update will be provided at this time.

Remediation: