huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
ceph-mon does not perform authorization on OSD pool ops
CVE: CVE-2018-10861
Component: ceph
CWE: CWE-285
Severity: Moderate
CVSS v3: 4.8/CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Release date: 2018-07-09T12:00:00+00:00

A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete and corrupt snapshot images


Remediation:
The References section of this erratum contains a download link. You must
log in to download the update.

Refer to the Red Hat Ceph Storage 2 Installation Guide for more information:

https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/2/html-single/installation_guide_for_ubuntu/#enabling_the_red_hat_ceph_storage_repositories
Use  mon_allow_pool_delete = false in ceph.conf to disable deletion of pools


~]$ for p in `rados lspools`
do
   ceph osd pool set $p nodelete true
done

caveat: This mitigation does not protect against  attacker from corrupting snapshot images
version 1.0.3.0 has a Buffer Overflow which could lead to DoS
CVE: CVE-2018-18944
Component: artha
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2018-01-01T00:00:00+00:00

Artha ~ The Open Thesaurus 1.0.3.0 has a Buffer Overflow.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CSRF vulnerability and missing permission checks allowed capturing credentials (SECURITY-804)
CVE: CVE-2018-1000183
Component: jenkins-plugin-github
CWE: CWE-352
Severity: Moderate
CVSS v3: 4.3/CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Release date: 2018-06-04T00:00:00+00:00

A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.0 and older in GitHubServerConfig.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.


Remediation:
CVE: CVE-2018-1000029
Component: CVE-2018-1000029
Release date: 2018-01-18T00:00:00+00:00

mcholste Enterprise Log Search and Archive (ELSA) version revision 1205, commit 2cc17f1 and earlier contains a Cross Site Scripting (XSS) vulnerability in index view (/) that can result in . This attack appear to be exploitable via Payload delivered via the type, name, and value parameters of /Query/set_preference and the name and value parameters of /Query/preference. Payload executed when the user visits the index view (/).

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Denial-of-service via fsync(2) in Gluster FUSE client
CVE: CVE-2018-10924
Component: glusterfs
CWE: CWE-400
Severity: Moderate
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2018-09-04T05:30:00+00:00

It was discovered that fsync(2) system call in glusterfs client code leaks memory. An authenticated attacker could use this flaw to launch a denial of service attack by making gluster clients consume memory of the host machine.

Statement: This issue did not affect the versions of glusterfs as shipped with Red Hat Enterprise Linux 6 and 7, and Red Hat Gluster Storage 3.

Remediation:
memory leak for a colormap in WriteMPCImage in coders/mpc.c
CVE: CVE-2018-14434
Component: ImageMagick
CWE: CWE-400
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2018-07-04T00:00:00+00:00

ImageMagick 7.0.8-4 has a memory leak for a colormap in WriteMPCImage in coders/mpc.c.


Remediation:
CVE: CVE-2018-1999029
Component: CVE-2018-1999029
Release date: 2018-01-01T00:00:00+00:00

A cross-site scripting vulnerability exists in Jenkins Shelve Project Plugin 1.5 and earlier in ShelveProjectAction/index.jelly, ShelvedProjectsAction/index.jelly that allows attackers with Job/Configure permission to define JavaScript that would be executed in another user's browser when that other user performs some UI actions.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Use after free in WebRTC
CVE: CVE-2018-6155
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2018-07-24T00:00:00+00:00

Incorrect handling of frames in the VP8 parser in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted video file.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Improper input validation in WARC parser resulting in a denial of service
CVE: CVE-2018-1000880
Component: libarchive
CWE: CWE-20
Severity: Low
CVSS v3: 4.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2018-11-20T00:00:00+00:00

libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file.

Statement: This vulnerability is rated as low severity because it results in a denial of service due to improper input validation, it may crash the application, it does not pose a significant risk to system security or integrity.

This issue did not affect the versions of libarchive as shipped with Red Hat Enterprise Linux 6 and 7.

Remediation:
Use after free in PDFium
CVE: CVE-2018-6088
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2018-04-17T00:00:00+00:00

An iterator-invalidation bug in PDFium in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Heap-based buffer overflow in tiff2pdf.c:t2p_write_pdf()
CVE: CVE-2018-17795
Component: libtiff
CWE: CWE-122
Severity: Low
CVSS v3: 4.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2018-10-02T00:00:00+00:00

The function t2p_write_pdf in tiff2pdf.c in LibTIFF 4.0.9 and earlier allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted TIFF file, a similar issue to CVE-2017-9935.


Remediation:
stored XSS in subscriptions and repositories pages
CVE: CVE-2018-16887
Component: katello
CWE: CWE-79
Severity: Moderate
CVSS v3: 5.2/CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Release date: 2018-10-11T00:00:00+00:00

A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users.

Statement: Red Hat Subscription Asset Manager does not support the Organization Change, and therefore is not affected by this flaw.

Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Type confusion in V8
CVE: CVE-2018-6122
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2018-05-10T00:00:00+00:00

Type confusion in WebAssembly in Google Chrome prior to 66.0.3359.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
integer overflow in vcSetXCutTextProc in VNConsole.c
CVE: CVE-2018-7226
Component: libvncserver
CWE: CWE-190
Severity: Low
CVSS v3: 5.6/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Release date: 2018-02-18T00:00:00+00:00

An issue was discovered in vcSetXCutTextProc() in VNConsole.c in LinuxVNC and VNCommand from the LibVNC/vncterm distribution through 0.9.10. Missing sanitization of the client-specified message length may cause integer overflow or possibly have unspecified other impact via a specially crafted VNC packet.

Statement: This issue did not affect the versions of libvncserver as shipped with Red Hat Enterprise Linux 6 and 7.

Remediation:
Prototype pollution in Object.prototype
CVE: CVE-2018-16491
Component: nodejs-extend
CWE: CWE-20
Severity: Moderate
CVSS v3: 4.7/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Release date: 2018-11-30T00:00:00+00:00

A prototype pollution vulnerability was found in node.extend <1.1.7, ~<2.0.1 that allows an attacker to inject arbitrary properties onto Object.prototype.


Remediation:
Out-of-bounds Read in packet-ieee1905.c
CVE: CVE-2018-11354
Component: wireshark
CWE: CWE-125
Severity: Moderate
CVSS v3: 5.8/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2018-05-02T00:00:00+00:00

In Wireshark 2.6.0, the IEEE 1905.1a dissector could crash. This was addressed in epan/dissectors/packet-ieee1905.c by making a certain correction to string handling.


Remediation:
unitialized memory due to incorrect logic of RAR decoder might lead to arbitrary code execution
CVE: CVE-2018-10115
Component: p7zip
CWE: CWE-119
Severity: Important
CVSS v3: 9.8/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2018-05-01T00:00:00+00:00

Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memory, allowing remote attackers to cause a denial of service (segmentation fault) or execute arbitrary code via a crafted RAR archive.


Remediation:
buffer overflow in skia
CVE: CVE-2018-6067
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2018-03-06T00:00:00+00:00

Incorrect IPC serialization in Skia in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Dumpable FPM child processes allow bypassing opcache access controls
CVE: CVE-2018-10545
Component: php
CWE: CWE-287
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2018-01-01T00:00:00+00:00

An issue was discovered in PHP before 5.6.35, 7.0.x before 7.0.29, 7.1.x before 7.1.16, and 7.2.x before 7.2.4. Dumpable FPM child processes allow bypassing opcache access controls because fpm_unix.c makes a PR_SET_DUMPABLE prctl call, allowing one user (in a multiuser environment) to obtain sensitive information from the process memory of a second user's PHP applications by running gcore on the PID of the PHP-FPM worker process.

Statement: Red Hat Product Security has rated this issue as having a security impact of Low, and a future update may address this flaw.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
Bleichenbacher-like side channel leakage in PKCS#1 v1.5 verification and padding oracle verification
CVE: CVE-2018-16868
Component: gnutls
CWE: CWE-203
Severity: Moderate
CVSS v3: 4.5/CVSS:3.0/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
Release date: 2018-11-30T00:00:00+00:00

A Bleichenbacher type side-channel based padding oracle attack was found in the way gnutls handles verification of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run a process on the same physical core as the victim process could use this to extract plain text or, in some cases, downgrade any TLS connections to a vulnerable server.


Remediation:
Unauthorized Access with Spring Security Method Security
CVE: CVE-2018-1258
Component: spring-security-core
CWE: CWE-287
Severity: Moderate
CVSS v3: 5.6/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2018-05-09T00:00:00+00:00

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.


Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

Installation instructions are available from the Fuse 7.4.0 product documentation page:
https://access.redhat.com/documentation/en-us/red_hat_fuse/7.4/
Use-after-free while manipulating form input elements (MFSA 2018-03)
CVE: CVE-2018-5098
Component: Mozilla
CWE: CWE-416
Severity: Important
CVSS v3: 9.8/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2018-01-23T00:00:00+00:00

A use-after-free vulnerability can occur when form input elements, focus, and selections are manipulated by script content. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
slab out-of-bounds write in trace/trace_events_filter.c
CVE: CVE-2018-12714
Component: kernel
CWE: CWE-787
Severity: Moderate
CVSS v3: 7.2/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Release date: 2018-06-23T00:00:00+00:00

An issue was discovered in the Linux kernel in the filter parsing code in kernel/trace/trace_events_filter.c. The code could be called with no filter when it expected at least one, which allows attackers to cause a slab out-of-bounds write and so a denial of service via crafted perf_event_open and mmap system calls.


Remediation:
cross-site scripting via 'name' parameter in  Account Information page
CVE: CVE-2018-17146
Component: Nagios-XI
CWE: CWE-79
Severity: Moderate
CVSS v3: 6.0/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2018-01-01T00:00:00+00:00

A cross-site scripting vulnerability exists in Nagios XI before 5.5.4 via the 'name' parameter within the Account Information page. Exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript code within the auto login admin management page.

Statement: This issue did not affect Red Hat Gluster Storage 3 as it does not ship Nagios XI.

Remediation:
Missing authentication in edfault installation without a security realm reference
CVE: CVE-2018-10683
Component: wildfly
CWE: CWE-306
Severity: Important
CVSS v3: 8.1/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2018-05-02T00:00:00+00:00

An issue was discovered in WildFly 10.1.2.Final. In the case of a default installation without a security realm reference, an attacker can successfully access the server without authentication. NOTE: the Security Realms documentation in the product's Admin Guide indicates that "without a security realm reference" implies "effectively unsecured." The vendor explicitly supports these unsecured configurations because they have valid use cases during development

Statement: Red Hat Product Security does not consider this issue to be a vulnerability. The default installation are by default secured and set to have an authentication mechanism in place. It is possible to explicitly remove the realm from the configuration files when needed. For example, in case there's need to run in single user mode for development use, ability to switch off security is desirable so the admin console can be accessed without the need for user accounts. There is adequate mechanism in place to secure the WildFly environment.

Remediation:
Improper management of AST depth in jsparse.c can allow a remote attacker to cause a denial of service via a crafted file
CVE: CVE-2018-5759
Component: mujs
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2018-01-24T00:00:00+00:00

jsparse.c in Artifex MuJS through 1.0.2 does not properly maintain the AST depth for binary expressions, which allows remote attackers to cause a denial of service (excessive recursion) via a crafted file.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Stack-based buffer under-read in ole/oleprop.cpp
CVE: CVE-2018-6876
Component: ImageMagick
CWE: CWE-121
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2018-02-07T00:00:00+00:00

The OLEProperty class in ole/oleprop.cpp in libfpx 1.3.1-10, as used in ImageMagick 7.0.7-22 Q16 and other products, allows remote attackers to cause a denial of service (stack-based buffer under-read) via a crafted bmp image.


Remediation:
URL spoof in permission dialogs
CVE: CVE-2018-16079
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2018-09-04T00:00:00+00:00

A race condition between permission prompts and navigations in Prompts in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Reachable assertion in RateTransposer::setChannels() causing denial of service
CVE: CVE-2018-14044
Component: soundtouch
CWE: CWE-400
Severity: Low
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2018-07-13T00:00:00+00:00

SoundTouch library is vulnerable to reachable assertion in RateTransposer::setChannels() function that can cause denial of service to applications using this library for processing the untrusted file input.


Remediation:
x86 DB exception safety check can be triggered by a guest (XSA-265)
CVE: CVE-2018-12893
Component: xen
CWE: CWE-266
Severity: Moderate
CVSS v3: 6.3/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Release date: 2018-06-27T21:00:00+00:00

An issue was discovered in Xen through 4.10.x. One of the fixes in XSA-260 added some safety checks to help prevent Xen livelocking with debug exceptions. Unfortunately, due to an oversight, at least one of these safety checks can be triggered by a guest. A malicious PV guest can crash Xen, leading to a Denial of Service. All Xen systems which have applied the XSA-260 fix are vulnerable. Only x86 systems are vulnerable. ARM systems are not vulnerable. Only x86 PV guests can exploit the vulnerability. x86 HVM and PVH guests cannot exploit the vulnerability. An attacker needs to be able to control hardware debugging facilities to exploit the vulnerability, but such permissions are typically available to unprivileged users.


Remediation:
CVE: CVE-2018-1000009
Component: CVE-2018-1000009
Release date: 2018-01-01T00:00:00+00:00

Jenkins Checkstyle Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Unsanitized file names in debug/io-stats translator can allow remote attackers to execute arbitrary code
CVE: CVE-2018-10904
Component: glusterfs
CWE: CWE-426
Severity: Important
CVSS v3: 9.0/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2018-09-04T05:30:00+00:00

It was found that glusterfs server does not properly sanitize file paths in the "trusted.io-stats-dump" extended attribute which is used by the "debug/io-stats" translator. An attacker can use this flaw to create files and execute arbitrary code. To exploit this, the attacker would require sufficient access to modify the extended attributes of files on a gluster volume.

Statement: This issue did not affect Red Hat Enterprise Linux 6 and 7 as the flaw is present in glusterfs-server, which is not shipped there.

This flaw affects glusterfs versions included in Red Hat Virtualization 4 Hypervisor. However, in recommended configurations, the vulnerability is only exposed to hypervisor administrators and can not be exploited from virtual machines or other hosts on the network. For Red Hat Virtualization, Product Security has rated this flaw as Moderate. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/2974891
To limit exposure of gluster server nodes :  

1. gluster server should be on LAN and not reachable from public networks.  
2. Use gluster auth.allow and auth.reject.  
3. Use TLS certificates to authenticate gluster clients.

caveat: This does not protect from attacks against authenticated gluster clients.
integer overflow in PdfObjectStreamParserObject::ReadObjectsFromStream in src/base/PdfObjectStreamParserObject.cpp
CVE: CVE-2018-5309
Component: podofo
CVSS v3: 4.6/CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2018-01-08T00:00:00+00:00

In PoDoFo 0.9.5, there is an integer overflow in the PdfObjectStreamParserObject::ReadObjectsFromStream function (base/PdfObjectStreamParserObject.cpp). Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted pdf file.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation: