huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
format string vulnerability
CVE: CVE-2022-4639
Component: sslh
Release date: 2022-12-21T00:00:00+00:00

A vulnerability, which was classified as critical, has been found in sslh. This issue affects the function hexdump of the file probe.c of the component Packet Dumping Handler. The manipulation of the argument msg_info leads to format string. The attack may be initiated remotely. The name of the patch is b19f8a6046b080e4c2e28354a58556bb26040c6f. It is recommended to apply a patch to fix this issue. The identifier VDB-216497 was assigned to this vulnerability.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Server: Optimizer unspecified vulnerability (CPU Oct 2022)
CVE: CVE-2022-21625
Component: mysql
Severity: Moderate
CVSS v3: 4.9/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-10-18T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.30 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
vdpa: ifcvf: Do proper cleanup if IFCVF init fails
CVE: CVE-2022-48706
Component: kernel
CWE: CWE-459
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

vdpa: ifcvf: Do proper cleanup if IFCVF init fails

ifcvf_mgmt_dev leaks memory if it is not freed before
returning. Call is made to correct return statement
so memory does not leak. ifcvf_init_hw does not take
care of this so it is needed to do it here.


Remediation:
kcm: close race conditions on sk_receive_queue
CVE: CVE-2022-49814
Component: kernel
Severity: None
Release date: 2022-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

kcm: close race conditions on sk_receive_queue

sk->sk_receive_queue is protected by skb queue lock, but for KCM
sockets its RX path takes mux->rx_lock to protect more than just
skb queue. However, kcm_recvmsg() still only grabs the skb queue
lock, so race conditions still exist.

We can teach kcm_recvmsg() to grab mux->rx_lock too but this would
introduce a potential performance regression as struct kcm_mux can
be shared by multiple KCM sockets.

So we have to enforce skb queue lock in requeue_rx_msgs() and handle
skb peek case carefully in kcm_wait_data(). Fortunately,
skb_recv_datagram() already handles it nicely and is widely used by
other sockets, we can just switch to skb_recv_datagram() after
getting rid of the unnecessary sock lock in kcm_recvmsg() and
kcm_splice_read(). Side note: SOCK_DONE is not used by KCM sockets,
so it is safe to get rid of this check too.

I ran the original syzbot reproducer for 30 min without seeing any
issue.


Remediation:
media: mtk-vcodec: NULL pointer dereference in mtk_vcodec_fw_vpu_init()
CVE: CVE-2022-3113
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-12-13T00:00:00+00:00

An issue was discovered in the Linux kernel through 5.16-rc6. mtk_vcodec_fw_vpu_init in drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c lacks check of the return value of devm_kzalloc() and will cause the null pointer dereference.


Remediation:
A flaw in unix_sock_destructor/unix_release_sock in net/unix/af_unix.c leads to memory leak
CVE: CVE-2022-3543
Component: kernel
CWE: CWE-401
Severity: Moderate
CVSS v3: 3.7/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2022-10-03T06:30:00+00:00

A flaw was found in unix_sock_destructor/unix_release_sock in net/unix/af_unix.c in the BPF component in the Linux Kernel. This issue may lead to a memory leak problem.


Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
mips: ralink: fix a refcount leak in ill_acc_of_setup()
CVE: CVE-2022-49117
Component: kernel
CWE: CWE-402
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mips: ralink: fix a refcount leak in ill_acc_of_setup()

of_node_put(np) needs to be called when pdev == NULL.


Remediation:
Uninitialized array in pg_query_params() leading to RCE
CVE: CVE-2022-31625
Component: php
CWE: CWE-824
Severity: Moderate
CVSS v3: 6.9/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Release date: 2022-05-16T00:00:00+00:00

A vulnerability was found in PHP due to an uninitialized array in pg_query_params() function. When using the Postgres database extension, supplying invalid parameters to the parameterized query may lead to PHP attempting to free memory, using uninitialized data as pointers. This flaw allows a remote attacker with the ability to control query parameters to execute arbitrary code on the system or may cause a denial of service.

Statement: This CVE rated as moderate because attack complexity is high, and creating/supplying invalid parameters is complex  while using a Postgres database extension.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
heap-buffer-overread in mobi_decode_infl() in index.c
CVE: CVE-2022-1987
Component: libmobi
CVSS v3: 2.5/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2022-06-03T00:00:00+00:00

Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Denial of Service
CVE: CVE-2022-0695
Component: radare2
CVSS v3: 6.9/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:H
Release date: 2022-02-24T00:00:00+00:00

Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
btrfs: set generation before calling btrfs_clean_tree_block in btrfs_init_new_buffer
CVE: CVE-2022-50766
Component: kernel
CWE: CWE-908
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

A use of uninitialized memory was found in the Linux kernel's btrfs filesystem. In btrfs_init_new_buffer(), btrfs_set_header_generation() was moved after btrfs_clean_tree_block() during code refactoring. However, btrfs_clean_tree_block() calls btrfs_header_generation() which reads the generation value before it is initialized, causing use of uninitialized data.

Statement: This flaw was discovered by syzbot and affects btrfs filesystems during extent buffer initialization. The uninitialized value read occurs in the b-tree block cleaning path. While this primarily causes undefined behavior from reading uninitialized memory, it could potentially lead to incorrect decisions based on garbage values.

Remediation:
use-after-free in nilfs_mdt_destroy
CVE: CVE-2022-2978
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2022-08-16T09:00:00+00:00

A use-after-free flaw was found in the Linux kernel’s NILFS file system in the way a user triggers the security_inode_alloc function to fail with the following call to the nilfs_mdt_destroy function. This flaw allows a local user to crash or potentially escalate their privileges on the system.

Statement: No shipped kernel version was seen to be affected by this problem. These files are not built in our source code.

Remediation:
Out-of-bounds read allows reading sensitive information
CVE: CVE-2022-1207
Component: radare2
CVSS v3: 6.5/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
Release date: 2022-04-01T00:00:00+00:00

Out-of-bounds read in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability allows attackers to read sensitive information from outside the allocated buffer boundary.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Out-of-bounds Read in vim src/regexp.c
CVE: CVE-2022-2581
Component: vim
CWE: CWE-125
Severity: Low
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2022-08-01T00:00:00+00:00

A flaw was found in vim. The vulnerability occurs due to illegal memory access and leads to a heap buffer overflow. This flaw allows an attacker to input a specially crafted file, leading to a crash or code execution.


Remediation:
Untrusted vim scripts with -s [scriptin] are not recommended to run.
Inappropriate implementation in Blink
CVE: CVE-2022-4906
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2022-11-29T00:00:00+00:00

Inappropriate implementation in Blink in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Use after free in SwiftShader
CVE: CVE-2022-0103
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2022-01-04T00:00:00+00:00

Use after free in SwiftShader in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
net/packet: fix slab-out-of-bounds access in packet_recvmsg()
CVE: CVE-2022-48839
Component: kernel
CWE: CWE-125
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

A vulnerability was found in the Linux kernel in the packet_recvmsg() function where an issue arises from slab-out-of-bounds access when an AF_PACKET socket is used with mmap operations, leading to improper handling of socket buffers that may contain garbage data. As a result, this can cause a potentially harmful copy operation to user space, risking system stability and data integrity.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
fbcon: Use kzalloc() in fbcon_prepare_logo()
CVE: CVE-2022-48993
Component: kernel
CWE: CWE-457
Severity: None
CVSS v3: 0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N
Release date: 2022-01-01T00:00:00+00:00

[REJECTED CVE] A memory initialization vulnerability in the Linux Kernel's fbcon module allows uninitialized memory in the save variable to be copied during operations in fbcon_prepare_logo(). This can result in unpredictable behavior, including kernel crashes or memory corruption, when handling frame buffer devices.

Statement: This CVE has been rejected upstream:
https://lore.kernel.org/linux-cve-announce/2024102311-REJECTED-ec05@gregkh/T/#u

Red Hat has also evaluated this issue and determined that it does not meet the criteria to be classified as a security vulnerability. This assessment is based on the issue not posing a significant security risk, being a result of misconfiguration or usage error, or falling outside the scope of security considerations. 

As such, this CVE has been marked as "Rejected" in alignment with Red Hat's vulnerability management policies.

If you have additional information or concerns regarding this determination, please contact Red Hat Product Security for further clarification.

Remediation:
xtensa: xtfpga: Fix refcount leak bug in setup
CVE: CVE-2022-49681
Component: kernel
CWE: CWE-402
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

xtensa: xtfpga: Fix refcount leak bug in setup

In machine_setup(), of_find_compatible_node() will return a node
pointer with refcount incremented. We should use of_node_put() when
it is not used anymore.


Remediation:
Fix null deref in io.bank
CVE: CVE-2022-4843
Component: radare2
Release date: 2022-12-29T00:00:00+00:00

NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.8.2.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Heap buffer overflow in Cast UI
CVE: CVE-2022-0800
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2022-03-01T00:00:00+00:00

Heap buffer overflow in Cast UI in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
path traversal in PFS extractor script
CVE: CVE-2022-4510
Component: binwalk
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2022-01-01T00:00:00+00:00

A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. By crafting a malicious PFS filesystem file, an attacker can get binwalk's PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction, would extract a malicious binwalk module into the folder .config/binwalk/plugins.
 This vulnerability is associated with program files src/binwalk/plugins/unpfs.py.

This issue affects binwalk from 2.1.2b through 2.3.3 included.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message
CVE: CVE-2022-50859
Component: kernel
CWE: CWE-497
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2022-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message

Commit d5c7076b772a ("smb3: add smb3.1.1 to default dialect list")
extend the dialects from 3 to 4, but forget to decrease the extended
length when specific the dialect, then the message length is larger
than expected.

This maybe leak some info through network because not initialize the
message body.

After apply this patch, the VALIDATE_NEGOTIATE_INFO message length is
reduced from 28 bytes to 26 bytes.


Remediation:
Improper ECDSA signature verification (Libraries, 8277233)
CVE: CVE-2022-21449
Component: OpenJDK
CWE: CWE-347
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2022-04-19T20:00:00+00:00

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of OpenJDK Java must be restarted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of OpenJDK Java must be restarted for this update to take effect.
Before applying this update, make sure all previously-released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/openjdk/17/html/installing_and_using_openjdk_17_for_windows/index
reflected XSS attack
CVE: CVE-2022-4137
Component: keycloak
CWE: CWE-81
Severity: Important
CVSS v3: 8.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Release date: 2022-01-01T00:00:00+00:00

A reflected cross-site scripting (XSS) vulnerability was found in the 'oob' OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious link to insert an arbitrary URI into a Keycloak error page. This flaw requires a user or administrator to interact with a link in order to be vulnerable. This may compromise user details, allowing it to be changed or collected by an attacker.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Insufficient policy enforcement in Developer Tools
CVE: CVE-2022-3308
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2022-09-27T00:00:00+00:00

Insufficient policy enforcement in developer tools in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
DNS rebinding in --inspect via invalid IP addresses
CVE: CVE-2022-32212
Component: nodejs
CWE: CWE-703
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2022-07-08T00:00:00+00:00

A vulnerability was found in NodeJS, where the IsAllowedHost check can be easily bypassed because IsIPAddress does not properly check if an IP address is invalid or not. When an invalid IPv4 address is provided (for instance, 10.0.2.555 is provided), browsers (such as Firefox) will make DNS requests to the DNS server. This issue provides a vector for an attacker-controlled DNS server or a Man-in-the-middle attack (MITM) who can spoof DNS responses to perform a rebinding attack and then connect to the WebSocket debugger allowing for arbitrary code execution on the target system.

Statement: This issue is a bypass of CVE-2021-22884.

Remediation: