huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
memory leak in sof_dfsentry_write() function in sound/soc/sof/debug.c
CVE: CVE-2019-18812
Component: kernel
CWE: CWE-400
Severity: Moderate
CVSS v3: 6.1/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2019-10-28T00:00:00+00:00

A memory leak in the sof_dfsentry_write() function in sound/soc/sof/debug.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-c0a333d842ef.


Remediation:
CVE: CVE-2019-1003022
Component: CVE-2019-1003022
Release date: 2019-01-01T00:00:00+00:00

A denial of service vulnerability exists in Jenkins Monitoring Plugin 1.74.0 and earlier in PluginImpl.java that allows attackers to kill threads running on the Jenkins master.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
heap-based buffer over-read in function Splash::blitTransparent in splash/Splash.cc
CVE: CVE-2019-10872
Component: poppler
CWE: CWE-122
Severity: Moderate
CVSS v3: 5.0/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Release date: 2019-04-03T00:00:00+00:00

An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function Splash::blitTransparent at splash/Splash.cc.


Remediation:
Stack buffer overflow in WebRTC networking
CVE: CVE-2019-11760
Component: Mozilla
CWE: CWE-120
Severity: Moderate
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2019-10-22T00:00:00+00:00

A flaw was discovered in Mozilla Firefox and Thunderbird where a fixed-stack buffer overflow could occur during WebRTC signalling. The vulnerability could lead to an exploitable crash or leak data.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
Incorrect scoping in shipped sysV scripts allows arbitrary PID insertion to kill
CVE: CVE-2019-2389
Component: mongodb
CWE: CWE-732
Severity: Moderate
CVSS v3: 4.7/CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H
Release date: 2019-08-30T00:00:00+00:00

Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to be killed when the root user stops the MongoDB process via SysV init. This issue affects MongoDB Server v4.0 versions prior to 4.0.11; MongoDB Server v3.6 versions prior to 3.6.14; MongoDB Server v3.4 versions prior to 3.4.22.

Statement: This issue affects the mongodb packages as shipped in the Red Hat Enterprise Linux version 6 release of Red Hat Software Collections. For the Red Hat Enterprise Linux version 7 release of Red Hat Software Collections, refer to systemd CVE-2018-16888.

Red Hat Satellite 6 is using MongoDB, but is not considered vulnerable because it is using the systemd service file. Please refer to CVE-2018-16888.

Remediation:
/etc/passwd is given incorrect privileges
CVE: CVE-2019-19350
Component: openshift/ansible-service-broker
CWE: CWE-266
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2019-01-01T00:00:00+00:00

An insecure modification vulnerability in the /etc/passwd file was found in the openshift/ansible-service-broker. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.

Statement: By default this vulnerability is not exploitable in un-privilieged containers running on OpenShift Container Platform. This is because the system call SETUID and SETGID is blocked by the default seccomp policy.

Remediation:
DxeImageVerificationHandler integer overflow leads to endless loop
CVE: CVE-2019-14562
Component: edk2
CWE: CWE-835
Severity: Low
CVSS v3: 3.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Release date: 2019-09-24T00:00:00+00:00

Integer overflow in DxeImageVerificationHandler() EDK II may allow an authenticated user to potentially enable denial of service via local access.


Remediation:
Buffer overflows in PartitionDxe and UdfDxe with long file names and invalid UDF media
CVE: CVE-2019-0160
Component: edk2
CWE: CWE-120
Severity: Moderate
CVSS v3: 5.9/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2019-02-26T00:00:00+00:00

Buffer overflows were discovered in UDF-related codes under MdeModulePkg\Universal\Disk\PartitionDxe\Udf.c and MdeModulePkg\Universal\Disk\UdfDxe, which could be triggered with long file names or invalid formatted UDF media.


Remediation:
Authenticated user could impersonate server user when providing wrong credentials
CVE: CVE-2019-13423
Component: search-guard-kibana-plugin
CWE: CWE-290
Severity: Moderate
CVSS v3: 5.4/CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Release date: 2019-08-23T00:00:00+00:00

Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an authenticated Kibana user could impersonate as kibanaserver user when providing wrong credentials when all of the following conditions a-c are true: a) Kibana is configured to use Single-Sign-On as authentication method, one of Kerberos, JWT, Proxy, Client certificate. b) The kibanaserver user is configured to use HTTP Basic as the authentication method. c) Search Guard is configured to use an SSO authentication domain and HTTP Basic at the same time


Remediation:
an integer overflow vulnerability in the function TIFFSeekCustomStream in coders/tiff.c
CVE: CVE-2019-13136
Component: ImageMagick
CWE: CWE-190
Severity: Moderate
CVSS v3: 7.3/CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2019-06-19T00:00:00+00:00

ImageMagick, prior to version 7.0.8-50, has an integer overflow vulnerability in the function TIFFSeekCustomStream in coders/tiff.c.

Statement: This issue does not affect the versions of ImageMagick as shipped with Red Hat Enterprise Linux 5, 6, and 7 as they did not include the vulnerable code.

Remediation:
Opening crafted disk image triggers crash in tsk/fs/hfs_dent.c:237
CVE: CVE-2019-1010065
Component: sleuthkit
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2019-08-01T00:00:00+00:00

The Sleuth Kit 4.6.0 and earlier is affected by: Integer Overflow. The impact is: Opening crafted disk image triggers crash in tsk/fs/hfs_dent.c:237. The component is: Overflow in fls tool used on HFS image. Bug is in tsk/fs/hfs.c file in function hfs_cat_traverse() in lines: 952, 1062. The attack vector is: Victim must open a crafted HFS filesystem image.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
unsanitized location in scp could lead to unwanted command execution
CVE: CVE-2019-14889
Component: libssh
CWE: CWE-78
Severity: Low
CVSS v3: 7.2/CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2019-12-05T00:00:00+00:00

A flaw was found with the libssh API function ssh_scp_new(). A user able to connect to a server using SCP could execute arbitrary command using a user-provided path, leading to a compromise of the remote target.

Statement: Red Hat Virtualization only uses libssh for client-side, not server-side where this vulnerability is present.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing these updated packages, all running applications using libssh must be restarted for this update to take effect.
Sandbox bypass via IOCSTI (incomplete fix for CVE-2017-5226)
CVE: CVE-2019-10063
Component: flatpak
CWE: CWE-266
Severity: Important
CVSS v3: 8.5/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Release date: 2019-03-22T00:00:00+00:00

An incomplete fix for CVE-2017-5226 was found in flatpak. A sandbox bypass flaw was found in the way bubblewrap, which is used for sandboxing flatpak applications handled the TIOCSTI ioctl. A malicious flatpak application could use this flaw to inject commands into the controlled terminal of the host after the flatpak applications exits. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: This flaw can be exploited by malicious flatpak applications which include the code to exploit the wrong handling of the TIOCSTI ioctl (AV:L). No special action is needed to be performed by the attacker just having the exploit code should be enough for bypassing the sandbox restrictions (AC:L), Also the applications needs to be downloaded and run by the victim (PR:L). The flaw results in code being executed on the host system which is running the sandboxed application therefore this affects the host beyond the sandboxed application (S:C). Lastly considering the worst scenario in which the flatpak is run as root on the host system, this flaw can result in the malicious application running code as root on the host system (CIA:H).

Remediation:
SQL injection in sqlite3ExprCodeTarget in expr.c
CVE: CVE-2019-19242
Component: sqlite
CWE: CWE-89
Severity: Moderate
CVSS v3: 5.8/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2019-11-27T00:00:00+00:00

SQLite 3.30.1 mishandles pExpr->y.pTab, as demonstrated by the TK_COLUMN case in sqlite3ExprCodeTarget in expr.c.


Remediation:
stack-buffer-overflow in libcups's asn1_get_packed function
CVE: CVE-2019-8696
Component: cups
CWE: CWE-121
Severity: Low
CVSS v3: 3.7/CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2019-08-14T17:00:00+00:00

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra. An attacker in a privileged network position may be able to execute arbitrary code.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the cupsd service will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the cupsd service will be restarted automatically.
URL injection via xinclude parameter
CVE: CVE-2019-3873
Component: picketlink
CWE: CWE-79
Severity: Moderate
CVSS v3: 6.0/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
Release date: 2019-06-10T15:16:00+00:00

It was found that Picketlink as shipped with Jboss Enterprise Application Platform 7.2 would accept an xinclude parameter in SAMLresponse XML. An attacker could use this flaw to send a URL to achieve cross-site scripting or possibly conduct further attacks.


Remediation:
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

The References section of this erratum contains a download link (you must log in to download the update).

The JBoss server process must be restarted for the update to take effect.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link (you must log in to download the update).
allows local attackers to read private cookies
CVE: CVE-2019-18900
Component: libzypp
CVSS v3: 3.9/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2019-01-01T00:00:00+00:00

: Incorrect Default Permissions vulnerability in libzypp of SUSE CaaS Platform 3.0, SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allowed local attackers to read a cookie store used by libzypp, exposing private cookies. This issue affects: SUSE CaaS Platform 3.0 libzypp versions prior to 16.21.2-27.68.1. SUSE Linux Enterprise Server 12 libzypp versions prior to 16.21.2-2.45.1. SUSE Linux Enterprise Server 15 17.19.0-3.34.1.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
InnoDB unspecified vulnerability (CPU Apr 2019)
CVE: CVE-2019-2624
Component: mysql
Severity: Moderate
CVSS v3: 5.9/CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2019-04-16T00:00:00+00:00

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
null-pointer dereference in function nfc_llcp_build_tlv in net/nfc/llcp_commands.c
CVE: CVE-2019-12818
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 6.1/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2019-06-13T00:00:00+00:00

An issue was discovered in the Linux kernel before 4.20.15. The nfc_llcp_build_tlv function in net/nfc/llcp_commands.c may return NULL. If the caller does not check for this, it will trigger a NULL pointer dereference. This will cause denial of service. This affects nfc_llcp_build_gb in net/nfc/llcp_core.c.


Remediation:
Content security policy directives ignore port and path if host is a wildcard
CVE: CVE-2019-11737
Component: Mozilla
CWE: CWE-358
Severity: Low
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Release date: 2019-09-03T00:00:00+00:00

If a wildcard ('*') is specified for the host in Content Security Policy (CSP) directives, any port or path restriction of the directive will be ignored, leading to CSP directives not being properly applied to content. This vulnerability affects Firefox < 69.


Remediation:
Multiple memory corruption issues leading to arbitrary code execution
CVE: CVE-2019-8679
Component: webkitgtk
Severity: Moderate
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2019-08-29T00:00:00+00:00

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution.


Remediation:
denial of service in function adv_png_unfilter_8 in lib/png.c
CVE: CVE-2019-8383
Component: advancecomp
CWE: CWE-122
Severity: Low
CVSS v3: 4.0/CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L
Release date: 2019-02-16T00:00:00+00:00

An issue was discovered in AdvanceCOMP through 2.1. An invalid memory address occurs in the function adv_png_unfilter_8 in lib/png.c. It can be triggered by sending a crafted file to a binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact when a victim opens a specially crafted file.

Statement: This issue affects the versions of advancecomp as shipped with Red Hat Enterprise Linux 7. Red Hat Product Security has rated this issue as having a security impact of Low. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
Multiple memory corruption issues leading to arbitrary code execution
CVE: CVE-2019-6237
Component: webkitgtk
Severity: Moderate
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2019-05-20T00:00:00+00:00

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution.


Remediation:
Heap overflow in mwifiex_uap_parse_tail_ies function in drivers/net/wireless/marvell/mwifiex/ie.c
CVE: CVE-2019-10126
Component: kernel
CWE: CWE-122
Severity: Important
CVSS v3: 7.9/CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2019-05-31T00:00:00+00:00

A flaw was found in the mwifiex implementation in the Linux kernel. A system connecting to wireless access point could be manipulated by an attacker with advanced permissions on the access point into localized memory corruption or possibly privilege escalation.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
improper input validation when writing tar header fields leads to unexpected tar generation
CVE: CVE-2019-14866
Component: cpio
CWE: CWE-20
Severity: Moderate
CVSS v3: 6.7/CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2019-08-30T00:00:00+00:00

It was discovered cpio does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.


Remediation:
Download and install a new CLI binary by following the instructions linked from the References section.
TAR archives should be inspected before being extracted and the extraction should be performed with the `tar` command or `--no-absolute-filenames` option if done with `cpio`. Moreover, it should be performed by a low-privilege user whenever possible, to prevent extraction of files that could compromise the system.
allows attackers to impersonate others via crafted XML message
CVE: CVE-2019-3465
Component: php-robrichards-xmlseclibs
CVSS v3: 6.5/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2019-11-07T00:00:00+00:00

Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Safer mode bypass by .forceput exposure in .pdf_hook_DSC_Creator (701445)
CVE: CVE-2019-14811
Component: ghostscript
CWE: CWE-648
Severity: Important
CVSS v3: 7.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2019-08-28T12:00:00+00:00

A flaw was found in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_3scale_api_management/2.6/html-single/installing_3scale/#onpremises-installation
Please refer to the "Mitigation" section of CVE-2018-16509 : https://access.redhat.com/security/cve/cve-2018-16509