huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
libxl fails to honour readonly flag on HVM emulated SCSI disks
CVE: CVE-2018-12892
Component: xen
CWE: CWE-285
Severity: Moderate
CVSS v3: 7.7/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2018-06-27T00:00:00+00:00

An issue was discovered in Xen 4.7 through 4.10.x. libxl fails to pass the readonly flag to qemu when setting up a SCSI disk, due to what was probably an erroneous merge conflict resolution. Malicious guest administrators or (in some situations) users may be able to write to supposedly read-only disk images. Only emulated SCSI disks (specified as "sd" in the libxl disk configuration, or an equivalent) are affected. IDE disks ("hd") are not affected (because attempts to make them readonly are rejected). Additionally, CDROM devices (that is, devices specified to be presented to the guest as CDROMs, regardless of the nature of the backing storage on the host) are not affected; they are always read only. Only systems using qemu-xen (rather than qemu-xen-traditional) as the device model version are vulnerable. Only systems using libxl or libxl-based toolstacks are vulnerable. (This includes xl, and libvirt with the libxl driver.) The vulnerability is present in Xen versions 4.7 and later. (In earlier versions, provided that the patch for XSA-142 has been applied, attempts to create read only disks are rejected.) If the host and guest together usually support PVHVM, the issue is exploitable only if the malicious guest administrator has control of the guest kernel or guest kernel command line.


Remediation:
CVE: CVE-2018-1000008
Component: CVE-2018-1000008
Release date: 2018-01-22T00:00:00+00:00

Jenkins PMD Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
IEEE 802.11 dissector crash in airpdcap.c
CVE: CVE-2018-7335
Component: wireshark
CWE: CWE-130
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2018-02-18T00:00:00+00:00

A denial of service flaw was found in the IEEE 802.11 dissector in Wireshark. A remote network attacker could potentially use this flaw to crash Wireshark by tricking it into processing a crafted packet.


Remediation:
Double free in slp_buffer:SLPBufferRealloc() may allow a remote attacker to execute arbitrary code
CVE: CVE-2018-12938
Component: openslp
CWE: CWE-416
Severity: None
CVSS v3: 8.6/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Release date: 2018-06-28T00:00:00+00:00

No description is available for this CVE.

Statement: This flaw was found to be a duplicate of CVE-2017-17833. Please see https://access.redhat.com/security/cve/CVE-2017-17833 for information about affected products and security errata.

Remediation:
Improper access control in dRuby allows local users to execute arbitrary commands as root
CVE: CVE-2018-10905
Component: cfme
CWE: CWE-284
Severity: Important
CVSS v3: 7.9/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2018-07-20T19:54:00+00:00

CloudForms Management Engine has a vulnerability that allows local users to execute arbitrary commands as root. An attacker with SSH access to the system can use the dRuby (DRb) module installed on the system to execute arbitrary shell commands using `instance_eval()`.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Administrators of the CloudForms appliance can filter local packages going to the port where MIQ Server is listening, by using the following iptables command:
# iptables -I OUTPUT 1 -o lo -d localhost/32 -p tcp -m tcp --dport <MIQ Server port> -m owner '!' --uid-owner root -j DROP

Where the MIQ Server port can be found using netstat command:
# netstat -nl --tcp -p | grep -i "miq server"
Out-of-bounds write in dfMemoryOutputStream::Write function in base/PdfOutputStream.cpp
CVE: CVE-2018-5308
Component: podofo
CVSS v3: 6.2/CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H
Release date: 2018-01-08T00:00:00+00:00

PoDoFo 0.9.5 does not properly validate memcpy arguments in the PdfMemoryOutputStream::Write function (base/PdfOutputStream.cpp). Remote attackers could leverage this vulnerability to cause a denial-of-service or possibly unspecified other impact via a crafted pdf file.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2018-1999008
Component: CVE-2018-1999008
Release date: 2018-01-01T00:00:00+00:00

October CMS version prior to build 437 contains a Cross Site Scripting (XSS) vulnerability in the Media module and create folder functionality that can result in an Authenticated user with media module permission creating arbitrary folder name with XSS content. This attack appear to be exploitable via an Authenticated user with media module permission who can create arbitrary folder name (XSS). This vulnerability appears to have been fixed in build 437.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
NULL pointer dereference in g_markup_parse_context_end_parse() function in gmarkup.c
CVE: CVE-2018-16428
Component: glib2
CWE: CWE-119
Severity: Low
CVSS v3: 9.8/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2018-09-04T00:00:00+00:00

In GNOME GLib 2.56.1, g_markup_parse_context_end_parse() in gmarkup.c has a NULL pointer dereference.


Remediation:
Since the only affected code in this flaw is g_markup_parse_context_end_parse(), any application (compiled with glib2) which does not use this function or any other function which calls this vulnerable code, is not affected by this flaw.
Integer overflow in SwiftShader
CVE: CVE-2018-6174
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2018-07-24T00:00:00+00:00

Integer overflows in Swiftshader in Google Chrome prior to 68.0.3440.75 potentially allowed a remote attacker to execute arbitrary code via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
NULL pointer exception in snmp_oid_compare in snmplib/snmp_api.c resulting in a denial of service
CVE: CVE-2018-18066
Component: net-snmp
CWE: CWE-476
Severity: Moderate
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2018-01-01T00:00:00+00:00

snmp_oid_compare in snmplib/snmp_api.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an unauthenticated attacker to remotely cause the instance to crash via a crafted UDP packet, resulting in Denial of Service.


Remediation:
Configuring snmp with a secret community string makes this attack much more difficult to perform, as the attacker must guess the community string in order to exploit the vulnerability.

Protecting the snmp service with host firewall rules to prevent unauthorized hosts from sending messages to the snmp service will prevent this attack being carried out by users of other hosts on the network.

Either or both of these steps is recommended to prevent potential attackers from gaining extra information about network devices and topology, and from causing undue load to snmp services.
use after free in pdfium
CVE: CVE-2018-6031
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2018-01-24T00:00:00+00:00

Use after free in PDFium in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
buffer overflow in URL auth code
CVE: CVE-2018-18820
Component: icecast
CVSS v3: 7.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2018-10-16T00:00:00+00:00

A buffer overflow was discovered in the URL-authentication backend of the Icecast before 2.4.4. If the backend is enabled, then any malicious HTTP client can send a request for that specific resource including a crafted header, leading to denial of service and potentially remote code execution.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Stack-based buffer overflow in contrib/pngminus/pnm2png.c:get_token() potentially leading to arbitrary code execution
CVE: CVE-2018-14550
Component: libpng
CWE: CWE-121
Severity: Moderate
CVSS v3: 6.9/CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2018-07-21T00:00:00+00:00

An issue has been found in third-party PNM decoding associated with libpng 1.6.35. It is a stack-based buffer overflow in the function get_token in pnm2png.c in pnm2png.

Statement: This issue did not affect the versions of libpng as shipped with Red Hat Enterprise Linux 5, 6 and 7 as they did not include the vulnerable code.

Remediation:
Heap-based buffer overflow in fs/ext4/xattr.c:ext4_xattr_set_entry() with crafted ext4 image
CVE: CVE-2018-10840
Component: kernel
CWE: CWE-122
Severity: Moderate
CVSS v3: 5.1/CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Release date: 2018-04-11T00:00:00+00:00

The Linux kernel is vulnerable to a heap-based buffer overflow in the fs/ext4/xattr.c:ext4_xattr_set_entry() function. An attacker could exploit this by operating on a mounted crafted ext4 image.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
CVE: CVE-2018-1000663
Component: CVE-2018-1000663
Release date: 2018-01-01T00:00:00+00:00

jsish version 2.4.70 2.047 contains a Buffer Overflow vulnerability in function _jsi_evalcode from jsiEval.c that can result in Crash due to segmentation fault. This attack appear to be exploitable via The victim must execute crafted javascript code.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Use-after-free with widget listener (MFSA 2018-03)
CVE: CVE-2018-5099
Component: Mozilla
CWE: CWE-416
Severity: Important
CVSS v3: 9.8/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2018-01-23T00:00:00+00:00

A use-after-free vulnerability can occur when the widget listener is holding strong references to browser objects that have previously been freed, resulting in a potentially exploitable crash when these references are used. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
Out-of-bounds read in uriParse*Ex*
CVE: CVE-2018-20721
Component: uriparser
CWE: CWE-125
Severity: Low
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2018-12-08T00:00:00+00:00

URI_FUNC() in UriParse.c in uriparser before 0.9.1 has an out-of-bounds read (in uriParse*Ex* functions) for an incomplete URI with an IPv6 address containing an embedded IPv4 address, such as a "//[::44.1" address.

Statement: This issue affects the versions of uriparser as shipped with Red Hat Enterprise Linux 7.

Remediation:
Anonymous access via 9990 port allows RCE via war file upload
CVE: CVE-2018-10682
Component: wildfly
CWE: CWE-306
Severity: Important
CVSS v3: 8.1/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2018-05-02T00:00:00+00:00

An issue was discovered in WildFly 10.1.2.Final. It is possible for an attacker to access the administration panel on TCP port 9990 without any authentication using "anonymous" access that is automatically created. Once logged in, a misconfiguration present by default (auto-deployment) permits an anonymous user to deploy a malicious .war file, leading to remote code execution. NOTE: the vendor indicates that anonymous access is not available in the default installation; however, it remains optional because there are several use cases for it, including development environments and network architectures that have a proxy server for access control to the WildFly server

Statement: Red Hat Product Security does not consider this issue as a vulnerability. The default installation are by default secured which means that management interfaces are set to have an authentication mechanism. Even without security on the management interfaces there are other approaches that could be taken, as an example a proxy fronting the server could be taking over the configuration.  A second one could be the application server is running on an isolated device that does not allow network connections to it so only a local trusted process can communicate with it. Our default out of the box security considers that the server could be installed on a multi-user server so other users could inadvertently gain access if we had no security.  However in many cases the server will be installed on a single user workstation for developer use, in that case being able to switch off security is desirable so the admin console can be accessed without the need for user accounts. As we switch to the Elytron configuration it is also possible for an administrator to define anonymous authentication policies even if sasl-authentication-factory is not referenced. HTTP remains the same, it is either on or off, a user could however still implement a custom anonymous mechanism.

Remediation:
cross-site scripting in login admin management page
CVE: CVE-2018-17147
Component: Nagios-XI
CWE: CWE-79
Severity: Moderate
CVSS v3: 6.0/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2018-01-01T00:00:00+00:00

Nagios XI before 5.5.4 has XSS in the auto login admin management page.

Statement: This issue did not affect Red Hat Gluster Storage 3 as it does not ship Nagios XI.

Remediation:
reachable assertion in jpc_firstone() in jpc_math.c
CVE: CVE-2018-9055
Component: jasper
CWE: CWE-617
Severity: Moderate
CVSS v3: 5.4/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2018-03-26T00:00:00+00:00

JasPer 2.0.14 allows denial of service via a reachable assertion in the function jpc_firstone in libjasper/jpc/jpc_math.c.

Statement: This vulnerability is rated as a Moderate vulnerability because it allows denial of service due to  reachable asseration in jpc_firstone fundtion within libjasper/jpc/jpc_math.c. Exploiting this issue could cause an application crash when processing crafted input, this vulnerability affects the availability of application.

Remediation:
Same origin policy bypass in Service Worker
CVE: CVE-2018-6089
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2018-04-17T00:00:00+00:00

A lack of CORS checks, after a Service Worker redirected to a cross-origin PDF, in Service Worker in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak limited cross-origin data via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
NULL pointer dereference in libiberty/cplus-dem.c:work_stuff_copy_to_from() via crafted input
CVE: CVE-2018-17794
Component: binutils
CWE: CWE-476
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2018-10-02T00:00:00+00:00

An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in work_stuff_copy_to_from when called from iterate_demangle_function.

Statement: This issue is classified with a low severity primarily because binutils is not typically exposed to untrusted inputs in most environments, limiting the possibility of exploitation. Additionally, this NULL pointer dereference is only triggered during the parsing of a specially crafted file, requiring an attacker to convince a user to process this file with c++filt. Furthermore, binutils does not handle privileged operations, meaning that exploitation is unlikely to lead to system compromise or escalation of privileges. Also, the impact is limited to the application itself, without affecting the broader system or network security.

Remediation:
Improper Authentication in auth/store.go:AuthInfoFromTLS() via gRPC-gateway
CVE: CVE-2018-16886
Component: etcd
CWE: CWE-287
Severity: Moderate
CVSS v3: 7.0/CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Release date: 2018-01-01T00:00:00+00:00

Etcd, versions 3.2.0 through 3.2.25 and 3.3.0 through 3.3.10, are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server's TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.

Statement: OpenShift Container Platform 3.x, and 4.1 versions do not use etcd Role-based access control so they are not affected.

Remediation:
Ensure that the client server TLS certificate (specified in --cert-file argument or ETCD_CERT_FILE environment variable) does not include a CN (Common Name) field. If a Common Name field is part of this certificate, replace it with one which omits it.

To check the CN field of a certificate:
  openssl x509 -noout -subject -in /path/to/client.crt | grep -o 'CN.*'

To check if there is a username matching the CN field in the TLS client certificate:
  etcdctl user get <TLS client certificate CN>

For more information on TLS authentication features including how client-cert-auth is enabled, refer to the etcd transport security model documentation: https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/security.md
For more information on Role-based access control including how it is enabled, refer to the etcd role-based access control documentation: https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/authentication.md
Use after free in Blink
CVE: CVE-2018-6123
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2018-05-29T00:00:00+00:00

A use after free in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Out-of-bounds read in drivers/usb/misc/yurex.c:yurex_read allows for DoS or potential code execution
CVE: CVE-2018-19270
Component: kernel
CWE: CWE-125
Severity: None
CVSS v3: 7.9/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2018-11-19T00:00:00+00:00

No description is available for this CVE.

Statement: This flaw was found to be a duplicate of CVE-2018-16276. Please see https://access.redhat.com/security/cve/CVE-2018-16276 for information about affected products and security errata.

Remediation:
heap-based buffer over-read in the XMLDocument::Parse function
CVE: CVE-2018-11210
Component: tinyxml2
CWE: CWE-122
Severity: Low
CVSS v3: 4.3/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Release date: 2018-05-15T00:00:00+00:00

TinyXML2 6.2.0 has a heap-based buffer over-read in the XMLDocument::Parse function in libtinyxml2.so. NOTE: The tinyxml2 developers have determined that the reported overflow is due to improper use of the library and not a vulnerability in tinyxml2


Remediation:
Heap-based Buffer Overflow in packet-rtcp.c
CVE: CVE-2018-11355
Component: wireshark
CWE: CWE-122
Severity: Moderate
CVSS v3: 5.8/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2018-05-12T00:00:00+00:00

In Wireshark 2.6.0, the RTCP dissector could crash. This was addressed in epan/dissectors/packet-rtcp.c by avoiding a buffer overflow for packet status chunks.


Remediation:
prototype pollution in Object.prototype
CVE: CVE-2018-16490
Component: nodejs-mpath
CWE: CWE-20
Severity: Moderate
CVSS v3: 4.1/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
Release date: 2018-11-30T00:00:00+00:00

A prototype pollution vulnerability was found in module mpath <0.5.1 that allows an attacker to inject arbitrary properties onto Object.prototype.


Remediation:
write access violation gegl_buffer_iterate_read_simple function in buffer/gegl-buffer-access.c
CVE: CVE-2018-10114
Component: gegl
CWE: CWE-787
Severity: Moderate
CVSS v3: 7.7/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2018-04-14T00:00:00+00:00

An issue was discovered in GEGL through 0.3.32. The gegl_buffer_iterate_read_simple function in buffer/gegl-buffer-access.c allows remote attackers to cause a denial of service (write access violation) or possibly have unspecified other impact via a malformed PPM file, related to improper restrictions on memory allocation in the ppm_load_read_header function in operations/external/ppm-load.c.


Remediation:
same origin bypass via canvas
CVE: CVE-2018-6066
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2018-03-06T00:00:00+00:00

Lack of CORS checking by ResourceFetcher/ResourceLoader in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.