huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
null pointer dereference in drivers/usb/misc/sisusbvga/sisusb.c driver
CVE: CVE-2019-15219
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 4.5/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2019-08-19T00:00:00+00:00

A NULL pointer dereference flaw was found in the way the USB2VGA dongles driver in the Linux kernel handled failed initialization. This flaw allows an attacker able to insert USB2VGA dongles into the system to crash the system.

Statement: This issue is rated as having Low impact because of the physical access needed to trigger this issue. Also, failed initialization with the core USB subsystem is also a rare event to hit.

Remediation:
To mitigate this issue, prevent module sisusbvga from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
URL bar spoof via download redirect
CVE: CVE-2019-5875
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2019-09-10T00:00:00+00:00

Insufficient data validation in downloads in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
stored XSS via the Customizer
CVE: CVE-2019-17674
Component: wordpress
CVSS v3: 5.2/CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Release date: 2019-10-14T00:00:00+00:00

WordPress before 5.2.4 is vulnerable to stored XSS (cross-site scripting) via the Customizer.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2019-3558
Component: CVE-2019-3558
Release date: 2019-01-01T00:00:00+00:00

Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
file descriptors command execution
CVE: CVE-2019-12499
Component: firejail
CVSS v3: 7.3/CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2019-02-18T00:00:00+00:00

Firejail before 0.9.60 allows truncation (resizing to length 0) of the firejail binary on the host by running exploit code inside a firejail sandbox and having the sandbox terminated. To succeed, certain conditions need to be fulfilled: The jail (with the exploit code inside) needs to be started as root, and it also needs to be terminated as root from the host (either by stopping it ungracefully (e.g., SIGKILL), or by using the --shutdown control command). This is similar to CVE-2019-5736.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
salt-api NET API with the ssh client enabled is vulnerable to command injection
CVE: CVE-2019-17361
Component: salt
CWE: CWE-77
Severity: Important
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2019-01-01T00:00:00+00:00

In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.

Statement: salt-api is not used and not shipped with Red Hat Ceph Storage 2.

Remediation:
denial of service in function Parser::getObj() in Parser.cc
CVE: CVE-2019-13288
Component: xpdf
CVSS v3: 5.4/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2019-07-04T00:00:00+00:00

In Xpdf 4.01.01, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack. This is similar to CVE-2018-16646.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Retaining an open socket in close_notify SSL-TLS leading to Information disclosure.
CVE: CVE-2019-0231
Component: mina-core
CWE: CWE-319
Severity: Moderate
CVSS v3: 6.8/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Release date: 2019-04-14T00:00:00+00:00

A cryptographic protocol integrity flaw was discovered in Apache Mina. The closure of a TLS session would not always result in closure of the socket, allowing the conversation to continue in clear text. This could undermine the confidentiality of a connection and potentially disclose sensitive information to third-party attackers.

Statement: * Red Hat OpenStack Platform's OpenDaylight versions 8-10 contain the vulnerable code. However, these OpenDaylight versions were released as technical preview with limited support and will therefore not be updated. Other OpenDaylight versions do not contain the vulnerable library.

* This issue affects the version of apache-mina shipped with Red Hat Gluster Storage 3, as it contains the vulnerable functionality.

Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For detailed instructions how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.7/html/upgrading_and_updating_red_hat_satellite/updating_satellite_server_capsule_server_and_content_hosts
For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.

The References section of this erratum contains a download link (you must log in to download the update).
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

Installation instructions are available from the Fuse 7.7.0 product documentation page:
https://access.redhat.com/documentation/en-us/red_hat_fuse/7.7/
For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.

The References section of this erratum contains a download link (you must log in to download the update).
Multiple memory corruption issues leading to arbitrary code execution
CVE: CVE-2019-8601
Component: webkitgtk
Severity: Moderate
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2019-05-20T00:00:00+00:00

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution.


Remediation:
memory leak in genl_register_family() in net/netlink/genetlink.c
CVE: CVE-2019-15921
Component: kernel
CWE: CWE-401
Severity: Low
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2019-09-04T00:00:00+00:00

A flaw was found in the genl_register_family function in the Linux kernel. An attacker able to induce the error conditions could use this flaw to crash the system. The highest threat from this vulnerability is to system availability.

Statement: This issue is rated as having Low impact because of the preconditions needed to trigger the error/resource cleanup code path (system-wide out-of-memory condition, high privileges or physical access). The generic netlink is a way for kernel modues to easily communicate with userspace using netlink. genl_register_family is thus called by kernel modules (code) only and it's hard for an attacker to invoke (module reloads?) it let alone fail on the right place.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
infinite loop on filenames with invalid encoding
CVE: CVE-2019-19451
Component: dia
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2019-11-07T00:00:00+00:00

When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CIFS: Relative paths injection in directory entry lists
CVE: CVE-2019-10220
Component: kernel
CWE: CWE-22
Severity: Important
CVSS v3: 8.1/CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2019-11-27T15:16:00+00:00

A flaw was found in the Linux kernel's SMB client. Path separators are not checked by cifs.ko when parsing directory listings back. A bad server can return relative paths that will be returned as-is to userspace potentially leading to manipulating of files outside shared mount points. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Remediation:
Stack overflow in function svg_run_element, svg_run_use_symbol, svg_run_use of file svg_run.c
CVE: CVE-2019-6131
Component: mupdf
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2019-01-05T00:00:00+00:00

svg-run.c in Artifex MuPDF 1.14.0 has infinite recursion with stack consumption in svg_run_use_symbol, svg_run_element, and svg_run_use, as demonstrated by mutool.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
remote AMI user can execute arbitrary system commands using specially crafted Originate AMI request
CVE: CVE-2019-18610
Component: asterisk
CVSS v3: 6.2/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2019-11-21T00:00:00+00:00

An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4. A remote authenticated Asterisk Manager Interface (AMI) user without system authorization could use a specially crafted Originate AMI request to execute arbitrary system commands.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Buffer over-read in vrrp_print() function in print-vrrp.c
CVE: CVE-2019-15167
Component: tcpdump
CWE: CWE-126
Severity: Low
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2019-08-18T00:00:00+00:00

A buffer over-read flaw was found in the vrrp_print() function in the print-vrrp.c file in the VRRP parser in tcpdump, in VRRP version 3. This is a different vulnerability than CVE-2018-14463.

Statement: tcpdump as shipped with Red Hat Enterprise Linux 8 and 9 is not affected by this issue.

Remediation:
stack-based off-by-one buffer overflow in spiro_to_bpath0() in spiro.c
CVE: CVE-2019-19847
Component: libspiro
CWE: CWE-193
Severity: Moderate
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2019-12-17T00:00:00+00:00

An off-by-one vulnerability was found in libspiro in the way a double array is first declared in a unit test and then accessed by the library itself. Applications that make use of libspiro in the same way as the example code in the test suite may be vulnerable to this flaw. A remote attacker could abuse this flaw to make the application crash or potentially execute arbitrary code.

Statement: This issue did not affect the versions of libspiro as shipped with Red Hat Enterprise Linux 6, 7, and 8 as they did not include the vulnerable code. The vulnerable function was introduced in a newer version of the package.

Remediation:
information disclosure of encrypted mail
CVE: CVE-2019-10735
Component: claws-mail
CVSS v3: 5.9/CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Release date: 2019-02-22T00:00:00+00:00

In Claws Mail 3.14.1, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
heap-based buffer over-read in function elf32_xlatetom in elf32_xlatetom.c
CVE: CVE-2019-7665
Component: elfutils
CWE: CWE-122
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2019-01-12T00:00:00+00:00

In elfutils 0.175, a heap-based buffer over-read was discovered in the function elf32_xlatetom in elf32_xlatetom.c in libelf. A crafted ELF input can cause a segmentation fault leading to denial of service (program crash) because ebl_core_note does not reject malformed core file notes.


Remediation:
For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html
Heap-based buffer overflow in gdImageColorMatch() in gd_color_match.c
CVE: CVE-2019-6977
Component: gd
CWE: CWE-122
Severity: Moderate
CVSS v3: 6.5/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2019-01-01T00:00:00+00:00

gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1, has a heap-based buffer overflow. This can be exploited by an attacker who is able to trigger imagecolormatch calls with crafted image data.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
CORS bypass in download manager
CVE: CVE-2019-5822
Component: chromium-browser
Severity: Low
CVSS v3: 4.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2019-04-23T00:00:00+00:00

Inappropriate implementation in Blink in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to bypass same origin policy via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Windows programs that are not 'URL Handlers' are exposed to web content
CVE: CVE-2019-9801
Component: Mozilla
CWE: CWE-88
Severity: Moderate
CVSS v3: 6.0/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2019-03-20T00:00:00+00:00

Firefox will accept any registered Program ID as an external protocol handler and offer to launch this local application when given a matching URL on Windows operating systems. This should only happen if the program has specifically registered itself as a "URL Handler" in the Windows registry. *Note: This issue only affects Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.

Statement: This issue does not affect the version of firefox and thunderbird as shipped with Red Hat Enterprise Linux 6 and 7.

Remediation:
out-of-bounds write in read_colordef in read.c
CVE: CVE-2019-19797
Component: transfig
CWE: CWE-787
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2019-12-13T00:00:00+00:00

An out-of-bounds write flaw was found in transfig in the way the `fig2dev` program handled the processing of Fig format files. Specifically, the flaw affects the translation process of Fig codes into the box graphics language. This flaw allows for potential exploitation by crashing the `fig2dev` program by tricking it into processing specially crafted Fig format files.


Remediation:
Avoid loading and processing Fig format files from untrusted external sources.
use-after-free in paste_tokens in asm/preproc.c
CVE: CVE-2019-8343
Component: nasm
CWE: CWE-416
Severity: Low
CVSS v3: 7.3/CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2019-02-14T00:00:00+00:00

In Netwide Assembler (NASM) 2.14.02, there is a use-after-free in paste_tokens in asm/preproc.c.

Statement: This issue affects the versions of nasm as shipped with Red Hat Enterprise Linux 6 and 7.

Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Low, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue did not affect the versions of nasm as shipped with Red Hat Enterprise Linux 5.

Remediation:
fs/btrfs/volumes.c allows a btrfs_verify_dev_extents NULL pointer dereference
CVE: CVE-2019-18885
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 5.6/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2019-01-19T00:00:00+00:00

fs/btrfs/volumes.c in the Linux kernel before 5.1 allows a btrfs_verify_dev_extents NULL pointer dereference via a crafted btrfs image because fs_devices->devices is mishandled within find_device, aka CID-09ba3bc9dd15.

Statement: The Btrfs was introduced as a Technology Preview in both Red Hat Enterprise Linux 6 and 7 but is currently deprecated and not supported in both Red Hat Enterprise Linux releases.

Remediation:
Full screen notification overlap
CVE: CVE-2019-13660
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2019-09-10T00:00:00+00:00

UI spoofing in Chromium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof notifications via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
out-of-bounds read in setup_group in bfd/elf.c
CVE: CVE-2019-12972
Component: binutils
CWE: CWE-125
Severity: Low
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2019-06-17T00:00:00+00:00

An out-of-bounds read was discovered in Binutils while it processes a malformed ELF relocatable file (.o file). A victim user who uses Binutils tools (size, gdb, readelf) to analyze untrusted binaries, may be vulnerable to a denial of service attack.

Statement: Exploitation of this bug specifically requires the victim to analyze a maliciously crafted binary using a tool that uses a vulnerable version of libbfd. No binary under normal circumstances, omits the '\0' in SHT_GROUP, that is a prerequisite for this attack to work.

It is neither common practice, nor recommended to analyze untrusted binaries outside a sandbox. Therefore RH ProdSec has set the Impact of this bug to "Low".

Remediation:
Heap buffer overflow in persistence_json.cpp while parsing crafted JSON file
CVE: CVE-2019-5064
Component: opencv
CWE: CWE-122
Severity: Moderate
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2019-01-01T00:00:00+00:00

An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, before version 4.2.0. A specially crafted JSON file can cause a buffer overflow, resulting in multiple heap corruptions and potentially code execution. An attacker can provide a specially crafted file to trigger this vulnerability.

Statement: This flaw did not affect the versions of OpenCV as shipped with Red Hat Enterprise Linux 6, 7, and 8, as they did not include the vulnerable code, which was introduced in a later version of the library.

Remediation:
Avoid loading OpenCV data structures from external untrusted JSON files.
Activity Stream writes unsanitized content to innerHTML
CVE: CVE-2019-11718
Component: Mozilla
CWE: CWE-138
Severity: Moderate
CVSS v3: 5.8/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
Release date: 2019-07-09T00:00:00+00:00

Activity Stream can display content from sent from the Snippet Service website. This content is written to innerHTML on the Activity Stream page without sanitization, allowing for a potential access to other information available to the Activity Stream, such as browsing history, if the Snipper Service were compromised. This vulnerability affects Firefox < 68.


Remediation: