huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Stack buffer overflow in ANGLE
CVE: CVE-2021-30628
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2021-09-13T00:00:00+00:00

Stack buffer overflow in ANGLE in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Regular expression denial of service if the application is provided and checks a crafted invalid SVG string
CVE: CVE-2021-29059
Component: nodejs-is-svg
CWE: CWE-400
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-06-21T00:00:00+00:00

A flaw was found in IS-SVG where a Regular Expression Denial of Service (ReDOS) occurs if the application is provided and checks a crafted invalid SVG string. The highest threat from this vulnerability is to system availability.

Statement: Since OpenShift Service Mesh 1.1.x is in its maintenance phase, only Important and Criticals will be fixed at this time.

In Red Hat OpenShift Container Platform (RHOCP) and OpenShift Service Mesh (OSSM), the affected components are behind OpenShift OAuth. This restricts access to the vulnerable is-svg library to authenticated users only, therefore the impact is low. 
OCP 4 delivers the kibana package where the is-svg is bundled, but during the update to container first (to openshift4/ose-logging-kibana6 starting in OCP 4.5) the dependency was removed and hence the kibana package is marked as wontfix. In OCP the grafana container bundles is-svg  library, but as the Grafana dashboard is read-only, injecting the malicious string is not be possible, therefore this component has been marked as wontfix at this time and may be fixed in a future release.

In Red Hat Advanced Cluster Management for Kubernetes (RHACM) the affected components are not longer in use for 2.2 and 2.3, except for console-ui-container in 2.1, which is behind the OAuth, which in case the impact is marked as low. RHACM 2.1 is in its maintenance phase, so only Important and Criticals will be fixed at this time.

In Red Hat Virtualization a vulnerable version of is-svg is used in ovirt-web-ui and ovirt-engine-ui-extensions. It is a build-time dependency not exploitable in the delivered product. Therefore impact is rated Low and it will not be immediately fixed. An update may be provided in future releases.

Remediation:
For OpenShift Container Platform 4.8 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html
For OpenShift Container Platform 4.9 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.9/updating/updating-cluster-cli.html
malicious scripts leads to XSS
CVE: CVE-2021-32245
Component: PageKit
CVSS v3: 7.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Release date: 2021-04-30T00:00:00+00:00

In PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS. These SVG files can contain malicious scripts. This file will be uploaded to the system and it will not be stripped or filtered. The user can create a link on the website pointing to "/storage/exp.svg" that will point to http://localhost/pagekit/storage/exp.svg. When a user comes along to click that link, it will trigger a XSS attack.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Use after free in Blink
CVE: CVE-2021-21193
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2021-03-12T00:00:00+00:00

Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
RDMA/cma: Fix rdma_resolve_route() memory leak
CVE: CVE-2021-47345
Component: kernel
CWE: CWE-402
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Release date: 2021-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

RDMA/cma: Fix rdma_resolve_route() memory leak

Fix a memory leak when "mda_resolve_route() is called more than once on
the same "rdma_cm_id".

This is possible if cma_query_handler() triggers the
RDMA_CM_EVENT_ROUTE_ERROR flow which puts the state machine back and
allows rdma_resolve_route() to be called again.


Remediation:
Heap buffer overflow in ntfs_attr_pread_i() triggered by specially crafted NTFS attributes
CVE: CVE-2021-33287
Component: ntfs-3g
CWE: CWE-119
Severity: Moderate
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2021-08-30T00:00:00+00:00

The ntfs3g package is susceptible to a heap overflow on crafted input. When processing NTFS attributes, proper bounds checking was not enforced leading to this software flaw. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.


Remediation:
a heap-based buffer overflow in dhcp_reply
CVE: CVE-2021-45952
Component: dnsmasq
CWE: CWE-787
Severity: None
CVSS v3: 0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
Release date: 2021-01-01T00:00:00+00:00

Dnsmasq 2.86 has a heap-based buffer overflow in dhcp_reply (called from dhcp_packet and FuzzDhcp). NOTE: the vendor's position is that CVE-2021-45951 through CVE-2021-45957 "do not represent real vulnerabilities, to the best of our knowledge.

Statement: Red Hat Product Security does not consider this to be a vulnerability.

Remediation:
use-after-free in __cil_verify_classperms()
CVE: CVE-2021-36085
Component: libsepol
CWE: CWE-416
Severity: Moderate
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2021-04-19T00:00:00+00:00

The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __verify_map_perm_classperms and hashtab_map).


Remediation:
net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg
CVE: CVE-2021-47596
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.5/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Release date: 2021-01-01T00:00:00+00:00

A vulnerability was found in the Linux kernel's HNS3 network driver related to a use-after-free condition in the hclgevf_send_mbx_msg function. The issue occurs when the hns3_remove function uninstalls a client instance before uninstalling the acceleration engine device, leading to access of freed memory during the device's uninstall process, resulting in system crash.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
XSS via the queue name of the live-poll feature
CVE: CVE-2021-30151
Component: sidekiq
CWE: CWE-79
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
Release date: 2021-10-08T00:00:00+00:00

A cross-site scripting vulnerability was found in sidekiq via the queue name of the live-poll feature. A potential attacker can impersonate or masquerade as the victim user using this vulnerability when Internet Explorer is used.


Remediation:
For Red Hat Satellite 6.11 see the following documentation for the release.
https://access.redhat.com/documentation/en-us/red_hat_satellite/6.11

The important instructions on how to upgrade are available below.
https://access.redhat.com/documentation/en-us/red_hat_satellite/6.11/html/upgrading_and_updating_red_hat_satellite
Remote Code Execution Vulnerability
CVE: CVE-2021-24112
Component: dotnet
Severity: Important
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2021-02-25T00:00:00+00:00

A flaw was found in dotnet. When a .NET application utilizing libgdiplus on a non-Windows system accepts input, this flaw allows an attacker to send a specially crafted request that could result in remote code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Statement: Red Hat Enterprise Linux 8 and the .NET versions as shipped by Red Hat are not affected by this vulnerability since libgdiplus is an optional dependency for .NET and is currently not available for Red Hat Enterprise Linux.

Remediation:
Assertion abort in function MemBuffer::alloc()
CVE: CVE-2021-30501
Component: upx
CVSS v3: 5.2/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2021-04-07T00:00:00+00:00

An assertion abort was found in upx MemBuffer::alloc() in mem.cpp, in version UPX 4.0.0. The flow allows attackers to cause a denial of service (abort) via a crafted file.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
netfilter: nft_ct: skip expectations for confirmed conntrack
CVE: CVE-2021-47129
Component: kernel
CWE: CWE-20
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_ct: skip expectations for confirmed conntrack

nft_ct_expect_obj_eval() calls nf_ct_ext_add() for a confirmed
conntrack entry. However, nf_ct_ext_add() can only be called for
!nf_ct_is_confirmed().

[ 1825.349056] WARNING: CPU: 0 PID: 1279 at net/netfilter/nf_conntrack_extend.c:48 nf_ct_xt_add+0x18e/0x1a0 [nf_conntrack]
[ 1825.351391] RIP: 0010:nf_ct_ext_add+0x18e/0x1a0 [nf_conntrack]
[ 1825.351493] Code: 41 5c 41 5d 41 5e 41 5f c3 41 bc 0a 00 00 00 e9 15 ff ff ff ba 09 00 00 00 31 f6 4c 89 ff e8 69 6c 3d e9 eb 96 45 31 ed eb cd <0f> 0b e9 b1 fe ff ff e8 86 79 14 e9 eb bf 0f 1f 40 00 0f 1f 44 00
[ 1825.351721] RSP: 0018:ffffc90002e1f1e8 EFLAGS: 00010202
[ 1825.351790] RAX: 000000000000000e RBX: ffff88814f5783c0 RCX: ffffffffc0e4f887
[ 1825.351881] RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff88814f578440
[ 1825.351971] RBP: 0000000000000000 R08: 0000000000000000 R09: ffff88814f578447
[ 1825.352060] R10: ffffed1029eaf088 R11: 0000000000000001 R12: ffff88814f578440
[ 1825.352150] R13: ffff8882053f3a00 R14: 0000000000000000 R15: 0000000000000a20
[ 1825.352240] FS:  00007f992261c900(0000) GS:ffff889faec00000(0000) knlGS:0000000000000000
[ 1825.352343] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1825.352417] CR2: 000056070a4d1158 CR3: 000000015efe0000 CR4: 0000000000350ee0
[ 1825.352508] Call Trace:
[ 1825.352544]  nf_ct_helper_ext_add+0x10/0x60 [nf_conntrack]
[ 1825.352641]  nft_ct_expect_obj_eval+0x1b8/0x1e0 [nft_ct]
[ 1825.352716]  nft_do_chain+0x232/0x850 [nf_tables]

Add the ct helper extension only for unconfirmed conntrack. Skip rule
evaluation if the ct helper extension does not exist. Thus, you can
only create expectations from the first packet.

It should be possible to remove this limitation by adding a new action
to attach a generic ct helper to the first packet. Then, use this ct
helper extension from follow up packets to create the ct expectation.

While at it, add a missing check to skip the template conntrack too
and remove check for IPCT_UNTRACK which is implicit to !ct.


Remediation:
Memory disclosure in partitioned-table UPDATE ... RETURNING
CVE: CVE-2021-32029
Component: postgresql
CWE: CWE-125
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2021-05-13T00:00:00+00:00

A flaw was found in postgresql. Using an UPDATE ... RETURNING command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

If the postgresql service is running, it will be automatically restarted after installing this update.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

If the postgresql service is running, it will be automatically restarted after installing this update.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

If the postgresql service is running, it will be automatically restarted after installing this update.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

If the postgresql service is running, it will be automatically restarted after installing this update.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

If the postgresql service is running, it will be automatically restarted after installing this update.
Path traversal vulnerability in agent names
CVE: CVE-2021-21605
Component: jenkins
CWE: CWE-20
Severity: Important
CVSS v3: 8.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2021-01-13T00:00:00+00:00

A flaw was found in jenkins. Users with Agent/Configure permissions can choose agent names that cause an override to the global `config.xml` file. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Remediation:
Before applying this update, ensure all previously released errata relevant
to your system is applied.

See the following documentation, which will be updated shortly for release
3.11.394, for important instructions on how to upgrade your cluster and fully
apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258.
For OpenShift Container Platform 4.5 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.5/release_notes/ocp-4-5-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.5/updating/updating-cluster-cli.html.
For OpenShift Container Platform 4.6 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html.
crafted input may cause a regular expression DoS
CVE: CVE-2021-22880
Component: rubygem-activerecord
CWE: CWE-400
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-02-11T00:00:00+00:00

The PostgreSQL adapter in Active Record suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the `money` type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input.

Statement: Red Hat Satellite ship affected version of rubygem-activerecord however, the product is not vulnerable to the flaw as it does not use the `money` field type in product code. We may update the rubygem-activerecord dependency in a future release.

Remediation:
ovl: fix warning in ovl_create_real()
CVE: CVE-2021-47579
Component: kernel
CWE: CWE-457
Severity: Low
CVSS v3: 4.4/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ovl: fix warning in ovl_create_real()

Syzbot triggered the following warning in ovl_workdir_create() ->
ovl_create_real():

	if (!err && WARN_ON(!newdentry->d_inode)) {

The reason is that the cgroup2 filesystem returns from mkdir without
instantiating the new dentry.

Weird filesystems such as this will be rejected by overlayfs at a later
stage during setup, but to prevent such a warning, call ovl_mkdir_real()
directly from ovl_workdir_create() and reject this case early.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Server: Optimizer unspecified vulnerability (CPU Oct 2021)
CVE: CVE-2021-35646
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-10-19T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.26 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
CVE: CVE-2021-34954
Component: Foxit PDF Editor StrikeOut Annotation Use-After-Free Remote Code Execution Vulnerability
Release date: 2021-10-15T12:32:54.111000+00:00

Foxit PDF Editor StrikeOut Annotation Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14355.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
it is possible to switch entities with IDOR from a logged in user
CVE: CVE-2021-21255
Component: glpi
CVSS v3: 5.9/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Release date: 2021-03-02T00:00:00+00:00

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI version 9.5.3, it was possible to switch entities with IDOR from a logged in user. This is fixed in version 9.5.4.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
pinctrl: mediatek: fix global-out-of-bounds issue
CVE: CVE-2021-47083
Component: kernel
CWE: CWE-125
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

pinctrl: mediatek: fix global-out-of-bounds issue

When eint virtual eint number is greater than gpio number,
it maybe produce 'desc[eint_n]' size globle-out-of-bounds issue.


Remediation:
Vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack
CVE: CVE-2021-25216
Component: bind
CWE: CWE-131
Severity: Important
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2021-04-28T00:00:00+00:00

A flaw was found in bind. The SPNEGO implementation used by BIND, which is a negotiation mechanism used by GSSAPI to support the secure exchange of keys used to verify the authenticity of communications between parties on a network, is subject to a buffer overflow attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: Versions of bind package shipped with Red Hat Enterprise Linux do not enable ISC SPNEGO and therefore are not affected by this flaw.

Remediation:
This vulnerability only affects servers configured to use GSS-TSIG, most often to sign dynamic updates. If another mechanism can be used to authenticate updates, the vulnerability can be avoided  by choosing not to enable the use of GSS-TSIG features.
use-after-free in nv_replace() in normal.c
CVE: CVE-2021-3796
Component: vim
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.3/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H
Release date: 2021-09-11T00:00:00+00:00

A use-after-free vulnerability in vim could allow an attacker to input a specially crafted file leading to memory corruption and a potentially exploitable crash or code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Remediation: