huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
incorrect processing of appmanifests
CVE: CVE-2018-6083
Component: chromium-browser
Severity: Low
CVSS v3: 4.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2018-03-06T00:00:00+00:00

Failure to disallow PWA installation from CSP sandboxed pages in AppManifest in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to access privileged APIs via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Stack overflow in BGP mask expressions
CVE: CVE-2018-12066
Component: bird
Release date: 2018-06-07T00:00:00+00:00

BIRD Internet Routing Daemon before 1.6.4 allows local users to cause a denial of service (stack consumption and daemon crash) via BGP mask expressions in birdc.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Shell command injection in unescaped bash-completed mount point names
CVE: CVE-2018-7738
Component: util-linux
CWE: CWE-78
Severity: Moderate
CVSS v3: 6.7/CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2018-03-07T00:00:00+00:00

A command injection flaw was found in the way util-linux implements umount autocompletion in Bash. An attacker with the ability to mount a filesystem with custom mount points may execute arbitrary commands on behalf of the user who triggers the umount autocompletion.

Statement: This issue did not affect the versions of util-linux as shipped with Red Hat Enterprise Linux 5, 6 and 7 as they did not include support for umount autocompletion.

Remediation:
CVE: CVE-2018-1000055
Component: CVE-2018-1000055
Release date: 2018-02-05T00:00:00+00:00

Jenkins Android Lint Plugin 2.5 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
SIGABRT caused by memory allocation in types.cpp:Exiv2::Internal::PngChunk::zlibUncompress()
CVE: CVE-2018-10958
Component: exiv2
CWE: CWE-400
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2018-05-09T00:00:00+00:00

In types.cpp in Exiv2 0.26, a large size value may lead to a SIGABRT during an attempt at memory allocation for an Exiv2::Internal::PngChunk::zlibUncompress call.


Remediation:
CVE: CVE-2018-1000540
Component: CVE-2018-1000540
Release date: 2018-06-26T00:00:00+00:00

LoboEvolution version < 9b75694cedfa4825d4a2330abf2719d470c654cd contains a XML External Entity (XXE) vulnerability in XML Parsing when viewing the XML file in the browser that can result in disclosure of confidential data, denial of service, server side request forgery. This attack appear to be exploitable via Specially crafted XML file.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Disclosure of user names and node names to unauthorized users through post-commit hook URL in Git Plugin (SECURITY-723)
CVE: CVE-2018-1000110
Component: jenkins-plugin-git
CWE: CWE-200
Severity: Moderate
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2018-02-26T00:00:00+00:00

An improper authorization vulnerability exists in Jenkins Git Plugin version 3.7.0 and earlier in GitStatus.java that allows an attacker with network access to obtain a list of nodes and users.


Remediation:
incomplete fix for CVE-2018-16509
CVE: CVE-2018-16863
Component: ghostscript
CWE: CWE-184
Severity: Important
CVSS v3: 7.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2018-12-03T00:00:00+00:00

It was found that RHSA-2018:2918 did not fully fix CVE-2018-16509. An attacker could possibly exploit another variant of the flaw and bypass the -dSAFER protection to, for example, execute arbitrary shell commands via a specially crafted PostScript document.

Statement: This vulnerability affects only Red Hat Enterprise Linux version 7. Red Hat Enterprise Linux version 6 is not affected by this vulnerability because the set of fixes for CVE-2018-16509, released via  RHSA-2018:3760, was complete.

Remediation:
Stack exhaustion in cp-demangle.c allows for denial of service
CVE: CVE-2018-18484
Component: binutils
CWE: CWE-400
Severity: Low
CVSS v3: 4.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2018-10-17T00:00:00+00:00

An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there is a stack consumption problem caused by recursive stack frames: cplus_demangle_type, d_bare_function_type, d_function_type.

Statement: Red Hat has determined this vulnerability is of low impact as the result of successful exploitation is a crash in the application utilizing libiberty's cp-demangler. There is no direct risk of code execution, privilege escalation, or system-wide instability.

Remediation:
Hostname spoofing in URL parser for javascript protocol
CVE: CVE-2018-12123
Component: nodejs
CWE: CWE-20
Severity: Low
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2018-11-27T00:00:00+00:00

Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" (e.g. "javAscript:") protocol (other protocols are not affected). If security decisions are made about the URL based on the hostname, they may be incorrect.

Statement: The nodejs RPMs shipped in Red Hat OpenShift Container Platform (OCP) versions 3.6 through 3.10 are vulnerable to this flaw because they contain the affected code. Later versions of OCP used nodejs RPMs delivered from Red Hat Software Collections and Red Hat Enterprise Linux channels.

Remediation:
CVE: CVE-2018-1000813
Component: CVE-2018-1000813
Release date: 2018-01-01T00:00:00+00:00

Backdrop CMS version 1.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Sanitization of custom class names used on blocks and layouts. that can result in Execution of JavaScript from an unexpected source.. This attack appear to be exploitable via A user must be directed to an affected page while logged in.. This vulnerability appears to have been fixed in 1.11.1 and later.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
arbitrary file write vulnerability / arbitrary code execution using a specially crafted zip file
CVE: CVE-2018-1002204
Component: nodejs-adm-zip
CWE: CWE-20
Severity: Moderate
CVSS v3: 5.4/CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L
Release date: 2018-01-01T00:00:00+00:00

adm-zip npm library before 0.4.9 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

Statement: While Red Hat Mobile Application Platform (RHMAP) does include the vulnerable library, it does not use the vulnerable methods extract* fixed in the library, [1]. RHMAP upgrade the vulnerable library in a future version.

Red Hat Quay includes adm-zip as a dependency of protractor which is only used at build time. The vulnerable library is not used at runtime meaning this has a low impact on Red Hat Quay.

[1] https://github.com/cthackers/adm-zip/commit/6f4dfeb9a2166e93207443879988f97d88a37cde

Remediation:
Server crash through modify command with large DN
CVE: CVE-2018-14624
Component: 389-ds-base
CWE: CWE-20
Severity: Moderate
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2018-08-31T00:36:00+00:00

A vulnerability was discovered in 389-ds-base. The lock controlling the error log was not correctly used when re-opening the log file in log__error_emergency(). An attacker could send a flood of modifications to a very large DN, which would cause slapd to crash.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the 389 server service will be restarted automatically.
CVE: CVE-2018-1000669
Component: CVE-2018-1000669
Release date: 2018-01-01T00:00:00+00:00

KOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x (up until 17.05.05) contains a Cross Site Request Forgery (CSRF) vulnerability in /cgi-bin/koha/members/paycollect.pl Parameters affected: borrowernumber, amount, amountoutstanding, paid that can result in Attackers can mark payments as paid for certain users on behalf of Administrators. This attack appear to be exploitable via The victim must be socially engineered into clicking a link, usually via email. This vulnerability appears to have been fixed in 17.11.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mate-screensaver before 1.20.2 in mate desktop environment allows physically proximate attackers to view screen content and possibly control application
CVE: CVE-2018-20681
Component: mate-screensaver
CVSS v3: 6.5/CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2018-05-02T00:00:00+00:00

mate-screensaver before 1.20.2 in MATE Desktop Environment allows physically proximate attackers to view screen content and possibly control applications. By unplugging and re-plugging or power-cycling external output devices (such as additionally attached graphical outputs via HDMI, VGA, DVI, etc.) the content of a screensaver-locked session can be revealed. In some scenarios, the attacker can execute applications, such as by clicking with a mouse.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
NULL pointer dereference in elf_link_input_bfd in elflink.c
CVE: CVE-2018-18607
Component: binutils
CWE: CWE-476
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2018-10-21T00:00:00+00:00

An issue was discovered in elf_link_input_bfd in elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in elf_link_input_bfd when used for finding STT_TLS symbols without any TLS section. A specially crafted ELF allows remote attackers to cause a denial of service, as demonstrated by ld.

Statement: Red Hat has determined this flaw to be of low impact as successful exploitation results in a crash (denial of service) of the application utilizing the binutils library and does not impact system-wide stability or lead to arbitrary code execution or memory corruption.

Remediation:
CVE: CVE-2018-6345
Component: CVE-2018-6345
Release date: 2018-01-01T00:00:00+00:00

The function number_format is vulnerable to a heap overflow issue when its second argument ($dec_points) is excessively large. The internal implementation of the function will cause a string to be created with an invalid length, which can then interact poorly with other functions. This affects all supported versions of HHVM (3.30.1 and 3.27.5 and below).

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Function signature mismatch in WebAssembly
CVE: CVE-2018-17458
Component: chromium-browser
Severity: Important
CVSS v3: 7.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2018-09-11T00:00:00+00:00

An improper update of the WebAssembly dispatch table in WebAssembly in Google Chrome prior to 69.0.3497.92 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Heap-base buffer over-read in dwarf.c:process_cu_tu_index() allows for denial of service via crafted file
CVE: CVE-2018-10372
Component: binutils
CWE: CWE-125
Severity: Low
CVSS v3: 3.4/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2018-04-14T00:00:00+00:00

process_cu_tu_index in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted binary file, as demonstrated by readelf.


Remediation:
Heap-based buffer overflow in S_handle_regex_sets()
CVE: CVE-2018-18312
Component: perl
CWE: CWE-22
Severity: Moderate
CVSS v3: 6.9/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Release date: 2018-11-29T00:00:00+00:00

Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.


Remediation:
Heap-based buffer over-read in header.cpp:header::add_INFO_descriptor()
CVE: CVE-2018-11099
Component: vcftools
CVSS v3: 4.3/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Release date: 2018-05-18T00:00:00+00:00

The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause information disclosure (heap-based buffer over-read) via a crafted vcf file.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Remote code execution in cssp_read_tsrequest
CVE: CVE-2018-8793
Component: rdesktop
CWE: CWE-119
Severity: Moderate
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2018-01-01T00:00:00+00:00

rdesktop versions up to and including v1.8.3 contain a Heap-Based Buffer Overflow in function cssp_read_tsrequest() that results in a memory corruption and probably even a remote code execution.


Remediation:
Stack-based buffer overflow in unzip.c:ec_read_file_func() allows for denial of service
CVE: CVE-2018-14346
Component: libextractor
CVSS v3: 4.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2018-07-18T00:00:00+00:00

GNU Libextractor before 1.7 has a stack-based buffer overflow in ec_read_file_func (unzip.c).

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
use-after-free can be caused by the function rsi_mac80211_detach in the file drivers/net/wireless/rsi/rsi_91x_mac80211.c
CVE: CVE-2018-21008
Component: kernel
CWE: CWE-416
Severity: Important
CVSS v3: 5.6/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2018-01-01T00:00:00+00:00

A use-after-free flaw was found in the Linux kernel's Redpine Signals driver implementation. A local attacker who is able force a module load (rsi_sdio) or usb plug/unplug could cause a system crash or memory corruption leading to privilege escalation. The highest threat from this vulnerability is to system availability.


Remediation:
ALLOW_ENCODED_SLASH option not taken into account in the AjpRequestParser
CVE: CVE-2018-1048
Component: undertow
CWE: CWE-22
Severity: Moderate
CVSS v3: 8.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Release date: 2018-01-15T00:00:00+00:00

It was found that the AJP connector in undertow does not use the ALLOW_ENCODED_SLASH option and thus allows the slash and anti-slash characters encoded in a URL. This may lead to path traversal and result in the information disclosure of arbitrary local files.


Remediation:
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

The References section of this erratum contains a download link (you must log in to download the update).
Server: Security: Privileges unspecified vulnerability (CPU Jul 2018)
CVE: CVE-2018-3075
Component: mysql
Severity: Moderate
CVSS v3: 5.9/CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2018-07-17T00:00:00+00:00

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 8.0.11 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
Use-after-free in SharedPtr class resulting in a denial of service
CVE: CVE-2018-19827
Component: libsass
CWE: CWE-416
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2018-12-03T00:00:00+00:00

A type confusion flaw was discovered in libsass in Expand::operator() in expand.cpp. An attacker could use this flaw to make an application that uses libsass crash or execute arbitrary code.


Remediation:
CVE: CVE-2018-6332
Component: CVE-2018-6332
Release date: 2018-12-03T00:00:00+00:00

A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 settings which can cause the server to spend disproportionate resources. This affects all supported versions of HHVM (3.24.3 and 3.21.7 and below) when using the proxygen server to handle HTTP2 requests.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
insufficient TLB flushing / improper large page mappings with AMD IOMMUs
CVE: CVE-2018-19962
Component: xen
CWE: CWE-212
Severity: Important
CVSS v3: 8.1/CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Release date: 2018-11-20T12:00:00+00:00

An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because small IOMMU mappings are unsafely combined into larger ones.


Remediation:
Heap-based buffer overflow via "gf_getspec_req" RPC message
CVE: CVE-2018-14653
Component: glusterfs
CWE: CWE-122
Severity: Moderate
CVSS v3: 6.7/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2018-10-31T08:00:00+00:00

A buffer overflow on the heap was found in gf_getspec_req RPC request. A remote, authenticated attacker could use this flaw to cause denial of service and read arbitrary files on glusterfs server node.

Statement: This issue did not affect Red Hat Enterprise Linux 6 and 7 as the flaw is present in glusterfs-server, which is not shipped there.

This flaw affects glusterfs versions included in Red Hat Virtualization 4 Hypervisor. However, in recommended configurations, the vulnerability is only exposed to hypervisor administrators and can not be exploited from virtual machines or other hosts on the network.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/2974891
Multiple vulnerabilities
CVE: CVE-2018-7173
Component: xpdf
Release date: 2018-02-11T00:00:00+00:00

A large loop in JBIG2Stream::readSymbolDictSeg in xpdf 4.00 allows an attacker to cause denial of service via a specific file due to inappropriate decoding.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Use-after-free due to race condition in AF_PACKET implementation
CVE: CVE-2018-18559
Component: kernel
CWE: CWE-416
Severity: Important
CVSS v3: 7.0/CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2018-06-15T00:00:00+00:00

A use-after-free flaw can occur in the Linux kernel due to a race condition between packet_do_bind() and packet_notifier() functions called for an AF_PACKET socket. An unprivileged, local user could use this flaw to induce kernel memory corruption on the system, leading to an unresponsive system or to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.