huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
HID: cp2112: prevent a buffer overflow in cp2112_xfer()
CVE: CVE-2022-50156
Component: kernel
CWE: CWE-787
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2022-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

HID: cp2112: prevent a buffer overflow in cp2112_xfer()

Smatch warnings:
drivers/hid/hid-cp2112.c:793 cp2112_xfer() error: __memcpy()
'data->block[1]' too small (33 vs 255)
drivers/hid/hid-cp2112.c:793 cp2112_xfer() error: __memcpy() 'buf' too
small (64 vs 255)

The 'read_length' variable is provided by 'data->block[0]' which comes
from user and it(read_length) can take a value between 0-255. Add an
upper bound to 'read_length' variable to prevent a buffer overflow in
memcpy().


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
exposure of sensitive information in cache manager
CVE: CVE-2022-41317
Component: squid
CWE: CWE-200
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2022-09-23T00:00:00+00:00

A flaw was found in squid. A trusted client can directly access the cache manager information, bypassing the manager ACL protection and resulting in information disclosure.


Remediation:
Adding the following line to the squid.conf file is a workaround:

acl manager url_regex +i ^[^:]+://[^/]+/squid-internal-mgr/
scsi: mpt3sas: Page fault in reply q processing
CVE: CVE-2022-48835
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

A page fault was observed in the Linux kernel. This is caused by mpt3sas_base_sync_reply_irqs() using an invalid reply_q pointer outside of the list_for_each_entry() loop. At the end of the full list traversal the pointer is invalid. This may lead to a potential loss of Availability.


Remediation:
ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg
CVE: CVE-2022-49727
Component: kernel
CWE: CWE-190
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg

When len >= INT_MAX - transhdrlen, ulen = len + transhdrlen will be
overflow. To fix, we can follow what udpv6 does and subtract the
transhdrlen from the max.


Remediation:
uncaught Exception (due to a data race) leads to process termination
CVE: CVE-2022-31015
Component: waitress
CWE: CWE-248
Severity: Low
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2022-06-01T00:00:00+00:00

Waitress is a Web Server Gateway Interface server for Python 2 and 3. Waitress versions 2.1.0 and 2.1.1 may terminate early due to a thread closing a socket while the main thread is about to call select(). This will lead to the main thread raising an exception that is not handled and then causing the entire application to be killed. This issue has been fixed in Waitress 2.1.2 by no longer allowing the WSGI thread to close the socket. Instead, that is always delegated to the main thread. There is no work-around for this issue. However, users using waitress behind a reverse proxy server are less likely to have issues if the reverse proxy always reads the full response.

Statement: The versions of waitress shipped with Red Hat products are not affected by this flaw.

Remediation:
drbd: only clone bio if we have a backing device
CVE: CVE-2022-50506
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

A NULL pointer dereference was found in the Linux kernel Distributed Replicated Block Device driver's I/O request handling. A local user with privileges to perform I/O operations on a DRBD block device can trigger I/O requests when the DRBD device is configured in diskless mode (no local backing device), causing the driver to dereference a NULL pointer when attempting to access the backing device structure, which results in denial of service through kernel crash.

Statement: The issue arises because of a code refactoring that moved device structure access earlier in the I/O request path without adding proper NULL validation. When drbd_req_new() processes a new I/O request, it attempts to clone the bio and access device->ldev->backing_bdev to set up the backing device information. However, when DRBD is configured in diskless mode (a valid configuration where DRBD acts purely as a network replication layer without local storage), the ldev pointer is NULL. The code lacks a check for this condition before dereferencing the pointer chain, causing an immediate kernel NULL pointer dereference. This occurs reliably whenever I/O is attempted on a diskless DRBD device. While this causes complete system failure through kernel panic, NULL pointer dereferences on modern kernels with memory protection mechanisms cannot be exploited for code execution or information disclosure, only denial of service.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
To mitigate this issue, prevent the drbd module from loading. See https://access.redhat.com/solutions/41278 for instructions on blacklisting kernel modules.
DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs
CVE: CVE-2022-2132
Component: dpdk
CWE: CWE-770
Severity: Important
CVSS v3: 8.5/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Release date: 2022-08-29T00:00:00+00:00

A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a denial of service triggered by sending a crafted Vhost header to DPDK.

Statement: In OpenShift Container Platform (OCP) the openvswitch rpm package is consumed from the RHEL Fast Datapath repositories, hence OCP openvswitch components are marked as "Will not fix".

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/2974891
Heap-based Buffer Overflow in radare2 prior to 5.7.0
CVE: CVE-2022-1437
Component: radare2
CVSS v3: 7.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Release date: 2022-04-19T00:00:00+00:00

Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Stack overflow vulnerability in function gmalloc in goo/gmem.cc
CVE: CVE-2022-45587
Component: xpdf
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

Stack overflow vulnerability in function gmalloc in goo/gmem.cc in xpdf 4.04, allows local attackers to cause a denial of service.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
fsi: occ: Prevent use after free
CVE: CVE-2022-50785
Component: kernel
Severity: None
Release date: 2022-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

fsi: occ: Prevent use after free

Use get_device and put_device in the open and close functions to
make sure the device doesn't get freed while a file descriptor is
open.
Also, lock around the freeing of the device buffer and check the
buffer before using it in the submit function.


Remediation:
Heap-based Buffer Overflow in NPM radare2.js
CVE: CVE-2022-0676
Component: radare2
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2022-02-22T00:00:00+00:00

Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.4.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
large length in the zero DataOffset case in smb2_write() processing could result in out-of-bounds read
CVE: CVE-2022-47943
Component: kernel
CWE: CWE-125
Severity: Critical
CVSS v3: 9.3/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H
Release date: 2022-12-22T00:00:00+00:00

An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. There is an out-of-bounds read and OOPS for SMB2_WRITE, when there is a large length in the zero DataOffset case.

Statement: There was no shipped kernel version that was seen affected by this problem. These files are not built in our source code.

Remediation:
XIChangeProperty out-of-bounds access
CVE: CVE-2022-46344
Component: xorg-x11-server
CWE: CWE-125
Severity: Important
CVSS v3: 9.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2022-12-14T00:00:00+00:00

A vulnerability was found in X.Org. The issue occurs because the handler for the XIChangeProperty request has a length-validation issue, resulting in out-of-bounds memory reads and potential information disclosure. This flaw can lead to local privilege elevation on systems where the X server runs privileged and remote code execution for ssh X forwarding sessions.

Statement: Xorg server does not run with root privileges in Red Hat Enterprise Linux 8 and 9, therefore Red Hat Enterprise Linux 8 and 9 have been rated with a Moderate severity.

Remediation:
wifi: mac80211: fix memory leak in ieee80211_if_add()
CVE: CVE-2022-50290
Component: kernel
CWE: CWE-772
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

No description is available for this CVE.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
invalid memory write in compileRule() in compileTranslationTable.c
CVE: CVE-2022-31783
Component: liblouis
CWE: CWE-787
Severity: Moderate
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-05-28T00:00:00+00:00

A vulnerability found in liblouis. This security flaw happens because of an invalid memory write in the compileRule() at compileTranslationTable.c.


Remediation:
Double-free vulnerability in contrib/shpsort.c
CVE: CVE-2022-0699
Component: shapelib
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2022-01-01T00:00:00+00:00

A double-free condition exists in contrib/shpsort.c of shapelib 1.5.0 and older releases. This issue may allow an attacker to cause a denial of service or have other unspecified impact via control over malloc.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Server-Side Request Forgery vulnerability
CVE: CVE-2022-44729
Component: batik
CWE: CWE-918
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Release date: 2022-01-01T00:00:00+00:00

A flaw was found in Apache Batik 1.0 - 1.16. This issue occurs due to a malicious SVG triggering external resources loading by default, causing resource consumption or in some cases information disclosure.


Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link (you must log in to download the update).
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
standard insecure cookie could be treated as a '__Host-' or '__Secure-' cookie by PHP applications
CVE: CVE-2022-31629
Component: php
CWE: CWE-20
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Release date: 2022-09-29T00:00:00+00:00

A vulnerability was found in PHP due to the way PHP handles HTTP variable names. It interferes with HTTP variable names that clash with ones that have a specific semantic meaning. This vulnerability allows network and same-site attackers to set a standard insecure cookie in the victim's browser, which is treated as a `__Host-` or `__Secure-` cookie by PHP applications, posing a threat to data integrity.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
segmentation fault in opj2_decompress due to uninitialized pointer
CVE: CVE-2022-1122
Component: openjpeg
CWE: CWE-824
Severity: Low
CVSS v3: 5.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

A flaw was found in the opj2_decompress program in openjpeg2 in the way it handles an input directory with a large number of files. When it fails to allocate a buffer to store the filenames of the input directory, it calls free() on an uninitialized pointer, leading to a segmentation fault and a denial of service.

Statement: This flaw affects the opj2_compress utility but is not in the openjpeg2 library. Therefore, the attack vector is local to the opj2_compress utility and would require an attacker to convince a user to open a directory with an extremely large number of files using opj2_compress, or a script to be feeding such arbitrary, untrusted files to opj2_compress.

Remediation:
mISDN: fix misuse of put_device() in mISDN_register_device()
CVE: CVE-2022-49818
Component: kernel
Severity: None
Release date: 2022-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mISDN: fix misuse of put_device() in mISDN_register_device()

We should not release reference by put_device() before calling device_initialize().


Remediation:
Disallow non closures in `sort` filter when the sandbox mode is enabled
CVE: CVE-2022-23614
Component: twig
CVSS v3: 9.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2022-02-05T00:00:00+00:00

Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions. In affected versions this constraint was not properly enforced and could lead to code injection of arbitrary PHP code. Patched versions now disallow calling non Closure in the `sort` filter as is the case for some other filters. Users are advised to upgrade.

Statement: Red Hat Codeready Workspaces is not affected by this vulnerability as it uses a NodeJS implementation of twig instead the twig PHP implementation, which is the affected implementation for this flaw.

Remediation:
incorrect json parsing
CVE: CVE-2022-32511
Component: jmespath.rb
Release date: 2022-06-07T00:00:00+00:00

jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Stack overflow vulnerability in function Dict::find
CVE: CVE-2022-45586
Component: xpdf
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

Stack overflow vulnerability in function Dict::find in xpdf/Dict.cc in xpdf 4.04, allows local attackers to cause a denial of service.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Server: Optimizer unspecified vulnerability (CPU Jan 2022)
CVE: CVE-2022-21297
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2022-01-18T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.26 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
wifi: fix potential NULL-ptr deref after clone
CVE: CVE-2022-50784
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
Release date: 2022-01-01T00:00:00+00:00

A flaw was found in the Linux kernel’s iwlwifi mei driver. When the driver attempts to clone a socket bufferand that operation fails, it may erroneously dereference a NULL pointer, leading to a kernel crash or denial of service. An unprivileged local user may be able to trigger this flaw by initiating conditions where skb cloning fails


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
improper validation user-supplied data could lead in heap buffer overflow which can result in RCE
CVE: CVE-2022-47942
Component: kernel
CWE: CWE-119
Severity: Important
CVSS v3: 8.3/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Release date: 2022-12-22T00:00:00+00:00

An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. There is a heap-based buffer overflow in set_ntacl_dacl, related to use of SMB2_QUERY_INFO_HE after a malformed SMB2_SET_INFO_HE command.

Statement: There was no shipped kernel version that was seen affected by this problem. These files are not built in our source code. See https://access.redhat.com/solutions/6991749 for more information.

Remediation:
Information exposure via cmd line output and table history into backup file
CVE: CVE-2022-26944
Component: percona-xtrabackup
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2022-06-02T00:00:00+00:00

Percona XtraBackup 2.4.20 unintentionally writes the command line to any resulting backup file output. This may include sensitive arguments passed at run time. In addition, when --history is passed at run time, this command line is also written to the PERCONA_SCHEMA.xtrabackup_history table. NOTE: this issue exists because of an incomplete fix for CVE-2020-10997.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation: