huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Insufficient encoding checks for LZ can cause different integer/buffer overflows
CVE: CVE-2018-10893
Component: spice-client
CWE: CWE-190
Severity: Moderate
CVSS v3: 7.7/CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
Release date: 2018-06-25T00:00:00+00:00

Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames. A malicious server could cause the client to crash or, potentially, execute arbitrary code.


Remediation:
Local user code injection in the meta rule syntax
CVE: CVE-2018-11781
Component: spamassassin
CWE: CWE-94
Severity: Moderate
CVSS v3: 8.4/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2018-09-17T00:00:00+00:00

A flaw was found in the way a local user on the SpamAssassin server could inject code in the meta rule syntax. This could cause the arbitrary code execution on the server when these rules are being processed.


Remediation:
sanitization bypass in parse_argument in options.c
CVE: CVE-2018-5764
Component: rsync
CWE: CWE-77
Severity: Moderate
CVSS v3: 6.5/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2018-01-17T00:00:00+00:00

The parse_arguments function in options.c in rsyncd in rsync before 3.1.3 does not prevent multiple --protect-args uses, which allows remote attackers to bypass an argument-sanitization protection mechanism.

Statement: This issue affects the versions of rsync as shipped with Red Hat Enterprise Linux 7 and Red Hat Enterprise Linux 6. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
CVE: CVE-2018-1999034
Component: CVE-2018-1999034
Release date: 2018-01-01T00:00:00+00:00

A man in the middle vulnerability exists in Jenkins Inedo ProGet Plugin 0.8 and earlier in ProGetApi.java, ProGetConfig.java, ProGetConfiguration.java that allows attackers to impersonate any service that Jenkins connects to.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
kvm: nVMX: missing privilege check allows privilege escalation in nested virtualization
CVE: CVE-2018-12904
Component: kernel
CWE: CWE-284
Severity: Moderate
CVSS v3: 7.7/CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Release date: 2018-06-12T00:00:00+00:00

In arch/x86/kvm/vmx.c in the Linux kernel before 4.17.2, when nested virtualization is used, local attackers could cause L1 KVM guests to VMEXIT, potentially allowing privilege escalations and denial of service attacks due to lack of checking of CPL.

Statement: This issue does not affect the versions of the kernel package as shipped with
Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2.

Remediation:
IxVeriWave file parser crash
CVE: CVE-2018-5334
Component: wireshark
Severity: Moderate
CVSS v3: 5.8/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2018-01-11T00:00:00+00:00

In Wireshark 2.4.0 to 2.4.3 and 2.2.0 to 2.2.11, the IxVeriWave file parser could crash. This was addressed in wiretap/vwr.c by correcting the signature timestamp bounds checks.


Remediation:
CVE: CVE-2018-1002009
Component: CVE-2018-1002009
Release date: 2018-12-03T00:00:00+00:00

There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in unsubscribe.html.php:3: via GET reuqest to the email variable.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Invalid access in the LZMA compression algorithm
CVE: CVE-2018-1000034
Component: unzip
CWE: CWE-119
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2018-02-07T00:00:00+00:00

An out-of-bounds read exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of service and read sensitive memory.

Statement: This issue did not affect the versions of unzip as shipped with Red Hat Enterprise Linux 5, 6 and 7 as they did not contain vulnerable code.

Remediation:
CSRF in report.cgi allows to extract confidential information from a bug
CVE: CVE-2018-5123
Component: bugzilla
CVSS v3: 4.9/CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Release date: 2018-01-26T00:00:00+00:00

A third party website can access information available to a user with access to a restricted bug entry using the image generation in report.cgi in all Bugzilla versions prior to 4.4.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Heap-based buffer overflow in SoundStretch/WavFile.cpp:WavInFile::readHeaderBlock() potentially leading to code execution
CVE: CVE-2018-1000223
Component: soundtouch
CWE: CWE-122
Severity: Moderate
CVSS v3: 4.2/CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
Release date: 2018-07-13T00:00:00+00:00

SoundStretch command-line utility packaged with SoundTouch library is vulnerable to heap-based buffer overflow in WavFile.cpp:WavInFile::readHeaderBlock() function that can lead to arbitrary code execution when processing untrusted file input.


Remediation:
Memory safety bugs fixed in Firefox 58 and Firefox ESR 52.6 (MFSA 2018-03)
CVE: CVE-2018-5089
Component: Mozilla
CWE: CWE-120
Severity: Critical
CVSS v3: 9.8/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2018-01-23T00:00:00+00:00

Memory safety bugs were reported in Firefox 57 and Firefox ESR 52.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
race condition in the ARM Advanced Microcontroller Bus Architecture (AMBA) driver
CVE: CVE-2018-9415
Component: kernel
CWE: CWE-400
Severity: Moderate
CVSS v3: 6.2/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Release date: 2018-07-02T00:00:00+00:00

A flaw was found in the Linux kernel. A race condition existed in the ARM Advanced Microcontroller Bus Architecture (AMBA) driver that could result in a double free. A local attacker could use this to cause a denial of service. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.


Remediation:
Allows loading of an undesired AMI by setting similar image properties
CVE: CVE-2018-15869
Component: awscli
CWE: CWE-20
Severity: Moderate
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Release date: 2018-08-14T00:00:00+00:00

An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog.


Remediation:
NULL pointer dereference in _poppler_attachment_new
CVE: CVE-2018-19149
Component: poppler
CWE: CWE-476
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2018-11-08T00:00:00+00:00

Poppler before 0.70.0 has a NULL pointer dereference in _poppler_attachment_new when called from poppler_annot_file_attachment_get_attachment.

Statement: This issue affects the versions of poppler as shipped with Red Hat Enterprise Linux 7.

Remediation:
Use after free in header.cpp:header::add_INFO_descriptor()
CVE: CVE-2018-11129
Component: vcftools
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2018-05-18T00:00:00+00:00

The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted vcf file.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Stack-based buffer over-read in print-hncp.c:print_prefix() via crafted pcap
CVE: CVE-2018-19519
Component: tcpdump
CWE: CWE-125
Severity: Low
CVSS v3: 4.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Release date: 2018-12-03T00:00:00+00:00

In tcpdump 4.9.2, a stack-based buffer over-read exists in the print_prefix function of print-hncp.c via crafted packet data because of missing initialization.

Statement: This issue affects the versions of tcpdump as shipped with Red Hat Enterprise Linux 7.

This issue did not affect the versions of tcpdump as shipped with Red Hat Enterprise Linux 5 and 6.

Remediation:
Privilege escalation on arm64 via KVM hypervisor
CVE: CVE-2018-18021
Component: kernel
CWE: CWE-20
Severity: Important
CVSS v3: 7.4/CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2018-10-03T00:00:00+00:00

A vulnerability was discovered in the Linux kernel that allows an attacker to escalate privileges with using a 64-bit ARM architecture. A local attacker with permission to create KVM-based virtual machines can both panic the hypervisor by triggering an illegal exception return (resulting in a DoS) and to redirect execution elsewhere within the hypervisor with full register control, instead of causing a return to the guest.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
URL spoof in Omnibox
CVE: CVE-2018-6133
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2018-05-29T00:00:00+00:00

Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Two flaws fixed in nextcloud 12.0.8
CVE: CVE-2018-3761
Component: nextcloud
CVSS v3: 6.5/CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
Release date: 2018-07-05T00:00:00+00:00

Nextcloud Server before 12.0.8 and 13.0.3 suffer from improper authentication on the OAuth2 token endpoint. Missing checks potentially allowed handing out new tokens in case the OAuth2 client was partly compromised.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CORS bypass in ServiceWorker
CVE: CVE-2018-6099
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2018-04-17T00:00:00+00:00

A lack of CORS checks in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak limited cross-origin data via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Memory leak in drivers/net/wireless/mac80211_hwsim.c:hwsim_new_radio_nl() can lead to potential denial of service
CVE: CVE-2018-8087
Component: kernel
CWE: CWE-400
Severity: Low
CVSS v3: 3.4/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2018-01-18T00:00:00+00:00

The Linux kernel is vulnerable to a memory leak in the drivers/net/wireless/mac80211_hwsim.c:hwsim_new_radio_nl() function. An attacker could exploit this to cause a potential denial of service.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
incorrect handling of url fragment identifiers in blink
CVE: CVE-2018-6076
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2018-03-06T00:00:00+00:00

Insufficient encoding of URL fragment identifiers in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform a DOM based XSS attack via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
security channel is not set properly for AMPQ connection
CVE: CVE-2018-16879
Component: Tower
CWE: CWE-311
Severity: Moderate
CVSS v3: 7.4/CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Release date: 2018-12-20T00:00:00+00:00

Tower does not set a secure channel as it is using the default insecure configuration channel settings for messaging celery workers from RabbitMQ. This could lead in data leak of sensitive information such as passwords as well as denial of service attacks by deleting projects or inventory files.

Statement: Red Hat CloudForms versions 4.5 and 4.6 ship an ansible-tower which correctly sets the security channel by default. Red Hat CloudForms version 4.7 ships ansible-tower 3.3.3 which already contains the fix.

Remediation:
DoS Attack via Range Requests
CVE: CVE-2018-15756
Component: springframework
CWE: CWE-20
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2018-10-16T00:00:00+00:00

Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.

Statement: The package rhvm-dependencies does not include the vulnerable spring-webmvc component.

Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link (you must log in to download the update).
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

Installation instructions are available from the Fuse 7.6.0 product documentation page:
https://access.redhat.com/documentation/en-us/red_hat_fuse/7.6/
CVE: CVE-2018-1000809
Component: CVE-2018-1000809
Release date: 2018-01-01T00:00:00+00:00

privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This attack appear to be exploitable via http request with user=<space>&pass= to /validate/check url. This vulnerability appears to have been fixed in 2.23.2.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Six security issues fixed in the latest release
CVE: CVE-2018-1137
Component: moodle
Release date: 2018-05-25T00:00:00+00:00

An issue was discovered in Moodle 3.x. By substituting URLs in portfolios, users can instantiate any class. This can also be exploited by users who are logged in as guests to create a DDoS attack.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
qemu-guest-agent: Integer overflow causes segmentation fault in qmp_guest_file_read()
CVE: CVE-2018-12617
Component: Qemu
CWE: CWE-190
Severity: Low
CVSS v3: 3.5/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L
Release date: 2018-06-22T00:00:00+00:00

qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causing a g_malloc0() call to trigger a segmentation fault when trying to allocate a large memory chunk. The vulnerability can be exploited by sending a crafted QMP command (including guest-file-read with a large count value) to the agent via the listening socket.


Remediation:
heap-based buffer over-read in Exiv2::Image::byteSwap2 function in image.cpp
CVE: CVE-2018-10780
Component: exiv2
CWE: CWE-122
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2018-05-05T00:00:00+00:00

Exiv2::Image::byteSwap2 in image.cpp in Exiv2 0.26 has a heap-based buffer over-read.


Remediation:
Stack-based buffer overflow in core/utils.c:uwsgi_expand_path() can lead to crash and potential code execution
CVE: CVE-2018-6758
Component: uwsgi
CVSS v3: 7.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2018-02-06T00:00:00+00:00

The uwsgi_expand_path function in core/utils.c in Unbit uWSGI through 2.0.15 has a stack-based buffer overflow via a large directory length.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2018-1000624
Component: CVE-2018-1000624
Release date: 2018-12-28T00:00:00+00:00

Battelle V2I Hub 2.5.1 is vulnerable to a denial of service, caused by the failure to restrict access to a sensitive functionality. By visiting http://V2I_HUB/UI/powerdown.php, a remote attacker could exploit this vulnerability to shut down the system.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Windows Defender SmartScreen UI runs with less secure behavior for downloaded files in Windows 10 April 2018 Update
CVE: CVE-2018-5174
Component: Mozilla
CWE: CWE-451
Severity: Moderate
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2018-05-09T00:00:00+00:00

In the Windows 10 April 2018 Update, Windows Defender SmartScreen honors the "SEE_MASK_FLAG_NO_UI" flag associated with downloaded files and will not show any UI. Files that are unknown and potentially dangerous will be allowed to run because SmartScreen will not prompt the user for a decision, and if the user is offline all files will be allowed to be opened because Windows won't prompt the user to ask what to do. Firefox incorrectly sets this flag when downloading files, leading to less secure behavior from SmartScreen. Note: this issue only affects Windows 10 users running the April 2018 update or later. It does not affect other Windows users or other operating systems. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8.


Remediation:
unfiltered db password in engine-backup log
CVE: CVE-2018-1072
Component: ovirt-engine-setup
CWE: CWE-532
Severity: Low
CVSS v3: 5.1/CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Release date: 2018-06-26T00:00:00+00:00

A flaw was found in ovirt-engine. When engine-backup was run with one of the options "--provision*db", the database username and password were logged in cleartext. Sharing the provisioning log might inadvertently leak database passwords.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/2974891
Use-after-free in the error function
CVE: CVE-2018-20623
Component: binutils
CWE: CWE-416
Severity: Moderate
CVSS v3: 5.4/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2018-12-31T00:00:00+00:00

In GNU Binutils 2.31.1, there is a use-after-free in the error function in elfcomm.c when called from the process_archive function in readelf.c via a crafted ELF file.

Statement: This issue did not affect the versions of binutils as shipped with Red Hat Enterprise Linux 5, 6, and 7 as they did not include the vulnerable code, which was introduced in a newer version of the package.

Remediation:
Integer overflow in multiply_ms in tools/ppm2tiff.c
CVE: CVE-2018-17100
Component: libtiff
CWE: CWE-119
Severity: Low
CVSS v3: 4.6/CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2018-09-16T00:00:00+00:00

An issue was discovered in LibTIFF 4.0.9. There is a int32 overflow in multiply_ms in tools/ppm2tiff.c, which can cause a denial of service (crash) or possibly have unspecified other impact via a crafted image file.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running applications linked against libtiff must be restarted for this update to take effect.
NULL pointer dereference in hfs_ext_read_extent in hfs.ko
CVE: CVE-2018-12928
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 5.1/CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Release date: 2018-04-12T00:00:00+00:00

A flaw was found in the Linux kernel, a NULL pointer dereference can happen in hfs_ext_read_extent in hfs.ko which can occur during a mount of a crafted hfs filesystem. This can lead to a system crash and a denial of service.


Remediation: