huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
out-of-bounds write in UAS (USB Attached SCSI) device emulation
CVE: CVE-2021-3713
Component: QEMU
CWE: CWE-787
Severity: Low
CVSS v3: 7.7/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Release date: 2021-08-17T00:00:00+00:00

An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.

Statement: This flaw does not affect the versions of `qemu-kvm` as shipped with Red Hat products because the UAS device is not enabled.

Remediation:
can: peak_pci: peak_pci_remove(): fix UAF
CVE: CVE-2021-47456
Component: kernel
CWE: CWE-416
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

can: peak_pci: peak_pci_remove(): fix UAF

When remove the module peek_pci, referencing 'chan' again after
releasing 'dev' will cause UAF.

Fix this by releasing 'dev' later.

The following log reveals it:

[   35.961814 ] BUG: KASAN: use-after-free in peak_pci_remove+0x16f/0x270 [peak_pci]
[   35.963414 ] Read of size 8 at addr ffff888136998ee8 by task modprobe/5537
[   35.965513 ] Call Trace:
[   35.965718 ]  dump_stack_lvl+0xa8/0xd1
[   35.966028 ]  print_address_description+0x87/0x3b0
[   35.966420 ]  kasan_report+0x172/0x1c0
[   35.966725 ]  ? peak_pci_remove+0x16f/0x270 [peak_pci]
[   35.967137 ]  ? trace_irq_enable_rcuidle+0x10/0x170
[   35.967529 ]  ? peak_pci_remove+0x16f/0x270 [peak_pci]
[   35.967945 ]  __asan_report_load8_noabort+0x14/0x20
[   35.968346 ]  peak_pci_remove+0x16f/0x270 [peak_pci]
[   35.968752 ]  pci_device_remove+0xa9/0x250


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Gerbv RS-274X format aperture macro variables out-of-bounds write vulnerability
CVE: CVE-2021-40393
Component: gerbv
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2021-12-22T00:00:00+00:00

An out-of-bounds write vulnerability exists in the RS-274X aperture macro variables handling functionality of Gerbv 2.7.0 and dev (commit b5f1eacd) and the forked version of Gerbv (commit 71493260). A specially-crafted gerber file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
ARM: 9064/1: hw_breakpoint: Do not directly check the event&#39;s overflow_handler hook
CVE: CVE-2021-47006
Component: kernel
CWE: CWE-253
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ARM: 9064/1: hw_breakpoint: Do not directly check the event's overflow_handler hook

The commit 1879445dfa7b ("perf/core: Set event's default
::overflow_handler()") set a default event->overflow_handler in
perf_event_alloc(), and replace the check event->overflow_handler with
is_default_overflow_handler(), but one is missing.

Currently, the bp->overflow_handler can not be NULL. As a result,
enable_single_step() is always not invoked.

Comments from Zhen Lei:

 https://patchwork.kernel.org/project/linux-arm-kernel/patch/20210207105934.2001-1-thunder.leizhen@huawei.com/


Remediation:
memory leak if multiple filters are executed and the last one is skipped due to a pcre error
CVE: CVE-2021-20212
Component: privoxy
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

Memory leak if multiple filters are executed and the last one is skipped due to a pcre error leading to a system crash.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
azure compute profile credential leak to authenticated users
CVE: CVE-2021-3590
Component: foreman
CWE: CWE-200
Severity: Low
CVSS v3: 9.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2021-06-08T05:25:00+00:00

A flaw was found in Foreman project. A credential leak was identified which will expose Azure Compute Profile password through JSON of the API output. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: Red Hat Satellite is vulnerable to the compute profile credential leak for Azure. Red Hat Product Security has rated this flaw as having a security impact of Low. Please refer to https://access.redhat.com/security/updates/classification for clarification on the scoring.

Remediation:
Out-of-bounds read in Exiv2::WebPImage::doWriteMetadata
CVE: CVE-2021-29463
Component: exiv2
CWE: CWE-125
Severity: Low
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2021-05-01T00:00:00+00:00

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.3 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as `insert`. The bug is fixed in version v0.27.4.


Remediation:
net/nfc/rawsock.c: fix a permission check bug
CVE: CVE-2021-47285
Component: kernel
CWE: CWE-99
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

[REJECTED CVE] In the Linux kernel, the following vulnerability has been resolved:

net/nfc/rawsock.c: fix a permission check bug

The Linux kernel CVE team has assigned CVE-2021-47285 to this issue.

Statement: This CVE has been rejected at upstream: https://lore.kernel.org/linux-cve-announce/2024070211-REJECTED-b953@gregkh/

Remediation:
Infinite loop via the paste_tokens function
CVE: CVE-2021-45257
Component: nasm
CWE: CWE-835
Severity: Low
CVSS v3: 3.2/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2021-12-22T00:00:00+00:00

An infinite loop flaw was found in nasm's preproc.c via paste_tokens() function. An attacker with local network access could pass a specially crafted unknown input causing an application to halt or crash leading to a denial of service.

Statement: This issue does not affect the versions of NASM shipped with Red Hat Enterprise Linux 6 and 7, as they do not include the vulnerable code in their source code.
The version of NASM shipped with Red Hat Enterprise Linux 8 is marked as won't fix because it is low priority flaw and real (non-malicious) assembler source code will never run into this problem.

Remediation:
information disclosure vulnerability
CVE: CVE-2021-32690
Component: helm
CWE: CWE-200
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Release date: 2021-06-16T00:00:00+00:00

A vulnerability was discovered in Helm, which could allow credentials associated with one Helm repository to be leaked to another repository referenced by the first one.  In order to exploit this vulnerability, an attacker would need to control a repository trusted by the configuration of the target Helm instance.

Statement: Red Hat Advanced Cluster Management for Kubernetes:

In Red Hat Advanced Cluster Management for Kubernetes (RHACM) the affected components are using helm chart provided by the installer, so components are not using untrusted charts except in the application-lifecycle area. For this reason we marked the impact as low. For RHACM, the credentials could be leaked only when a helm chart is stored in a domain other than the helm repository itself. In practice, this rarely happens as the chart is stored in the same helm repository. For example, this chart in the helm repo https://charts.helm.sh/stable/index.yaml references only charts stored in the same domain (charts.heml.sh). From version, 2.2 onwards, multicloud-operators-placementrule and multicloud-operators-deployable do not use helm at all.

OpenShift Developer Tools and Services:

The OpenShift Helm team has analyzed this CVE and we have come to the conclusion that this only affects OpenShift Helm customers that use the CLI to install and update charts. It does not affect customers that use the OpenShift Console to install and update charts. To mitigate this issue, customers can refresh their Helm cli by following the Red Had official Helm install guide here: https://docs.openshift.com/container-platform/4.7/cli_reference/helm_cli/getting-started-with-helm-on-openshift-container-platform.html#installing-helm_getting-started-with-helm-on-openshift. The mirror (https://mirror.openshift.com/pub/openshift-v4/clients/helm/latest/) have already been updated with helm 3.6.2 which contains the fix for this CVE.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.3/html-single/install/index#installing
To take advantage of these new features, fixes and changes, please upgrade Red Hat Advanced Cluster Security for Kubernetes to version 3.67.
For OpenShift Container Platform 4.9 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.9/updating/updating-cluster-cli.html
To start using Web Terminal, install the Web Terminal Operator from OpenShift OperatorHub on OpenShift Container Platform 4.5.3 or higher.
parisc: Clear stale IIR value on instruction access rights trap
CVE: CVE-2021-46928
Component: kernel
CWE: CWE-274
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

parisc: Clear stale IIR value on instruction access rights trap

When a trap 7 (Instruction access rights) occurs, this means the CPU
couldn't execute an instruction due to missing execute permissions on
the memory region.  In this case it seems the CPU didn't even fetched
the instruction from memory and thus did not store it in the cr19 (IIR)
register before calling the trap handler. So, the trap handler will find
some random old stale value in cr19.

This patch simply overwrites the stale IIR value with a constant magic
"bad food" value (0xbaadf00d), in the hope people don't start to try to
understand the various random IIR values in trap 7 dumps.


Remediation:
Heap buffer overflow in audio
CVE: CVE-2021-21116
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2021-01-06T00:00:00+00:00

Heap buffer overflow in audio in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Internal network hosts could have been probed by a malicious webpage
CVE: CVE-2021-23982
Component: Mozilla
CWE: CWE-200
Severity: Moderate
CVSS v3: 6.0/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2021-03-23T00:00:00+00:00

Using techniques that built on the slipstream research, a malicious webpage could have scanned both an internal network's hosts as well as services running on the user's local machine utilizing WebRTC connections. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
Certificate with CA:FALSE is accepted as valid CA cert
CVE: CVE-2021-3601
Component: openssl
CWE: CWE-295
Severity: Low
CVSS v3: 3.8/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
Release date: 2021-06-15T00:00:00+00:00

A flaw was found in the way OpenSSL will accept a certificate with explicitly set Basic Constraints to CA:FALSE as a valid CA if it is present in the trusted bundle. This flaw allows an attacker with access to a private key, of which the corresponding certificate is in the trust bundle, to use this flaw for MITM to any connection from the victim machine.

Statement: It was found that OpenSSL will accept a certificate with explicitly set Basic Constraints to CA:FALSE as a valid CA if it is present in the trusted bundle. The exploitability of this bug is limited; the attacker needs to get access to a private key of which the corresponding certificate is in the trust bundle. The attacker is able to leverage this certificate to MITM any connection from the victim machine, not just ones to the specific server that uses the self-signed certificate.

Remediation:
Red Hat recommends not to include self-signed server certificates in system trust bundle, even with CA:FALSE, as they are considered full-fledged Certificate Authorities.
use of mod_proxy65 is unrestricted in default configuration
CVE: CVE-2021-32917
Component: prosody
CVSS v3: 3.6/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2021-05-12T00:00:00+00:00

An issue was discovered in Prosody before 0.11.9. The proxy65 component allows open access by default, even if neither of the users has an XMPP account on the local server, allowing unrestricted use of the server's bandwidth.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
memory leaks in LazyPRM.cpp
CVE: CVE-2021-41490
Component: ompl
CVSS v3: 5.6/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2021-01-01T00:00:00+00:00

Memory leaks in LazyPRM.cpp of OMPL v1.5.0 can cause unexpected behavior.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Stored XSS via device name
CVE: CVE-2021-46355
Component: ocsinventory
CVSS v3: 6.5/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L
Release date: 2021-01-01T00:00:00+00:00

OCS Inventory 2.9.1 is affected by Cross Site Scripting (XSS). To exploit the vulnerability, the attacker needs to manipulate the name of some device on your computer, such as a printer, replacing the device name with some malicious code that allows the execution of Stored Cross-site Scripting (XSS).

Statement: No supported Red Hat products are affected by this flaw.

Remediation:
C API unspecified vulnerability (CPU Jan 2021)
CVE: CVE-2021-2010
Component: mysql
Severity: Moderate
CVSS v3: 4.3/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Release date: 2021-01-19T00:00:00+00:00

Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.50 and prior, 5.7.32 and prior and 8.0.22 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Client accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Client. CVSS 3.1 Base Score 4.2 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
ocfs2: fix data corruption by fallocate
CVE: CVE-2021-47114
Component: kernel
CWE: CWE-20
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: fix data corruption by fallocate

When fallocate punches holes out of inode size, if original isize is in
the middle of last cluster, then the part from isize to the end of the
cluster will be zeroed with buffer write, at that time isize is not yet
updated to match the new size, if writeback is kicked in, it will invoke
ocfs2_writepage()->block_write_full_page() where the pages out of inode
size will be dropped.  That will cause file corruption.  Fix this by
zero out eof blocks when extending the inode size.

Running the following command with qemu-image 4.2.1 can get a corrupted
coverted image file easily.

    qemu-img convert -p -t none -T none -f qcow2 $qcow_image \
             -O qcow2 -o compat=1.1 $qcow_image.conv

The usage of fallocate in qemu is like this, it first punches holes out
of inode size, then extend the inode size.

    fallocate(11, FALLOC_FL_KEEP_SIZE|FALLOC_FL_PUNCH_HOLE, 2276196352, 65536) = 0
    fallocate(11, 0, 2276196352, 65536) = 0

v1: https://www.spinics.net/lists/linux-fsdevel/msg193999.html
v2: https://lore.kernel.org/linux-fsdevel/20210525093034.GB4112@quack2.suse.cz/T/


Remediation:
Server: DML unspecified vulnerability (CPU Jul 2021)
CVE: CVE-2021-2440
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-07-20T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
unsafe permissions on sensitive files in /etc/cobbler
CVE: CVE-2021-45083
Component: cobbler
CWE: CWE-276
Severity: Moderate
CVSS v3: 7.2/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Release date: 2021-01-01T00:00:00+00:00

A flaw was found in cobbler. The vulnerability occurs due to unsafe permissions on sensitive files in /etc/cobbler and leads to cleartext transmission. This flaw allows an attacker to interact and read sensitive configuration files.


Remediation:
CVE: CVE-2021-34969
Component: Foxit PDF Reader Annotation Use-After-Free Information Disclosure Vulnerability
Release date: 2021-10-15T12:36:07.621000+00:00

Foxit PDF Reader Annotation Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-14622.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation: