huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
buffer overflow in function H5O__layout_encode in H5Olayout.c
CVE: CVE-2019-8396
Component: hdf5
CWE: CWE-120
Severity: Moderate
CVSS v3: 5.4/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2019-01-27T00:00:00+00:00

A buffer overflow in H5O__layout_encode in H5Olayout.c in the HDF HDF5 through 1.10.4 library allows attackers to cause a denial of service via a crafted HDF5 file. This issue was triggered while repacking an HDF5 file, aka "Invalid write of size 2."


Remediation:
out-of-bounds read in function MediaInfoLib::File__Tags_Helper::Synched_Test in Tag/File__Tags.cpp
CVE: CVE-2019-11372
Component: mediainfo
CVSS v3: 6.1/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2019-04-11T00:00:00+00:00

An out-of-bounds read in MediaInfoLib::File__Tags_Helper::Synched_Test in Tag/File__Tags.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 leads to a crash.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
reflected XSS in authentication flow
CVE: CVE-2019-3889
Component: atomic-openshift
CWE: CWE-79
Severity: Moderate
CVSS v3: 4.7/CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
Release date: 2019-07-08T00:00:00+00:00

A reflected XSS vulnerability exists in the authentication flow of the OpenShift Container Platform. An attacker could use this flaw to steal authentication data by having users click a malicious link.

Statement: Since the HTTP Response "Content Type" is "text/plain" most browsers won't execute any Javascipt in the response content. However if an attacker can trick a user into loading the response in an iFrame it is possible to exploit this vulnerability. Appropriate Cross Origin Resource (CORS) Allowed Domain configuration in OCP 3 should prevent an attacker from getting any response from a attacker hosted domain. Therefore make sure that corsAllowedDomains is specified correctly in your OCP 3 master-config.yaml. See [1] for more details on an issue with corsAllowedDomains in OCP 3.

[1] https://bugzilla.redhat.com/show_bug.cgi?id=1694913

Also content sniffing browsers [2] do execute Javascript even when the "Content Type" HTTP Response header is set to "text/plain".

[2] https://en.wikipedia.org/wiki/Content_sniffing

Remediation:
Before applying this update, ensure all previously released errata relevant
to your system is applied.

See the following documentation, which will be updated shortly for release
3.11.188, for important instructions on how to upgrade your cluster and fully
apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258.
For OpenShift Container Platform 4.1 see the following documentation, which
will be updated shortly for release 4.1.22, for important instructions on
how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/4.1/release_notes/ocp-4-1-release-notes.html
For OpenShift Container Platform 4.2 see the following documentation, which
will be updated shortly for release 4.2.4, for important instructions on
how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/4.2/release_notes/ocp-4-2-release-notes.html
Server: Information Schema unspecified vulnerability (CPU Apr 2019)
CVE: CVE-2019-2631
Component: mysql
Severity: Moderate
CVSS v3: 5.9/CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2019-04-16T00:00:00+00:00

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Information Schema). Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
stack consumption in function md5Round1() in Decrypt.cc
CVE: CVE-2019-9587
Component: xpdf
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2019-03-01T00:00:00+00:00

There is a stack consumption issue in md5Round1() located in Decrypt.cc in Xpdf 4.01. It can be triggered by sending a crafted pdf file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to Catalog::countPageTree.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Open redirect in upload cohorts page
CVE: CVE-2019-10133
Component: moodle
CVSS v3: 3.0/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Release date: 2019-05-20T00:00:00+00:00

A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The form to upload cohorts contained a redirect field, which was not restricted to internal URLs.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Several CVEs fixed in nextcloud 15, 16 and 17
CVE: CVE-2019-15624
Component: nextcloud
Release date: 2019-01-01T00:00:00+00:00

Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Uninitialized value in media reader
CVE: CVE-2019-5818
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2019-04-23T00:00:00+00:00

Uninitialized data in media in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
DokuWiki: Information disclosure through username enumeration in password reset
CVE: CVE-2019-25338
Component: dokuwiki
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2019-01-01T00:00:00+00:00

A flaw was found in DokuWiki. This vulnerability, identified as a username enumeration, resides in the password reset functionality. A remote attacker can exploit this by submitting various usernames to the password reset endpoint. By observing the server's differing error responses, the attacker can determine which usernames correspond to valid user accounts, leading to information disclosure.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
heap-based buffer overflow in function fmt_mtm_load_song in fmt/mtm.c in
CVE: CVE-2019-14465
Component: schismtracker
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2019-07-31T00:00:00+00:00

fmt_mtm_load_song in fmt/mtm.c in Schism Tracker 20190722 has a heap-based buffer overflow.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
buffer overflow in ConnectClientToUnixSock()
CVE: CVE-2019-20839
Component: libvncserver
CWE: CWE-120
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2019-01-01T00:00:00+00:00

libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.

Statement: This is only an issue if the "ConnectClientToUnixSock()" function is used directly with an overly long socket name. It's more common that the "ConnectToRFBServer()" function is used, which would prevent exploiting this flaw as it performs additional checks. Additionally, the buffer overflow is caught by compiled-in buffer overflow checks, limiting the impact to a crash.

Remediation:
Server: Optimizer unspecified vulnerability (CPU Jul 2019)
CVE: CVE-2019-2774
Component: mysql
Severity: Moderate
CVSS v3: 5.9/CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2019-07-16T00:00:00+00:00

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
information disclosure in mistral log
CVE: CVE-2019-3866
Component: openstack-mistral
CWE: CWE-732
Severity: Moderate
CVSS v3: 5.8/CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Release date: 2019-11-07T00:00:00+00:00

An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-text information were made world readable.  A malicious system user could exploit this flaw to access sensitive user information.

Statement: In Red Hat OpenStack Platform 10/13, because the flaw has a lower impact and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP10/13 openstack-mistral package.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Plain text information can be masked by ensuring that all mistral log files are not world readable.
null pointer dereference in function be_uint32_read() in endianrw.h
CVE: CVE-2019-8379
Component: advancecomp
CWE: CWE-476
Severity: Low
CVSS v3: 2.9/CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Release date: 2019-02-16T00:00:00+00:00

An issue was discovered in AdvanceCOMP through 2.1. A NULL pointer dereference exists in the function be_uint32_read() located in endianrw.h. It can be triggered by sending a crafted file to a binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact when a victim opens a specially crafted file.

Statement: This issue affects the versions of advancecomp as shipped with Red Hat Enterprise Linux 7. Red Hat Product Security has rated this issue as having a security impact of Low. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
Multiple memory corruption issues leading to arbitrary code execution
CVE: CVE-2019-8683
Component: webkitgtk
Severity: Moderate
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2019-08-29T00:00:00+00:00

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c
CVE: CVE-2019-7576
Component: SDL
CWE: CWE-122
Severity: Low
CVSS v3: 5.0/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Release date: 2019-02-05T00:00:00+00:00

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (outside the wNumCoef loop).


Remediation:
an untrusted domain with access to a physical device can DMA into host memory, leading to privilege escalation
CVE: CVE-2019-19579
Component: xen
CWE: CWE-266
Severity: Moderate
CVSS v3: 6.7/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Release date: 2019-12-06T00:00:00+00:00

An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where an untrusted domain has access to a physical device (and assignable-add is not used), because of an incomplete fix for CVE-2019-18424. XSA-302 relies on the use of libxl's "assignable-add" feature to prepare devices to be assigned to untrusted guests. Unfortunately, this is not considered a strictly required step for device assignment. The PCI passthrough documentation on the wiki describes alternate ways of preparing devices for assignment, and libvirt uses its own ways as well. Hosts where these "alternate" methods are used will still leave the system in a vulnerable state after the device comes back from a guest. An untrusted domain with access to a physical device can DMA into host memory, leading to privilege escalation. Only systems where guests are given direct access to physical devices capable of DMA (PCI pass-through) are vulnerable. Systems which do not use PCI pass-through are not vulnerable.


Remediation:
heap out-of-bound read in function rtreenode()
CVE: CVE-2019-8457
Component: sqlite
CWE: CWE-125
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2019-03-20T00:00:00+00:00

SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables.


Remediation:
memory leaks in *clock_source_create() functions under drivers/gpu/drm/amd/display/dc leads to DoS
CVE: CVE-2019-19083
Component: kernel
CWE: CWE-400
Severity: Low
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2019-09-17T00:00:00+00:00

A memory leak flaw was found in the Linux kernel. A system crash occurs under very specific, hard to obtain conditions, when the AMD GPU Display Engine configuration initialization handles resource cleaning when a failure occurs. The highest threat from this vulnerability is system availability.

Statement: This issue is rated as having a Low impact because of the preconditions needed to trigger the resource cleanup code path (system-wide out-of-memory condition).

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Cross-site scripting vulnerability permits perform destructive actions on behalf of other Kibana users
CVE: CVE-2019-7608
Component: kibana
CWE: CWE-79
Severity: Moderate
CVSS v3: 6.1/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N
Release date: 2019-01-01T00:00:00+00:00

Kibana versions before 5.6.15 and 6.6.1 had a cross-site scripting (XSS) vulnerability that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.


Remediation:
Before applying this update, ensure all previously released errata
relevant to your system have been applied.

For OpenShift Container Platform 3.11 see the following documentation,
which will be updated shortly for release 3.11.146, for important
instructions on how to upgrade your cluster and fully apply this
asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258.
For OpenShift Container Platform 4.1 see the following documentation, which
will be updated shortly for release 4.1.18, for important instructions on
how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/4.1/release_notes/ocp-4-1-release-notes.html
mod_proxy_wstunnel tunneling of non Upgraded connection
CVE: CVE-2019-17567
Component: httpd
CWE: CWE-287
Severity: Moderate
CVSS v3: 4.7/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Release date: 2019-01-01T00:00:00+00:00

A flaw was found in Apache httpd. The mod_proxy_wstunnel module tunnels non-upgraded connections.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link for the update. You must be logged in to download the update.
Only configurations which use mod_proxy_wstunnel  are affected by this flaw. It is also safe to comment-out the "LoadModule proxy_wstunnel_module ... " line in /etc/httpd/conf.modules.d/00-proxy.conf for configurations which do not rely on a websockets reverse proxy.
stack-based buffer over-read in do_bid_note in readelf.c
CVE: CVE-2019-8904
Component: file
CWE: CWE-125
Severity: Low
CVSS v3: 5.3/CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Release date: 2019-02-18T00:00:00+00:00

do_bid_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file_printf and file_vprintf.


Remediation:
null pointer dereference in drivers/scsi/qla2xxx/qla_os.c
CVE: CVE-2019-16233
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 4.4/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2019-09-09T00:00:00+00:00

A flaw was found in the Linux kernel. A NULL pointer dereference flaw was found in the QLOGIC drivers for HBA. A call to alloc_workqueue return was not validated and can cause a denial of service. The highest threat from this vulnerability is to system availability.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from the References section.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from the References section.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Heap buffer overflow in WebGL
CVE: CVE-2019-5770
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2019-01-29T00:00:00+00:00

Insufficient input validation in WebGL in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Stack-based buffer overflow via setting a password
CVE: CVE-2019-10164
Component: postgresql
CWE: CWE-121
Severity: Moderate
CVSS v3: 7.7/CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2019-06-20T00:00:00+00:00

PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any authenticated user can overflow a stack-based buffer by changing the user's own password to a purpose-crafted value. This often suffices to execute arbitrary code as the PostgreSQL operating system account.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

If the postgresql service is running, it will be automatically restarted after installing this update.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

If the postgresql service is running, it will be automatically restarted after installing this update.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

If the postgresql service is running, it will be automatically restarted after installing this update.
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

If the postgresql service is running, it will be automatically restarted after installing this update.