huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
vhost_net: infinite loop while receiving packets leads to DoS
CVE: CVE-2019-3900
Component: Kernel
CWE: CWE-835
Severity: Important
CVSS v3: 6.1/CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H
Release date: 2019-04-25T00:00:00+00:00

An infinite loop issue was found in the vhost_net kernel module while handling incoming packets in handle_rx(). The infinite loop could occur if one end sends packets faster than the other end can process them. A guest user, maybe a remote one, could use this flaw to stall the vhost_net kernel thread, resulting in a DoS scenario.

Statement: This issue does not affect the versions of the kernel package as shipped with Red Hat Enterprise Linux 5 and Red Hat Enterprise MRG 2.

This issue affects the version of Linux kernel as shipped with Red Hat Enterprise Linux 6 and 7. Future kernel updates for Red Hat Enterprise Linux 6 and 7 may address this issue.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Use-after-free in crash generation server
CVE: CVE-2019-9818
Component: Mozilla
CWE: CWE-416
Severity: Important
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2019-05-22T00:00:00+00:00

A race condition is present in the crash generation server used to generate data for the crash reporter. This issue can lead to a use-after-free in the main process, resulting in a potentially exploitable crash and a sandbox escape. *Note: this vulnerability only affects Windows. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.


Remediation:
out-of-bounds read in DIS optflow algorithm when dealing with small images
CVE: CVE-2019-19624
Component: opencv
CWE: CWE-617
Severity: Low
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2019-05-14T00:00:00+00:00

An out-of-bounds read vulnerability was discovered in OpenCV. This flaw can be exploited when a small, carefully crafted image is loaded by an application linked to OpenCV. A remote attacker could exploit this flaw, causing a denial of service by causing the application to crash or read sensitive information from memory.

Statement: This issue did not affect the versions of OpenCV as shipped with Red Hat Enterprise Linux 6, and 7 as they did not include support for DIS optflow algorithm.
This issue affects OpenCV as shipped with Red Hat Enterprise Linux 8. However, the package has been built with C++ standard library hardening (_GLIBCXX_ASSERTIONS) that enables range checks for C++ arrays, vectors, and strings. This leads to an application exit due to an assertion statement and prevents the out-of-bounds read to be exploitable.

Remediation:
fixed path in the Helper::getPartitionSizeInfo() function allows symlink attack
CVE: CVE-2019-13229
Component: deepin-clone
CVSS v3: 5.6/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Release date: 2019-07-16T00:00:00+00:00

deepin-clone before 1.1.3 uses a fixed path /tmp/partclone.log in the Helper::getPartitionSizeInfo() function to write a log file as root, and follows symlinks there. An unprivileged user can prepare a symlink attack there to create or overwrite files in arbitrary file system locations. The content is not attacker controlled.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
QMF methods exposed to goferd via qdrouterd
CVE: CVE-2019-3845
Component: katello-installer-base
CWE: CWE-284
Severity: Important
CVSS v3: 8.1/CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2019-04-09T13:27:00+00:00

A lack of access control was found in the message queues maintained by Satellite's QPID broker and used by katello-agent. A malicious user authenticated to a host registered to Satellite (or Capsule) can use this flaw to access QMF methods to any host also registered to Satellite (or Capsule) and execute privileged commands.

Statement: On Red Hat Satellite 6.5, the Satellite 6.5 GA release includes a version of katello-installer-base that provides the fixes for this issue.

Remediation:
Before applying this update, make sure all previously released errata relevant
to your system have been applied.

For detailed instructions how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.2/html/installation_guide/updating_satellite_server_capsule_server_and_content_hosts#updating_satellite_server_to_next_minor_version
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For detailed instructions how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.3/html/upgrading_and_updating_red_hat_satellite/updating_satellite_server_capsule_server_and_content_hosts#updating_satellite_server_to_next_minor_version
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For detailed instructions how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.4/html/upgrading_and_updating_red_hat_satellite/updating_satellite_server_capsule_server_and_content_hosts#updating_satellite_server_to_next_minor_version
On Satellite Server follow the instructions below:

* Modify /etc/qpid/qpidd.conf to add this line:

acl-file=qpid_acls.acl


* Create a new file: /var/lib/qpidd/.qpidd/qpid_acls.acl with content:

acl allow katello_agent@QPID create queue
acl allow katello_agent@QPID consume queue
acl allow katello_agent@QPID access exchange
acl allow katello_agent@QPID access queue
acl allow katello_agent@QPID publish exchange routingkey=pulp.task
acl allow katello_agent@QPID publish exchange name=qmf.default.direct
acl allow katello_agent@QPID access method name=create

acl deny-log katello_agent@QPID access method name=*
acl deny-log katello_agent@QPID all all

# allow anything else
acl allow all all


* As root, execute the command:
# systemctl restart qpidd


* In /etc/qpid-dispatch/qdrouterd.conf modify the connector:

connector {
	name: broker
	host: localhost
	port: 5671
	sasl-mechanisms: PLAIN
	sasl-username: katello_agent
	sasl-password: katello_agent
	role: route-container
	ssl-profile: client
	idle-timeout-seconds: 0
}


* As root, execute the command:
# systemctl restart qdrouterd


These ACLs will prevent clients to redirect or move messages to various queues which is the nature of the CVE.
All other behavior will be unchanged (acl allow all all) which is the current baseline.
Server: Optimizer unspecified vulnerability (CPU Jul 2019)
CVE: CVE-2019-2757
Component: mysql
Severity: Moderate
CVSS v3: 5.9/CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2019-07-16T00:00:00+00:00

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
out-of-bounds read in handle_keywordonly_args() function
CVE: CVE-2019-19274
Component: python3-typed_ast
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2019-11-26T00:00:00+00:00

typed_ast 1.3.0 and 1.3.1 has a handle_keywordonly_args out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that parses (but does not execute) Python code. (This issue also affected certain Python 3.8.0-alpha prereleases.)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
User gesture needed for printing
CVE: CVE-2019-13679
Component: chromium-browser
Severity: Low
CVSS v3: 4.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2019-09-10T00:00:00+00:00

Insufficient policy enforcement in PDFium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to show print dialogs via a crafted PDF file.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
remotely triggerable buffer overflow in string_vformat()
CVE: CVE-2019-16928
Component: exim
CWE: CWE-131
Severity: Critical
CVSS v3: 9.8/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2019-09-27T00:00:00+00:00

A heap-based buffer overflow flaw was found in Exim. The overflow can be triggered via specially crafted SMTP-protocol EHLO message, which may lead to unauthenticated remote code execution. It is thought that the execution of the remote code would be at the exim user level although execution as the root user cannot be ruled out.

Statement: This issue did not affect Red Hat Enterprise Linux 5 as the exim package did not contain the vulnerable code in any of our supported products.

Remediation:
Diagnostic web page exposed Cookie HTTP header
CVE: CVE-2019-10405
Component: jenkins
CWE: CWE-200
Severity: Moderate
CVSS v3: 4.2/CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Release date: 2019-09-25T00:00:00+00:00

Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly.


Remediation:
Before applying this update, ensure all previously released errata relevant
to your system is applied.

See the following documentation, which will be updated shortly for release
3.11.161, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258.
Before applying this update, ensure all previously released errata
relevant to your system have been applied.
scsi: lsi: potential infinite loop when executing script in lsi_execute_script
CVE: CVE-2019-12068
Component: qemu
CWE: CWE-835
Severity: Low
CVSS v3: 4.3/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Release date: 2019-08-14T00:00:00+00:00

A flaw was found in QEMU's LSI53C895A device emulator. When executing LSI scripts, a crafted sequence of I/O requests may cause the emulator to enter into an infinite loop. This vulnerability could be executed locally and would affect the availability of the system.

Statement: The qemu-kvm package versions as shipped with Red Hat Enterprise Linux 6, 7, and 8 are not affected by this issue, as the device, LSI53C895A, is not included in these versions.

Remediation:
denial of service in ftp_pasv_response
CVE: CVE-2019-10055
Component: suricata
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2019-08-28T00:00:00+00:00

An issue was discovered in Suricata 4.1.3. The function ftp_pasv_response lacks a check for the length of part1 and part2, leading to a crash within the ftp/mod.rs file.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
integer overflow in getElfSections function in p_vmlinx.cpp
CVE: CVE-2019-14295
Component: upx
CVSS v3: 3.9/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2019-07-19T00:00:00+00:00

An Integer overflow in the getElfSections function in p_vmlinx.cpp in UPX 3.95 allows remote attackers to cause a denial of service (crash) via a skewed offset larger than the size of the PE section in a UPX packed executable, which triggers an allocation of excessive memory.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Insecure randomness when using a secureRandom instance constructed by Spring Security
CVE: CVE-2019-3795
Component: spring-security-core
CWE: CWE-330
Severity: Low
CVSS v3: 3.4/CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Release date: 2019-04-02T00:00:00+00:00

Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBean#setSeed to configure a SecureRandom instance. In order to be impacted, an honest application must provide a seed and make the resulting random material available to an attacker for inspection.

Statement: Red Hat OpenStack Platform's OpenDaylight versions 9 and 10 contain the vulnerable code. However, these OpenDaylight versions were released as technical preview with limited support and will therefore not be updated. Other OpenDaylight versions do not contain the vulnerable library.

Remediation:
integer overflow in the regional allocator via regional_alloc
CVE: CVE-2019-25032
Component: unbound
CWE: CWE-190
Severity: Moderate
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2019-12-11T00:00:00+00:00

A flaw was found in unbound. An integer overflow in regional_alloc function may lead to a buffer overflow of the allocated buffer if the size can be controlled by an attacker and can be big enough. The highest threat from this vulnerability is to data confidentiality and integrity as well as service availability.

Statement: There is no available reproducer or proof of concept for this issue, nor it was ever proven the buffer overflow can happen in practice. Indeed in the original report this issue was considered one that might not be triggered and for this reason its Impact is Moderate. Upstream has also disputed this CVE.

Remediation:
Out of bounds read in vp8_norm table
CVE: CVE-2019-9232
Component: libvpx
CWE: CWE-125
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2019-10-26T00:00:00+00:00

In libvpx, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-122675483


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, all applications using libvpx must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, all applications using libvpx must be restarted for the changes to take effect.
memory leak in TIFFFdOpen function in tif_unix.c when using pal2rgb
CVE: CVE-2019-6128
Component: libtiff
CWE: CWE-244
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2019-01-04T00:00:00+00:00

The TIFFFdOpen function in tif_unix.c in LibTIFF 4.0.10 has a memory leak, as demonstrated by pal2rgb.

Statement: This vulnerability is rated as moderate because a memory leak in LibTIFF’s TIFFFdOpen function within tif_unix.c could lead to a denial of service, exploitation requires user interaction, as an attacker must persuade a victim to open a specially crafted file. While this does not lead to code execution, repeated exploitation could impact application availability.

Remediation:
This bug could be mitigated by configuring process memory limits using cgroups.
integer overflow in amqp_handle_input in amqp_connection.c leads to heap-based buffer overflow
CVE: CVE-2019-18609
Component: librabbitmq
CWE: CWE-122
Severity: Moderate
CVSS v3: 8.6/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Release date: 2019-12-01T00:00:00+00:00

An issue was discovered in amqp_handle_input in amqp_connection.c in rabbitmq-c 0.9.0. There is an integer overflow that leads to heap memory corruption in the handling of CONNECTION_STATE_HEADER. A rogue server could return a malicious frame header that leads to a smaller target_size value than needed. This condition is then carried on to a memcpy function that copies too much data into a heap buffer.


Remediation:
Processing maliciously crafted web content may lead to arbitrary code execution
CVE: CVE-2019-8835
Component: webkitgtk
CWE: CWE-119
Severity: Moderate
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2019-01-01T00:00:00+00:00

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 13.3, iCloud for Windows 10.9, iOS 13.3 and iPadOS 13.3, Safari 13.0.4, iTunes 12.10.3 for Windows, iCloud for Windows 7.16. Processing maliciously crafted web content may lead to arbitrary code execution.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

GDM must be restarted for this update to take effect.
Check length of inputs for cryptographic primitives
CVE: CVE-2019-17006
Component: nss
CWE: CWE-122
Severity: Moderate
CVSS v3: 8.1/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2019-12-26T00:00:00+00:00

A vulnerability was discovered in nss where input text length was not checked when using certain cryptographic primitives. This could lead to a heap-buffer overflow resulting in a crash and data leak. The highest threat is to confidentiality and integrity of data as well as system availability.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, applications using NSS or NSPR (for example, Firefox) must be restarted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, applications using NSS (for example, Firefox) must be restarted for this update to take effect.
Download and install a new CLI binary by following the instructions linked from the References section.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, applications using NSS (for example, Firefox) must be restarted for this update to take effect. After installing this update, applications using NSPR (for example, Firefox) must be restarted for this update to take effect.
handling of method names in method call expressions allowed attackers to execute arbitrary code in sandboxed scripts
CVE: CVE-2019-10393
Component: jenkins-script-security-plugin
CWE: CWE-94
Severity: Important
CVSS v3: 4.3/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Release date: 2019-09-12T00:00:00+00:00

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of method names in method call expressions allowed attackers to execute arbitrary code in sandboxed scripts.


Remediation:
See the following documentation, which will be updated shortly for release 3.11.157, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html
For OpenShift Container Platform 4.1 see the following documentation, which will be updated shortly for release 4.1.27, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.1/release_notes/ocp-4-1-release-notes.html

Details on how to access this content are available at https://docs.openshift.com/container-platform/4.1/updating/updating-cluster-cli.html.
For OpenShift Container Platform 4.2 see the following documentation, which will be updated shortly for release 4.2.10, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.2/release_notes/ocp-4-2-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.2/updating/updating-cluster-cli.html.