huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Expression Language injection via UserResource allows for unauthenticated remote code execution
CVE: CVE-2018-14667
Component: RichFaces
CWE: CWE-94
Severity: Critical
CVSS v3: 9.8/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2018-11-06T18:44:00+00:00

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.


Remediation:
Before applying this update, back up your existing JBoss Enterprise Application Platform installation (including all applications and configuration files) and make sure all previously-released errata relevant to your system have been applied.
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing Red Hat JBoss BRMS installation (including its databases,
applications, configuration files, and so on).

Note that it is recommended to halt the Red Hat JBoss BRMS server by
stopping the JBoss Application Server process before installing this
update, and then after installing the update, restart the Red Hat JBoss
BRMS server by starting the JBoss Application Server process.
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

The References section of this erratum contains a download link (you must log in to download the update).

The JBoss server process must be restarted for the update to take effect.
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing Red Hat JBoss SOA Platform installation (including its databases,
applications, configuration files, and so on).

Note that it is recommended to halt the Red Hat JBoss SOA Platform server
by stopping the JBoss Application Server process before installing this
update, and then after installing the update, restart the Red Hat JBoss SOA
Platform server by starting the JBoss Application Server process.
Directory traversal in RequestBuilder allows manipulation of resources
CVE: CVE-2018-1000850
Component: retrofit
CWE: CWE-22
Severity: Important
CVSS v3: 8.3/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Release date: 2018-10-21T00:00:00+00:00

A flaw was found in Retrofit, where it allowed directory traversal via its RequestBuilder class. An attacker could use this flaw to access information or commands outside of its set permissions.


Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

Installation instructions are available from the Fuse 7.5.0 product documentation page:
https://access.redhat.com/documentation/en-us/red_hat_fuse/7.5/
memory leak in epan/oids.c
CVE: CVE-2018-9270
Component: wireshark
CWE: CWE-400
Severity: Low
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2018-03-06T00:00:00+00:00

In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/oids.c has a memory leak.


Remediation:
CVE: CVE-2018-1000503
Component: CVE-2018-1000503
Release date: 2018-06-26T00:00:00+00:00

MyBB Group MyBB contains a Incorrect Access Control vulnerability in Private forums that can result in Users can view posts from private forums without having the password. This attack appear to be exploitable via Subscribe to a forum through IDOR. This vulnerability appears to have been fixed in 1.8.15.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2018-1000153
Component: CVE-2018-1000153
Release date: 2018-01-01T00:00:00+00:00

A cross-site request forgery vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java, ConvertToVm.java, Delete.java, DeleteSnapshot.java, Deploy.java, ExposeGuestInfo.java, FolderVSphereCloudProperty.java, PowerOff.java, PowerOn.java, Reconfigure.java, Rename.java, RenameSnapshot.java, RevertToSnapshot.java, SuspendVm.java, TakeSnapshot.java, VSphereBuildStepContainer.java, vSphereCloudProvisionedSlave.java, vSphereCloudSlave.java, vSphereCloudSlaveTemplate.java, VSphereConnectionConfig.java, vSphereStep.java that allows attackers to perform form validation related actions, including sending numerous requests to the configured vSphere server, potentially resulting in denial of service, or send credentials stored in Jenkins with known ID to an attacker-specified server ("test connection").

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Out of bounds read in Blink
CVE: CVE-2018-16066
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2018-09-04T00:00:00+00:00

A use after free in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
uncontrolled memory allocation in __zzip_parse_root_directory in zzip/zip.c
CVE: CVE-2018-6869
Component: zziplib
CWE: CWE-400
Severity: Low
CVSS v3: 4.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2018-02-08T00:00:00+00:00

An uncontrolled memory allocation was found in ZZIPlib that could lead to a crash in the __zzip_parse_root_directory function of zzip/zip.c if the package is compiled with Address Sanitizer. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.

Statement: Red Hat Product Security has rated this issue as having security impact of Low. This issue does not affect the versions of ZZIPlib as shipped in Red Hat Enterprise Linux 7, unless the package is recompiled with Address Sanitizer. The flaw is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
CVE: CVE-2018-1999016
Component: CVE-2018-1999016
Release date: 2018-01-01T00:00:00+00:00

Pydio version 8.2.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in ./core/vendor/meenie/javascript-packer/example-inline.php line 48; ./core/vendor/dapphp/securimage/examples/test.mysql.static.php lines: 114,118 that can result in an unauthenticated remote attacker manipulating the web client via XSS code injection. This attack appear to be exploitable via the victim openning a specially crafted URL. This vulnerability appears to have been fixed in version 8.2.1.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
XSS vulnerability in job configuration forms in Ant plugin (SECURITY-624, SECURITY-694)
CVE: CVE-2018-1000016
Component: jenkins-ant-plugin
CVSS v3: 3.9/CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Release date: 2018-01-22T00:00:00+00:00

No description is available for this CVE.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
NULL pointer dereference (DoS) vulnerability via POST request to /cimom
CVE: CVE-2018-6644
Component: sblim-sfcb
CWE: CWE-119
Severity: Moderate
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2018-02-06T00:00:00+00:00

A NULL pointer dereference flaw was found in the way sblim-sfcb handled processing of POST requests to the /cimom URI. A remote attacker could use this flaw to cause a sblim-sfcb child process to crash via a specially crafted HTTP POST request.

Statement: This issue did not affect the versions of sblim-sfcb as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Remediation:
Out of bounds read in remap_struct function in sa_common.c
CVE: CVE-2018-19517
Component: sysstat
CWE: CWE-119
Severity: Low
CVSS v3: 5.4/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2018-11-21T00:00:00+00:00

An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of-bounds read during a memset call, as demonstrated by sadf.

Statement: This issue did not affect the versions of sysstat as shipped with Red Hat Enterprise Linux 5, 6, and 7 as they did not include the vulnerable function, which was introduced in newer version of the package.

Remediation:
Integer underflow in when parsing MP4Atom in mp4atom.cpp
CVE: CVE-2018-14325
Component: libmp4v2
CVSS v3: 4.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2018-07-17T00:00:00+00:00

In MP4v2 2.0.0, there is an integer underflow (with resultant memory corruption) when parsing MP4Atom in mp4atom.cpp.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Segmentation fault in logging.c:lou_logPrint()
CVE: CVE-2018-11577
Component: liblouis
CWE: CWE-400
Severity: Low
CVSS v3: 4.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2018-05-30T00:00:00+00:00

Liblouis 3.5.0 has a Segmentation fault in lou_logPrint in logging.c.

Statement: Red Hat Product Security has rated this issue as having security impact of Low, and a future update may address this flaw.

Remediation:
DoS via non-preemptable L3/L4 pagetable freeing (XSA-252)
CVE: CVE-2018-7540
Component: xen
Severity: Moderate
CVSS v3: 5.2/CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Release date: 2018-02-27T00:00:00+00:00

An issue was discovered in Xen through 4.10.x allowing x86 PV guest OS users to cause a denial of service (host OS CPU hang) via non-preemptable L3/L4 pagetable freeing.


Remediation:
Moodle XML import of ddwtos could lead to intentional remote code execution (MSA-18-0017)
CVE: CVE-2018-14630
Component: moodle
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2018-09-17T00:00:00+00:00

moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution. When importing legacy 'drag and drop into text' (ddwtos) type quiz questions, it was possible to inject and execute PHP code from within the imported questions, either intentionally or by importing questions from an untrusted source.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
net: xen: Linux netback driver OOB access in hash handling (XSA-270)
CVE: CVE-2018-15471
Component: kernel
CWE: CWE-20
Severity: Important
CVSS v3: 7.4/CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Release date: 2018-08-14T17:00:00+00:00

A flaw in the netback module allowed frontends to control mapping of requests to request queues. An attacker can change this mapping by requesting invalid mapping requests allowing the (usually privileged) backend to access out-of-bounds memory access for reading and writing.


Remediation:
CVE: CVE-2018-1000104
Component: CVE-2018-1000104
Release date: 2018-01-01T00:00:00+00:00

A plaintext storage of a password vulnerability exists in Jenkins Coverity Plugin 1.10.0 and earlier in CIMInstance.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the configured keystore and private key passwords.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2018-1000554
Component: CVE-2018-1000554
Release date: 2018-06-26T00:00:00+00:00

Trovebox version <= 4.0.0-rc6 contains a Unsafe password reset token generation vulnerability in user component that can result in Password reset. This attack appear to be exploitable via HTTP request. This vulnerability appears to have been fixed in after commit 742b8ed.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
unspecified vulnerability fixed in 6u201, 7u191, and 8u181 (Java DB)
CVE: CVE-2018-2938
Component: JDK
Severity: Important
CVSS v3: 8.9/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Release date: 2018-07-17T00:00:00+00:00

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Java DB). Supported versions that are affected are Java SE: 6u191, 7u181 and 8u172. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. While the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVE-2018-2938 addresses CVE-2018-1313. CVSS 3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).


Remediation:
Use-after-free in X509 object handling
CVE: CVE-2018-1000807
Component: pyOpenSSL
CWE: CWE-416
Severity: Moderate
CVSS v3: 8.1/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2018-01-01T00:00:00+00:00

Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object handling that can result in Use after free can lead to possible denial of service or remote code execution.. This attack appear to be exploitable via Depends on the calling application and if it retains a reference to the memory.. This vulnerability appears to have been fixed in 17.5.0.

Statement: This vulnerability is only present when a specific and uncommon usage pattern of pyOpenSSL occurs. Red Hat Product Security has audited our packages that use pyOpenSSL, and determined that software we distribute in Red Hat Enterprise Linux and Red Hat Virtualization does not use pyOpenSSL in such a way as to be vulnerable. Future updates may address this issue.

Remediation:
Privilege escalation by manipulating saved authorization request
CVE: CVE-2018-15758
Component: spring-security-oauth
CWE: CWE-285
Severity: Important
CVSS v3: 6.8/CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Release date: 2018-10-16T00:00:00+00:00

Spring Security OAuth, versions 2.3 prior to 2.3.4, and 2.2 prior to 2.2.3, and 2.1 prior to 2.1.3, and 2.0 prior to 2.0.16, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can craft a request to the approval endpoint that can modify the previously saved authorization request and lead to a privilege escalation on the subsequent approval. This scenario can happen if the application is configured to use a custom approval endpoint that declares AuthorizationRequest as a controller method argument. This vulnerability exposes applications that meet all of the following requirements: Act in the role of an Authorization Server (e.g. @EnableAuthorizationServer) and use a custom Approval Endpoint that declares AuthorizationRequest as a controller method argument. This vulnerability does not expose applications that: Act in the role of an Authorization Server and use the default Approval Endpoint, act in the role of a Resource Server only (e.g. @EnableResourceServer), act in the role of a Client only (e.g. @EnableOAuthClient).


Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

Installation instructions are available from the Fuse 7.4.0 product documentation page:
https://access.redhat.com/documentation/en-us/red_hat_fuse/7.4/
Insufficient local IPC client-server authentication on the client's side can lead to local privesc
CVE: CVE-2018-16877
Component: pacemaker
CWE: CWE-287
Severity: Important
CVSS v3: 8.5/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Release date: 2018-01-01T00:00:00+00:00

A flaw was found in the way pacemaker's client-server authentication was implemented. A local attacker could use this flaw, and combine it with other IPC weaknesses, to achieve local privilege escalation.

Statement: This is essentially a design level security flaw which can be combined with other flaws to achieve local privilege escalation for clusters running pacemaker. The attacker needs to have access to the cluster node running pacemaker (AV:L). The attacker can use easily use the design flaw via the confused deputy problem to run the exploit (AC:L), also needs to have login access to the pacemaker node to run the exploit (PR:L). 

Due to the elevated privileges obtained, there is an impact to the system beyond the pacemaker node itself (S:C). Lastly due to the attacker's ability to run arbitrary code as root, confidentiality, integrity, and availability of the system is affected. (CIA:H)

Remediation:
Stored XSS in autocomplete suggestions for file comments
CVE: CVE-2018-3780
Component: nextcloud
CVSS v3: 0/CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:N
Release date: 2018-08-03T00:00:00+00:00

A missing sanitization of search results for an autocomplete field in NextCloud Server <13.0.5 could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names, hence malicious search results could only be crafted by authenticated users.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
url spoof in omnibox
CVE: CVE-2018-6078
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2018-03-06T00:00:00+00:00

Incorrect handling of confusable characters in Omnibox in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Fullscreen UI spoof
CVE: CVE-2018-6097
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2018-04-17T00:00:00+00:00

Incorrect handling of asynchronous methods in Fullscreen in Google Chrome on macOS prior to 66.0.3359.117 allowed a remote attacker to enter full screen without showing a warning via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Infinite recursion via crafted packet allows stack exhaustion and denial of service
CVE: CVE-2018-20103
Component: haproxy
CWE: CWE-400
Severity: Important
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2018-12-12T00:00:00+00:00

An issue was discovered in dns.c in HAProxy through 1.8.14. In the case of a compressed pointer, a crafted packet can trigger infinite recursion by making the pointer point to itself, or create a long chain of valid pointers resulting in stack exhaustion.

Statement: This issue did not affect the versions of haproxy as shipped with Red Hat Enterprise Linux 6 and 7.

Remediation:
Before applying this update, ensure all previously released errata relevant to your system have been applied.

See the following documentation, which will be updated shortly for release 3.11.82, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258.
Unsafe use of strcat allows buffer overflow in addressbook/backends/ldap/e-book-backend-ldap.c
CVE: CVE-2018-12422
Component: evolution-data-server
CWE: CWE-121
Severity: Moderate
CVSS v3: 5.6/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2018-05-16T00:00:00+00:00

addressbook/backends/ldap/e-book-backend-ldap.c in Evolution-Data-Server in GNOME Evolution through 3.29.2 might allow attackers to trigger a Buffer Overflow via a long query that is processed by the strcat function. NOTE: the software maintainer disputes this because "the code had computed the required string length first, and then allocated a large-enough buffer on the heap.


Remediation:
Use-after-free on HTTP/2 stream shutdown
CVE: CVE-2018-1302
Component: httpd
CWE: CWE-119
Severity: Low
CVSS v3: 5.8/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2018-03-21T00:00:00+00:00

When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to trigger in usual configurations, the reporter and the team could not reproduce it outside debug builds, so it is classified as low risk.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon will be restarted automatically.
The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Core Services installation (including all applications and configuration files).