huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Global window leak via console
CVE: CVE-2019-13668
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2019-09-10T00:00:00+00:00

Insufficient policy enforcement in developer tools in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
vulnerability in solaris_zone module via crafted solaris zone
CVE: CVE-2019-14904
Component: Ansible
CWE: CWE-78
Severity: Moderate
CVSS v3: 6.6/CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L
Release date: 2019-11-27T00:00:00+00:00

A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take advantage of this flaw by crafting the name of the zone and executing arbitrary commands in the remote host.

Statement: Because a flaw exploit would depend on the use of Solaris and Red Hat does not support RHOSP on Solaris, the RHOSP Ansible package will not be updated at this time.

Ansible Engine 2.7.15, 2.8.7, and 2.9.2 as well as previous versions are affected.

Remediation:
Currently, there is no mitigation for this issue.
Several CVEs fixed in nextcloud 15, 16 and 17
CVE: CVE-2019-15616
Component: nextcloud
Release date: 2019-01-01T00:00:00+00:00

Dangling remote share attempts in Nextcloud 16 allow a DNS pollution when running long.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2019-1000015
Component: CVE-2019-1000015
Release date: 2019-02-04T00:00:00+00:00

Chamilo Chamilo-lms version 1.11.8 and earlier contains a Cross Site Scripting (XSS) vulnerability in main/messages/new_message.php, main/social/personal_data.php, main/inc/lib/TicketManager.php, main/ticket/ticket_details.php that can result in a message being sent to the Administrator with the XSS to steal cookies. A ticket can be created with a XSS payload in the subject field. This attack appears to be exploitable via <svg/onload=alert(1)> as the payload user on the Subject field. This makes it possible to obtain the cookies of all users that have permission to view the tickets. This vulnerability appears to have been fixed in 1.11.x after commit 33e2692a37b5b6340cf5bec1a84e541460983c03.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Crafted null dereference attack in authenticated mode 6 packet
CVE: CVE-2019-8936
Component: ntp
CWE: CWE-119
Severity: Moderate
CVSS v3: 5.4/CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2019-03-07T00:00:00+00:00

NTP through 4.2.8p12 has a NULL Pointer Dereference.

Statement: This issue did not affect the versions of ntp as shipped with Red Hat Enterprise Linux 5, 6, and 7.

Remediation:
out of bounds write due to missing bounds check in mnh driver leads to local privilege escalation
CVE: CVE-2019-9274
Component: kernel
CWE: CWE-787
Severity: Moderate
CVSS v3: 7.4/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2019-09-03T00:00:00+00:00

In the Android kernel in the mnh driver there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.


Remediation:
vulnerability in rds6_inc_info_copy in net/rds/recv.c allows attackers to obtain sensitive information
CVE: CVE-2019-16714
Component: kernel
CWE: CWE-200
Severity: Moderate
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2019-09-23T00:00:00+00:00

In the Linux kernel before 5.2.14, rds6_inc_info_copy in net/rds/recv.c allows attackers to obtain sensitive information from kernel stack memory because tos and flags fields are not initialized.


Remediation:
Server: PS unspecified vulnerability (CPU Apr 2019)
CVE: CVE-2019-2592
Component: mysql
Severity: Moderate
CVSS v3: 5.9/CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2019-04-16T00:00:00+00:00

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: PS). Supported versions that are affected are 5.7.25 and prior and 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
crafted web content leads to arbitrary code execution
CVE: CVE-2019-7285
Component: webkitgtk
CWE: CWE-94
Severity: Moderate
CVSS v3: 6.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2019-04-10T00:00:00+00:00

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.


Remediation:
mishandling of malformed ZIP files causing denial of service
CVE: CVE-2019-13453
Component: zipios
CVSS v3: 3.9/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2019-07-15T00:00:00+00:00

Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an infinite loop, causing a denial of service. This is related to zipheadio.h:readUint32() and zipfile.cpp:Zipfile::Zipfile().

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Regular expression denial of service vulnerability of WEBrick's Digest authentication
CVE: CVE-2019-16201
Component: ruby
CWE: CWE-400
Severity: Moderate
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2019-10-01T00:00:00+00:00

WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network.


Remediation:
cross-site scripting via dojox.xmpp.util.xmlEncode
CVE: CVE-2019-10785
Component: dojo
CWE: CWE-79
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2019-01-01T00:00:00+00:00

A flaw was found in dojox. Cross-site scripting is possible as only the first occurrence of each character is encoded. The highest threat from this vulnerability is to data confidentiality and integrity.

Statement: This flaw affects the XML encoding used on XMPP implementation at Dojo, although the FreeIPA versions shipped with Red Hat Enterprise Linux 6, 7 and 8 it doesn't make use of this specific API and are not affected by this issue.

Remediation:
out-of-bounds read in contrib/pmdb2diag/pmdb2diag.c
CVE: CVE-2019-17040
Component: rsyslog
Severity: Moderate
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2019-09-24T00:00:00+00:00

contrib/pmdb2diag/pmdb2diag.c in Rsyslog v8.1908.0 allows out-of-bounds access because the level length is mishandled.


Remediation:
Git mistakes some paths for relative paths allowing writing outside of the worktree while cloning
CVE: CVE-2019-1351
Component: git
CWE: CWE-20
Severity: None
CVSS v3: 0/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
Release date: 2019-12-10T00:00:00+00:00

A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka 'Git for Visual Studio Tampering Vulnerability'.

Statement: This issue did not affect the versions of git as shipped with Red Hat Enterprise Linux 6, 7, and 8 as this is a Windows only issue and it does not affect the Linux versions of git.

Remediation:
XXS when a crafted SVG element is republished
CVE: CVE-2019-15587
Component: rubygem-loofah
CWE: CWE-79
Severity: Moderate
CVSS v3: 4.8/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Release date: 2019-10-10T00:00:00+00:00

In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.

Statement: Supported versions of Satellite 6 contain a vulnerable version of rubygem-loofah. However, it is not possible to inject untrusted SVG files, and thus it is considered that this vulnerability can not be triggered. A future update may fix this vulnerability.

Remediation:
Local privilege escalation in pcp spec file through migrate_tempdirs
CVE: CVE-2019-3696
Component: pcp
CWE: CWE-22
Severity: Low
CVSS v3: 7.3/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2019-10-14T00:00:00+00:00

A Improper Limitation of a Pathname to a Restricted Directory vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Module for Development Tools 15-SP1, SUSE Linux Enterprise Module for Open Buildservice Development Tools 15, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15, SUSE Linux Enterprise Software Development Kit 12-SP4, SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1 allows local user pcp to overwrite arbitrary files with arbitrary content. This issue affects: SUSE Linux Enterprise High Performance Computing 15-ESPOS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise High Performance Computing 15-LTSS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Module for Development Tools 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Module for Development Tools 15-SP1 pcp versions prior to 4.3.1-3.5.3. SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Server 15-LTSS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Server for SAP 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Software Development Kit 12-SP4 pcp versions prior to 3.11.9-6.14.1. SUSE Linux Enterprise Software Development Kit 12-SP5 pcp versions prior to 3.11.9-6.14.1. openSUSE Leap 15.1 pcp versions prior to 4.3.1-lp151.2.3.1.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Multiple memory corruption issues leading to arbitrary code execution
CVE: CVE-2019-8609
Component: webkitgtk
Severity: Moderate
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2019-05-20T00:00:00+00:00

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution.


Remediation:
mishandles signature checking on some federation APIs
CVE: CVE-2019-18835
Component: matrix-synapse
CVSS v3: 0/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
Release date: 2019-10-28T00:00:00+00:00

Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Events sent over /send_join, /send_leave, and /invite may not be correctly signed, or may not come from the expected servers.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Sandbox Bypass in Script Security Plugin (SECURITY-1292)
CVE: CVE-2019-1003005
Component: jenkins-plugin-script-security
CWE: CWE-96
Severity: Important
CVSS v3: 9.0/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2019-01-29T00:00:00+00:00

A flaw was found in the Jenkins Script Security plugin through version 1.50. The fix for CVE-2019-1003000 was found to be incomplete. Script Security sandbox protection could be circumvented during the script compilation phase by applying AST transforming annotations such as @Grab to source code elements. This affected an HTTP endpoint used to validate a user-submitted Groovy script that was not covered in the 2019-01-08 fix for SECURITY-1266 and allowed users with Overall/Read permission to bypass the sandbox protection and execute arbitrary code on the Jenkins master. The affected HTTP endpoint now applies a safe Groovy compiler configuration prohibiting unsafe AST transforming annotations. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Remediation:
See the following documentation, which will be updated shortly for release
3.11.98, for important instructions on how to upgrade your cluster and fully
apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258.
NULL profile dereference in dbi_profile()
CVE: CVE-2019-20919
Component: perl-dbi
CWE: CWE-476
Severity: Low
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2019-07-31T00:00:00+00:00

An issue was discovered in the DBI module before 1.643 for Perl. The hv_fetch() documentation requires checking for NULL and the code does that. But, shortly thereafter, it calls SvOK(profile), causing a NULL pointer dereference.


Remediation:
TCP/HTTP detection bypass in detect.c leads to denial of service
CVE: CVE-2019-1010279
Component: suricata
CVSS v3: 4.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2019-01-31T00:00:00+00:00

Open Information Security Foundation Suricata prior to version 4.1.3 is affected by: Denial of Service - TCP/HTTP detection bypass. The impact is: An attacker can evade a signature detection with a specialy formed sequence of network packets. The component is: detect.c (https://github.com/OISF/suricata/pull/3625/commits/d8634daf74c882356659addb65fb142b738a186b). The attack vector is: An attacker can trigger the vulnerability by a specifically crafted network TCP session. The fixed version is: 4.1.3.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
use-after-free in btrfs_queue_work in fs/btrfs/async-thread.c
CVE: CVE-2019-19377
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2019-11-28T00:00:00+00:00

A flaw was found in the Linux kernel's implementation of the BTRFS file system. A local attacker, with the ability to mount a file system, can create a use-after-free memory fault after the file system has been unmounted. This may lead to memory corruption or privilege escalation.

Statement: This flaw is rated as moderate, the attacker would need to have physical access or permission to mount/write to a filesystem to abuse this.  If they can write to a block device they can already do other evil things, like make a setuid binary etc.

Remediation:
As the btrfs module will be auto-loaded when required, its use can be disabled by preventing the module from loading with the following instructions:

# echo "install btrfs /bin/true" >> /etc/modprobe.d/disable-btrfs.conf 
 
The system will need to be restarted if the BTRFS modules are loaded. In most circumstances, the CIFS kernel modules will be unable to be unloaded while any network interfaces are active and the protocol is in use.

If the system requires this module to work correctly (as a filesytem required to run), this mitigation may not be suitable.

If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services.
'Forget about this site' removes sites from pre-loaded HSTS list
CVE: CVE-2019-11747
Component: Mozilla
CWE: CWE-358
Severity: Low
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Release date: 2019-09-03T00:00:00+00:00

The "Forget about this site" feature in the History pane is intended to remove all saved user data that indicates a user has visited a site. This includes removing any HTTP Strict Transport Security (HSTS) settings received from sites that use it. Due to a bug, sites on the pre-load list also have their HSTS setting removed. On the next visit to that site if the user specifies an http: URL rather than secure https: they will not be protected by the pre-loaded HSTS setting. After that visit the site's HSTS setting will be restored. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
out of bounds write due to missing bounds check in FingerTipS touchscreen driver leads to local privilege escalation
CVE: CVE-2019-9448
Component: kernel
CWE: CWE-787
Severity: Moderate
CVSS v3: 7.4/CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2019-09-03T00:00:00+00:00

In the Android kernel in the FingerTipS touchscreen driver there is a possible out of bounds write due to a missing bounds check. This could lead to a local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.


Remediation:
unsafe template evaluation of returned module data can lead to information disclosure
CVE: CVE-2019-10156
Component: ansible
CWE: CWE-200
Severity: Moderate
CVSS v3: 4.8/CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Release date: 2019-06-04T00:00:00+00:00

A flaw was discovered in the way Ansible templating was implemented, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitution the content of any variable may be disclosed.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
add-to-physmap can be abused to DoS Arm hosts
CVE: CVE-2019-18423
Component: xen
CWE: CWE-20
Severity: Moderate
CVSS v3: 5.6/CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H
Release date: 2019-10-31T00:00:00+00:00

An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service via a XENMEM_add_to_physmap hypercall. p2m->max_mapped_gfn is used by the functions p2m_resolve_translation_fault() and p2m_get_entry() to sanity check guest physical frame. The rest of the code in the two functions will assume that there is a valid root table and check that with BUG_ON(). The function p2m_get_root_pointer() will ignore the unused top bits of a guest physical frame. This means that the function p2m_set_entry() will alias the frame. However, p2m->max_mapped_gfn will be updated using the original frame. It would be possible to set p2m->max_mapped_gfn high enough to cover a frame that would lead p2m_get_root_pointer() to return NULL in p2m_get_entry() and p2m_resolve_translation_fault(). Additionally, the sanity check on p2m->max_mapped_gfn is off-by-one allowing "highest mapped + 1" to be considered valid. However, p2m_get_root_pointer() will return NULL. The problem could be triggered with a specially crafted hypercall XENMEM_add_to_physmap{, _batch} followed by an access to an address (via hypercall or direct access) that passes the sanity check but cause p2m_get_root_pointer() to return NULL. A malicious guest administrator may cause a hypervisor crash, resulting in a Denial of Service (DoS). Xen version 4.8 and newer are vulnerable. Only Arm systems are vulnerable. x86 systems are not affected.


Remediation:
use-after-free in drivers/media/v4l2-core/v4l2-dev.c
CVE: CVE-2019-15211
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.3/CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2019-08-19T00:00:00+00:00

A use-after-free flaw was found in the Linux kernel. A local attacker who was able to disconect a USB raremono v4l radio device could trigger a use-after-free condition where they could abuse this flaw to corrupt memory, crash the system, or escalate privileges

Statement: This module is not included in the Red Hat Enterprise Linux kernels.

Remediation: