huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
stack-based buffer overflow in speexenc.c via a crafted WAV file
CVE: CVE-2020-23904
Component: speex
CWE: CWE-119
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2020-07-14T00:00:00+00:00

A stack-based buffer overflow flaw was found in speex within the read_samples() at src/speexenc.c function. This flaw allows a malicious user to provide a crafted wav file to the speexenc utility, and in some cases, possibly lead to arbitrary code execution. The highest threat from this vulnerability is to system availability.


Remediation:
insufficient cache write-back under VT-d leads to DoS (XSA-321)
CVE: CVE-2020-15565
Component: xen
CWE: CWE-200
Severity: Moderate
CVSS v3: 7.7/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
Release date: 2020-07-07T12:00:00+00:00

A flaw was found in Xen, in the page table sharing between the IOMMU and CPU. This flaw allows a  malicious guest user to access sensitive information pertaining to other guests to crash the host, resulting in a denial of service and privilege escalation. The highest threat from this vulnerability is to system availability.

Statement: Only x86 HVM guests using hardware assisted paging (HAP), having a passed through PCI device assigned, and having page table sharing enabled can leverage the vulnerability. Note that page table sharing is enabled (by default) only if Xen considers IOMMU and CPU large page size support compatible. x86 AMD as well as ARM systems are not affected by this flaw.

Remediation:
- Suppress the use of page table sharing (command line option `iommu=no-sharept`). Note however that as of Xen version 4.13 there is also a respective per-guest control (`passthrough=` libxl guest config file option). If any guests have been created with an explicit setting, this setting may conflict with the addition of the `iommu=no-sharept` Xen command line option.

- Suppress the use of large HAP pages (command line options `hap_2mb=no` and `hap_1gb=no`).

- Avoid pass-through of PCI devices to HVM guests.
Stream pointer out of bounds in update_recv_secondary_order could lead out of bounds read later
CVE: CVE-2020-11526
Component: freerdp
CWE: CWE-125
Severity: Low
CVSS v3: 2.7/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L
Release date: 2020-04-09T00:00:00+00:00

libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc4 has an Out-of-bounds Read.


Remediation:
remote Code Execution in vhost_crypto (VM Escape)
CVE: CVE-2020-14374
Component: dpdk
CWE: CWE-120
Severity: Important
CVSS v3: 8.5/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Release date: 2020-09-28T15:00:00+00:00

A flaw was found in dpdk. A flawed bounds checking in the copy_data function leads to a buffer overflow allowing an attacker in a virtual machine to write arbitrary data to any address in the vhost_crypto application. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: This flaw does not affect the versions of `dpdk` as shipped with Red Hat Enterprise Linux 7 and 8 or the versions embedded in Red Hat Virtualization or the Fast Datapath `openvswitch` package, as they do not enable generic crypto device library support. This causes the vulnerable code in vhost_crypto.c to not be included.

This flaw does not affect Red Hat Ceph Storage 3 and 4 as dpdk (embedded in ceph source rpm) is not built in the packages, therefore the vulnerable code is not available in the resulting RPM and the issue cannot be exploited.

Remediation:
Insufficient policy enforcement in extensions
CVE: CVE-2020-15973
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2020-10-06T00:00:00+00:00

Insufficient policy enforcement in extensions in Google Chrome prior to 86.0.4240.75 allowed an attacker who convinced a user to install a malicious extension to bypass same origin policy via a crafted Chrome Extension.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
hide-download shares to be downloadable when appending /download to the URL
CVE: CVE-2020-8139
Component: nextcloud
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2020-03-20T00:00:00+00:00

A missing access control check in Nextcloud Server < 18.0.1, < 17.0.4, and < 16.0.9 causes hide-download shares to be downloadable when appending /download to the URL.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Generated passwords may be identical on the same site between separate private browsing sessions
CVE: CVE-2020-6824
Component: Mozilla
CWE: CWE-384
Severity: Moderate
CVSS v3: 2.9/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Release date: 2020-04-10T12:00:00+00:00

Initially, a user opens a Private Browsing Window and generates a password for a site, then closes the Private Browsing Window but leaves Firefox open. Subsequently, if the user had opened a new Private Browsing Window, revisited the same site, and generated a new password - the generated passwords would have been identical, rather than independent. This vulnerability affects Firefox < 75.


Remediation:
NULL pointer dereference in snapshot-controller when processing a VolumeSnapshot custom resource
CVE: CVE-2020-8569
Component: kubernetes-csi
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.4/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-11-03T00:00:00+00:00

A flaw was found in the Kubernetes snapshot-controller, where it is vulnerable to a denial of service attack via authorized API requests. The snapshot-controller can dereference a NULL pointer when processing a VolumeSnapshot custom resource via an authorized API request with invalid references to PersistentVolumeClaims and VolumeSnapshotClasses. The result causes the snapshot-controller to enter an endless crash loop. The highest threat from this vulnerability is to system availability.

Statement: This vulnerability only affects versions v3.0.0 - v3.0.1 of the upstream snapshot-controller. No released component of OpenShift Container Platform (OCP) includes a vulnerable version. The first release of OCP 4.6 included v3 of a snapshot-controller with this fix, earlier versions of OCP include v2, which is not affected by this vulnerability. Similarly, no components of OpenShift Virtualization include a vulnerable version.

Remediation:
any API user with READ right on User itemtype will have access to full list of users when querying apirest.php/User
CVE: CVE-2020-11033
Component: glpi
CVSS v3: 5.9/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N
Release date: 2020-05-05T00:00:00+00:00

In GLPI from version 9.1 and before version 9.4.6, any API user with READ right on User itemtype will have access to full list of users when querying apirest.php/User. The response contains: - All api_tokens which can be used to do privileges escalations or read/update/delete data normally non accessible to the current user. - All personal_tokens can display another users planning. Exploiting this vulnerability requires the api to be enabled, a technician account. It can be mitigated by adding an application token. This is fixed in version 9.4.6.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
slab-out-of-bounds read in fbcon
CVE: CVE-2020-28974
Component: kernel
CWE: CWE-125
Severity: Moderate
CVSS v3: 5.2/AV:P/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H
Release date: 2020-11-09T00:00:00+00:00

An out-of-bounds (OOB) SLAB memory access flaw was found in the Linux kernel's fbcon driver module. A bounds check failure allows a local attacker with special user privileges to gain access to out-of-bounds memory, leading to a system crash or leaking of internal kernel information. The highest threat from this vulnerability is to system availability.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Add 'nomodeset' option as kernel boot parameter to disable frame buffering in /etc/default/grub, and run 'grub2-mkconfig -o /boot/grub2/grub.cfg' and reboot.
~~~
# cat /proc/cmdline 
BOOT_IMAGE=(hd0,msdos1)/vmlinuz-4.18.0-147.el8.x86_64 root=/dev/mapper/rhel_rhel8u2--1-root ro crashkernel=auto resume=/dev/mapper/rhel_rhel8u2--1-swap rd.lvm.lv=rhel_rhel8u2-1/root rd.lvm.lv=rhel_rhel8u2-1/swap nomodeset

# ls -l /dev/fb*
ls: cannot access '/dev/fb*': No such file or directory
~~~

The above said mitigation does not so effect for rhel6 kernel , and is only applicable for rhel7/8.
input validation issue may lead to a cross site scripting
CVE: CVE-2020-9952
Component: webkitgtk
CWE: CWE-79
Severity: Moderate
CVSS v3: 7.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Release date: 2020-11-23T00:00:00+00:00

An input validation issue was addressed with improved input validation. This issue is fixed in iOS 14.0 and iPadOS 14.0, tvOS 14.0, watchOS 7.0, Safari 14.0, iCloud for Windows 11.4, iCloud for Windows 7.21. Processing maliciously crafted web content may lead to a cross site scripting attack.

Statement: webkit2gtk3 as shipped with Red Hat Enterprise Linux 8 is not affected by this flaw, as the version shipped is newer than the affected version range.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

GDM must be restarted for this update to take effect.
inability to timely contact accountservice via dbus leads gnome-initial-setup to creation of account with admin privileges
CVE: CVE-2020-16125
Component: gdm
CWE: CWE-636
Severity: Low
CVSS v3: 6.4/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-11-10T00:00:00+00:00

A vulnerability was found in GDM. If gdm can't contact the AccountService service via DBus in a timely manner it would default to assume there are no existing users and would allow the attacker to create a new user with high privileges.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

GDM must be restarted for this update to take effect.
CVE: CVE-2020-1898
Component: CVE-2020-1898
Release date: 2020-01-01T00:00:00+00:00

The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Atomix 3.1.5 ONOS Node information disclosure
CVE: CVE-2020-35215
Component: atomix
CWE: CWE-200
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2020-01-01T00:00:00+00:00

An issue in Atomix v3.1.5 allows attackers to access sensitive information when a malicious Atomix node queries distributed variable primitives which contain the entire primitive lists that ONOS nodes use to share important states.


Remediation:
Heap buffer overflow in esci2_img
CVE: CVE-2020-12865
Component: sane-backends
CWE: CWE-190
Severity: Important
CVSS v3: 8.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-05-17T00:00:00+00:00

A flaw was found in sane-backends in versions prior to 1.0.30. A heap buffer overflow in the esci2_img function could lead to a remote code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: The vulnerable code is a part of "driver for Epson ESC/I-2 scanners" which was first introduced in sane-backends-1.0.25 (via https://gitlab.com/sane-project/backends/-/commit/d72f4663c0ad6e6f779c15c8baf5f92b675ae19a). Therefore, only versions of sane-backends shipped with Red Hat Enterprise Linux 8 are affected by this flaw.

Remediation:
This flaw can be mitigated by limiting network scanner discovery to a trusted subnet via the "net" configuration in the "/etc/sane.d/epsonds.conf" configuration file. Also, automatic network scanner discovery can be turned off by commenting out the line "net autodiscovery" in the same configuration file.
session resumption works without master key allowing MITM
CVE: CVE-2020-13777
Component: gnutls
CWE: CWE-345
Severity: Important
CVSS v3: 7.4/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2020-06-03T00:00:00+00:00

A flaw was found in GnuTLS, in versions starting from 3.6.4, where it does not session the ticket encryption key in a secure fashion by the application which is connecting. This flaw allows an attacker to craft a man-in-the-middle-attack, with the ability to bypass the TLS1.3 authentication and also recover older conversations when TLS1.2 is in use. The highest threat to this flaw is to confidentiality and integrity.

Statement: GnuTLS versions as shipped with Red Hat Enterprise Linux 7 and earlier are not affected, as the bug was introduced in upstream at GnuTLS version 3.6.4. The older versions do not carry the affected code.

Remediation:
There's no available mitigation for this issue.
Geneve/IPsec traffic may be unencrypted between two Geneve endpoints
CVE: CVE-2020-25645
Component: kernel
CWE: CWE-319
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2020-09-16T00:00:00+00:00

A flaw was found in the Linux kernel. Traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone in between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidentiality.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
A possible workaround for this flaw is to configure IPsec for all traffic between the endpoints, instead of specifically for the UDP port used by the GENEVE tunnels. If GENEVE tunnels are not used, this flaw will not be triggered. In that case, it is possible to disable those tunnels, by unloading the "geneve" kernel module and blacklisting it (See https://access.redhat.com/solutions/41278 for a
guide on how to blacklist modules).
Some database module web services did not respect group settings
CVE: CVE-2020-25700
Component: moodle
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Release date: 2020-11-16T04:00:00+00:00

A flaw was found in Moodle, where some of the database module web services allowed students to add entries within groups where they did not belong. The highest threat from this vulnerability is to integrity.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Missing permission check in Kubernetes Plugin allows listing pod templates
CVE: CVE-2020-2308
Component: jenkins-2-plugins/kubernetes
CWE: CWE-862
Severity: Moderate
CVSS v3: 4.5/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2020-11-04T00:00:00+00:00

A missing permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to list global pod template names.


Remediation:
Before applying this update, ensure all previously released errata relevant
to your system is applied.

See the following documentation, which will be updated shortly for release
3.11.394, for important instructions on how to upgrade your cluster and fully
apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258.
For OpenShift Container Platform 4.5 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.5/release_notes/ocp-4-5-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.5/updating/updating-cluster-cli.html.
For OpenShift Container Platform 4.6 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html.
NULL pointer dereference in ext/fts3/fts3_snippet.c via a crafted matchinfo() query
CVE: CVE-2020-13632
Component: sqlite
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-05-14T00:00:00+00:00

A NULL pointer dereference flaw was found in the matchinfo auxiliary function of the SQLite FTS3 extension module. This flaw allows an attacker who can execute SQL statements to crash the application, resulting in a denial of service.

Statement: This flaw did not affect the versions of SQLite as shipped with Red Hat Enterprise Linux 7 as they did not include the vulnerable code, which was introduced in a later version of the package.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/4.19/html/updating_openshift_data_foundation/updating-ocs-to-odf_rhodf
Insecure handling of root directory for path lookups via io_uring
CVE: CVE-2020-29373
Component: kernel
CWE: CWE-552
Severity: None
CVSS v3: 0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N
Release date: 2020-05-07T00:00:00+00:00

An issue was discovered in fs/io_uring.c in the Linux kernel before 5.6. It unsafely handles the root directory during path lookups, and thus a process inside a mount namespace can escape to unintended filesystem locations, aka CID-ff002b30181d.


Remediation:
XRecordRegisterClients integer underflow privilege escalation vulnerability
CVE: CVE-2020-14362
Component: xorg-x11-server
CWE: CWE-191
Severity: Important
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-08-25T00:00:00+00:00

A flaw was found in X.Org Server. An Integer underflow leading to heap-buffer overflow may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: Xorg server does not run with root  privileges in Red Hat Enterprise Linux 8, therefore this flaw has been rated as having moderate impact for Red Hat Enterprise linux 8.

Remediation:
Buffer overflow in read_fru_area_section function in lib/ipmi_fru.c
CVE: CVE-2020-5208
Component: ipmitool
CWE: CWE-119
Severity: Important
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-02-05T00:00:00+00:00

A flaw was found in several functions of the IPMItool, where it failed to check data received from a LAN properly. An attacker could use this flaw to craft payloads, which can lead to a buffer overflow and also cause memory corruption, a denial of service, and remote code execution.

Statement: The ipmitool package distributed with Red Hat Enterprise Linux versions are compiled using gcc's stack-protector feature. The stack canary generated by this feature helps mitigating any remote code execution attacks for this flaw.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the IPMI event daemon (ipmievd) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the IPMI event daemon (ipmievd) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the IPMI event daemon (ipmievd) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the IPMI event daemon (ipmievd) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the IPMI event daemon (ipmievd) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the IPMI event daemon (ipmievd) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the IPMI event daemon (ipmievd) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the IPMI event daemon (ipmievd) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the IPMI event daemon (ipmievd) will be restarted automatically.
There's no mitigation available for this issue, although a few actions help to reduce the attack risk:

1) Avoid to run `ipmitool` as privileged user;
2) Avoid to run `ipmitool` against non-trusted IPMI-enabled devices;