huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
resource: // documents can load privileged pages (MFSA 2015-33)
CVE: CVE-2015-0816
Component: Mozilla
CWE: CWE-250
Severity: Moderate
Release date: 2015-03-31T00:00:00+00:00

A flaw was found in the way documents were loaded via resource URLs in, for example, Mozilla's PDF.js PDF file viewer. An attacker could use this flaw to bypass certain restrictions and under certain conditions even execute arbitrary code with the privileges of the user running Firefox.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Buffer overflow in libvpx while parsing vp9 format video (MFSA 2015-101)
CVE: CVE-2015-4506
Component: Mozilla
CWE: CWE-120
Severity: Moderate
Release date: 2015-09-22T00:00:00+00:00

Buffer overflow in the vp9_init_context_buffers function in libvpx, as used in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3, allows remote attackers to execute arbitrary code via a crafted VP9 file.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Zend/zend_exceptions.c does not validate certain Exception objects
CVE: CVE-2015-8876
Component: php
CWE: CWE-502
Severity: Moderate
Release date: 2015-08-04T00:00:00+00:00

Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not validate certain Exception objects, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger unintended method execution via crafted serialized data.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
Project name disclosure via fingerprints (SECURITY-153)
CVE: CVE-2015-5317
Component: jenkins
Severity: Low
Release date: 2015-11-11T00:00:00+00:00

The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request.


Remediation:
Before applying this update, make sure all previously released 
errata relevant to your system have been applied.

See the OpenShift Enterprise 2.2 Release Notes, which will be 
updated shortly for release 2.2.9, for important instructions on how 
to fully apply this asynchronous errata update:

https://access.redhat.com/documentation/en-US/OpenShift_Enterprise/2/html-single/2.2_Release_Notes/index.html#chap-Asynchronous_Errata_Updates

This update is available via the Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at: 
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released 
errata relevant to your system have been applied.

See the OpenShift Enterprise 3.1 documentation, which will be 
updated shortly for release 3.1.1, for important instructions on how 
to upgrade your OpenShift cluster and fully apply this asynchronous 
errata update:

https://docs.openshift.com/enterprise/3.1/release_notes/ose_3_1_release_notes.html

This update is available via the Red Hat Network. Details on how to 
use the Red Hat Network to apply this update are available at 
https://access.redhat.com/articles/11258.
Insufficient symlink verification in smbd
CVE: CVE-2015-5252
Component: samba
CWE: CWE-41
Severity: Low
Release date: 2015-12-16T00:00:00+00:00

An access flaw was found in the way Samba verified symbolic links when creating new files on a Samba share. A remote attacker could exploit this flaw to gain access to files outside of Samba's share path.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
unspecified vulnerability fixed in 7u85 and 8u51 (Install)
CVE: CVE-2015-2597
Component: JDK
Severity: Important
Release date: 2015-07-14T00:00:00+00:00

Unspecified vulnerability in Oracle Java SE 7u80 and 8u45 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Install.


Remediation:
multiple code execution issues fixed in APSB16-01
CVE: CVE-2015-8460
Component: flash-plugin
Severity: Critical
Release date: 2015-12-28T00:00:00+00:00

Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8459, CVE-2015-8636, and CVE-2015-8645.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Unauthorized privilege escalation in sudoedit
CVE: CVE-2015-5602
Component: sudo
CWE: CWE-59
Severity: Moderate
Release date: 2015-07-23T00:00:00+00:00

sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a file whose full path is defined using multiple wildcards in /etc/sudoers, as demonstrated by "/home/*/*/file.txt."


Remediation:
unspecified vulnerability related to Server:Memcached (CPU October 2015)
CVE: CVE-2015-4910
Component: mysql
Severity: Moderate
Release date: 2015-10-21T00:00:00+00:00

Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Memcached.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
NTLM authentication data disclosure via redirect to proxy (Libraries, 8048035)
CVE: CVE-2015-0400
Component: OpenJDK
Severity: Moderate
Release date: 2015-01-20T00:00:00+00:00

Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to Libraries.

Statement: Not vulnerable. This issue did not affect the versions of OpenJDK and Oracle JDK as shipped with Red Hat Enterprise Linux.

Remediation:
Denial-of-service when empty address from DNS overlays A record from hosts
CVE: CVE-2015-8899
Component: dnsmasq
CWE: CWE-476
Severity: Low
Release date: 2015-11-14T00:00:00+00:00

Dnsmasq before 2.76 allows remote servers to cause a denial of service (crash) via a reply with an empty DNS address that has an (1) A or (2) AAAA record defined locally.


Remediation:
Undefined behavior / signed integer overflow in TAR parser
CVE: CVE-2015-8933
Component: libarchive
CWE: CWE-190
Severity: Low
CVSS v3: 3.3/CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L
Release date: 2015-01-01T00:00:00+00:00

Integer overflow in the archive_read_format_tar_skip function in archive_read_support_format_tar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted tar file.


Remediation:
privilege escalation in service workers
CVE: CVE-2015-1211
Component: chromium-browser
Severity: Important
Release date: 2015-02-04T00:00:00+00:00

The OriginCanAccessServiceWorkers function in content/browser/service_worker/service_worker_dispatcher_host.cc in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android does not properly restrict the URI scheme during a ServiceWorker registration, which allows remote attackers to gain privileges via a filesystem: URI.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
reference clock memory corruption vulnerability
CVE: CVE-2015-7853
Component: ntp
Severity: Moderate
Release date: 2015-10-21T00:00:00+00:00

The datalen parameter in the refclock driver in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a negative input value.

Statement: This issue did not affect the versions of ntp as shipped with Red Hat Enterprise Linux 5, 6, and 7 as they do not include the custom refclock driver.

Remediation:
code execution issue fixed in APSB15-14
CVE: CVE-2015-3113
Component: flash-plugin
Severity: Critical
Release date: 2015-06-23T00:00:00+00:00

Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in June 2015.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
WebSocket DoS (wnpa-sec-2015-13)
CVE: CVE-2015-3810
Component: wireshark
CWE: CWE-835
Severity: Moderate
Release date: 2015-05-12T00:00:00+00:00

epan/dissectors/packet-websocket.c in the WebSocket dissector in Wireshark 1.12.x before 1.12.5 uses a recursive algorithm, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted packet.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Heap buffer overflow in xmlParseMisc
CVE: CVE-2015-7500
Component: libxml2
CWE: CWE-122
Severity: Moderate
Release date: 2015-12-01T00:00:00+00:00

A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to crash.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).

After installing the updated packages, the httpd daemon will be restarted automatically.
unsigned files interpreted as signed in some circumstances
CVE: CVE-2015-3406
Component: perl-Module-Signature
CWE: CWE-347
Severity: Moderate
Release date: 2015-04-05T00:00:00+00:00

The PGP signature parsing in Module::Signature before 0.74 allows remote attackers to cause the unsigned portion of a SIGNATURE file to be treated as the signed portion via unspecified vectors.


Remediation:
Lack of validation for the Destination attribute in a Response element in a SAML assertion
CVE: CVE-2015-6254
Component: PicketLink
CWE: CWE-345
Severity: Important
CVSS v3: 6.5/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2015-04-14T00:00:00+00:00

A flaw was found in the way PicketLink's Service Provider (SP) and Identity Provider (IdP) handled certain requests. The SP and IdP in PicketLink before 2.7.0 does not ensure that the Destination attribute in a Response element in the SAML assertion matches the location from which the message was received. This flaw allows a remote attacker to log into a victim's account via PicketLink.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied. Also, back up any customized Red
Hat JBoss Enterprise Application Platform 6 configuration files. On update,
the configuration files that have been locally modified will not be
updated. The updated version of such files will be stored as the rpmnew
files. Make sure to locate any such files after the update and merge any
changes manually.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied. Also, back up any customized Red
Hat JBoss Enterprise Application Platform 6 configuration files. On update,
the configuration files that have been locally modified will not be
updated. The updated version of such files will be stored as the rpmnew
files. Make sure to locate any such files after the update and merge any
changes manually.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied. Also, back up any customized Red
Hat JBoss Enterprise Application Platform 6 configuration files. On update,
the configuration files that have been locally modified will not be
updated. The updated version of such files will be stored as the rpmnew
files. Make sure to locate any such files after the update and merge any
changes manually.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
The References section of this erratum contains a download link (you must
log in to download the update). Before applying this update, back up your
existing Red Hat JBoss Enterprise Application Platform installation and
deployed applications.
java.nio Buffers integer overflow issues (Libraries, 8130891)
CVE: CVE-2015-4843
Component: OpenJDK
CWE: CWE-119
Severity: Critical
Release date: 2015-10-20T00:00:00+00:00

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

For this update to take effect, Red Hat Satellite must be restarted ("/usr/sbin/rhn-satellite restart"), as well as all running instances of IBM Java.
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
missing user authorization check when deleting a service provider
CVE: CVE-2015-5301
Component: ipsilon
CWE: CWE-862
Severity: Moderate
Release date: 2015-10-14T00:00:00+00:00

It was found that Ipsilon did not check whether a user is authorized to delete a service provider. An authenticated user could use this flaw to delete any service provider, potentially resulting in a denial of service.


Remediation:
insecure processing of symbolic links during package processing
CVE: CVE-2015-8860
Component: nodejs-tar
CWE: CWE-59
Severity: Moderate
Release date: 2015-03-27T00:00:00+00:00

A flaw was found in the way nodejs-tar, a Node.js module for reading and writing of tar archives, handled symbolic links when processing NPM packages. An attacker could potentially use this flaw to rewrite arbitrary files on the system.


Remediation:
Use-after-free with shared workers and IndexedDB (MFSA 2015-104)
CVE: CVE-2015-4510
Component: Mozilla
CWE: CWE-416
Severity: Critical
Release date: 2015-09-22T00:00:00+00:00

Race condition in the WorkerPrivate::NotifyFeatures function in Mozilla Firefox before 41.0 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) by leveraging improper interaction between shared workers and the IndexedDB implementation.


Remediation:
Unclear invalid memory read in mtree parser
CVE: CVE-2015-8925
Component: libarchive
CWE: CWE-125
Severity: Low
CVSS v3: 3.6/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2015-01-01T00:00:00+00:00

A vulnerability was found in libarchive.  A specially crafted MTREE file could cause a small out-of-bounds read, potentially disclosing a small amount of application memory.


Remediation:
unspecified vulnerability fixed in 8u65 (JavaFX)
CVE: CVE-2015-4906
Component: JDK
Severity: Moderate
Release date: 2015-10-20T00:00:00+00:00

Unspecified vulnerability in Oracle Java SE 8u60 and JavaFX 2.2.85 allows remote attackers to affect confidentiality via unknown vectors related to JavaFX, a different vulnerability than CVE-2015-4908 and CVE-2015-4916.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
multiple code execution issues fixed in APSB15-25
CVE: CVE-2015-7629
Component: flash-plugin
Severity: Critical
Release date: 2015-10-13T00:00:00+00:00

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via a TextFormat object with a crafted tabStops property, a different vulnerability than CVE-2015-7631, CVE-2015-7643, and CVE-2015-7644.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Message injection caused by line breaks in addresses
CVE: CVE-2015-8476
Component: php-PHPMailer
Release date: 2015-11-01T00:00:00+00:00

Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in an (1) email address to the validateAddress function in class.phpmailer.php or (2) SMTP command to the sendCommand function in class.smtp.php, a different vulnerability than CVE-2012-0796.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
incorrect ciphersuite parsing
CVE: CVE-2015-5244
Component: mod_nss
Severity: Moderate
Release date: 2015-09-15T00:00:00+00:00

The NSSCipherSuite option with ciphersuites enabled in mod_nss before 1.0.12 allows remote attackers to bypass application restrictions.


Remediation:
Out-of-bounds heap read when parsing SVG file
CVE: CVE-2015-7557
Component: librsvg2
CWE: CWE-125
Severity: Moderate
Release date: 2015-12-21T00:00:00+00:00

The _rsvg_node_poly_build_path function in rsvg-shapes.c in librsvg before 2.40.7 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via an odd number of elements in a coordinate pair in an SVG document.


Remediation: