huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
multiple code execution issues fixed in APSB15-09
CVE: CVE-2015-3086
Component: flash-plugin
Severity: Critical
Release date: 2015-05-12T00:00:00+00:00

Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-3077 and CVE-2015-3084.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
API permits HTTP requests when require_ssl is enabled
CVE: CVE-2015-5152
Component: Foreman
CWE: CWE-319
Severity: Moderate
Release date: 2015-07-15T00:00:00+00:00

Foreman after 1.1 and before 1.9.0-RC1 does not redirect HTTP requests to HTTPS when the require_ssl setting is set to true, which allows remote attackers to obtain user credentials via a man-in-the-middle attack.

Statement: This issue affects the versions of foreman as shipped with Red Hat Satellite 6 and OpenStack. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied and that the Satellite is updated to the most recent 6.1.x release. 

For details on how to apply this update, refer to:

https://access.redhat.com/documentation/en/red-hat-satellite/6.2/single/installation-guide#upgrading_satellite_server_and_capsule_server
build_principal() memory flaw
CVE: CVE-2015-2697
Component: krb5
CWE: CWE-125
Severity: Moderate
Release date: 2015-09-25T00:00:00+00:00

An out-of-bounds flaw was discovered in MIT Kerberos; the build_principal_va() function did not properly duplicate the realm. An authenticated remote attacker could possibly exploit this flaw by sending a TGS request containing a specially crafted realm field and crashing the KDC (denial of service).


Remediation:
multiple code execution issues fixed in APSB15-06
CVE: CVE-2015-0350
Component: flash-plugin
Severity: Critical
Release date: 2015-04-14T00:00:00+00:00

Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0347, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, and CVE-2015-3043.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Reflective XSS vulnerability (SECURITY-171, SECURITY-177)
CVE: CVE-2015-1812
Component: jenkins
CWE: CWE-79
Severity: Moderate
Release date: 2015-03-23T00:00:00+00:00

Two cross-site scripting (XSS) flaws were found in Jenkins. A remote attacker could use these flaws to conduct XSS attacks against users of an application using Jenkins.


Remediation:
Before applying this update, make sure all previously released 
errata relevant to your system have been applied.

See the OpenShift Enterprise 2.2 Release Notes, which will be 
updated shortly for release 2.2.7, for important instructions on 
how to fully apply this asynchronous errata update:

https://access.redhat.com/documentation/en-US/OpenShift_Enterprise/2/html-single/2.2_Release_Notes/index.html#chap-Asynchronous_Errata_Updates

This update is available via the Red Hat Network. Details on how to 
use the Red Hat Network to apply this update are available at 
https://access.redhat.com/articles/11258.
Before applying this update, make sure all previously released 
errata relevant to your system have been applied.

See the OpenShift Enterprise 3.1 documentation, which will be 
updated shortly for release 3.1.1, for important instructions on how 
to upgrade your OpenShift cluster and fully apply this asynchronous 
errata update:

https://docs.openshift.com/enterprise/3.1/release_notes/ose_3_1_release_notes.html

This update is available via the Red Hat Network. Details on how to 
use the Red Hat Network to apply this update are available at 
https://access.redhat.com/articles/11258.
multiple flaws fixed in 1.26.1, 1.25.4, 1.24.5, and 1.23.12
CVE: CVE-2015-8625
Component: mediawiki
Release date: 2015-12-21T00:00:00+00:00

MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when calling the cURL library, which allows remote attackers to read arbitrary files via an @ (at sign) character in unspecified POST array parameters.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
new update fixes several security issues
CVE: CVE-2015-0215
Component: moodle
Release date: 2015-01-19T00:00:00+00:00

calendar/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to obtain sensitive calendar-event information via a web-services request.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Vulnerabilities found through code inspection (MFSA 2015-112)
CVE: CVE-2015-7180
Component: Mozilla
CWE: CWE-250
Severity: Important
Release date: 2015-09-22T00:00:00+00:00

The ReadbackResultWriterD3D11::Run function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 misinterprets the return value of a function call, which might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
several vulnerabilities fixed in Wordpress 4.1.2
CVE: CVE-2015-3439
Component: wordpress
Release date: 2015-04-23T00:00:00+00:00

Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiecode) plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3.9.x, 4.0.x, and 4.1.x before 4.1.2 and other products, allows remote attackers to execute same-origin JavaScript functions via the target parameter, as demonstrated by executing a certain click function, related to _init.as and _fireEvent.as.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Various fixes from internal audits, fuzzing and other initiatives
CVE: CVE-2015-6791
Component: chromium-browser
Severity: Important
Release date: 2015-12-08T00:00:00+00:00

Multiple unspecified vulnerabilities in Google Chrome before 47.0.2526.80 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Buffer overflows on Libvpx when decoding WebM video (MFSA 2015-89)
CVE: CVE-2015-4485
Component: Mozilla
CWE: CWE-119
Severity: Critical
Release date: 2015-08-11T00:00:00+00:00

Heap-based buffer overflow in the resize_context_buffers function in libvpx in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via malformed WebM video data.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
information leak through XEN_DOMCTL_gettscinfo (xsa132)
CVE: CVE-2015-3340
Component: xen
CWE: CWE-200
Severity: Low
Release date: 2015-04-20T00:00:00+00:00

Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request.

Statement: This issue did not affect the versions of xen as shipped with Red Hat Enterprise Linux 5.

Remediation:
stack buffer overflow in _mdir_mem_forget()
CVE: CVE-2015-3205
Component: libmimedir
Release date: 2015-06-23T00:00:00+00:00

libmimedir allows remote attackers to execute arbitrary code via a VCF file with two NULL bytes at the end of the file, related to "free" function calls in the "lexer's memory clean-up procedure."

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Out-of-bounds write in Skia
CVE: CVE-2015-1238
Component: chromium-browser
CWE: CWE-787
Severity: Important
Release date: 2015-04-14T00:00:00+00:00

Skia, as used in Google Chrome before 42.0.2311.90, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via unknown vectors.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
net: buffer overflow when copying data from skbuff to userspace
CVE: CVE-2015-8019
Component: kernel
CWE: CWE-121
Severity: Moderate
Release date: 2015-10-27T00:00:00+00:00

The skb_copy_and_csum_datagram_iovec function in net/core/datagram.c in the Linux kernel 3.14.54 and 3.18.22 does not accept a length argument, which allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a write system call followed by a recvmsg system call.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6, 7 and MRG-2, as the code introduced the flaw is not present in these products.

Remediation:
incomplete MaxXMLNameLimit enforcement (JAXP, 8086733)
CVE: CVE-2015-4893
Component: OpenJDK
CWE: CWE-770
Severity: Moderate
Release date: 2015-10-20T00:00:00+00:00

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4803 and CVE-2015-4911.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

For this update to take effect, Red Hat Satellite must be restarted ("/usr/sbin/rhn-satellite restart"), as well as all running instances of IBM Java.
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
information leak via internal x86 system device emulation (XSA-121)
CVE: CVE-2015-2044
Component: xen
CWE: CWE-212
Severity: Low
Release date: 2015-03-06T00:00:00+00:00

The emulation routines for unspecified X86 devices in Xen 3.2.x through 4.5.x does not properly initialize data, which allow local HVM guest users to obtain sensitive information via vectors involving an unsupported access size.

Statement: Not vulnerable.

This issue does not affect the Xen hypervisor as shipped with Red Hat Enterprise Linux 5.

Remediation:
multiple code execution issues fixed in APSB15-32
CVE: CVE-2015-8449
Component: flash-plugin
Severity: Critical
Release date: 2015-12-08T00:00:00+00:00

Use-after-free vulnerability in the MovieClip object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via a crafted lineTo method call, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
various flaws fixed in 7.0.5
CVE: CVE-2015-3012
Component: owncloud
Release date: 2015-03-25T00:00:00+00:00

Multiple cross-site scripting (XSS) vulnerabilities in WebODF before 0.5.5, as used in ownCloud, allow remote attackers to inject arbitrary web script or HTML via a (1) style or (2) font name or (3) javascript or (4) data URI.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
kvm x86: NULL pointer dereference in kvm_apic_has_events function
CVE: CVE-2015-4692
Component: kernel
CWE: CWE-476
Severity: Moderate
Release date: 2015-06-04T00:00:00+00:00

A DoS flaw was found for a Linux kernel built for the x86 architecture which had the KVM virtualization support(CONFIG_KVM) enabled. The kernel would be vulnerable to a NULL pointer dereference flaw in Linux kernel's kvm_apic_has_events() function while doing an ioctl. An unprivileged user able to access the "/dev/kvm" device could use this flaw to crash the system kernel.

Statement: This issue does not affect the versions of Linux kernel as shipped with
Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG 2.

This issue affects the version of the kernel package as shipped with
Red Hat Enterprise Linux 7.

Remediation:
multiple code execution flaws (APSB15-19)
CVE: CVE-2015-5129
Component: flash-plugin
Severity: Critical
Release date: 2015-08-12T00:00:00+00:00

Heap-based buffer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5541.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
possible denial of service in strip_tags()
CVE: CVE-2015-2316
Component: Django
CWE: CWE-835
Severity: Moderate
Release date: 2015-03-18T00:00:00+00:00

The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.


Remediation:
Remote code execution by SuperUser role on hosts in RHEV
CVE: CVE-2015-7544
Component: redhat-support-plugin-rhev
CWE: CWE-20
Severity: Important
Release date: 2015-12-07T00:00:00+00:00

It was found that redhat-support-plugin-rhev passed a user-specified path and file name directly to the command line in the log viewer component. This could allow users with the SuperUser role on any Entity to execute arbitrary commands on any host in the RHEV environment.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
multiple code execution issues fixed in APSB15-23
CVE: CVE-2015-5579
Component: flash-plugin
Severity: Critical
Release date: 2015-09-21T00:00:00+00:00

Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to execute arbitrary code or cause a denial of service (stack memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5567.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
default event scripts follow symbolic links
CVE: CVE-2015-1869
Component: abrt
CWE: CWE-59
Severity: Important
Release date: 2015-04-17T00:00:00+00:00

It was discovered that the default event handling scripts installed by ABRT did not handle symbolic links correctly. A local attacker with write access to an ABRT problem directory could use this flaw to escalate their privileges.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
heap buffer overflow in sort(1) keycompare_mb()
CVE: CVE-2015-4041
Component: coreutils
CWE: CWE-122
Severity: Low
Release date: 2015-04-27T00:00:00+00:00

The keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 on 64-bit platforms performs a size calculation without considering the number of bytes occupied by multibyte characters, which allows attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via long UTF-8 strings.


Remediation:
This flaw is triggered by using sort on specially crafted malicious data file. When using sort with trusted inputs, this flaw cannot be triggered.
Use after free in __ext4_journal_stop
CVE: CVE-2015-8961
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.0/CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2015-10-18T00:00:00+00:00

A flaw was found in the ext4 subsystem.  This vulnerability is a use after free vulnerability was found in __ext4_journal_stop(). Attackers could abuse this to allow any code which attempts to deal with the journal failure to be mishandled or not fail at all.  This could lead to data corruption or crashes.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6, 7 and MRG 2.x. This issue has been rated as having moderate security impact.

Remediation:
use-after-free in DOM
CVE: CVE-2015-1243
Component: chromium-browser
CWE: CWE-416
Severity: Important
Release date: 2015-01-28T00:00:00+00:00

Use-after-free vulnerability in the MutationObserver::disconnect function in core/dom/MutationObserver.cpp in the DOM implementation in Blink, as used in Google Chrome before 42.0.2311.135, allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering an attempt to unregister a MutationObserver object that is not currently registered.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258