huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Integer overflows, leading to stack-based buffer overflows in strto* related routines
CVE: CVE-2012-3480
Component: glibc
CWE: CWE-121
Severity: Moderate
Release date: 2012-08-12T00:00:00+00:00

Multiple integer overflows in the (1) strtod, (2) strtof, (3) strtold, (4) strtod_l, and other unspecified "related functions" in stdlib in GNU C Library (aka glibc or libc6) 2.16 allow local users to cause a denial of service (application crash) and possibly execute arbitrary code via a long string, which triggers a stack-based buffer overflow.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

To upgrade Hypervisors in Red Hat Enterprise Virtualization 2.2
environments using the disk image provided by this package, refer to: 

https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Enterprise_Linux/5/html/Hypervisor_Deployment_Guide/chap-Deployment_Guide-Upgrading_Red_Hat_Enterprise_Virtualization_Hypervisors.html

To upgrade Hypervisors in Red Hat Enterprise Virtualization 3.0
environments using the disk image provided by this package, refer to:

https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Hypervisor_Deployment_Guide/chap-Deployment_Guide-Upgrading_Red_Hat_Enterprise_Virtualization_Hypervisors.html
Multiple XSS in Table operations, Database structure, Trigger and Visualize GIS data pages (PMASA-2012-4)
CVE: CVE-2012-4345
Component: phpMyAdmin
Release date: 2012-08-16T00:00:00+00:00

Multiple cross-site scripting (XSS) vulnerabilities in the Database Structure page in phpMyAdmin 3.4.x before 3.4.11.1 and 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) a crafted table name during table creation, or a (2) Empty link or (3) Drop link for a crafted table name.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
ext4: fix inconsistency in ext4_fill_flex_info()
CVE: CVE-2012-2100
Component: kernel
Severity: Low
Release date: 2012-01-10T00:00:00+00:00

The ext4_fill_flex_info function in fs/ext4/super.c in the Linux kernel before 3.2.2, on the x86 platform and unspecified other platforms, allows user-assisted remote attackers to trigger inconsistent filesystem-groups data and possibly cause a denial of service via a malformed ext4 filesystem containing a super block with a large FLEX_BG group size (aka s_log_groups_per_flex value).  NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-4307.

Statement: This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise MRG 2.

Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

To install kernel packages manually, use "rpm -ivh [package]". Do not
use "rpm -Uvh" as that will remove the running kernel binaries from
your system. You may use "rpm -e" to remove old kernels after
determining that the new kernel functions properly on your system.
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

To install kernel packages manually, use "rpm -ivh [package]". Do not
use "rpm -Uvh" as that will remove the running kernel binaries from
your system. You may use "rpm -e" to remove old kernels after
determining that the new kernel functions properly on your system.
:Cookie): Do not run Storable::thaw() on arbitrary untrusted user input
CVE: CVE-2012-6143
Component: (Spoon
Release date: 2012-01-01T00:00:00+00:00

Spoon::Cookie in the Spoon module 0.24 for Perl does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via a crafted request, which is not properly handled when it is deserialized.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Miscellaneous memory safety hazards (rv:16.0.1) (MFSA 2012-88)
CVE: CVE-2012-4191
Component: Mozilla
Severity: Critical
Release date: 2012-10-11T00:00:00+00:00

The mozilla::net::FailDelayManager::Lookup function in the WebSockets implementation in Mozilla Firefox before 16.0.1, Thunderbird before 16.0.1, and SeaMonkey before 2.13.1 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors.

Statement: This issue does not affect the version of firefox and thunderbird as shipped with Red Hat Enterprise Linux 5 and 6

Remediation:
Heap buffer overflow in Skinny channel driver (AST-2012-005)
CVE: CVE-2012-2415
Component: asterisk
Release date: 2012-04-23T00:00:00+00:00

Heap-based buffer overflow in chan_skinny.c in the Skinny channel driver in Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1, and 10.x before 10.3.1 allows remote authenticated users to cause a denial of service or possibly have unspecified other impact via a series of KEYPAD_BUTTON_MESSAGE events.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Users connected through FTP can list hidden folder contents
CVE: CVE-2012-5503
Component: (Plone)
Severity: Low
Release date: 2012-11-06T00:00:00+00:00

ftp.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read hidden folder contents via unspecified vectors.

Statement: Not vulnerable. This issue did not affect the versions of luci (as provided by conga) as shipped with Red Hat Enterprise Linux 5.

Remediation:
backend allows unprivileged queries
CVE: CVE-2012-2696
Component: rhev
Severity: Low
Release date: 2012-12-04T00:00:00+00:00

The backend in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1 does not properly check privileges, which allows remote authenticated users to query arbitrary information via a (1) SOAP or (2) GWT request.

Statement: This issue does affect Red Hat Enterprise Virtualization 2 and 3.

Red Hat Enterprise Virtualization 2 is now in Production 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Virtualization Life Cycle: https://access.redhat.com/support/policy/updates/rhev/.

Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
DoS due to crafted JavaScript code that causes out-of-bounds access to stack memory
CVE: CVE-2012-5153
Component: v8
Release date: 2012-01-01T00:00:00+00:00

Google V8 before 3.14.5.3, as used in Google Chrome before 24.0.1312.52, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers an out-of-bounds access to stack memory.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Select element persistance allows for attacks (MFSA 2012-75)
CVE: CVE-2012-3984
Component: Mozilla
Severity: Critical
Release date: 2012-10-09T00:00:00+00:00

Mozilla Firefox before 16.0, Thunderbird before 16.0, and SeaMonkey before 2.13 do not properly handle navigation away from a web page that has a SELECT element's menu active, which allows remote attackers to spoof page content via vectors involving absolute positioning and scrolling.

Statement: Not vulnerable. This issue does not affect the version of firefox and thunderbird as shipped with Red Hat Enterprise Linux 5 and 6.

Remediation:
Insecure permissions used for /var/log/rhncfg-actions file
CVE: CVE-2012-2679
Component: rhncfg
Severity: Moderate
Release date: 2012-06-14T00:00:00+00:00

Red Hat Network (RHN) Configuration Client (rhncfg-client) in rhncfg before 5.10.27-8 uses weak permissions (world-readable) for /var/log/rhncfg-actions, which allows local users to obtain sensitive information about the rhncfg-client actions by reading the file.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Location object can be shadowed using Object.defineProperty (MFSA 2012-59)
CVE: CVE-2012-1956
Component: Mozilla
Severity: Moderate
Release date: 2012-08-28T00:00:00+00:00

Mozilla Firefox before 15.0, Thunderbird before 15.0, and SeaMonkey before 2.12 do not prevent use of the Object.defineProperty method to shadow the location object (aka window.location), which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via vectors involving a plugin.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
drm/i915: integer overflow in i915_gem_execbuffer2()
CVE: CVE-2012-2383
Component: kernel
CWE: CWE-190
Severity: Moderate
Release date: 2012-04-23T00:00:00+00:00

Integer overflow in the i915_gem_execbuffer2 function in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 3.3.5 on 32-bit platforms allows local users to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted ioctl call.

Statement: This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5 and Red Hat Enterprise MRG 2.

Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

To install kernel packages manually, use "rpm -ivh [package]". Do not
use "rpm -Uvh" as that will remove the running kernel binaries from
your system. You may use "rpm -e" to remove old kernels after
determining that the new kernel functions properly on your system.
png_IM_malloc() size argument
CVE: CVE-2012-3438
Component: GraphicsMagick
Release date: 2012-07-27T00:00:00+00:00

The Magick_png_malloc function in coders/png.c in GraphicsMagick 6.7.8-6 does not use the proper variable type for the allocation size, which might allow remote attackers to cause a denial of service (crash) via a crafted PNG file that triggers incorrect memory allocation.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
multiple flaws fixed in 6.27/7.18 (SA-CORE-2012-004)
CVE: CVE-2012-5651
Component: drupal
Release date: 2012-12-19T00:00:00+00:00

Drupal 6.x before 6.27 and 7.x before 7.18 displays information for blocked users, which might allow remote attackers to obtain sensitive information by reading the search results.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CSRF fixed in 4.0.5, 4.2
CVE: CVE-2012-0453
Component: bugzilla
Release date: 2012-02-23T00:00:00+00:00

Cross-site request forgery (CSRF) vulnerability in xmlrpc.cgi in Bugzilla 4.0.2 through 4.0.4 and 4.1.1 through 4.2rc2, when mod_perl is used, allows remote attackers to hijack the authentication of arbitrary users for requests that modify the product's installation via the XML-RPC API.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
SimpleXMLRPCServer CPU usage DoS via malformed XML-RPC request
CVE: CVE-2012-0845
Component: python
Severity: Moderate
Release date: 2012-02-12T00:00:00+00:00

SimpleXMLRPCServer.py in SimpleXMLRPCServer in Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an XML-RPC POST request that contains a smaller amount of data than specified by the Content-Length header.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
unspecified vulnerability related to InnoDB DoS
CVE: CVE-2012-1757
Component: mysql
Severity: Moderate
Release date: 2012-07-18T00:00:00+00:00

Unspecified vulnerability in Oracle MySQL Server 5.5.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB.


Remediation:
Multiple XSS flaws in web demos
CVE: CVE-2012-6092
Component: activemq
CWE: CWE-79
Severity: Moderate
Release date: 2012-10-18T00:00:00+00:00

Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via (1) the refresh parameter to PortfolioPublishServlet.java (aka demo/portfolioPublish or Market Data Publisher), or vectors involving (2) debug logs or (3) subscribe messages in webapp/websocket/chat.js.  NOTE: AMQ-4124 is covered by CVE-2012-6551.


Remediation:
The References section of this erratum contains a download link (you must
log in to download the update).
Temporary denial of service on interrupted token format operations
CVE: CVE-2012-4555
Component: pki-tps
Severity: Low
Release date: 2012-12-06T00:00:00+00:00

The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 does not properly handle interruptions of token format operations, which allows remote attackers to cause a denial of service (NULL pointer dereference and Apache httpd web server child process crash) via unspecified vectors.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
incorrect filtering of rsync --rsh command line option
CVE: CVE-2012-2252
Component: rssh
Release date: 2012-11-27T00:00:00+00:00

Incomplete blacklist vulnerability in rssh before 2.3.4, when the rsync protocol is enabled, allows local users to bypass intended restricted shell access via the --rsh command line option.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
DoS (crash) in the ISAKMP dissector (wnpa-sec-2012-35)
CVE: CVE-2012-5597
Component: wireshark
Severity: Low
Release date: 2012-11-28T00:00:00+00:00

[REJECTED CVE] An out of heap-based buffer bounds read flaw was found in the way Wireshark, a network traffic analyzer, performed dissection of certain ISAKMP packets. The issue occurs because dissect_isakmp() function in epan/dissectors/packet-isakmp.c in the ISAKMP dissector uses an incorrect data structure to determine IKEv2 decryption parameters. A remote attacker could provide a specially-crafted ISAKMP packet / packet capture that, when processed, would lead to wireshark executable crash.

Statement: This CVE has been rejected. This candidate is a duplicate of CVE-2012-6059. Note: All CVE users should reference CVE-2012-6059 instead of this candidate.

Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
multiple security fixes in 2.2.1, 2.1.4, 2.0.7, 1.9.16
CVE: CVE-2012-0795
Component: moodle
Release date: 2012-01-09T00:00:00+00:00

Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 does not validate e-mail address settings, which allows remote authenticated users to have an unspecified impact via a crafted address.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
1.3.1 and 1.4.0 Denial-of-service in image validation
CVE: CVE-2012-3443
Component: Django
Release date: 2012-07-30T00:00:00+00:00

The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a denial of service (memory consumption) by uploading an image file.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Stack-based buffer overflow by processing certain HTTP Digest Authentication headers (AST-2012-003)
CVE: CVE-2012-1184
Component: asterisk
Release date: 2012-03-15T00:00:00+00:00

Stack-based buffer overflow in the ast_parse_digest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x before 10.2.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string in an HTTP Digest Authentication header.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
unspecified Server DoS vulnerability
CVE: CVE-2012-3156
Component: mysql
Severity: Low
Release date: 2012-10-16T00:00:00+00:00

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.25 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server.


Remediation:
Signed overflows in SO_{SND|RCV}BUF in sock_setsockopt()
CVE: CVE-2012-6704
Component: kernel
CWE: CWE-190
Severity: Moderate
CVSS v3: 7.4/CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2012-04-26T00:00:00+00:00

A flaw was found in the Linux kernel's implementation of setsockopt for the SO_{SND|RCV}BUF setsockopt() system call.  Users with non-namespace CAP_NET_ADMIN are able to trigger this call and create a situation in which the sockets sendbuff data size could be negative.

Statement: This issue does not affect the kernels as shipping with Red Hat Enterprise Linux 5, 6, 7, MRG-2 and realtime.

Remediation:
insecure permissions on configuration file
CVE: CVE-2012-5578
Component: python-keyring
Release date: 2012-07-27T00:00:00+00:00

Python keyring has insecure permissions on new databases allowing world-readable files to be created

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
multiple flaws fixed in Google V8 3.13.7.5 (Chrome 23.0.1271.64)
CVE: CVE-2012-5128
Component: v8
Release date: 2012-11-07T00:00:00+00:00

Google V8 before 3.13.7.5, as used in Google Chrome before 23.0.1271.64, does not properly perform write operations, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation: