huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
AMQP 0-10 protocol sequence-set maximal range DoS (incomplete CVE-2015-0203 fix)
CVE: CVE-2015-0224
Component: qpid-cpp
Severity: Moderate
Release date: 2015-01-27T00:00:00+00:00

A flaw was found in the way the Qpid daemon (qpidd) processed certain protocol sequences. An unauthenticated attacker able to send a specially crafted protocol sequence set that could use this flaw to crash qpidd.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied and that the Satellite is updated to the most recent 6.1.x release. 

For details on how to apply this update, refer to:

https://access.redhat.com/documentation/en/red-hat-satellite/6.2/single/installation-guide#upgrading_satellite_server_and_capsule_server
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
arbitrary code execution when verifying module signatures
CVE: CVE-2015-3408
Component: perl-Module-Signature
CWE: CWE-77
Severity: Moderate
Release date: 2015-04-05T00:00:00+00:00

Module::Signature before 0.74 allows remote attackers to execute arbitrary shell commands via a crafted SIGNATURE file which is not properly handled when generating checksums from a signed manifest.


Remediation:
unspecified vulnerability related to Server:Partition (CPU July 2015)
CVE: CVE-2015-4772
Component: mysql
Severity: Moderate
Release date: 2015-07-14T00:00:00+00:00

Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Glance v2 API host file disclosure through qcow2 backing file
CVE: CVE-2015-5163
Component: openstack-glance
CWE: CWE-454
Severity: Important
Release date: 2015-08-13T00:00:00+00:00

A flaw was found in the OpenStack Image Service (glance) import task action. When processing a malicious qcow2 header, glance could be tricked into reading an arbitrary file from the glance host. Only setups using the glance V2 API are affected by this flaw.


Remediation:
Before applying this update, ensure all previously released errata relevant
to your system have been applied.

For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
integer overflow in the jas_matrix_create() function
CVE: CVE-2015-8751
Component: jasper
CWE: CWE-190
Severity: Moderate
Release date: 2015-12-24T00:00:00+00:00

Integer overflow in the jas_matrix_create function in JasPer allows context-dependent attackers to have unspecified impact via a crafted JPEG 2000 image, related to integer multiplication for memory allocation.

Statement: This issue did not affect the versions of jasper as shipped with Red Hat Enterprise Linux 6 and 7 as it was already fixed via CVE-2008-3520.

Remediation:
xen crash due to use after free on hvm guest teardown (xsa116)
CVE: CVE-2015-0361
Component: kernel
CWE: CWE-416
Severity: Moderate
Release date: 2015-01-06T00:00:00+00:00

Use-after-free vulnerability in Xen 4.2.x, 4.3.x, and 4.4.x allows remote domains to cause a denial of service (system crash) via a crafted hypercall during HVM guest teardown.

Statement: Not vulnerable.

This issue does not affect the kernel-xen packages as shipped with Red Hat Enterprise Linux 5.

Remediation:
several issues fixed in 7.38 and 6.36 (SA-CORE-2015-002)
CVE: CVE-2015-3234
Component: drupal
Release date: 2015-06-17T00:00:00+00:00

The OpenID module in Drupal 6.x before 6.36 and 7.x before 7.38 allows remote attackers to log into other users' accounts by leveraging an OpenID identity from certain providers, as demonstrated by the Verisign, LiveJournal, and StackExchange providers.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
use-after-free in DOM
CVE: CVE-2015-1209
Component: chromium-browser
CWE: CWE-416
Severity: Important
Release date: 2015-02-04T00:00:00+00:00

Use-after-free vulnerability in the VisibleSelection::nonBoundaryShadowTreeRootNode function in core/editing/VisibleSelection.cpp in the DOM implementation in Blink, as used in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers improper handling of a shadow-root anchor.

Statement: This issue affects the versions of webkitgtk and webkitgtk3 as shipped with Red Hat Enterprise Linux 6 and 7 respectively.

Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
multiple vulnerabilities fixed in 4.7.80.23
CVE: CVE-2015-8478
Component: v8
Severity: Moderate
Release date: 2015-01-21T00:00:00+00:00

Multiple unspecified vulnerabilities in Google V8 before 4.7.80.23, as used in Google Chrome before 47.0.2526.73, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
multiple code execution issues fixed in APSB15-25
CVE: CVE-2015-7627
Component: flash-plugin
Severity: Critical
Release date: 2015-10-13T00:00:00+00:00

Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-7625, CVE-2015-7626, CVE-2015-7630, CVE-2015-7633, and CVE-2015-7634.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
unspecified vulnerability fixed in 8u65 (JavaFX)
CVE: CVE-2015-4908
Component: JDK
Severity: Moderate
Release date: 2015-10-20T00:00:00+00:00

Unspecified vulnerability in Oracle Java SE 8u60 and JavaFX 2.2.85 allows remote attackers to affect confidentiality via unknown vectors, a different vulnerability than CVE-2015-4906 and CVE-2015-4916.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
directory traversal vulnerability
CVE: CVE-2015-1589
Component: archmage
Release date: 2015-01-24T00:00:00+00:00

Directory traversal vulnerability in arCHMage 0.2.4 allows remote attackers to write to arbitrary files via a .. (dot dot) in a CHM file.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Free called on unitialized pointer in exif.c
CVE: CVE-2015-0232
Component: php
CWE: CWE-822
Severity: Moderate
Release date: 2015-01-01T00:00:00+00:00

An uninitialized pointer use flaw was found in PHP's Exif extension. A specially crafted JPEG or TIFF file could cause a PHP application using the exif_read_data() function to crash or, possibly, execute arbitrary code with the privileges of the user running that PHP application.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Multiple security issues fixed in 1.1
CVE: CVE-2015-8747
Component: radicale
Release date: 2015-12-31T00:00:00+00:00

The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
LBMR infinite loop (wnpa-sec-2015-12)
CVE: CVE-2015-3808
Component: wireshark
CWE: CWE-835
Severity: Moderate
Release date: 2015-05-12T00:00:00+00:00

The dissect_lbmr_pser function in epan/dissectors/packet-lbmr.c in the LBMR dissector in Wireshark 1.12.x before 1.12.5 does not reject a zero length, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.

Statement: This issue did not affect the versions of wireshark as shipped with Red Hat Enterprise Linux 5, 6 and 7.

Remediation:
Out-of-bounds heap read when parsing file with unfinished xml declaration
CVE: CVE-2015-8317
Component: libxml2
CWE: CWE-125
Severity: Low
Release date: 2015-06-29T00:00:00+00:00

A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to leak potentially sensitive information.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).

After installing the updated packages, the httpd daemon will be restarted automatically.
Stored XSS vulnerability in smart class parameters/variables
CVE: CVE-2015-7518
Component: foreman
CWE: CWE-79
Severity: Moderate
Release date: 2015-11-26T00:00:00+00:00

A stored cross-site scripting (XSS) flaw was found in the smart class parameters/variables field. By sending a specially crafted request to Satellite, a remote, authenticated attacker could embed HTML content into the stored data, allowing them to inject malicious content into the web page that is used to view that data.


Remediation:
Before applying this update, make sure all previously released
errata relevant to your system have been applied.

To update this system to include these fixes, ensure your system has 
access to the latest Red Hat packages.  For instructions on how to 
apply this update, refer to:

https://access.redhat.com/articles/11258

Then re-run the installer to complete the upgrade:

# katello-installer --upgrade

or

# capsule-installer --upgrade
Information leakage in LocalStorage
CVE: CVE-2015-6759
Component: chromium-browser
CWE: CWE-200
Severity: Moderate
Release date: 2015-10-13T00:00:00+00:00

The shouldTreatAsUniqueOrigin function in platform/weborigin/SecurityOrigin.cpp in Blink, as used in Google Chrome before 46.0.2490.71, does not ensure that the origin of a LocalStorage resource is considered unique, which allows remote attackers to obtain sensitive information via vectors involving a blob: URL.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
multiple code execution issues fixed in APSB15-25
CVE: CVE-2015-7631
Component: flash-plugin
Severity: Critical
Release date: 2015-10-13T00:00:00+00:00

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via a TextLine object with a crafted validity property, a different vulnerability than CVE-2015-7629, CVE-2015-7643, and CVE-2015-7644.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Crash due to out of bounds error in SpliceImage
CVE: CVE-2015-8897
Component: ImageMagick
CWE: CWE-125
Severity: Low
Release date: 2015-01-01T00:00:00+00:00

The SpliceImage function in MagickCore/transform.c in ImageMagick before 6.9.2-4 allows remote attackers to cause a denial of service (application crash) via a crafted png file.


Remediation:
buffer over-read in function T1_Get_Private_Dict in type1/t1parse.c
CVE: CVE-2015-9290
Component: freetype
CWE: CWE-125
Severity: Low
CVSS v3: 6.1/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2015-01-01T00:00:00+00:00

In FreeType before 2.6.1, a buffer over-read occurs in type1/t1parse.c on function T1_Get_Private_Dict where there is no check that the new values of cur and limit are sensible before going to Again.

Statement: This issue affects the versions of freetype as shipped with Red Hat Enterprise Linux 5 and 6.

This issue did not affect the versions of freetype as shipped with Red Hat Enterprise Linux 7 and 8.

Red Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Low, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Remediation:
main/php_open_temporary_file.c does not ensure thread safety
CVE: CVE-2015-8878
Component: php
CWE: CWE-567
Severity: Moderate
Release date: 2015-07-06T00:00:00+00:00

main/php_open_temporary_file.c in PHP before 5.5.28 and 5.6.x before 5.6.12 does not ensure thread safety, which allows remote attackers to cause a denial of service (race condition and heap memory corruption) by leveraging an application that performs many temporary-file accesses.


Remediation:
URL spoofing in reader mode (MFSA 2015-103)
CVE: CVE-2015-4508
Component: Mozilla
CWE: CWE-120
Severity: Low
Release date: 2015-09-22T00:00:00+00:00

Mozilla Firefox before 41.0, when reader mode is enabled, allows remote attackers to spoof the relationship between address-bar URLs and web content via a crafted web site.


Remediation:
Privilege escalation through SVG navigation (MFSA 2015-28)
CVE: CVE-2015-0818
Component: Mozilla
Severity: Critical
Release date: 2015-03-21T00:00:00+00:00

Mozilla Firefox before 36.0.4, Firefox ESR 31.x before 31.5.3, and SeaMonkey before 2.33.1 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving SVG hash navigation.

Statement: This issue does not affect the version of thunderbird package as shipped with Red Hat Enterprise Linux 5, 6 and 7.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
unspecified vulnerability related to Installation (CPU April 2015)
CVE: CVE-2015-2576
Component: mysql-utilities
Severity: Low
Release date: 2015-04-15T00:00:00+00:00

Unspecified vulnerability in the MySQL Utilities component in Oracle MySQL 1.5.1 and earlier, when running on Windows, allows local users to affect integrity via unknown vectors related to Installation.

Statement: This issue did not affect the versions of mysql or mysql55 as shipped with Red Hat Enterprise Linux 5, 6, or 7 as it only affects MySQL versions shipped on Microsoft Windows.

Remediation:
XXE injection into job configurations via CLI (SECURITY-173)
CVE: CVE-2015-5319
Component: jenkins
Severity: Low
Release date: 2015-11-11T00:00:00+00:00

XML external entity (XXE) vulnerability in the create-job CLI command in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to read arbitrary files via a crafted job configuration that is then used in an "XML-aware tool," as demonstrated by get-job and update-job.


Remediation:
Before applying this update, make sure all previously released 
errata relevant to your system have been applied.

See the OpenShift Enterprise 2.2 Release Notes, which will be 
updated shortly for release 2.2.9, for important instructions on how 
to fully apply this asynchronous errata update:

https://access.redhat.com/documentation/en-US/OpenShift_Enterprise/2/html-single/2.2_Release_Notes/index.html#chap-Asynchronous_Errata_Updates

This update is available via the Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at: 
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released 
errata relevant to your system have been applied.

See the OpenShift Enterprise 3.1 documentation, which will be 
updated shortly for release 3.1.1, for important instructions on how 
to upgrade your OpenShift cluster and fully apply this asynchronous 
errata update:

https://docs.openshift.com/enterprise/3.1/release_notes/ose_3_1_release_notes.html

This update is available via the Red Hat Network. Details on how to 
use the Red Hat Network to apply this update are available at 
https://access.redhat.com/articles/11258.
multiple code execution issues fixed in APSB15-32
CVE: CVE-2015-8655
Component: flash-plugin
Severity: Critical
Release date: 2015-12-08T00:00:00+00:00

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via crafted MPEG-4 data, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, CVE-2015-8454, CVE-2015-8653, CVE-2015-8821, and CVE-2015-8822.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Denial-of-service possibility in logout() view by filling session store
CVE: CVE-2015-5964
Component: python-django
CWE: CWE-770
Severity: Moderate
Release date: 2015-08-18T00:00:00+00:00

It was found that certain Django functions would, in certain circumstances, create empty sessions. A remote attacker could use this flaw to fill up the session store or cause other users' session records to be evicted by requesting a large number of new sessions.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258