huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
unspecified vulnerability fixed in 6u39 and 7u13 (Deployment)
CVE: CVE-2013-0423
Component: JDK
Severity: Moderate
Release date: 2013-02-01T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than other CVEs listed in the February 2013 CPU.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
DoS (application crash) in the Netmon file parser (wnpa-sec-2013-51)
CVE: CVE-2013-4933
Component: wireshark
Severity: Low
Release date: 2013-07-26T00:00:00+00:00

The netmon_open function in wiretap/netmon.c in the Netmon file parser in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) via a crafted packet-trace file.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
XSS in mod/quiz/report/responses/responses_table.php
CVE: CVE-2013-4525
Component: moodle
Release date: 2013-11-04T00:00:00+00:00

Cross-site scripting (XSS) vulnerability in mod/quiz/report/responses/responses_table.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 allows remote authenticated users to inject arbitrary web script or HTML via an answer to a text-based quiz question.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Multiple stack-based buffer overflows when processing certain ZRTP Hello packets
CVE: CVE-2013-2222
Component: libzrtpcpp
Release date: 2013-06-27T00:00:00+00:00

Multiple stack-based buffer overflows in GNU ZRTPCPP before 3.2.0 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted ZRTP Hello packet to the (1) ZRtp::findBestSASType, (2) ZRtp::findBestAuthLen, (3) ZRtp::findBestCipher, (4) ZRtp::findBestHash, or (5) ZRtp::findBestPubKey functions.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
disabled CONFIG_NETLABEL in cipso_v4_validate in include/net/cipso_ipv4.h leads to denial of service
CVE: CVE-2013-7470
Component: kernel
CWE: CWE-400
Severity: Moderate
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2013-10-19T00:00:00+00:00

cipso_v4_validate in include/net/cipso_ipv4.h in the Linux kernel before 3.11.7, when CONFIG_NETLABEL is disabled, allows attackers to cause a denial of service (infinite loop and crash), as demonstrated by icmpsic, a different vulnerability than CVE-2013-0310.


Remediation:
use-after-free flaw
CVE: CVE-2013-6631
Component: libjingle
Release date: 2013-11-12T00:00:00+00:00

Use-after-free vulnerability in the Channel::SendRTCPPacket function in voice_engine/channel.cc in libjingle in WebRTC, as used in Google Chrome before 31.0.1650.48 and other products, allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via vectors that trigger the absence of certain statistics initialization, leading to the skipping of a required DeRegisterExternalTransport call.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
remote arbitrary command execution as root on cluster
CVE: CVE-2013-4319
Component: torque
Release date: 2013-09-06T00:00:00+00:00

pbs_mom in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 2.5.x, 4.x, and earlier does not properly restrict access by unprivileged ports, which allows remote authenticated users to execute arbitrary jobs by submitting a command.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
unspecified information leak issue (APSB13-15)
CVE: CVE-2013-2737
Component: acroread
Severity: Moderate
Release date: 2013-05-14T00:00:00+00:00

A JavaScript API in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to obtain sensitive information via unspecified vectors.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Stack-overflow by processing XML element with multiple file signatures
CVE: CVE-2013-2019
Component: boinc-client
Release date: 2013-04-28T00:00:00+00:00

Stack-based buffer overflow in BOINC 6.10.58 and 6.12.34 allows remote attackers to have unspecified impact via multiple file_signature elements.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Plain Text Password Disclosure via configuration parameters
CVE: CVE-2013-5676
Component: Plugin
Severity: Low
Release date: 2013-12-06T00:00:00+00:00

The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.

Statement: Not Vulnerable. The SonarQube plug-in for Jenkins is not shipped by Red Hat.

Remediation:
GnomeFileTypeDetector path access check (Libraries, 8004288)
CVE: CVE-2013-2449
Component: OpenJDK
Severity: Moderate
Release date: 2013-06-18T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via unknown vectors related to Libraries.  NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to GnomeFileTypeDetector and a missing check for read permissions for a path.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
All users of java-1.7.0-openjdk are advised to upgrade to these updated
packages, which resolve these issues. All running instances of OpenJDK Java
must be restarted for the update to take effect.

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
saltstack multiple flaws
CVE: CVE-2013-4437
Component: salt
Release date: 2013-09-19T00:00:00+00:00

Unspecified vulnerability in salt-ssh in Salt (aka SaltStack) 0.17.0 has unspecified impact and vectors related to "insecure Usage of /tmp."

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Arbitrary locations file write due absent validation of soap.wsdl_cache_dir configuration directive value
CVE: CVE-2013-1635
Component: php53
Severity: Moderate
Release date: 2013-02-07T00:00:00+00:00

ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13 does not validate the relationship between the soap.wsdl_cache_dir directive and the open_basedir directive, which allows remote attackers to bypass intended access restrictions by triggering the creation of cached SOAP WSDL files in an arbitrary directory.

Statement: We do not consider safe_mode / open_basedir restriction bypass issues to be security sensitive.  For more details see http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=169857#c1 and http://www.php.net/security-note.php

Remediation:
several XSS flaws in ganglia-web
CVE: CVE-2013-1770
Component: ganglia
Release date: 2013-01-18T00:00:00+00:00

Cross-site scripting (XSS) vulnerability in views_view.php in Ganglia Web 3.5.7 allows remote attackers to inject arbitrary web script or HTML via the view_name parameter.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
security releases 1.21.3, 1.20.8, and 1.19.9
CVE: CVE-2013-4572
Component: mediawiki
Release date: 2013-08-19T00:00:00+00:00

The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies when a user is autocreated, which allows remote attackers to authenticate as the created user.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
NULL pointer dereference (DoS) when glibc v.2.17 or FIPS-140 enabled Linux system used
CVE: CVE-2013-4122
Component: cyrus-sasl
CWE: CWE-476
Severity: Moderate
Release date: 2013-07-12T00:00:00+00:00

Cyrus SASL 2.1.23, 2.1.26, and earlier does not properly handle when a NULL value is returned upon an error by the crypt function as implemented in glibc 2.17 and later, which allows remote attackers to cause a denial of service (thread crash and consumption) via (1) an invalid salt or, when FIPS-140 is enabled, a (2) DES or (3) MD5 encrypted password, which triggers a NULL pointer dereference.

Statement: Not Vulnerable. This issue does not affect the version of cyrus-sasl package as shipped with Red Hat Enterprise Linux 5 and 6.

Remediation:
multiple code execution flaws (APSB13-02)
CVE: CVE-2013-0618
Component: acroread
Severity: Critical
Release date: 2013-01-08T00:00:00+00:00

Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to execute arbitrary code via unspecified vectors, related to a "logic error," a different vulnerability than CVE-2013-0607, CVE-2013-0608, CVE-2013-0611, and CVE-2013-0614.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
default auth.conf allows authenticated node to submit a report for any other node
CVE: CVE-2013-2275
Component: Puppet
Severity: Moderate
Release date: 2013-03-12T00:00:00+00:00

The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, allows remote authenticated nodes to submit reports for other nodes via unspecified vectors.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
/tmp directory used by default for uploaded files (possibility to overwrite arbitrary files)
CVE: CVE-2013-0248
Component: apache-commons-fileupload
CWE: CWE-552
Severity: Low
Release date: 2013-03-06T00:00:00+00:00

The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.

Statement: Red Hat Enterprise Linux 5 and Red Hat Satellite Server 5 are now in Production 3 and Production 2 Phases of the support and maintenance life cycle respectively. This has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/ and the Red Hat Satellite and Proxy Server Life Cycle: https://access.redhat.com/support/policy/updates/satellite.

Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 4 and 5; Red Hat JBoss Enterprise Portal Platform 5; Red Hat JBoss Enterprise SOA Platform 4 and 5; and Red Hat JBoss Enterprise Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/.

This issue affects the versions of commons-fileupload as shipped with Red Hat Enterprise Virtualization Manager 3 and Red Hat JBoss Fuse Service Works 6. Red Hat Product Security has rated this issue as having Low security impact. A future update to these products may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
By default, the system wide temporary directory is configured as the repository to use when uploading files. Setting the repository to another location will mitigate this vulnerability.
heap-based buffer overflow if MTU is increased on reconnection
CVE: CVE-2013-7098
Component: openconnect
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2013-01-01T00:00:00+00:00

OpenConnect VPN client with GnuTLS before 5.02 contains a heap overflow if MTU is increased on reconnection.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
lack of access control in Exclusion plugin (SECURITY-53)
CVE: CVE-2013-6373
Component: Jenkins
Severity: Low
Release date: 2013-11-21T00:00:00+00:00

The Exclusion plugin before 0.9 for Jenkins does not properly prevent access to resource locks, which allows remote authenticated users to list and release resources via unspecified vectors.

Statement: Not affected. This issue did not affect Jenkins as shipped with various Red Hat products, as they do not include the Jenkins Exclusion plugin.

Remediation:
DoS (crash) in the ASN.1 BER dissector (wnpa-sec-2013-25, upstream #8599)
CVE: CVE-2013-3556
Component: wireshark
Severity: Low
Release date: 2013-05-17T00:00:00+00:00

The fragment_add_seq_common function in epan/reassemble.c in the ASN.1 BER dissector in Wireshark before r48943 has an incorrect pointer dereference during a comparison, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.

Statement: Not Vulnerable. This issue does not affect the version of wireshark as shipped with Red Hat Enterprise Linux 5 and 6.

Remediation:
Plaintext passwords in server logs
CVE: CVE-2013-4293
Component: Server
Severity: Low
Release date: 2013-10-21T00:00:00+00:00

The server in Red Hat JBoss Operations Network (JON) 3.1.2 logs passwords in plaintext, which allows local users to obtain sensitive information by reading the log files.


Remediation:
The References section of this erratum contains a download link (you must
log in to download the update). Before applying this update, back up your
existing JBoss Operations Network installation (including its databases,
applications, configuration files, the JBoss Operations Network server's
file system directory, and so on).

Note: This update provides fixes for the server, agent, and core GUI
components of Red Hat JBoss Operations Network. It is recommended to apply
all the patches provided by this update.

Refer to the JBoss Operations Network 3.1.2 Release Notes for installation
information.
cloud controller (aka CLC) component DNS amplification DoS
CVE: CVE-2013-4769
Component: Eucalyptus
Release date: 2013-01-01T00:00:00+00:00

The cloud controller (aka CLC) component in Eucalyptus 3.3.x and 3.4.x before 3.4.2, when the dns.recursive.enabled setting is used, allows remote attackers to cause a denial of service (traffic amplification) via spoofed DNS queries.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
new security issues fixed in 3.6.1
CVE: CVE-2013-4339
Component: wordpress
Release date: 2013-09-10T00:00:00+00:00

WordPress before 3.6.1 does not properly validate URLs before use in an HTTP redirect, which allows remote attackers to bypass intended redirection restrictions via a crafted string.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Multiple integer overflows leading to heap-based bufer overflows
CVE: CVE-2013-1992
Component: libdmx
CWE: CWE-122
Severity: Moderate
Release date: 2013-05-23T00:00:00+00:00

Multiple integer overflows in X.org libdmx 1.1.2 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) DMXGetScreenAttributes, (2) DMXGetWindowAttributes, and (3) DMXGetInputAttributes functions.

Statement: Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This flaw only affects X clients that connect to malicious X servers.  Generally speaking, these will be untrusted/unknown X servers only, as trusted remote X servers should be connected to via SSH (which provides end-point verification and authentication), or the local X server.  Because this flaw requires that the X server be changed (recompiled to deviate from a standard X server) in order to impact the X client, it requires root privileges on the X server to effect the change.  If this is a system where the X client and server are on the same (local) host, and an attacker is able to replace the X server binary, then they already have root privileges and no trust boundary is crossed.  With remote X servers, using SSH with strict host-key checking will prevent the X client from connecting to the X server without intervention, as the user will be alerted to host-key changes.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
unspecified DoS related to Prepared Statements (CPU July 2013)
CVE: CVE-2013-3805
Component: mysql
Severity: Low
Release date: 2013-07-17T00:00:00+00:00

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.30 and earlier and 5.6.10 allows remote authenticated users to affect availability via unknown vectors related to Prepared Statements.

Statement: Not vulnerable. This issue did not affect the versions of mysql as shipped with Red Hat Enterprise Linux 5 and 6.

Remediation: