huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
insufficient syscall number validation in perf and ftrace subsystems
CVE: CVE-2014-7825
Component: kernel
Severity: Moderate
Release date: 2014-11-07T00:00:00+00:00

An out-of-bounds memory access flaw, CVE-2014-7825, was found in the syscall tracing functionality of the Linux kernel's perf subsystem. A local, unprivileged user could use this flaw to crash the system. Additionally, an out-of-bounds memory access flaw, CVE-2014-7826, was found in the syscall tracing functionality of the Linux kernel's ftrace subsystem. On a system with ftrace syscall tracing enabled, a local, unprivileged user could use this flaw to crash the system, or escalate their privileges.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat
Enterprise Linux 5.

This issue does affect the Linux kernel packages as shipped with Red Hat
Enterprise Linux 6, 7 and Red Hat Enterprise MRG 2. Future kernel updates for
the respective releases may address this issue.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258

To install kernel packages manually, use "rpm -ivh [package]". Do not use
"rpm -Uvh" as that will remove the running kernel binaries from your
system. You may use "rpm -e" to remove old kernels after determining that
the new kernel functions properly on your system.
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
possible CSRF attacks to some address book operations as well as to the ACL and Managesieve plugins
CVE: CVE-2014-9587
Component: roundcubemail
Release date: 2014-12-15T00:00:00+00:00

Multiple cross-site request forgery (CSRF) vulnerabilities in Roundcube Webmail before 1.0.4 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to (1) address book operations or the (2) ACL or (3) Managesieve plugins.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Swift metadata constraints are not correctly enforced
CVE: CVE-2014-7960
Component: openstack-swift
CWE: CWE-400
Severity: Moderate
Release date: 2014-09-04T00:00:00+00:00

A flaw was found in the metadata constraints in OpenStack Object Storage (swift). By adding metadata in several separate calls, a malicious user could bypass the max_meta_count constraint, and store more metadata than allowed by the configuration.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, ensure all previously released errata
relevant to your system have been applied.

Red Hat Enterprise Linux OpenStack Platform 5 for RHEL 6 runs on Red Hat
Enterprise Linux 6.6.

The Red Hat Enterprise Linux OpenStack Platform 5 for RHEL 6 Release Notes
contain the following:

* An explanation of the way in which the provided components interact to
form a working cloud computing environment.

* Technology Previews, Recommended Practices, and Known Issues.

* The channels required for Red Hat Enterprise Linux OpenStack Platform 5
for RHEL 6, including which channels need to be enabled and disabled.

The Release Notes are linked to in the References section.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, ensure all previously released errata
relevant to your system have been applied.

Red Hat Enterprise Linux OpenStack Platform 5 for RHEL 7 runs on Red Hat
Enterprise Linux 7.1.

The Red Hat Enterprise Linux OpenStack Platform 5 for RHEL 7 Release Notes
contain the following:

* An explanation of the way in which the provided components interact to
form a working cloud computing environment.

* Technology Previews, Recommended Practices, and Known Issues.

* The channels required for Red Hat Enterprise Linux OpenStack Platform 5
for RHEL 7, including which channels need to be enabled and disabled.

The Release Notes are linked to in the References section.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
client-side denial of service when using anonymous ECDH
CVE: CVE-2014-3470
Component: openssl
CWE: CWE-476
Severity: Moderate
Release date: 2014-06-05T00:00:00+00:00

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service (NULL pointer dereference and client crash) by triggering a NULL certificate value.

Statement: This issue does not affect the version of openssl and openssl097a as shipped with Red Hat Enterprise Linux 5. This issue does not affect the openssl098e as shipped with Red Hat Enterprise Linux 6.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
arbitrary code execution and denial of service via a crafted web site (WSA-2015-0001)
CVE: CVE-2014-1334
Component: webkitgtk
Severity: Moderate
Release date: 2014-01-01T00:00:00+00:00

WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.

Statement: Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
default password set at install
CVE: CVE-2014-0175
Component: mcollective
CWE: CWE-798
Severity: Important
Release date: 2014-07-10T00:00:00+00:00

mcollective has a default password set at install


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

See the latest OpenShift Enterprise Deployment Guide at
https://access.redhat.com/site/documentation/en-US/OpenShift_Enterprise/2/
for instructions on initial installations and upgrades from previous
versions.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258.
Insufficient authorization constraints
CVE: CVE-2014-8115
Component: Workbench
CWE: CWE-285
Severity: Moderate
Release date: 2014-01-01T00:00:00+00:00

It was discovered that the default authorization constrains applied on servelets deployed in the KIE Workbench application were insufficient. A remote, authenticated user without sufficient privileges could use this flaw to upload or download arbitrary files, perform privileged actions that otherwise cannot be accessed, or perform other more complex attacks.

Statement: Red Hat JBoss BRMS 5 is now in Phase 3, Extended Life Support, of its life cycle. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/

Remediation:
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing installation, including all applications, configuration files,
databases and database settings, and so on.

It is recommended to halt the server by stopping the JBoss Application
Server process before installing this update, and then after installing
the update, restart the server by starting the JBoss Application Server
process.
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing installation, including all applications, configuration files,
databases and database settings, and so on.

It is recommended to halt the server by stopping the JBoss Application
Server process before installing this update, and then after installing the
update, restart the server by starting the JBoss Application Server
process.
buffer overflow in png_combine_row
CVE: CVE-2014-9495
Component: libpng
Severity: Moderate
Release date: 2014-12-22T00:00:00+00:00

Heap-based buffer overflow in the png_combine_row function in libpng before 1.5.21 and 1.6.x before 1.6.16, when running on 64-bit systems, might allow context-dependent attackers to execute arbitrary code via a "very wide interlaced" PNG image.

Statement: Not vulnerable. This issue does not affect the version of libpng as shipped with Red Hat Enterprise Linux 5, 6 and 7. For a more detailed explanation please refer to: https://bugzilla.redhat.com/show_bug.cgi?id=1177327#c1

Remediation:
unauthenticated information disclosure
CVE: CVE-2014-3562
Component: 389-ds
CWE: CWE-201
Severity: Important
Release date: 2014-08-07T00:00:00+00:00

It was found that when replication was enabled for each attribute in Red Hat Directory Server / 389 Directory Server, which is the default configuration, the server returned replicated metadata when the directory was searched while debugging was enabled. A remote attacker could use this flaw to disclose potentially sensitive information.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
multiple XSS issues fixed in 0.7.49
CVE: CVE-2014-2236
Component: askbot
Release date: 2014-02-27T00:00:00+00:00

Multiple cross-site scripting (XSS) vulnerabilities in Askbot before 0.7.49 allow remote attackers to inject arbitrary web script or HTML via vectors related to the (1) tag or (2) user search forms.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
incomplete fixes for command execution flaws
CVE: CVE-2014-5009
Component: snoopy
Severity: Important
CVSS v3: 7.1/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Release date: 2014-07-03T00:00:00+00:00

Various command-execution flaws were found in the Snoopy library included with Nagios. These flaws allowed remote attackers to execute arbitrary commands by manipulating Nagios HTTP headers.


Remediation:
bypass screensaver lock via the keyboard's Menu key
CVE: CVE-2014-1949
Component: cinnamon
Release date: 2014-02-12T00:00:00+00:00

GTK+ 3.10.9 and earlier, as used in cinnamon-screensaver, gnome-screensaver, and other applications, allows physically proximate attackers to bypass the lock screen by pressing the menu button.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
insecure temporary file use for cache data
CVE: CVE-2014-5459
Component: php-pear
CWE: CWE-377
Severity: Moderate
Release date: 2014-08-25T00:00:00+00:00

The PEAR_REST class in REST.php in PEAR in PHP through 5.6.0 allows local users to write to arbitrary files via a symlink attack on a (1) rest.cachefile or (2) rest.cacheid file in /tmp/pear/cache/, related to the retrieveCacheFirst and useLocalCache functions.

Statement: This issue did not affect the versions of php-pear as shipped with Red Hat Enterprise Linux 5, 6 and 7 as well as Red Hat Software Collections as they do not use a world-writable directory for storing PEAR cache data.

Remediation:
use-after-free in FFmpeg
CVE: CVE-2014-7937
Component: chromium-browser
CWE: CWE-416
Severity: Important
Release date: 2014-01-01T00:00:00+00:00

Multiple off-by-one errors in libavcodec/vorbisdec.c in FFmpeg before 2.4.2, as used in Google Chrome before 40.0.2214.91, allow remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted Vorbis I data.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
use after free vulnerability in unserialize()
CVE: CVE-2014-8142
Component: php
CWE: CWE-416
Severity: Moderate
Release date: 2014-12-18T00:00:00+00:00

A flaws was discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code.

Statement: This issue did not affect the versions of php as shipped with Red Hat Enterprise Linux 5 and 6 or the versions of php53 as shipped with Red Hat Enterprise Linux 5.

The PHP manual documents that using unserialize() on untrusted user input is unsafe and not recommended.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
possible arbitrary code execution via SPDY implementation in 1.5.10
CVE: CVE-2014-0088
Component: nginx
Severity: Moderate
Release date: 2014-03-04T00:00:00+00:00

The SPDY implementation in the ngx_http_spdy_module module in nginx 1.5.10 before 1.5.11, when running on a 32-bit platform, allows remote attackers to execute arbitrary code via a crafted request.


Remediation:
upstream 2.6.2, 2.5.5, and 2.4.9 fixes
CVE: CVE-2014-0122
Component: moodle
Release date: 2014-03-17T00:00:00+00:00

mod/chat/chat_ajax.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly check for the mod/chat:chat capability during chat sessions, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by remaining in a chat session after an intra-session capability removal by an administrator.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
unspecified vulnerability related to Optimizer DoS (CPU Jan 2014)
CVE: CVE-2014-0437
Component: mysql
Severity: Moderate
Release date: 2014-01-14T00:00:00+00:00

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.72 and earlier, 5.5.34 and earlier, and 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
security issues fixed in version 3.9.2
CVE: CVE-2014-5265
Component: wordpress
Release date: 2014-08-06T00:00:00+00:00

The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarations without considering recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Vulnerability during "make check"
CVE: CVE-2014-0067
Component: postgresql
Severity: Low
Release date: 2014-02-17T00:00:00+00:00

The "make check" command for the test suites in PostgreSQL 9.3.3 and earlier does not properly invoke initdb to specify the authentication requirements for a database cluster to be used for the tests, which allows local users to gain privileges by leveraging access to this cluster.

Statement: Not vulnerable. This issue did not affect postgresql packages as shipped with Red Hat Enterprise Linux and Red Hat Software Collections. Refer to bug 1065863 for further details: https://bugzilla.redhat.com/show_bug.cgi?id=1065863

Remediation:
denial of service in verbose mode using malformed Geonet payload
CVE: CVE-2014-8768
Component: tcpdump
CWE: CWE-787
Severity: Low
Release date: 2014-11-13T00:00:00+00:00

Multiple Integer underflows in the geonet_print function in tcpdump 4.5.0 through 4.6.2, when in verbose mode, allow remote attackers to cause a denial of service (segmentation fault and crash) via a crafted length value in a Geonet frame.


Remediation:
use-after-free during key garbage collection
CVE: CVE-2014-9529
Component: kernel
CWE: CWE-416
Severity: Moderate
Release date: 2014-12-29T00:00:00+00:00

A race condition flaw was found in the way the Linux kernel keys management subsystem performed key garbage collection. A local attacker could attempt accessing a key while it was being garbage collected, which would cause the system to crash.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6, 7 and Red Hat Enterprise MRG 2. Future kernel updates for the respective releases may address this issue.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
hypervisor: HVMOP_set_mem_type allows invalid P2M entries to be created (XSA-92)
CVE: CVE-2014-3124
Component: xen
Severity: Moderate
Release date: 2014-04-29T00:00:00+00:00

The HVMOP_set_mem_type control in Xen 4.1 through 4.4.x allows local guest HVM administrators to cause a denial of service (hypervisor crash) or possibly execute arbitrary code by leveraging a separate qemu-dm vulnerability to trigger invalid page table translations for unspecified memory page types.

Statement: Not vulnerable.

This issue did not affect the versions of the kernel-xen package as shipped with Red Hat Enterprise Linux 5.

Remediation: