huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
source-highlighting feature allows security bypass which could lead to arbitrary code execution
CVE: CVE-2014-1867
Component: suphp
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2014-01-28T00:00:00+00:00

suPHP before 0.7.2 source-highlighting feature allows security bypass which could lead to arbitrary code execution

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
double free in pdb coder
CVE: CVE-2014-9807
Component: ImageMagick
CWE: CWE-416
Severity: Moderate
Release date: 2014-12-24T00:00:00+00:00

The pdb coder in ImageMagick allows remote attackers to cause a denial of service (double free) via unspecified vectors.


Remediation:
RTP dissector crash (wnpa-sec-2014-12)
CVE: CVE-2014-6422
Component: wireshark
CWE: CWE-416
Severity: Moderate
Release date: 2014-03-23T00:00:00+00:00

The SDP dissector in Wireshark 1.10.x before 1.10.10 creates duplicate hashtables for a media channel, which allows remote attackers to cause a denial of service (application crash) via a crafted packet to the RTP dissector.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
cookies accepted for TLDs
CVE: CVE-2014-3620
Component: curl
CWE: CWE-284
Severity: Moderate
Release date: 2014-09-10T00:00:00+00:00

cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain.

Statement: This issue did not affect the versions of curl as shipped with Red Hat Enterprise Linux 5, 6, or 7.

Remediation:
DoS due to incorrect bounds checking on certain strings
CVE: CVE-2014-2031
Component: maradns
Release date: 2014-02-11T00:00:00+00:00

Deadwood before 2.3.09, 3.x before 3.2.05, and as used in MaraDNS before 1.4.14 and 2.x before 2.0.09, allow remote attackers to cause a denial of service (out-of-bounds read and crash) by leveraging permission to perform recursive queries against Deadwood, related to a logic error.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
XSS flaw in remoting
CVE: CVE-2014-0149
Component: Seam
CWE: CWE-79
Severity: Moderate
Release date: 2014-05-01T00:00:00+00:00

Multiple cross-site scripting (XSS) vulnerabilities in Red Hat JBoss Web Framework Kit 2.5.0 allow remote attackers to inject arbitrary web script or HTML via a (1) parameter or (2) id name.

Statement: Red Hat JBoss Enterprise Application Platform 4 and 5; Red Hat JBoss Enterprise Portal Platform 5; and Red Hat JBoss Enterprise SOA Platform 4 and 5 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/

Remediation:
The References section of this erratum contains a download link (you must
log in to download the update). Before applying this update, back up your
existing installation of Red Hat JBoss Web Framework Kit.

The JBoss server process must be restarted for this update to take effect.
out-of-bounds read/write with malformed TIFF image in tiff2pdf
CVE: CVE-2014-8129
Component: libtiff
CWE: CWE-125
Severity: Low
CVSS v3: 4.3/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Release date: 2014-12-07T00:00:00+00:00

LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted TIFF image, as demonstrated by failure of tif_next.c to verify that the BitsPerSample value is 2, and the t2p_sample_lab_signed_to_unsigned function in tiff2pdf.c.

Statement: Red Hat Product Security has rated this issue as having low security impact, a future update may address this flaw in libtiff.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running applications linked against libtiff must be restarted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running applications linked against libtiff must be restarted for this
update to take effect.
security protection bypass (APSB14-14)
CVE: CVE-2014-0519
Component: flash-plugin
Severity: Critical
Release date: 2014-05-13T00:00:00+00:00

Adobe Flash Player before 13.0.0.214 on Windows and OS X and before 11.2.202.359 on Linux, Adobe AIR SDK before 13.0.0.111, and Adobe AIR SDK & Compiler before 13.0.0.111 allow attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2014-0517, CVE-2014-0518, and CVE-2014-0520.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
insecure temporary file use in _rl_tropen()
CVE: CVE-2014-2524
Component: readline
CWE: CWE-377
Severity: Low
Release date: 2014-03-14T00:00:00+00:00

The _rl_tropen function in util.c in GNU readline before 6.3 patch 3 allows local users to create or overwrite arbitrary files via a symlink attack on a /var/tmp/rltrace.[PID] file.

Statement: This issue is only exposed via readline's debugging/tracing code and is not used by readline or any other application in Red Hat Enterprise Linux.  The tracing functions are defined in a private header file and are only meant for the readline library's internal use.  In general use, there is no exposure of this insecure temporary file issue, and while this does affect the versions of readline as shipped with Red Hat Enterprise Linux 5, 6 and 7 it is not currently planned to be addressed in future updates.

Red Hat Product Security has rated this issue as having Low security impact. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
arbitrary code execution and denial of service via a crafted web site (WSA-2015-0001)
CVE: CVE-2014-1308
Component: webkitgtk
Severity: Moderate
Release date: 2014-01-01T00:00:00+00:00

WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.

Statement: Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
insecure temporary file creation
CVE: CVE-2014-1934
Component: python-eyed3
Release date: 2014-01-29T00:00:00+00:00

tag.py in eyeD3 (aka python-eyed3) 7.0.3, 0.6.18, and earlier for Python allows local users to modify arbitrary files via a symlink attack on a temporary file.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
crash in xwd file handler
CVE: CVE-2014-9811
Component: ImageMagick
CWE: CWE-20
Severity: Moderate
Release date: 2014-12-24T00:00:00+00:00

The xwd file handler in ImageMagick allows remote attackers to cause a denial of service (segmentation fault and application crash) via a malformed xwd file.


Remediation:
denial of service via png_push_read_chunk()
CVE: CVE-2014-0333
Component: libpng
Severity: Moderate
Release date: 2014-02-25T00:00:00+00:00

The png_push_read_chunk function in pngpread.c in the progressive decoder in libpng 1.6.x through 1.6.9 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an IDAT chunk with a length of zero.

Statement: Not vulnerable. This issue did not affect the versions of libpng as shipped with Red Hat Enterprise Linux 5 or 6.

Remediation:
heap-based buffer overflow flaw in list_file()
CVE: CVE-2014-9112
Component: cpio
CWE: CWE-122
Severity: Moderate
Release date: 2014-11-23T00:00:00+00:00

A heap-based buffer overflow flaw was found in cpio's list_file() function. An attacker could provide a specially crafted archive that, when processed by cpio, would crash cpio, or potentially lead to arbitrary code execution.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Web Audio memory corruption issues (MFSA 2014-36)
CVE: CVE-2014-1522
Component: Mozilla
Severity: Important
Release date: 2014-04-29T00:00:00+00:00

The mozilla::dom::OscillatorNodeEngine::ComputeCustom function in the Web Audio subsystem in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read, memory corruption, and application crash) via crafted content.

Statement: This issue does not affect the version of firefox and thunderbird as shipped with Red Hat Enterprise Linux 5 and 6

Remediation:
Crash when using web workers with asm.js (MFSA 2014-11)
CVE: CVE-2014-1488
Component: Mozilla
Severity: Critical
Release date: 2014-02-04T00:00:00+00:00

The Web workers implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allows remote attackers to execute arbitrary code via vectors involving termination of a worker process that has performed a cross-thread object-passing operation in conjunction with use of asm.js.

Statement: This issue does not affect the version of firefox and thunderbird as shipped with Red Hat Enterprise Linux 5 and 6

Remediation:
denial of service by queuing or splitting file descriptors
CVE: CVE-2014-3636
Component: dbus
Severity: Low
Release date: 2014-09-16T00:00:00+00:00

D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 allows local users to (1) cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors or (2) cause a denial of service (disconnect) via multiple messages that combine to have more than the allowed number of file descriptors for a single sendmsg call.


Remediation:
potential resource exhaustion and denial of service using images manipulation API
CVE: CVE-2014-9684
Component: openstack-glance
CWE: CWE-400
Severity: Moderate
Release date: 2014-01-01T00:00:00+00:00

Multiple flaws were found in the glance task API that could cause untracked image data to be left in the back end. A malicious user could use these flaws to deliberately accumulate untracked image data, and cause a denial of service via resource exhaustion.


Remediation:
Before applying this update, ensure all previously released errata relevant
to your system have been applied.

Red Hat Enterprise Linux OpenStack Platform 6 runs on Red Hat Enterprise
Linux 7.1.

The Red Hat Enterprise Linux OpenStack Platform 6 Release Notes (see
References section) contain the following:
* An explanation of the way in which the provided components interact to
form a working cloud computing environment.
* Technology Previews, Recommended Practices, and Known Issues.
* The channels required for Red Hat Enterprise Linux OpenStack Platform 6,
including which channels need to be enabled and disabled.

For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
AcceptEnv environment restriction bypass flaw
CVE: CVE-2014-2532
Component: openssh
CWE: CWE-138
Severity: Low
Release date: 2014-03-15T00:00:00+00:00

It was found that OpenSSH did not properly handle certain AcceptEnv parameter values with wildcard characters. A remote attacker could use this flaw to bypass intended environment variable restrictions.

Statement: This issue affects the version of openssh as shipped with Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this issue as having Low security impact. This issue is not planned to be fixed in Red Hat Enterprise Linux 5 as it is now in Production 3 Phase of the support and maintenance life cycle, https://access.redhat.com/support/policy/updates/errata/

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
out of bounds access due to not validating length or offset values in XInput extension
CVE: CVE-2014-8095
Component: xorg-x11-server
CWE: CWE-125
Severity: Moderate
Release date: 2014-12-09T00:00:00+00:00

Multiple out-of-bounds access flaws were found in the way the X.Org server calculated memory requirements for certain requests. A malicious, authenticated client could use either of these flaws to crash the X.Org server.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
NULL pointer dereference flaw in XRegion
CVE: CVE-2014-8241
Component: tigervnc
CWE: CWE-476
Severity: Moderate
Release date: 2014-10-10T00:00:00+00:00

A NULL pointer dereference flaw was found in TigerVNC's XRegion. A malicious VNC server could use this flaw to cause a client to crash.

Statement: This issue affects the version of tigervnc as shipped with Red Hat Enterprise Linux 5 and 6. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates of Red Hat Enterprise Linux 5 and 6.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Information leak in sys_sched_getattr()
CVE: CVE-2014-9903
Component: kernel
CWE: CWE-200
Severity: Low
CVSS v3: 3.4/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2014-02-16T00:00:00+00:00

The sched_read_attr function in kernel/sched/core.c in the Linux kernel 3.14-rc before 3.14-rc4 uses an incorrect size, which allows local users to obtain sensitive information from kernel stack memory via a crafted sched_getattr system call.


Remediation:
DoS when sending invalid DTLS handshake
CVE: CVE-2014-0221
Component: openssl
CWE: CWE-400
Severity: Moderate
Release date: 2014-06-05T00:00:00+00:00

A denial of service flaw was found in the way OpenSSL handled certain DTLS ServerHello requests. A specially crafted DTLS handshake packet could cause a DTLS client using OpenSSL to crash.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
The References section of this erratum contains a download link (you must
log in to download the update). Before applying this update, back up your
existing Red Hat JBoss Enterprise Application Platform installation and
deployed applications.
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing Red Hat JBoss Web Server installation (including all applications
and configuration files).
SQL injection in chart_bar.php
CVE: CVE-2014-9450
Component: zabbix
Release date: 2014-08-05T00:00:00+00:00

Multiple SQL injection vulnerabilities in chart_bar.php in the frontend in Zabbix before 1.8.22, 2.0.x before 2.0.14, and 2.2.x before 2.2.8 allow remote attackers to execute arbitrary SQL commands via the (1) itemid or (2) periods parameter.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Potential remote code execution (RCE) via dozer's reflection-based type conversion
CVE: CVE-2014-9515
Component: dozer
CWE: CWE-470
Severity: Important
CVSS v3: 8.9/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Release date: 2014-12-05T00:00:00+00:00

Dozer improperly uses a reflection-based approach to type conversion, which might allow remote attackers to execute arbitrary code via a crafted serialized object.


Remediation:
security issues fixed in the upstream 2.7.1, 2.6.4, 2.5.7, and 2.4.11 releases
CVE: CVE-2014-3548
Component: moodle
Release date: 2014-07-14T00:00:00+00:00

Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via vectors that trigger an AJAX exception dialog.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Miscellaneous memory safety hazards (rv:33.0) (MFSA 2014-74)
CVE: CVE-2014-1575
Component: Mozilla
Severity: Critical
Release date: 2014-10-14T00:00:00+00:00

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 33.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to improper interaction between threading and garbage collection in the GCRuntime::triggerGC function in js/src/jsgc.cpp, and unknown other vectors.

Statement: This issue does not affect the version of firefox and thunderbird as shipped with Red Hat Enterprise Linux 5, 6 and 7.

Remediation:
command injection issues fixed in bug#0002405
CVE: CVE-2014-2709
Component: cacti
Release date: 2014-03-30T00:00:00+00:00

lib/rrd.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified parameters.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
overflow in rle file
CVE: CVE-2014-9846
Component: ImageMagick
Severity: Moderate
Release date: 2014-12-24T00:00:00+00:00

Buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact.


Remediation:
IQ response spoofing
CVE: CVE-2014-0364
Component: smack
Severity: Moderate
Release date: 2014-01-31T00:00:00+00:00

It was found that the ParseRoster component in the Smack XMPP API did not verify the From attribute of a roster-query IQ stanza. A remote attacker could use this flaw to spoof IQ responses.


Remediation:
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing installation, including all applications, configuration files,
databases and database settings, and so on.

It is recommended to halt the server by stopping the JBoss Application
Server process before installing this update, and then after installing the
update, restart the server by starting the JBoss Application Server
process.
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing installation, including all applications, configuration files,
databases and database settings, and so on.

It is recommended to halt the server by stopping the JBoss Application
Server process before installing this update, and then after installing the
update, restart the server by starting the JBoss Application Server
process.
All users of Red Hat JBoss Fuse 6.1.0 as provided from the Red Hat Customer
Portal are advised to apply this update.

The References section of this erratum contains a download link (you must
log in to download the update).