huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
CVE: CVE-2014-8177
Component: gluster-swift metadata constraints are not correctly enforced
Severity: Moderate
Release date: 2014-01-01T00:00:00+00:00

A flaw was found in the metadata constraints in Red Hat Gluster Storage's OpenStack Object Storage (swiftonfile). By adding metadata in several separate calls, a malicious user could bypass the max_meta_count constraint, and store more metadata than allowed by the configuration.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
information disclosure flaw in form API
CVE: CVE-2014-2983
Component: drupal
Release date: 2014-04-16T00:00:00+00:00

Drupal 6.x before 6.31 and 7.x before 7.27 does not properly isolate the cached data of different anonymous users, which allows remote anonymous users to obtain sensitive interim form input information in opportunistic situations via unspecified vectors.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
failure to verify SSL certificates
CVE: CVE-2014-3691
Component: foreman-proxy
CWE: CWE-295
Severity: Important
Release date: 2014-10-06T00:00:00+00:00

It was discovered that foreman-proxy, when running in SSL-secured mode, did not correctly verify SSL client certificates. This could permit any client with access to the API to make requests and perform actions otherwise restricted.


Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.

This update is available via Red Hat Subscription Management. Details on how to use Red Hat Subscription Management are available at https://access.redhat.com/articles/433903.

NOTE: This update requires additional steps to complete beyond just installing new packages.  To complete this update please follow the steps outlined below:

To update your Satellite or Capsule with this or other errata please follow these instructions:

SATELLITE SERVER

I. Shut down all Satellite related services. During this time managed hosts will not be able to install packages or apply configuration, so plan accordingly.

# katello-service stop
Shutting down Katello services...
Stopping httpd:                                            [  OK  ]
celery init v10.0.
...

II. update packages via yum

# yum clean all
# yum update

This step will download and install any available Satellite errata as well as any other pending updates (such as RHEL) to Satellite 6 server. Review the list of packages being updated and accept with Y/N

III. Perform data migration

# service mongod start
# sudo -u apache pulp-manage-db
# katello-service start
# foreman-rake katello:reindex

these steps may take some amount of time, let them run to completion. After the last command is complete your Satellite is ready for use.

CAPSULE SERVER

I. Stop all services: The Satellite Capsule currently lacks a wrapper utility to start/stop all associated services so they must be stopped manually. See this article to see how to stop all services:

# for i in pulp_celerybeat pulp_resource_manager pulp_workers httpd foreman-proxy; do service $i stop; done

II. update packages via yum

# yum clean all
# yum update

This step will download and install any available Satellite Capsule errata as well as any other pending updates (such as RHEL) to Satellite 6 Capsule server. Review the list of packages being updated and accept with Y/N

III. Perform data migration

# sudo -u apache pulp-manage-db

this step may take some amount of time, let it run to completion.

III. Restart services: 

# for i in pulp_celerybeat pulp_resource_manager pulp_workers httpd foreman-proxy; do service $i start; done
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment)
CVE: CVE-2014-6493
Component: JDK
Severity: Important
Release date: 2014-10-14T00:00:00+00:00

Unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2014-4288, CVE-2014-6503, and CVE-2014-6532.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
integer overflow in create_bits function
CVE: CVE-2014-9766
Component: pixman
CWE: CWE-122
Severity: Moderate
Release date: 2014-10-14T00:00:00+00:00

Integer overflow in the create_bits function in pixman-bits-image.c in Pixman before 0.32.6 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via large height and stride values.


Remediation:
missing checks for small-sized files
CVE: CVE-2014-9273
Component: hivex
CWE: CWE-120
Severity: Moderate
Release date: 2014-10-29T00:00:00+00:00

It was found that hivex attempted to read, and possibly write, beyond its allocated buffer when reading a hive file with a very small size or with a truncated or improperly formatted content. An attacker able to supply a specially crafted hive file to an application using the hivex library could possibly use this flaw to execute arbitrary code with the privileges of the user running that application.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
user storage quota bypass
CVE: CVE-2014-9623
Component: openstack-glance
CWE: CWE-400
Severity: Low
Release date: 2014-01-01T00:00:00+00:00

A storage quota bypass flaw was found in OpenStack Image (glance). If an image was deleted while it was being uploaded, it would not count towards a user's quota. A malicious user could use this flaw to deliberately fill the backing store, and cause a denial of service.


Remediation:
Before applying this update, ensure all previously released errata
relevant to your system have been applied.

Red Hat Enterprise Linux OpenStack Platform 5 for RHEL 6 runs on Red Hat
Enterprise Linux 6.6.

The Red Hat Enterprise Linux OpenStack Platform 5 for RHEL 6 Release Notes
contain the following:

* An explanation of the way in which the provided components interact to
form a working cloud computing environment.

* Technology Previews, Recommended Practices, and Known Issues.

* The channels required for Red Hat Enterprise Linux OpenStack Platform 5
for RHEL 6, including which channels need to be enabled and disabled.

The Release Notes are linked to in the References section.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Red Hat Enterprise Linux OpenStack Platform 5 for RHEL 7 runs on Red Hat
Enterprise Linux 7.1.

The Red Hat Enterprise Linux OpenStack Platform 5 for RHEL 7 Release Notes
contain the following:

* An explanation of the way in which the provided components interact to
form a working cloud computing environment.

* Technology Previews, Recommended Practices, and Known Issues.

* The channels required for Red Hat Enterprise Linux OpenStack Platform 5
for RHEL 7, including which channels need to be enabled and disabled.

The Release Notes are linked to in the References section.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
unspecified vulnerability related to Locking DoS (CPU Jan 2014)
CVE: CVE-2014-0402
Component: mysql
Severity: Moderate
Release date: 2014-01-14T00:00:00+00:00

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.71 and earlier, 5.5.33 and earlier, and 5.6.13 and earlier allows remote authenticated users to affect availability via unknown vectors related to Locking.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
unsupported BrowseAllow value lets cups-browsed accept from all hosts
CVE: CVE-2014-4338
Component: cups-filters
Severity: Moderate
Release date: 2014-04-25T00:00:00+00:00

A flaw was found in the way the cups-browsed daemon interpreted the "BrowseAllow" directive in the cups-browsed.conf file. An attacker able to add a malformed "BrowseAllow" directive to the cups-browsed.conf file could use this flaw to bypass intended access restrictions.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
security issues fixed in versions 2.7.3, 2.6.6 and 2.5.9
CVE: CVE-2014-7847
Component: moodle
Release date: 2014-11-10T00:00:00+00:00

iplookup/index.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allows remote attackers to cause a denial of service (resource consumption) by triggering the calculation of an estimated latitude and longitude for an IP address.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
multiple temporary file vulnerabilities
CVE: CVE-2014-1839
Component: python-logilab-common
Release date: 2014-01-29T00:00:00+00:00

The Execute class in shellutils in logilab-commons before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
TLS certificate verification disabled
CVE: CVE-2014-7144
Component: python-keystoneclient
CWE: CWE-295
Severity: Moderate
Release date: 2014-08-06T00:00:00+00:00

It was found that python-keystoneclient treated all settings in paste.ini files as string types. If the "insecure" option were set to any value in a paste.ini configuration file, it would be evaluated as true, resulting in TLS connections being vulnerable to man-in-the-middle attacks.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
access bypass issue
CVE: CVE-2014-5179
Component: drupal6-freelinking
Release date: 2014-07-23T00:00:00+00:00

The freelinking module for Drupal, as used in the Freelinking for Case Tracker module, does not properly check access permissions for (1) nodes or (2) users, which allows remote attackers to obtain sensitive information via a crafted link.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
failure to check DNS SSHFP records in certain scenarios
CVE: CVE-2014-2653
Component: openssh
CWE: CWE-287
Severity: Moderate
Release date: 2014-03-24T00:00:00+00:00

It was discovered that OpenSSH clients did not correctly verify DNS SSHFP records. A malicious server could use this flaw to force a connecting client to skip the DNS SSHFP record check and require the user to perform manual host verification of the DNS SSHFP record.

Statement: The Red Hat Security Response Team has rated this issue as having Moderate security impact. This issue is not planned to be fixed in Red Hat Enterprise Linux 5 as it is now in Production 3 Phase of the support and maintenance life cycle, https://access.redhat.com/support/policy/updates/errata/

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Inconsistent video sharing within iframe (MFSA 2014-81)
CVE: CVE-2014-1585
Component: Mozilla
Severity: Moderate
Release date: 2014-10-14T00:00:00+00:00

The WebRTC video-sharing feature in dom/media/MediaManager.cpp in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 does not properly recognize Stop Sharing actions for videos in IFRAME elements, which allows remote attackers to obtain sensitive information from the local camera by maintaining a session after the user tries to discontinue streaming.


Remediation:
Remote crash when handling out of call message in certain dialplan configurations [AST-2014-010]
CVE: CVE-2014-6610
Component: asterisk
Release date: 2014-09-18T00:00:00+00:00

Asterisk Open Source 11.x before 11.12.1 and 12.x before 12.5.1 and Certified Asterisk 11.6 before 11.6-cert6, when using the res_fax_spandsp module, allows remote authenticated users to cause a denial of service (crash) via an out of call message, which is not properly handled in the ReceiveFax dialplan application.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
fs: udf: information leakage when reading symlink
CVE: CVE-2014-9731
Component: Kernel
CWE: CWE-200
Severity: Low
Release date: 2014-12-18T00:00:00+00:00

A path length checking flaw was found in Linux kernels built with UDF file system (CONFIG_UDF_FS) support. An attacker able to mount a corrupted/malicious UDF file system image could use this flaw to leak kernel memory to user-space.

Statement: This issue affects the versions of the Linux kernel as shipped with
Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2.

Remediation:
The UDF filesystem is enabled via loading the UDF kernel module.  The kernel module can be prevented from loading via blacklisting see https://access.redhat.com/solutions/41278 for more information.
Linux user namespaces can bypass group-based restrictions
CVE: CVE-2014-8989
Component: kernel
Severity: Moderate
Release date: 2014-11-15T00:00:00+00:00

The Linux kernel through 3.17.4 does not properly restrict dropping of supplemental group memberships in certain namespace scenarios, which allows local users to bypass intended file permissions by leveraging a POSIX ACL containing an entry for the group category that is more restrictive than the entry for the other category, aka a "negative groups" issue, related to kernel/groups.c, kernel/uid16.c, and kernel/user_namespace.c.

Statement: Not vulnerable. This issue does not affect the versions of the kernel package as shipped with Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2.

Remediation:
use-after-free flaw leads to arbitrary code execution
CVE: CVE-2014-0510
Component: flash-plugin
CWE: CWE-416
Severity: Critical
Release date: 2014-03-13T00:00:00+00:00

Heap-based buffer overflow in Adobe Flash Player 12.0.0.77 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism via unspecified vectors, as demonstrated by Zeguang Zhao and Liang Chen during a Pwn2Own competition at CanSecWest 2014.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
local JMX URL disclosure
CVE: CVE-2014-8120
Component: thermostat
CWE: CWE-200
Severity: Important
Release date: 2014-12-16T00:00:00+00:00

It was discovered that, in certain configurations, the Thermostat agent disclosed JMX management URLs of all local Java virtual machines to any local user. A local, unprivileged user could use this flaw to escalate their privileges on the system.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
default routes expose controllers and actions
CVE: CVE-2014-0140
Component: CFME
CWE: CWE-749
Severity: Moderate
Release date: 2014-10-02T00:00:00+00:00

It was found that Red Hat CloudForms exposed default routes that were reachable via HTTP(S) requests. An authenticated user could use this flaw to access potentially sensitive controllers and actions that would allow for privilege escalation.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258