huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
unspecified vulnerability related to SRREP (CPU July 2014)
CVE: CVE-2014-4233
Component: mysql
Severity: Low
Release date: 2014-04-15T00:00:00+00:00

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.17 and earlier allows remote authenticated users to affect availability via vectors related to SRREP.

Statement: Not vulnerable.  This issue is reported to only affect MySQL 5.6, which is not currently shipped as part of any Red Hat product.

Remediation:
predictable generation of form submission token
CVE: CVE-2014-7809
Component: struts2
CWE: CWE-330
Severity: Moderate
Release date: 2014-12-08T00:00:00+00:00

Apache Struts 2.0.0 through 2.3.x before 2.3.20 uses predictable <s:token/> values, which allows remote attackers to bypass the CSRF protection mechanism.

Statement: A previous statement by Red Hat related to this CVE, prior to August 2019, said that Apache Struts 2 is not included in any Red Hat products. This earlier statement was incorrect. While Struts 2 is not actively compiled, shipped, used, or enabled in any Red Hat provided final products, and does not cause any vulnerability in the product, struts2-core jars have been included in some products' source code packages. The inclusion was part of an import of the Google Guice repository, which includes struts2-core. Customers that build artefacts from our source code could be at risk. Red Hat will remove these artefacts from source code in future releases.

The products that included the Struts 2 artefacts in their source jars:
Fuse Service Works 6.0.0
Single Sign On 7.3.0+

If you have used the source package from one of these products to build artefacts on your system, you should do the following to remove potentially affected jars:
1. Run 'find . -name struts2*.jar' under the source location
2. Remove any files found
This will not affect the product, as the jar is included with the source of google-guice, but no functionality requiring struts2 is implemented.

Remediation:
command injection flaw in blkid
CVE: CVE-2014-9114
Component: util-linux
CWE: CWE-77
Severity: Moderate
Release date: 2014-11-26T00:00:00+00:00

Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.

Statement: This issue affects the versions of util-linux as shipped with Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this issue as having Moderate security impact. Because exploitability of this issue requires conditions unlikely to occur, this issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
Buffer overflow when using non-XBL object as XBL (MFSA 2014-38)
CVE: CVE-2014-1524
Component: Mozilla
Severity: Critical
Release date: 2014-04-29T00:00:00+00:00

The nsXBLProtoImpl::InstallImplementation function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 does not properly check whether objects are XBL objects, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted JavaScript code that accesses a non-XBL object as if it were an XBL object.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
heap buffer overflow in pdb file handling
CVE: CVE-2014-9817
Component: ImageMagick
CWE: CWE-122
Severity: Moderate
Release date: 2014-12-24T00:00:00+00:00

Heap-based buffer overflow in ImageMagick allows remote attackers to have unspecified impact via a crafted pdb file.


Remediation:
out-of-bounds memory access in PCX parser
CVE: CVE-2014-8355
Component: ImageMagick
Severity: Low
Release date: 2014-10-27T00:00:00+00:00

PCX parser code in ImageMagick before 6.8.9-9 allows remote attackers to cause a denial of service (out-of-bounds read).


Remediation:
DOS Sniffer file parser flaw (wnpa-sec-2014-19)
CVE: CVE-2014-6432
Component: wireshark
Severity: Moderate
Release date: 2014-09-10T00:00:00+00:00

The SnifferDecompress function in wiretap/ngsniffer.c in the DOS Sniffer file parser in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 does not prevent data overwrites during copy operations, which allows remote attackers to cause a denial of service (application crash) via a crafted file.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
cross-site scripting flaw (APSB14-09)
CVE: CVE-2014-0509
Component: flash-plugin
CWE: CWE-79
Severity: Moderate
Release date: 2014-04-08T00:00:00+00:00

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK & Compiler before 13.0.0.83 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
CRC32 verification heap-based buffer overread (oCERT-2014-011)
CVE: CVE-2014-8139
Component: unzip
CWE: CWE-125
Severity: Low
Release date: 2014-12-22T00:00:00+00:00

A buffer overflow flaw was found in the way unzip computed the CRC32 checksum of certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash when the archive was tested with unzip's '-t' option.

Statement: Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Low security impact and is not currently planned to be addressed in future updates in Red Hat Enterprise Linux 5. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
integer overflow in GLX extension requests when calculating memory needs for requests
CVE: CVE-2014-8093
Component: xorg-x11-server
CWE: CWE-119
Severity: Important
Release date: 2014-12-09T00:00:00+00:00

Multiple integer overflow flaws were found in the way the X.Org server calculated memory requirements for certain GLX extension requests. A malicious, authenticated client could use either of these flaws to crash the X.Org server or, potentially, execute arbitrary code with root privileges.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
fs: udf: heap overflow in __udf_adinicb_readpage
CVE: CVE-2014-9728
Component: Kernel
CWE: CWE-122
Severity: Moderate
Release date: 2014-12-19T00:00:00+00:00

A symlink size validation was missing in Linux kernels built with UDF file system (CONFIG_UDF_FS) support, allowing the corruption of kernel memory. An attacker able to mount a corrupted/malicious UDF file system image could cause the kernel to crash.

Statement: This issue affects the versions of the Linux kernel as shipped with
Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2.

Remediation:
The UDF filesystem is enabled via loading the UDF kernel module.  The kernel module can be prevented from loading via blacklisting see https://access.redhat.com/solutions/41278 for more information.
server response memory corruption issue
CVE: CVE-2014-3775
Component: libgadu
Severity: Moderate
Release date: 2014-05-07T00:00:00+00:00

libgadu before 1.11.4 and 1.12.0 before 1.12.0-rc3, as used in Pidgin and other products, allows remote Gadu-Gadu file relay servers to cause a denial of service (memory overwrite) or possibly execute arbitrary code via a crafted message.


Remediation:
multiple vulnerabilities
CVE: CVE-2014-9378
Component: ettercap
Release date: 2014-12-16T00:00:00+00:00

Ettercap 0.8.1 does not validate certain return values, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted (1) name to the parse_line function in mdns_spoof/mdns_spoof.c or (2) base64 encoded password to the dissector_imap function in dissectors/ec_imap.c.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
command injection through backticks in a filename
CVE: CVE-2014-8990
Component: lsyncd
Release date: 2014-10-29T00:00:00+00:00

default-rsyncssh.lua in Lsyncd 2.1.5 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a filename.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Incorrect TLS/EC management (Security, 8031340)
CVE: CVE-2014-4264
Component: OpenJDK
Severity: Moderate
Release date: 2014-07-15T00:00:00+00:00

Unspecified vulnerability in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect availability via unknown vectors related to Security.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
cross-site scripting issues
CVE: CVE-2014-5025
Component: cacti
Release date: 2014-07-04T00:00:00+00:00

Cross-site scripting (XSS) vulnerability in data_sources.php in Cacti 0.8.8b allows remote authenticated users with console access to inject arbitrary web script or HTML via the name_cache parameter in a ds_edit action.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
out of bound access in palm file
CVE: CVE-2014-9840
Component: ImageMagick
CWE: CWE-125
Severity: Moderate
Release date: 2014-12-24T00:00:00+00:00

ImageMagick 6.8.9-9 allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted palm file.


Remediation:
security fixes release
CVE: CVE-2014-1573
Component: bugzilla
Release date: 2014-10-06T00:00:00+00:00

Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 does not ensure that a scalar context is used for certain CGI parameters, which allows remote attackers to conduct cross-site scripting (XSS) attacks by sending three values for a single parameter name.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
scsi: do not fill dirty page content in the SG_IO buffer
CVE: CVE-2014-8181
Component: kernel
CWE: CWE-665
Severity: Low
Release date: 2014-01-01T00:00:00+00:00

The kernel in Red Hat Enterprise Linux 7 and MRG-2 does not clear garbage data for SG_IO buffer, which may leaking sensitive information to userspace.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5,6.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and MRG-2. This has been rated as having Low security impact as exploiting it requires privileged access and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Remediation:
various flaws related to IMAP4-over-SSL certificate validation
CVE: CVE-2014-7274
Component: getmail
Release date: 2014-10-06T00:00:00+00:00

The IMAP-over-SSL implementation in getmail 4.44.0 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof IMAP servers and obtain sensitive information via a crafted certificate from a recognized Certification Authority.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
plug-in code can be downloaded by anyone with read access (SECURITY-155)
CVE: CVE-2014-3667
Component: jenkins
CWE: CWE-285
Severity: Moderate
Release date: 2014-10-02T00:00:00+00:00

Jenkins before 1.583 and LTS before 1.565.3 does not properly prevent downloading of plugins, which allows remote authenticated users with the Overall/READ permission to obtain sensitive information by reading the plugin code.


Remediation:
Before applying this update, make sure all previously released errata relevant
to your system have been applied.

See the OpenShift Enterprise 2.1 Release Notes, which will be updated shortly for this advisory, for important instructions on how to fully apply this asynchronous errata update:

https://access.redhat.com/site/documentation/en-US/OpenShift_Enterprise/2/html-single/2.1_Release_Notes/index.html#chap-Asynchronous_Errata_Updates

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258.
Before applying this update, make sure all previously released 
errata relevant to your system have been applied.

See the OpenShift Enterprise 3.1 documentation, which will be 
updated shortly for release 3.1.1, for important instructions on how 
to upgrade your OpenShift cluster and fully apply this asynchronous 
errata update:

https://docs.openshift.com/enterprise/3.1/release_notes/ose_3_1_release_notes.html

This update is available via the Red Hat Network. Details on how to 
use the Red Hat Network to apply this update are available at 
https://access.redhat.com/articles/11258.
unspecified vulnerability related to SERVER:DDL (CPU October 2014)
CVE: CVE-2014-6520
Component: mysql
Severity: Moderate
Release date: 2014-10-15T00:00:00+00:00

Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:DDL.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
stack-based buffer overflow flaw in pam_cifscreds
CVE: CVE-2014-2830
Component: cifs-utils
CWE: CWE-121
Severity: Moderate
Release date: 2014-04-08T00:00:00+00:00

Stack-based buffer overflow in cifskey.c or cifscreds.c in cifs-utils before 6.4, as used in pam_cifscreds, allows remote attackers to have unspecified impact via unknown vectors.


Remediation:
buffer overflow exists in versions of TORQUE which can be exploited in order to remotely execute code from an unauthenticated perspective
CVE: CVE-2014-0749
Component: torque
Release date: 2014-05-13T00:00:00+00:00

Stack-based buffer overflow in lib/Libdis/disrsi_.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 2.5.x through 2.5.13 allows remote attackers to execute arbitrary code via a large count value.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
SQL injection and directory traversal vulnerabilities
CVE: CVE-2014-2324
Component: lighttpd
Release date: 2014-03-12T00:00:00+00:00

Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary files via a .. (dot dot) in the host name, related to request_check_hostname.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
denial of service via specially-crafted JPEG file
CVE: CVE-2014-9092
Component: libjpeg-turbo
Severity: Low
Release date: 2014-10-26T00:00:00+00:00

libjpeg-turbo before 1.3.1 allows remote attackers to cause a denial of service (crash) via a crafted JPEG file, related to the Exif marker.


Remediation:
Information disclosure through polygon rendering in MathML (MFSA 2014-26)
CVE: CVE-2014-1508
Component: Mozilla
Severity: Moderate
Release date: 2014-03-18T00:00:00+00:00

The libxul.so!gfxContext::Polygon function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive information from process memory, cause a denial of service (out-of-bounds read and application crash), or possibly bypass the Same Origin Policy via vectors involving MathML polygon rendering.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
netdevice.h: NULL pointer dereference over VxLAN
CVE: CVE-2014-3535
Component: Kernel
CWE: CWE-476
Severity: Important
Release date: 2014-09-09T00:00:00+00:00

A NULL pointer dereference flaw was found in the way the Linux kernel's networking implementation handled logging while processing certain invalid packets coming in via a VxLAN interface. A remote attacker could use this flaw to crash the system by sending a specially crafted packet to such an interface.

Statement: This issue does not affect the versions of the kernel package as shipped with Red Hat Enterprise Linux 5, 7 and Red Hat Enterprise MRG 2.

This issue affects the version of Linux kernel as shipped with Red Hat Enterprise Linux 6. Future kernel updates for Red Hat Enterprise Linux 6
may address this issue.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258

To install kernel packages manually, use "rpm -ivh [package]". Do not use
"rpm -Uvh" as that will remove the running kernel binaries from your
system. You may use "rpm -e" to remove old kernels after determining that
the new kernel functions properly on your system.
This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258

To upgrade Hypervisors in Red Hat Enterprise Virtualization environments
using the disk image provided by this package, refer to:

https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Hypervisor_Deployment_Guide/chap-Deployment_Guide-Upgrading_Red_Hat_Enterprise_Virtualization_Hypervisors.html