huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
CREATE INDEX race condition possibly leading to privilege escalation
CVE: CVE-2014-0062
Component: postgresql
Severity: Moderate
Release date: 2014-02-17T00:00:00+00:00

Race condition in the (1) CREATE INDEX and (2) unspecified ALTER TABLE commands in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allows remote authenticated users to create an unauthorized index or read portions of unauthorized tables by creating or deleting a table with the same name during the timing window.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
These updated packages upgrade PostgreSQL to version 9.2.7, which fixes
these issues as well as several non-security issues. Refer to the
PostgreSQL Release Notes for a full list of changes:

http://www.postgresql.org/docs/9.2/static/release-9-2-7.html

This update also fixes several bugs and adds various enhancements.
Documentation for these changes will be available shortly from the
Technical Notes document linked to in the References section.

All users of Red Hat CloudForms 3.0 are advised to upgrade to these updated
packages, which correct these issues and add these enhancements.

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
integer truncation in the resolveImplicitLevels function
CVE: CVE-2014-8147
Component: icu
CWE: CWE-190
Severity: Low
Release date: 2014-01-01T00:00:00+00:00

The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Components for Unicode (ICU) before 55.1 uses an integer data type that is inconsistent with a header file, which allows remote attackers to cause a denial of service (incorrect malloc followed by invalid free) or possibly execute arbitrary code via crafted text.


Remediation:
multiple code execution flaws (APSB14-24)
CVE: CVE-2014-0577
Component: flash-plugin
Severity: Critical
Release date: 2014-11-11T00:00:00+00:00

Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2014-0584, CVE-2014-0585, CVE-2014-0586, and CVE-2014-0590.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
XML external entity injection (JVN#91502163)
CVE: CVE-2014-5325
Component: dwr
CWE: CWE-611
Severity: Moderate
Release date: 2014-11-14T00:00:00+00:00

The (1) DOMConverter, (2) JDOMConverter, (3) DOM4JConverter, and (4) XOMConverter functions in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allow remote attackers to read arbitrary files via DOM data containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.


Remediation:
ftp client could be forced to execute arbitrary commands
CVE: CVE-2014-8517
Component: tnftp
Release date: 2014-10-26T00:00:00+00:00

The fetch_url function in usr.bin/ftp/fetch.c in tnftp, as used in NetBSD 5.1 through 5.1.4, 5.2 through 5.2.2, 6.0 through 6.0.6, and 6.1 through 6.1.5 allows remote attackers to execute arbitrary commands via a | (pipe) character at the end of an HTTP redirect.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
upstream 2.6.2, 2.5.5, and 2.4.9 fixes
CVE: CVE-2014-0127
Component: moodle
Release date: 2014-03-17T00:00:00+00:00

The time-validation implementation in (1) mod/feedback/complete.php and (2) mod/feedback/complete_guest.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote authenticated users to bypass intended restrictions on starting a Feedback activity by choosing an unavailable time.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
division by zero leading to denial of service in psf_fwrite()
CVE: CVE-2014-9756
Component: libsndfile
CWE: CWE-369
Severity: Low
Release date: 2014-12-22T00:00:00+00:00

The psf_fwrite function in file_io.c in libsndfile allows attackers to cause a denial of service (divide-by-zero error and application crash) via unspecified vectors related to the headindex variable.


Remediation:
integer overflow can lead to a remote denial of service
CVE: CVE-2014-1736
Component: v8
CWE: CWE-190
Severity: Moderate
Release date: 2014-04-24T00:00:00+00:00

Integer overflow in api.cc in Google V8, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large length value.


Remediation:
security flaws fixed in the 4.0.1 release
CVE: CVE-2014-9039
Component: wordpress
Release date: 2014-11-20T00:00:00+00:00

wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveraging access to an e-mail account that received a password-reset message.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
use-after-free in IndexedDB
CVE: CVE-2014-7924
Component: chromium-browser
CWE: CWE-416
Severity: Important
Release date: 2014-01-01T00:00:00+00:00

Use-after-free vulnerability in the IndexedDB implementation in Google Chrome before 40.0.2214.91 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering duplicate BLOB references, related to content/browser/indexed_db/indexed_db_callbacks.cc and content/browser/indexed_db/indexed_db_dispatcher_host.cc.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Vulnerabilities in HVM MSI injection (XSA-96)
CVE: CVE-2014-3967
Component: xen
Severity: Moderate
Release date: 2014-06-03T00:00:00+00:00

The HVMOP_inject_msi function in Xen 4.2.x, 4.3.x, and 4.4.x does not properly check the return value from the IRQ setup check, which allows local HVM guest administrators to cause a denial of service (NULL pointer dereference and crash) via unspecified vectors.

Statement: Not vulnerable.

This issue did not affect the versions of the kernel-xen package as
shipped with Red Hat Enterprise Linux 5.

This issue did not affect Red Hat Enterprise Linux 6 and Red Hat
Enterprise MRG 2 as we did not have support for Xen hypervisor.

Remediation:
various issues fixed in 1.3.9
CVE: CVE-2014-8628
Component: polarssl
Release date: 2014-10-22T00:00:00+00:00

Memory leak in PolarSSL before 1.2.12 and 1.3.x before 1.3.9 allows remote attackers to cause a denial of service (memory consumption) via a large number of crafted X.509 certificates.  NOTE: this identifier has been SPLIT per ADT3 due to different affected versions. See CVE-2014-9744 for the ClientHello message issue.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
upstream 2.7, 2.6.3, 2.5.6, and 2.4.10 security fixes
CVE: CVE-2014-0218
Component: moodle
Release date: 2014-05-18T00:00:00+00:00

Cross-site scripting (XSS) vulnerability in the URL downloader repository in repository/url/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
user-assisted arbitrary commands execution
CVE: CVE-2014-3121
Component: rxvt-unicode
Release date: 2014-04-26T00:00:00+00:00

rxvt-unicode before 9.20 does not properly handle OSC escape sequences, which allows user-assisted remote attackers to manipulate arbitrary X window properties and execute arbitrary commands.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
DTLS segmentation fault in dtls1_get_record
CVE: CVE-2014-3571
Component: openssl
Severity: Moderate
Release date: 2014-01-01T00:00:00+00:00

A NULL pointer dereference flaw was found in the DTLS implementation of OpenSSL. A remote attacker could send a specially crafted DTLS message, which would cause an OpenSSL server to crash.

Statement: This issue does not affect the version of openssl097a as shipped with Red Hat Enterprise Linux 5. This issue affects the version of openssl098e as shipped with Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this issue as having Moderate security impact and does not plan to address this flaw for the above components in any future security updates.

This issue affects the version of openssl as shipped with Red Hat Enterprise Linux 5. Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Remediation:
Before applying this update, make sure all previously released errata 
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the 
Red Hat Network to apply this update are available at 
https://access.redhat.com/articles/11258
successful authentication without specifying user name or password
CVE: CVE-2014-0074
Component: Shiro
CWE: CWE-287
Severity: Important
Release date: 2014-03-04T00:00:00+00:00

It was discovered that Apache Shiro authenticated users without specifying a user name or a password when used in conjunction with an LDAP back end that allowed unauthenticated binds.


Remediation:
The References section of this erratum contains a download link (you must
log in to download the update).
The References section of this erratum contains a download link (you must
log in to download the update).
unspecified vulnerability fixed in 6u71 and 7u51 (Deployment)
CVE: CVE-2014-0424
Component: JDK
Severity: Important
Release date: 2014-01-14T00:00:00+00:00

Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5889, CVE-2013-5902, CVE-2014-0410, CVE-2014-0415, and CVE-2014-0418.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
unspecified DoS related to Partition (CPU April 2014)
CVE: CVE-2014-2419
Component: mysql
Severity: Low
Release date: 2014-04-15T00:00:00+00:00

Unspecified vulnerability in Oracle MySQL Server 5.5.35 and earlier and 5.6.15 and earlier allows remote authenticated users to affect availability via unknown vectors related to Partition.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
buffer overflow in yyerror() due to improper fix for CVE-2014-0978
CVE: CVE-2014-1235
Component: graphviz
CWE: CWE-121
Severity: Low
Release date: 2014-01-08T00:00:00+00:00

Stack-based buffer overflow in the "yyerror" function in Graphviz 2.34.0 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted file.  NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-0978.

Statement: Not vulnerable. This issue did not affect the versions of graphviz as shipped with Red Hat Enterprise Linux 6 as it did not include the patch that introduced this flaw.

Remediation:
Bypass of security constraints via URL parameter injection
CVE: CVE-2014-4172
Component: cas-client
Severity: Important
Release date: 2014-08-11T00:00:00+00:00

A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java.


Remediation:
All users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat
Customer Portal are advised to upgrade to Red Hat JBoss Portal 6.2.0.

The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up all
applications deployed on JBoss Enterprise Portal Platform, along with all
customized configuration files, and any databases and database settings.
net: use-after-free during segmentation with zerocopy
CVE: CVE-2014-0131
Component: kernel
CWE: CWE-416
Severity: Low
Release date: 2014-03-10T00:00:00+00:00

Use-after-free vulnerability in the skb_segment function in net/core/skbuff.c in the Linux kernel through 3.13.6 allows attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation.

Statement: This issue does not affect Red Hat Enterprise Linux 5 and Red Hat Enterprise MRG 2.

This issue affects the Linux kernel package as shipped with Red Hat Enterprise Linux 6. 

Red Hat Product Security has rated this issue as having Low security impact. The risks and engineering effort associated with fixing this bug are greater
than its security impact. This issue is not currently planned to be addressed
in future kernel updates for Red Hat Enterprise Linux 6. For additional
information, refer to the Issue Severity Classification: 
https://access.redhat.com/security/updates/classification/.

Remediation:
out-of-bounds write when parsing specially crafted PE executable
CVE: CVE-2014-8501
Component: binutils
CWE: CWE-787
Severity: Low
Release date: 2014-10-26T00:00:00+00:00

A stack-based buffer overflow flaw was found in the way various binutils utilities processed certain files. If a user were tricked into processing a specially crafted file, it could cause the utility used to process that file to crash or, potentially, execute arbitrary code with the privileges of the user running that utility.

Statement: Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
multiple code execution or security bypass flaws (APSB14-18)
CVE: CVE-2014-5333
Component: flash-plugin
Severity: Critical
Release date: 2014-08-12T00:00:00+00:00

Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API, in conjunction with a manipulation involving a '$' (dollar sign) or '(' (open parenthesis) character. NOTE: this issue exists because of an incomplete fix for CVE-2014-4671.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
certificate check bypass when built with DarwinSSL as TLS backend
CVE: CVE-2014-8151
Component: curl
CWE: CWE-295
Severity: Low
Release date: 2014-01-01T00:00:00+00:00

The darwinssl_connect_step1 function in lib/vtls/curl_darwinssl.c in libcurl 7.31.0 through 7.39.0, when using the DarwinSSL (aka SecureTransport) back-end for TLS, does not check if a cached TLS session validated the certificate when reusing the session, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.

Statement: Not vulnerable. This issue did not affect the versions of curl as shipped with Red Hat Enterprise Linux 5, 6 and 7 as they do no use DarwinSSL library as TLS backend.

Remediation:
multiple security fixes in Chrome 38.0.2125.101
CVE: CVE-2014-3199
Component: chromium
Severity: Critical
Release date: 2014-10-07T00:00:00+00:00

The wrap function in bindings/core/v8/custom/V8EventCustom.cpp in the V8 bindings in Blink, as used in Google Chrome before 38.0.2125.101, has an erroneous fallback outcome for wrapper-selection failures, which allows remote attackers to cause a denial of service via vectors that trigger stopping a worker process that had been handling an Event object.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
security issues fixed in versions 2.7.3, 2.6.6 and 2.5.9
CVE: CVE-2014-7836
Component: moodle
Release date: 2014-11-10T00:00:00+00:00

Multiple cross-site request forgery (CSRF) vulnerabilities in the LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allow remote attackers to hijack the authentication of arbitrary users for a (1) mod/lti/request_tool.php or (2) mod/lti/instructor_edit_tool_type.php request.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Self-XSS due to unescaped HTML output in navigation items hiding feature
CVE: CVE-2014-4349
Component: phpMyAdmin
Release date: 2014-06-20T00:00:00+00:00

Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.1.x before 4.1.14.1 and 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted table name that is improperly handled after a (1) hide or (2) unhide action.

Statement: Not vulnerable. This issue did not affect the versions of phpMyAdmin as shipped with any Red Hat product.

Remediation: