huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
cross-site scripting flaw on view operations page (PMASA-2014-9)
CVE: CVE-2014-5274
Component: phpMyAdmin
Release date: 2014-08-06T00:00:00+00:00

Cross-site scripting (XSS) vulnerability in the view operations page in phpMyAdmin 4.1.x before 4.1.14.3 and 4.2.x before 4.2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted view name, related to js/functions.js.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
ECDSA nonces susceptible to Yarom/Benger flush+reload cache side-channel attack
CVE: CVE-2014-0076
Component: openssl
Severity: Moderate
Release date: 2014-02-14T00:00:00+00:00

The Montgomery ladder implementation in OpenSSL through 1.0.0l does not ensure that certain swap operations have a constant-time behavior, which makes it easier for local users to obtain ECDSA nonces via a FLUSH+RELOAD cache side-channel attack.

Statement: Not vulnerable. This issue does not affect the version of openssl and openssl097a as shipped with Red Hat Enterprise Linux 5. This issue does not affect the version of openssl and openssl098e as shipped with Red Hat Enterprise Linux 6 or 7.

Remediation:
XML eXternal Entity (XXE) flaw in backend module
CVE: CVE-2014-3573
Component: Engine
CWE: CWE-611
Severity: Moderate
Release date: 2014-09-04T00:00:00+00:00

It was discovered that, when loading XML/RSDL documents, the oVirt Engine back end module used an insecure DocumentBuilderFactory. A remote, authenticated attacker could use this flaw to read files accessible to the user running the ovirt-engine server, and potentially perform other more advanced XML External Entity (XXE) attacks.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
buffer overflow flaw when handling PSD images that use RLE encoding
CVE: CVE-2014-1958
Component: ImageMagick
Severity: Moderate
Release date: 2014-01-01T00:00:00+00:00

Buffer overflow in the DecodePSDPixels function in coders/psd.c in ImageMagick before 6.8.8-5 might allow remote attackers to execute arbitrary code via a crafted PSD image, involving the L%06ld string, a different vulnerability than CVE-2014-2030.

Statement: Not vulnerable. This issue did not affect the versions of ImageMagick as shipped with Red Hat Enterprise Linux 5 and 6.

Remediation:
multiple default permission issues
CVE: CVE-2014-5448
Component: zarafa
Release date: 2014-08-24T00:00:00+00:00

Zarafa 5.00 uses world-readable permissions for the files in the log directory, which allows local users to obtain sensitive information by reading the log files.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
git-prompt.sh does not sanitize branch names in $PS1
CVE: CVE-2014-9938
Component: git
CWE: CWE-78
Severity: Moderate
CVSS v3: 7.7/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2014-04-22T00:00:00+00:00

It was found that the git-prompt.sh script shipped with git failed to correctly handle branch names containing special characters. A specially crafted git repository could use this flaw to execute arbitrary commands if a user working with the repository configured their shell to include repository information in the prompt.


Remediation:
regexp engine incorrect handling of a zero length quantifier
CVE: CVE-2014-7926
Component: ICU
CWE: CWE-787
Severity: Important
Release date: 2014-01-01T00:00:00+00:00

The Regular Expressions package in International Components for Unicode (ICU) 52 before SVN revision 292944, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via vectors related to a zero-length quantifier.

Statement: The flaw is caused because the ICU regular expression compiler is unable to properly handle certain malformed patterns. Because of the way in which this flaw manifests itself, it can only be triggered via untrusted content, which is common for components such as web browsers, in this case, the Chromium browser. 

This flaw has been rated moderate for ICU component in Red Hat products, because either it is very difficult to trigger this flaw, or it is unusual to directly pass untrusted parameters to the ICU library.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
two heap out-of-bounds access issues (oCERT-2014-010)
CVE: CVE-2014-8145
Component: sox
Severity: Moderate
Release date: 2014-12-22T00:00:00+00:00

It was discovered that SoX did not correctly process NIST Sphere and WAV audio files. By tricking a victim into processing a specially crafted NIST Sphere or WAV audio file, a remote attacker could possibly use this flaw to execute arbitrary code with the privileges of the user running SoX.


Remediation:
upstream 2.6.2, 2.5.5, and 2.4.9 fixes
CVE: CVE-2014-0125
Component: moodle
Release date: 2014-03-17T00:00:00+00:00

repository/alfresco/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 places a session key in a URL, which allows remote attackers to bypass intended Alfresco Repository file restrictions by impersonating a file's owner.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
unspecified vulnerability related to Performance Schema DoS (CPU Jan 2014)
CVE: CVE-2014-0430
Component: mysql
Severity: Low
Release date: 2014-01-14T00:00:00+00:00

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.13 and earlier allows remote authenticated users to affect availability via unknown vectors related to Performance Schema.

Statement: Not Vulnerable. This issue does not affect the version of mysql55-mysql package as shipped with Red Hat Enterprise Linux 5. This issue does not affect the version of mysql as shipped with Red Hat Enterprise Linux 6.

Remediation:
SET ROLE without ADMIN OPTION allows adding and removing group members
CVE: CVE-2014-0060
Component: postgresql
Severity: Moderate
Release date: 2014-02-17T00:00:00+00:00

PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the ADMIN OPTION restriction, which allows remote authenticated members of a role to add or remove arbitrary users to that role by calling the SET ROLE command before the associated GRANT command.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
These updated packages upgrade PostgreSQL to version 9.2.7, which fixes
these issues as well as several non-security issues. Refer to the
PostgreSQL Release Notes for a full list of changes:

http://www.postgresql.org/docs/9.2/static/release-9-2-7.html

This update also fixes several bugs and adds various enhancements.
Documentation for these changes will be available shortly from the
Technical Notes document linked to in the References section.

All users of Red Hat CloudForms 3.0 are advised to upgrade to these updated
packages, which correct these issues and add these enhancements.

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
remote code execution and SQL injection
CVE: CVE-2014-5262
Component: cacti
Release date: 2014-06-28T00:00:00+00:00

SQL injection vulnerability in the graph settings script (graph_settings.php) in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Certificate parsing broken by non-standard character encoding (MFSA 2014-65)
CVE: CVE-2014-1558
Component: Mozilla
Severity: Moderate
Release date: 2014-07-22T00:00:00+00:00

Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service (X.509 certificate parsing outage) via a crafted certificate that does not use UTF-8 character encoding in a required context, a different vulnerability than CVE-2014-1559.

Statement: This issue does not affect the version of thunderbird as shipped with Red Hat Enterprise Linux 5 and 6, or the version of firefox as shipped with Red Hat Enterprise Linux 5, 6, and 7.

Remediation:
snmptrapd crash when handling an SNMP trap containing a ifMtu with a NULL type
CVE: CVE-2014-3565
Component: net-snmp
CWE: CWE-843
Severity: Moderate
Release date: 2014-08-31T00:00:00+00:00

A denial of service flaw was found in the way snmptrapd handled certain SNMP traps when started with the "-OQ" option. If an attacker sent an SNMP trap containing a variable with a NULL type where an integer variable type was expected, it would cause snmptrapd to crash.

Statement: This issue affects the versions of net-snmp as shipped with Red Hat Enterprise Linux 5.  Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
use-after-free in DOM
CVE: CVE-2014-7930
Component: chromium-browser
CWE: CWE-416
Severity: Important
Release date: 2014-01-01T00:00:00+00:00

Use-after-free vulnerability in core/events/TreeScopeEventContext.cpp in the DOM implementation in Blink, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers improper maintenance of TreeScope data.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
potential heap overflow in buffer/bufferevent APIs
CVE: CVE-2014-6272
Component: libevent
CWE: CWE-835
Severity: Moderate
Release date: 2014-01-01T00:00:00+00:00

Multiple integer overflows in the evbuffer API in Libevent 1.4.x before 1.4.15, 2.0.x before 2.0.22, and 2.1.x before 2.1.5-beta allow context-dependent attackers to cause a denial of service or possibly have other unspecified impact via "insanely large inputs" to the (1) evbuffer_add, (2) evbuffer_expand, or (3) bufferevent_write function, which triggers a heap-based buffer overflow or an infinite loop.  NOTE: this identifier has been SPLIT per ADT3 due to different affected versions. See CVE-2015-6525 for the functions that are only affected in 2.0 and later.


Remediation:
security update
CVE: CVE-2014-7199
Component: mediawiki
Release date: 2014-09-24T00:00:00+00:00

Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.19, 1.22.x before 1.22.11, and 1.23.x before 1.23.4 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
integer overflow, leading to a heap-based buffer overflow in libdw
CVE: CVE-2014-0172
Component: elfutils
CWE: CWE-190
Severity: Moderate
Release date: 2014-04-09T00:00:00+00:00

Integer overflow in the check_section function in dwarf_begin_elf.c in the libdw library, as used in elfutils 0.153 and possibly through 0.158 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed compressed debug section in an ELF file, which triggers a heap-based buffer overflow.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
multiple issues
CVE: CVE-2014-0488
Component: apt
Release date: 2014-09-16T00:00:00+00:00

APT before 1.0.9 does not "invalidate repository data" when moving from an unauthenticated to authenticated state, which allows remote attackers to have unspecified impact via crafted repository data.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
password hashing bypassed when "nsslapd-unhashed-pw-switch" is set to off
CVE: CVE-2014-8112
Component: 389-ds-base
CWE: CWE-522
Severity: Low
Release date: 2014-01-01T00:00:00+00:00

It was found that when the nsslapd-unhashed-pw-switch 389 Directory Server configuration option was set to "off", it did not prevent the writing of unhashed passwords into the Changelog. This could potentially allow an authenticated user able to access the Changelog to read sensitive information.

Statement: This issue did not affect the versions of 389-ds-base as shipped with Red Hat Enterprise Linux 6.

Remediation:
All 389-ds-base users are advised to upgrade to these updated packages,
which contain backported patches to correct these issues and add these
enhancements. After installing this update, the 389 server service will be restarted automatically.

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
arbitrary code execution and denial of service via a crafted web site (WSA-2015-0001)
CVE: CVE-2014-1299
Component: webkitgtk
Severity: Moderate
Release date: 2014-01-01T00:00:00+00:00

WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.

Statement: Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
arbitrary code execution and denial of service via a crafted web site (WSA-2015-0001)
CVE: CVE-2014-1333
Component: webkitgtk
Severity: Moderate
Release date: 2014-01-01T00:00:00+00:00

WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.

Statement: Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
unsafe OS command execution
CVE: CVE-2014-7208
Component: gparted
Release date: 2014-12-08T00:00:00+00:00

GParted before 0.15.0 allows local users to execute arbitrary commands with root privileges via shell metacharacters in a crafted filesystem label.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
unauthenticated denial of service flaw
CVE: CVE-2014-0037
Component: zarafa
Release date: 2014-01-31T00:00:00+00:00

The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 5.00 before 7.1.8 beta2 allows remote attackers to cause a denial of service (crash) via vectors related to "a NULL pointer of the username."

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
heap-based buffer overflow when parsing certain headers
CVE: CVE-2014-0467
Component: mutt
CWE: CWE-122
Severity: Important
Release date: 2014-01-01T00:00:00+00:00

Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of service (crash) via a crafted RFC2047 header line, related to address expansion.

Statement: This issue does not affect the version of mutt package as shipped with Red Hat Enterprise Linux 5.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Potential untrusted template execution
CVE: CVE-2014-3498
Component: ansible
CWE: CWE-20
Severity: Low
Release date: 2014-06-30T00:00:00+00:00

The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands.


Remediation:
splice: lack of generic write checks
CVE: CVE-2014-7822
Component: kernel
Severity: Moderate
Release date: 2014-01-01T00:00:00+00:00

A flaw was found in the way the Linux kernel's splice() system call validated its parameters. On certain file systems, a local, unprivileged user could use this flaw to write past the maximum file size, and thus crash the system.

Statement: This issue does affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2. Future kernel updates for the respective releases may address this flaw.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258

To install kernel packages manually, use "rpm -ivh [package]". Do not use
"rpm -Uvh" as that will remove the running kernel binaries from your
system. You may use "rpm -e" to remove old kernels after determining that
the new kernel functions properly on your system.
All kernel users are advised to upgrade to these updated packages, which
contain backported patches to correct these issues. The system must be
rebooted for this update to take effect.

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258

To install kernel packages manually, use "rpm -ivh [package]". Do not use
"rpm -Uvh" as that will remove the running kernel binaries from your
system. You may use "rpm -e" to remove old kernels after determining that
the new kernel functions properly on your system.
denial of service in file descriptor passing feature
CVE: CVE-2014-3532
Component: dbus
Severity: Moderate
Release date: 2014-07-02T00:00:00+00:00

dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6, when running on Linux 2.6.37-rc4 or later, allows local users to cause a denial of service (system-bus disconnect of other services or applications) by sending a message containing a file descriptor, then exceeding the maximum recursion depth before the initial message is forwarded.


Remediation:
Timing attack and PHP object injection
CVE: CVE-2014-8684
Component: php-Kohana
CVSS v3: 8.1/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2014-05-12T00:00:00+00:00

CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to compare cryptographic hashes.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
SQL injection and directory traversal vulnerabilities
CVE: CVE-2014-2323
Component: lighttpd
Release date: 2014-03-12T00:00:00+00:00

SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation: