huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
security issues fixed in the upstream 2.7.1, 2.6.4, 2.5.7, and 2.4.11 releases
CVE: CVE-2014-3545
Component: moodle
Release date: 2014-07-14T00:00:00+00:00

Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to execute arbitrary code via a calculated question in a quiz.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Out-of-bounds write with WebM video (MFSA 2014-77)
CVE: CVE-2014-1578
Component: Mozilla
CWE: CWE-787
Severity: Critical
Release date: 2014-10-14T00:00:00+00:00

The get_tile function in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly execute arbitrary code via WebM frames with invalid tile sizes that are improperly handled in buffering operations during video playback.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
unspecified vulnerability fixed in 6u71 and 7u51 (Deployment)
CVE: CVE-2014-0410
Component: JDK
Severity: Critical
Release date: 2014-01-14T00:00:00+00:00

Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5889, CVE-2013-5902, CVE-2014-0415, CVE-2014-0418, and CVE-2014-0424.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
use of HTTP to download signing keys/code
CVE: CVE-2014-0040
Component: openstack-heat-templates
CWE: CWE-522
Severity: Low
Release date: 2014-01-09T00:00:00+00:00

OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, uses an HTTP connection to download (1) packages and (2) signing keys from Yum repositories, which allows man-in-the-middle attackers to prevent updates via unspecified vectors.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
security issues fixed in the 1.19.18, 1.22.9, and 1.23.2 releases
CVE: CVE-2014-5242
Component: mediawiki
Release date: 2014-07-30T00:00:00+00:00

Cross-site scripting (XSS) vulnerability in mediawiki.page.image.pagination.js in MediaWiki 1.22.x before 1.22.9 and 1.23.x before 1.23.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving the multipageimagenavbox class in conjunction with an action=raw value.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
integer overflow in PRI parsing
CVE: CVE-2014-3683
Component: rsyslog
CWE: CWE-190
Severity: Important
Release date: 2014-10-02T00:00:00+00:00

Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash) via a large priority (PRI) value.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3634.

Statement: This issue did not affect the versions of sysklogd and rsyslog packages as shipped with Red Hat Enterprise Linux 5, 6, and7.

Remediation:
arbitrary code execution and denial of service
CVE: CVE-2014-1344
Component: webkitgtk
Severity: Moderate
Release date: 2014-11-08T00:00:00+00:00

WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.


Remediation:
Excessive checking in compatibility mode hypercall argument translation (xsa111)
CVE: CVE-2014-8866
Component: xen
Severity: Important
Release date: 2014-11-27T00:00:00+00:00

The compatibility mode hypercall argument translation in Xen 3.3.x through 4.4.x, when running on a 64-bit hypervisor, allows local 32-bit HVM guests to cause a denial of service (host crash) via vectors involving altering the high halves of registers while in 64-bit mode.

Statement: Not vulnerable.

This issue did not affect the versions of the kernel-xen package as shipped with Red Hat Enterprise Linux 5.

Remediation:
net: potential information leak when ubuf backed skbs are skb_zerocopy()ied
CVE: CVE-2014-2568
Component: kernel
Severity: Low
Release date: 2014-03-18T00:00:00+00:00

Use-after-free vulnerability in the nfqnl_zcopy function in net/netfilter/nfnetlink_queue_core.c in the Linux kernel through 3.13.6 allows attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation. NOTE: the affected code was moved to the skb_zerocopy function in net/core/skbuff.c before the vulnerability was announced.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG 2.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258

To install kernel packages manually, use "rpm -ivh [package]". Do not use
"rpm -Uvh" as that will remove the running kernel binaries from your
system. You may use "rpm -e" to remove old kernels after determining that
the new kernel functions properly on your system.
multiple code execution or security bypass flaws (APSB14-21)
CVE: CVE-2014-0555
Component: flash-plugin
Severity: Critical
Release date: 2014-09-09T00:00:00+00:00

Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0547, CVE-2014-0549, CVE-2014-0550, CVE-2014-0551, and CVE-2014-0552.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
arbitrary code execution due to unpickling untrusted input
CVE: CVE-2014-8165
Component: powerpc-utils-python
CWE: CWE-502
Severity: Moderate
Release date: 2014-09-30T00:00:00+00:00

It was found that the amsvis command of the powerpc-utils-python package did not verify unpickled data before processing it. This could allow an attacker who can connect to an amsvis server process (or cause an amsvis client process to connect to them) to execute arbitrary code as the user running the amsvis process.

Statement: This issue affects the versions of powerpc-utils-python as shipped with Red Hat Enterprise Linux 7 for Power. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
Potential context confusion in Keystone middleware
CVE: CVE-2014-0105
Component: python-keystoneclient
Severity: Important
Release date: 2014-03-27T00:00:00+00:00

The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, related to an "interaction between eventlet and python-memcached."


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
integer overflow in several XSM/Flask hypercalls (xsa-84)
CVE: CVE-2014-1893
Component: xen
CWE: CWE-190
Severity: Moderate
Release date: 2014-02-06T00:00:00+00:00

Multiple integer overflows in the (1) FLASK_GETBOOL and (2) FLASK_SETBOOL suboperations in the flask hypercall in Xen 4.1.x, 3.3.x, 3.2.x, and earlier, when XSM is enabled, allow local users to cause a denial of service (processor fault) via unspecified vectors, a different vulnerability than CVE-2014-1891, CVE-2014-1892, and CVE-2014-1894.

Statement: Not vulnerable.

This issue did not affect the versions of the kernel-xen package as shipped with Red Hat Enterprise Linux 5.

This issue did not affect Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG 2 as we did not have support for Xen hypervisor.

Remediation:
command injection issue
CVE: CVE-2014-3007
Component: python-imaging
CWE: CWE-78
Severity: Moderate
Release date: 2014-01-29T00:00:00+00:00

Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py.


Remediation:
unspecified vulnerability related to SROPTZR (CPU July 2014)
CVE: CVE-2014-4238
Component: mysql
Severity: Low
Release date: 2014-04-15T00:00:00+00:00

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.17 and earlier allows remote authenticated users to affect availability via vectors related to SROPTZR.

Statement: Not vulnerable.  This issue is reported to only affect MySQL 5.6, which is not currently shipped as part of any Red Hat product.

Remediation:
authentication bypass when LDAP server allows unauthenticated binds
CVE: CVE-2014-4668
Component: cherokee
Release date: 2014-02-11T00:00:00+00:00

The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly consider unauthenticated-bind semantics, which allows remote attackers to bypass authentication via an empty password.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
out-of-bounds read in PDFium
CVE: CVE-2014-7947
Component: chromium-browser
CWE: CWE-125
Severity: Moderate
Release date: 2014-01-01T00:00:00+00:00

OpenJPEG before r2944, as used in PDFium in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PDF document, related to j2k.c, jp2.c, pi.c, t1.c, t2.c, and tcd.c.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
XSLT stylesheets treated as styles in Content Security Policy (MFSA 2014-07)
CVE: CVE-2014-1485
Component: Mozilla
Severity: Moderate
Release date: 2014-02-04T00:00:00+00:00

The Content Security Policy (CSP) implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 operates on XSLT stylesheets according to style-src directives instead of script-src directives, which might allow remote attackers to execute arbitrary XSLT code by leveraging insufficient style-src restrictions.

Statement: This issue does not affect the version of firefox and thunderbird as shipped with Red Hat Enterprise Linux 5 and 6

Remediation:
SRP buffer overrun
CVE: CVE-2014-3512
Component: openssl
CWE: CWE-119
Severity: Moderate
Release date: 2014-08-06T00:00:00+00:00

Multiple buffer overflows in crypto/srp/srp_lib.c in the SRP implementation in OpenSSL 1.0.1 before 1.0.1i allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an invalid SRP (1) g, (2) A, or (3) B parameter.

Statement: Not vulnerable. This issue did not affect the versions of openssl as shipped
with Red Hat Enterprise Linux 5, 6 and 7, Red Hat Enterprise Virtualization 3,
and Red Hat Enterprise Storage 2, as they do not enable Secure Remote Password
(SRP) support. All other supported Red Hat products that include openssl use
older versions that are not affected by this issue.

Remediation:
CSRF via insecure CORS default configuration
CVE: CVE-2014-6439
Component: Elasticsearch
CWE: CWE-352
Severity: Low
Release date: 2014-10-01T00:00:00+00:00

Cross-site scripting (XSS) vulnerability in the CORS functionality in Elasticsearch before 1.4.0.Beta1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Statement: This issue affects the versions of elasticsearch as shipped with Red Hat Satellite 6.x and Subscription Asset Manager 1.x. Red Hat Product Security has rated this issue as having Low security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
As provided at http://www.elasticsearch.org/community/security/,

Users should either set "http.cors.enabled" to false, or set "http.cors.allow-origin" to the value of the server that should be allowed access, such as localhost or a server hosting Kibana. Disabling CORS entirely with the former setting is more secure, but may not be suitable for all use cases.

For Satellite 6.x and Sam 1.x you can simply firewall elasticsearch to trusted users only (e.g. root, katello, foreman). For instructions on this please see:

https://access.redhat.com/documentation/en-US/Red_Hat_Satellite/6.0/html-single/Installation_Guide/index.html#sect-Red_Hat_Satellite-Installation_Guide-Red_Hat_Satellite_Installation-Configuring_Red_Hat_Satellite_Manually
integer overflow in tt_sbit_decoder_init() leading to out-of-bounds read
CVE: CVE-2014-9666
Component: freetype
CWE: CWE-125
Severity: Low
Release date: 2014-11-24T00:00:00+00:00

The tt_sbit_decoder_init function in sfnt/ttsbit.c in FreeType before 2.5.4 proceeds with a count-to-size association without restricting the count value, which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted embedded bitmap.

Statement: This issue did not affect the versions of freetype as shipped with Red Hat Enterprise Linux 5, 6, and 7.

Remediation:
Improper initialization of PRNG after fork()
CVE: CVE-2014-0017
Component: libssh
Severity: Moderate
Release date: 2014-03-04T00:00:00+00:00

The RAND_bytes function in libssh before 0.6.3, when forking is enabled, does not properly reset the state of the OpenSSL pseudo-random number generator (PRNG), which causes the state to be shared between children processes and allows local users to obtain sensitive information by leveraging a pid collision.

Statement: Not Vulnerable. This issue does not affect the version of libssh2 package as shipped with Red Hat Enterprise Linux 5 and 6.

Remediation:
session fixation
CVE: CVE-2014-0152
Component: ovirt-engine-webadmin
CWE: CWE-384
Severity: Moderate
Release date: 2014-03-17T00:00:00+00:00

Session fixation vulnerability in the web admin interface in oVirt 3.4.0 and earlier allows remote attackers to hijack web sessions via unspecified vectors.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
out-of-bounds memory error in DCM decode
CVE: CVE-2014-8562
Component: ImageMagick
Severity: Low
Release date: 2014-10-27T00:00:00+00:00

DCM decode in ImageMagick before 6.8.9-9 allows remote attackers to cause a denial of service (out-of-bounds read).


Remediation:
out of bounds access due to not validating length or offset values in GLX extension
CVE: CVE-2014-8098
Component: xorg-x11-server
CWE: CWE-787
Severity: Important
Release date: 2014-12-09T00:00:00+00:00

Multiple out-of-bounds write flaws were found in the way the X.Org server calculated memory requirements for certain GLX extension requests. A malicious, authenticated client could use either of these flaws to crash the X.Org server or, potentially, execute arbitrary code with root privileges.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
multiple flaws lead to arbitrary code execution (APSB14-07)
CVE: CVE-2014-0502
Component: flash-plugin
Severity: Critical
Release date: 2014-02-20T00:00:00+00:00

Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2014.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Possible double free on a dangling pointer with crafted kexinit packet
CVE: CVE-2014-8132
Component: libssh
Release date: 2014-12-19T00:00:00+00:00

Double free vulnerability in the ssh_packet_kexinit function in kex.c in libssh 0.5.x and 0.6.x before 0.6.4 allows remote attackers to cause a denial of service via a crafted kexinit packet.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
arbitrary code execution and denial of service via a crafted web site (WSA-2015-0001)
CVE: CVE-2014-1313
Component: webkitgtk
Severity: Moderate
Release date: 2014-01-01T00:00:00+00:00

WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-04-01-1.

Statement: Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
resource consumption denial of service when using XMPP application-layer compression
CVE: CVE-2014-2745
Component: prosody
Release date: 2014-04-04T00:00:00+00:00

Prosody before 0.9.4 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack, related to core/portmanager.lua and util/xmppstream.lua.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation: