huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Double free in inflateEnd
CVE: CVE-2002-0059
Component: zlib
CWE: CWE-416
Severity: Moderate
CVSS v3: 6.9/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2002-03-09T00:00:00+00:00

The decompression algorithm in zlib 1.1.3 and earlier, as used in many different utilities and packages, causes inflateEnd to release certain memory more than once (a "double free"), which may allow local and remote attackers to execute arbitrary code via a block of malformed compression data.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade.  Only those
RPMs which are currently installed will be updated.  Those RPMs which are
not installed but included in the list will not be updated.  Note that you
can also use wildcards (*.rpm) if your current directory *only* contains
the desired RPMs.

The procedure for upgrading the kernel is documented at:

     http://www.redhat.com/support/docs/howto/kernel-upgrade/

Please read the directions for your architecture carefully before
proceeding with the kernel upgrade.

Please note that this update is also available via Red Hat Network.  Many
people find this an easier way to apply updates.  To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade.  Only those
RPMs which are currently installed will be updated.  Those RPMs which are
not installed but included in the list will not be updated.  Note that you
can also use wildcards (*.rpm) if your current directory *only* contains
the
desired RPMs.

Please note that this update is also available via Red Hat Network.  Many
people find this an easier way to apply updates.  To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.
Local users able to read private mailing list archives
CVE: CVE-2002-0389
Component: mailman
Severity: Low
Release date: 2002-01-01T00:00:00+00:00

It was found that mailman stored private email messages in a world-readable directory. A local user could use this flaw to read private mailing list archives.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
CVE: CVE-2002-2215
Component: security flaw
Severity: Moderate
Release date: 2002-09-07T00:00:00+00:00

The imap_header function in the IMAP functionality for PHP before 4.3.0 allows remote attackers to cause a denial of service via an e-mail message with a large number of "To" addresses, which triggers an error in the rfc822_write_address function.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network.  To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.
CVE: CVE-2002-2185
Component: security flaw
Severity: Moderate
Release date: 2002-06-25T00:00:00+00:00

The Internet Group Management Protocol (IGMP) allows local users to cause a denial of service via an IGMP membership report to a target's Ethernet address instead of the Multicast group address, which causes the target to stop sending reports to the router and effectively disconnect the group from the network.


Remediation:
Before applying this update, make sure that all previously released
errata relevant to your system have been applied.  Use Red Hat
Network to download and update your packages.  To launch the Red Hat
Update Agent, use the following command:

    up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

    http://www.redhat.com/docs/manuals/enterprise/
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.  Use Red Hat
Network to download and update your packages.  To launch the Red Hat
Update Agent, use the following command:

    up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

    http://www.redhat.com/docs/manuals/enterprise/
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network.  To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network.  To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.
CVE: CVE-2002-2214
Component: security flaw
Severity: Moderate
Release date: 2002-02-18T00:00:00+00:00

The php_if_imap_mime_header_decode function in the IMAP functionality in PHP before 4.2.2 allows remote attackers to cause a denial of service (crash) via an e-mail header with a long "To" header.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network.  To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.
insecure temporary file use
CVE: CVE-2001-1593
Component: a2ps
CWE: CWE-367
Severity: Low
Release date: 2001-01-05T00:00:00+00:00

The tempname_ensure function in lib/routines.h in a2ps 4.14 and earlier, as used by the spy_user function and possibly other functions, allows local users to modify arbitrary files via a symlink attack on a temporary file.


Remediation:
allows local users to overwrite arbitrary files via a symlink attack
CVE: CVE-2001-0131
Component: httpd
CWE: CWE-59
Severity: Low
CVSS v3: 2.8/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Release date: 2001-01-10T00:00:00+00:00

A flaw was found in Apache httpd. Both htpasswd and htdigest allow local users to overwrite arbitrary files via a symlink attack. The highest threat from this vulnerability is to data integrity.

Statement: All versions of httpd package shipped with Red Hat Products, uses APR's safe temp file creation and therefore they are not affected by this flaw

Remediation:
log files contain information directly supplied by clients and does not filter or quote control characters
CVE: CVE-2001-1556
Component: httpd
CWE: CWE-532
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2001-12-31T00:00:00+00:00

The log files in Apache web server contain information directly supplied by clients and does not filter or quote control characters, which could allow remote attackers to hide HTTP requests and spoof source IP addresses when logs are viewed with UNIX programs such as cat, tail, and grep.

Statement: This is a duplicate CVE name and is a combination of CVE-2003-0020 and CVE-2003-0083.

Remediation:
TCP connection ISN hijacks
CVE: CVE-2001-0328
Component: kernel
Severity: Low
Release date: 2001-05-01T00:00:00+00:00

TCP implementations that use random increments for initial sequence numbers (ISN) can allow remote attackers to perform session hijacking or disruption by injecting a flood of packets with a range of ISN values, one of which may match the expected ISN.

Statement: This issue did NOT affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG 2.

Remediation:
CVE: CVE-2001-1494
Component: security flaw
Severity: Low
Release date: 2001-12-12T00:00:00+00:00

script command in the util-linux package before 2.11n allows local users to overwrite arbitrary files by setting a hardlink from the typescript log file to any file on the system, then having root execute the script command.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network.  To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.
Mishandling C bitwise-shift operations making easier to bypass protection mechanisms
CVE: CVE-2000-1254
Component: openssl
Severity: Moderate
Release date: 2000-06-01T00:00:00+00:00

crypto/rsa/rsa_gen.c in OpenSSL before 0.9.6 mishandles C bitwise-shift operations that exceed the size of an expression, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging improper RSA key generation on 64-bit HP-UX platforms.


Remediation:
CVE: CVE-2000-1191
Component: security flaw
Severity: Low
Release date: 2000-04-18T00:00:00+00:00

htsearch program in htDig 3.2 beta, 3.1.6, 3.1.5, and earlier allows remote attackers to determine the physical path of the server by requesting a non-existent configuration file using the config parameter, which generates an error message that includes the full path.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network.  To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.
CVE: CVE-1999-1572
Component: security flaw
Severity: Low
Release date: 1999-01-01T00:00:00+00:00

cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O (archive) or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files.

Statement: Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.

Remediation:
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.  Use Red Hat
Network to download and update your packages.  To launch the Red Hat
Update Agent, use the following command:

    up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

    http://www.redhat.com/docs/manuals/enterprise/
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.  Use Red Hat
Network to download and update your packages.  To launch the Red Hat
Update Agent, use the following command:

    up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

    http://www.redhat.com/docs/manuals/enterprise/
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network.  To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.
CVE: CVE-1999-0710
Component: security flaw
Severity: Low
Release date: 1999-07-25T00:00:00+00:00

The Squid package in Red Hat Linux 5.2 and 6.0, and other distributions, installs cachemgr.cgi in a public web directory, which allows remote attackers to use it as an intermediary to connect to other systems.


Remediation:
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.  Use Red Hat
Network to download and update your packages.  To launch the Red Hat
Update Agent, use the following command:

    up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

    http://www.redhat.com/docs/manuals/enterprise/
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.  Use Red Hat
Network to download and update your packages.  To launch the Red Hat
Update Agent, use the following command:

    up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

    http://www.redhat.com/docs/manuals/enterprise/
manual/search.texi lacks a statement about the unspecified tdelete return value upon deletion of a tree's root
CVE: CVE-1999-0199
Component: glibc
CWE: CWE-1053
Severity: None
CVSS v3: 0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
Release date: 1999-11-09T00:00:00+00:00

manual/search.texi in the GNU C Library (aka glibc) before 2.2 lacks a statement about the unspecified tdelete return value upon deletion of a tree's root, which might allow attackers to access a dangling pointer in an application whose developer was unaware of a documentation update from 1999.

Statement: Red Hat Product Security does not feel that this issue has any security impact because the CVE description suggests that a missing statement in the manpage could lead to a generalized developer awareness problem, that in turn could potentially lead to a flaw. Thus, there is no actual exploitable vulnerability reported in this CVE, but rather, the possibility that one could occur in some *unspecified* software which uses glibc where the developers haven't read the manpage since 1999. There is no direct way for a vulnerability to come to fruition in software based solely on developer knowledge (or lack thereof), but an *implementation* of that knowledge, which is absent from the description of this issue.

This manpage issue does not affect glibc as shipped with Red Hat Enterprise Linux 5, 6, 7, or 8 as the versions of glibc shipped already have the updated manpage.

Remediation:
allow remote attackers to reuse SSL sessions and bypass access controls
CVE: CVE-1999-0428
Component: openssl
CWE: CWE-384
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 1999-03-22T00:00:00+00:00

OpenSSL and SSLeay allow remote attackers to reuse SSL sessions and bypass access controls.

Statement: OpenSSL, as shipped with Red Hat Enterprise Linux 5, 6, 7, and 8, is not affected by this flaw because newer versions of OpenSSL that have already been patched are shipped. This vulnerability was originally published over 20 years ago. It affects OpenSSL versions < 0.92b, which are not shipped in Red Hat products.

Remediation: