huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
XSS with Drag and Drop and Javascript: URL (MFSA 2012-13)
CVE: CVE-2012-0455
Component: Mozilla
CWE: CWE-79
Severity: Moderate
Release date: 2012-03-13T00:00:00+00:00

Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 do not properly restrict drag-and-drop operations on javascript: URLs, which allows user-assisted remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web page, related to a "DragAndDropJacking" issue.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
information disclosure flaw due to error when processing XML data
CVE: CVE-2012-5657
Component: php-ZendFramework
Release date: 2012-12-19T00:00:00+00:00

The (1) Zend_Feed_Rss and (2) Zend_Feed_Atom classes in Zend_Feed in Zend Framework 1.11.x before 1.11.15 and 1.12.x before 1.12.1 allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service (CPU and memory consumption) via an XML External Entity (XXE) attack.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
uninitialized Array JVM memory disclosure (Hotspot, 7198606)
CVE: CVE-2012-4416
Component: OpenJDK
Severity: Low
Release date: 2012-09-07T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Hotspot.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Multiple flaws fixed in upstream 3.8.15 version
CVE: CVE-2012-6581
Component: rt3
Release date: 2012-10-25T00:00:00+00:00

Best Practical Solutions RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8, when GnuPG is enabled, allows remote attackers to bypass intended restrictions on reading keys in the product's keyring, and trigger outbound e-mail messages signed by an arbitrary stored secret key, by leveraging a UI e-mail signing privilege.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
world-readable cookie file
CVE: CVE-2012-0843
Component: uzbl
Release date: 2012-02-10T00:00:00+00:00

uzbl: Information disclosure via world-readable cookies storage file

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
'Listen localhost:631' option not honoured correctly on IPv6-enabled systems when systemd used for CUPS socket activation
CVE: CVE-2012-6094
Component: cups
Severity: Moderate
Release date: 2012-12-21T00:00:00+00:00

cups (Common Unix Printing System) 'Listen localhost:631' option not honored correctly which could provide unauthorized access to the system

Statement: Not vulnerable. This issue did not affect the versions of cups as shipped with Red Hat Enterprise Linux 5 and 6 as they did not use the systemd capability for CUPS socket activation yet.

Remediation:
Multiple heap-based buffer overflows in memory management based on NDR marshalling code output
CVE: CVE-2012-1182
Component: samba
CWE: CWE-122
Severity: Critical
Release date: 2012-04-10T00:00:00+00:00

The RPC code generator in Samba 3.x before 3.4.16, 3.5.x before 3.5.14, and 3.6.x before 3.6.4 does not implement validation of an array length in a manner consistent with validation of array memory allocation, which allows remote attackers to execute arbitrary code via a crafted RPC call.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
futex: forbid uaddr == uaddr2 in futex_wait_requeue_pi()
CVE: CVE-2012-6647
Component: Kernel
Severity: Moderate
Release date: 2012-07-20T00:00:00+00:00

A NULL pointer dereference flaw was found in the way the futex_wait_requeue_pi() function of the Linux kernel's futex subsystem handled the requeuing of certain Priority Inheritance (PI) futexes. A local, unprivileged user could use this flaw to crash the system.

Statement: This issue does not affect the versions of the kernel package as shipped with
Red Hat Enterprise Linux 5 and 7, and Red Hat Enterprise MRG 2.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258

To install kernel packages manually, use "rpm -ivh [package]". Do not use
"rpm -Uvh" as that will remove the running kernel binaries from your
system. You may use "rpm -e" to remove old kernels after determining that
the new kernel functions properly on your system.
Did not prevent account creation for IP addresses blocked with GlobalBlocking
CVE: CVE-2012-4380
Component: mediawiki
Release date: 2012-08-30T00:00:00+00:00

MediaWiki before 1.18.5, and 1.19.x before 1.19.2 allows remote attackers to bypass GlobalBlocking extension IP address blocking and create an account via unspecified vectors.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
crash in virTypedParameterArrayClear
CVE: CVE-2012-3445
Component: libvirt
Severity: Moderate
Release date: 2012-07-30T00:00:00+00:00

The virTypedParameterArrayClear function in libvirt 0.9.13 does not properly handle virDomain* API calls with typed parameters, which might allow remote authenticated users to cause a denial of service (libvirtd crash) via an RPC command with nparams set to zero, which triggers an out-of-bounds read or a free of an invalid pointer.

Statement: The versions of libvirt as shipped with Red Hat Enterprise Linux 5 are not affected.

Future libvirt updates for Red Hat Enterprise Linux 6 may address this flaw.

Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
multiple security fixes in 2.2.1, 2.1.4, 2.0.7, 1.9.16
CVE: CVE-2012-0793
Component: moodle
Release date: 2012-01-09T00:00:00+00:00

Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 allows remote attackers to view the profile images of arbitrary user accounts via unspecified vectors.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
incomplete CVE-2012-1823 fix - incorrect check for =
CVE: CVE-2012-2311
Component: php
Severity: Critical
Release date: 2012-05-03T00:00:00+00:00

sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that contain a %3D sequence but no = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.

Statement: Not vulnerable. Red Hat did not release PHP package updates addressing CVE-2012-1823 that introduce the CVE-2012-2311 issue. Therefore, this CVE does not affect any Red Hat products.

Remediation:
unspecified DoS vulnerability related to Server Optimizer (CPU Oct 2012)
CVE: CVE-2012-3150
Component: mysql
Severity: Low
Release date: 2012-10-16T00:00:00+00:00

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.64 and earlier, and 5.5.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
TOCTOU race condition in annotate-output
CVE: CVE-2012-3500
Component: rpmdevtools
CWE: CWE-367
Severity: None
Release date: 2012-08-31T00:00:00+00:00

scripts/annotate-output.sh in devscripts before 2.12.2, as used in rpmdevtools before 8.3, allows local users to modify arbitrary files via a symlink attack on the temporary (1) standard output or (2) standard error output file.


Remediation:
Using XML_Parse before rand() results into non-random output
CVE: CVE-2012-6702
Component: expat
CWE: CWE-330
Severity: Moderate
Release date: 2012-01-01T00:00:00+00:00

Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via vectors involving use of the srand function.


Remediation:
DoS (infinite loop) in the RTCP dissector (wnpa-sec-2012-38)
CVE: CVE-2012-5600
Component: wireshark
CWE: CWE-835
Severity: Low
Release date: 2012-11-28T00:00:00+00:00

[REJECTED CVE] A denial of service flaw was found in the way RTCP dissector of Wireshark, a network traffic analyzer, performed dissection of certain RTCP packet capture files. A remote attacker could provide a specially-crafted RTCP packet / packet capture that, once processed, would lead to excessive CPU consumption or into situation where tshark executable would enter an infinite loop, when trying to process the crafted packet / packet capture file.

Statement: This CVE has been rejected. This candidate is a duplicate of CVE-2012-6062. Note: All CVE users should reference CVE-2012-6062 instead of this candidate.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
multiple code-execution flaws (APSB12-22)
CVE: CVE-2012-5250
Component: flash-plugin
Severity: Critical
Release date: 2012-10-08T00:00:00+00:00

Buffer overflow in Adobe Flash Player before 10.3.183.29 and 11.x before 11.4.402.287 on Windows and Mac OS X, before 10.3.183.29 and 11.x before 11.2.202.243 on Linux, before 11.1.111.19 on Android 2.x and 3.x, and before 11.1.115.20 on Android 4.x; Adobe AIR before 3.4.0.2710; and Adobe AIR SDK before 3.4.0.2710 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than other Flash Player buffer overflow CVEs listed in APSB12-22.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Unapproved agents can connect using the name of an existing approved agent
CVE: CVE-2012-0052
Component: JON
Severity: Important
Release date: 2012-02-01T00:00:00+00:00

Red Hat JBoss Operations Network (JON) before 2.4.2 and 3.0.x before 3.0.1 does not check the JON agent key, which allows remote attackers to spoof the identity of arbitrary agents via the registered agent name.


Remediation:
The References section of this erratum contains a download link (you must
log in to download the update).
The References section of this erratum contains a download link (you must
log in to download the update). Before applying this update, back up your
existing JBoss ON installation (including its databases, applications,
configuration files, the JBoss ON server's file system directory, and so
on).

Refer to the JBoss Operations Network 3.0.1 Release Notes for installation
information.
AWT hardening fixes (AWT, 7163201)
CVE: CVE-2012-0547
Component: OpenJDK
Severity: Low
Release date: 2012-08-30T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier, and 6 Update 34 and earlier, has no impact and remote attack vectors involving AWT and "a security-in-depth issue that is not directly exploitable but which can be used to aggravate security vulnerabilities that can be directly exploited." NOTE: this identifier was assigned by the Oracle CNA, but CVE is not intended to cover defense-in-depth issues that are only exposed by the presence of other vulnerabilities.  NOTE: Oracle has not commented on claims from a downstream vendor that this issue is related to "toolkit internals references."


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Unspecified vulnerability allows remote authenticated users to affect availability via unknown vectors
CVE: CVE-2012-0117
Component: mysql
Severity: Low
Release date: 2012-01-18T00:00:00+00:00

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0486, CVE-2012-0487, CVE-2012-0488, CVE-2012-0489, CVE-2012-0491, CVE-2012-0493, and CVE-2012-0495.

Statement: Not vulnerable.  According to the upstream report, this flaw affects MySQL 5.5.x, which is not provided in Red Hat Enterprise Linux 4, 5, or 6.

Remediation:
multiple code execution flaw (APSB12-16)
CVE: CVE-2012-4154
Component: acroread
Severity: Critical
Release date: 2012-08-14T00:00:00+00:00

Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Windows and Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-2051, CVE-2012-4147, CVE-2012-4148, CVE-2012-4149, CVE-2012-4150, CVE-2012-4151, CVE-2012-4152, CVE-2012-4153, CVE-2012-4155, CVE-2012-4156, CVE-2012-4157, CVE-2012-4158, CVE-2012-4159, and CVE-2012-4160.


Remediation:
forced command option information disclosure
CVE: CVE-2012-0814
Component: openssh
Severity: Low
Release date: 2012-01-26T00:00:00+00:00

The auth_parse_options function in auth-options.c in sshd in OpenSSH before 5.7 provides debug messages containing authorized_keys command options, which allows remote authenticated users to obtain potentially sensitive information by reading these messages, as demonstrated by the shared user account required by Gitolite.  NOTE: this can cross privilege boundaries because a user account may intentionally have no shell or filesystem access, and therefore may have no supported way to read an authorized_keys file in its own home directory.

Statement: This issue did not affect the versions of openssh as shipped with Red Hat Enterprise Linux 4 and 5.

On Red Hat Enterprise Linux 6, configured forced commands are returned in the debugging output for the key that is used when logging in.

Remediation:
net: info leak in compat dev_ifconf
CVE: CVE-2012-6539
Component: Kernel
Severity: Low
Release date: 2012-08-15T00:00:00+00:00

The dev_ifconf function in net/socket.c in the Linux kernel before 3.6 does not initialize a certain structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.

Statement: This issue does not affect the versions of the kernel package as shipped with
Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG 2.

Remediation:
long proxy.pac file handling buffer overflow
CVE: CVE-2012-4504
Component: libproxy
Severity: Moderate
Release date: 2012-10-10T00:00:00+00:00

Stack-based buffer overflow in the url::get_pac function in url.cpp in libproxy 0.4.x before 0.4.9 allows remote servers to have an unspecified impact via a large proxy.pac file.

Statement: Not vulnerable. This issue did not affect the version of libproxy as shipped with Red Hat Enterprise Linux 6.

Remediation:
multiple buffer overflows
CVE: CVE-2012-5196
Component: condor
Severity: None
Release date: 2012-09-19T00:00:00+00:00

Multiple buffer overflows in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 have unknown impact and attack vectors.

Statement: The Red Hat Security Response team does not consider this bug to be security relevant.  However, it has been corrected in MRG Grid 2.2 (via RHSA-2012:1278 and RHSA-2012:1281) as a proactive/hardening measure.

Remediation:
fails to drop supplementary groups
CVE: CVE-2012-2653
Component: arpwatch
Severity: Moderate
Release date: 2012-05-24T00:00:00+00:00

arpwatch 2.1a15, as used by Red Hat, Debian, Fedora, and possibly others, does not properly drop supplementary groups, which might allow attackers to gain root privileges by leveraging other vulnerabilities in the daemon.


Remediation: